A city proposes facial analytics on public plaza cameras. What privacy step should precede go-live?

Adding facial analytics to plaza cameras is a material change in processing, not a minor firmware tweak on existing poles. Before go-live, the city should complete a privacy impact assessment that identifies AI-specific privacy risks—biometric-style processing, secondary identification, chilling effects in public space, retention of embeddings or stills, vendor access, and disproportionate impacts on protected groups—and documents mitigations, residual risk acceptance, and public-notice expectations. Existing camera hardware does not automatically authorize a new analytic purpose.

Skipping assessment because cameras already exist fails by conflating video capture with facial analytics; the poles may be old, but face matching, clustering, or watchlisting is a new high-sensitivity processing activity. Launching quietly and assessing only after complaints fails because reactive privacy work arrives after harm, undercuts democratic oversight of civic surveillance, and teaches residents that transparency is optional. Treating facial analytics as low risk merely because the plaza is outdoors fails conceptually: public location does not erase privacy interests, expectation-of-privacy nuances, or municipal duties to minimize and justify intrusive AI.

Exam caveat: “we already had CCTV” is a common distractor; purpose change and AI capability change drive PIA obligations. Operational check: require a finished PIA (or equivalent DPIA-style review) signed before enabling facial analytics, with explicit go/no-go criteria, retention limits, signage/notice plan, and a rollback path if residual risk is unacceptable to counsel or the privacy officer.