Deleuze replied: Yeah. It is much bigger process than this though. The first step is to define the purpose narrowly. IRIS should not describe its purpose broadly as “driver monitoring” or “behavioural analysis”. The purpose should be limited to real-time driver fatigue or drowsiness detection for road safety. This distinction matters because a narrow purpose prevents later function creep into emotion detection, productivity monitoring, insurance scoring, employment discipline, law enforcement, or general surveillance. Second, IRIS must identify a lawful basis for processing under GDPR Article 6 and, where the data falls within special-category data, a separate condition under Article 9. Heart-rate data is likely to be health data because it relates to a person’s physical state. Facial imagery may also become biometric data if it is processed through technical means for identification or biometric analysis. A general privacy notice or end-user agreement is not enough; the controller must be able to justify why this sensitive processing is legally permitted. Third, IRIS should carry out a necessity and proportionality assessment. The provider should explain why facial imagery is needed, why heart-rate signals are needed, and why less intrusive alternatives would not be sufficient. For example, it should assess whether fatigue can be detected using steering behaviour, eyelid metrics without identity recognition, local-only processing, or non-identifying derived features instead of storing raw images or physiological signals. Fourth, a Data Protection Impact Assessment should be completed before deployment. This is especially important because IRIS involves new technology, safety-related monitoring, facial or physiological data, and potentially vulnerable contexts such as employment, fleet management, taxis, or public transport. The DPIA should identify risks to privacy, discrimination, safety, autonomy, and misuse, and it should document the measures adopted to reduce those risks. Fifth, IRIS should apply privacy by design and by default. Cameras should be physically positioned and technically configured to focus only on the driver. Passenger areas should be excluded wherever possible. Facial images should be cropped, blurred, transformed into non-identifying features, or discarded immediately if raw images are not needed. Heart-rate signals should be processed only to the extent required to detect fatigue, not to infer broader health, emotional, or behavioural information. Sixth, the system should prefer local and transient processing. The safest design is one where imagery and heart-rate signals are processed in real time inside the vehicle or device, without default storage or cloud transmission. If raw data needs to be retained for debugging, validation, incident investigation, or regulatory evidence, that retention should be exceptional, short, justified, access-controlled, and documented. Seventh, IRIS must separate operational use from training, model improvement, and bias testing. Data collected to warn a driver about fatigue should not automatically be reused to retrain models, develop unrelated products, monitor employees, support insurance decisions, or build behavioural profiles. Any secondary use would require a separate compatibility assessment and, where necessary, a separate lawful basis. Eighth, special-category data should only be used for bias detection and correction under strict safeguards. The EU AI Act allows processing sensitive data for bias monitoring in high-risk AI systems only where this is strictly necessary and cannot be effectively achieved using other data such as anonymised or synthetic data. Access should be restricted, privacy-preserving measures such as pseudonymisation should be used, onward transfer should be prevented, and the data should be deleted once the bias has been corrected or the lawful retention period ends. Ninth, access and sharing must be tightly limited. Raw facial imagery and heart-rate data should not be available to fleet managers, employers, insurers, vehicle manufacturers, or third parties unless there is a strict need and clear legal justification. In most cases, the deployer should receive only the fatigue alert, system status, or aggregated performance information, not the underlying biometric or health-related data. Tenth, strong security measures are required. Because the data is sensitive and safety-related, IRIS should use encryption, access controls, audit logs, secure model updates, tamper resistance, and protections against unauthorised extraction of images or physiological data. Security should cover both stored data and data in transit, as well as the model and sensors themselves. Eleventh, drivers must receive clear transparency information. They should be told what data is collected, why it is collected, whether processing is local or cloud-based, whether raw data is stored, who can access it, how long it is retained, what rights they have, and what the system’s limitations are. If IRIS is a high-risk AI system, the instructions for use should also explain the system’s intended purpose, accuracy, known limitations, human oversight measures, and conditions under which performance may be reduced. Twelfth, IRIS must define and enforce retention and deletion rules. Raw images and heart-rate signals should have the shortest possible retention period. If only real-time fatigue alerts are needed, raw data should not be retained at all by default. Aggregated or anonymised performance metrics may be kept for longer, but only if they cannot reasonably be linked back to individual drivers. Thirteenth, the provider must prevent function creep both technically and contractually. Contracts, system settings, access controls, and internal policies should prohibit use of IRIS data for emotion recognition, productivity scoring, employment discipline, insurance pricing, marketing, law enforcement, or unrelated passenger surveillance unless a separate legal basis and compliance assessment has been completed. Finally, IRIS should maintain technical documentation and audit records showing how these controls are implemented. If IRIS is treated as high-risk under the EU AI Act, documentation should cover data governance, risk management, representative datasets, bias testing, accuracy, robustness, cybersecurity, post-market monitoring, and changes to the system over time. This evidence is essential because compliance is not just about having a policy; the provider must be able to prove that minimisation and purpose limitation are built into the system’s design and operation.

Deleuze replied: Yep, to comply with data minimisation and purpose limitation, IRIS must be designed so that sensitive data is collected only where it is genuinely necessary for driver fatigue detection, used only for that defined safety purpose, and deleted or anonymised as soon as it is no longer needed. Under GDPR, personal data must be collected for specified, explicit and legitimate purposes, and it must be limited to what is necessary for those purposes.