Data Protection When Cameras Record a Workspace

What is actually in the box

Most people picture a demonstration dataset as a robot arm doing a task. It is everything the cameras could see while the arm did it, plus a precise record of when a human was at the desk. Before arguing about lawful bases, walk the LeRobot dataset directory and name what a regulator would be looking at.

Article 4(1) covers "any information relating to an identified or identifiable natural person". That bar is deliberately low. A colleague reaching into frame to reset a block is identifiable to everyone in that building, and so is the episode timeline saying they did it 180 times on a Tuesday. The frames are the obvious problem. The timestamps are the one people forget.

Three questions before you press record

1. Is it personal data, and for whom?

Recital 26 puts anonymous information outside the regulation and sets the test: weigh "all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing". A moving target by design.

Identifiability is also relative to the holder. In EDPS v SRB (C-413/23 P, 4 September 2025) the Court confirmed that pseudonymised data "must not be regarded as constituting, in all cases and for every person, personal data". A stranger downloading your episodes may genuinely not identify the forearm in frame 4,000. Their colleague next door does it instantly, and you plan for the colleague.

2. Which lawful basis are you relying on?

The three-step test is short enough to keep in a file beside the dataset: identify the interest, show the processing is necessary for it, show it is not overridden by the rights of the people in frame. Necessity is where robot datasets fail, and they fail on camera count. A third camera that sweeps the room while improving the policy by nothing measurable is not necessary, and Article 5(1)(c) says drop it.

3. Do you need a DPIA?

Article 35(1) triggers where processing "is likely to result in a high risk to the rights and freedoms of natural persons", and 35(3)(c) names "a systematic monitoring of a publicly accessible area on a large scale". One SO-100 on a bench in a closed lab is not that. The same rig in a shop or a corridor moves toward it. Article 35(7) lists what the document needs: four bullet points.

The household exemption will not save a lab bench

The second half matters more here. The EDPB cites Lindqvist for the point that the exemption covers private or family life, "which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people". Publishing a dataset is exactly that.

Before you press record: the fixes that cost nothing

Everything after this section is repair work, and repair is lossy. The EDPB advises controllers to "consider physical and technical means, for example blocking out or pixelating not relevant areas". In a workspace you have a better option: aim the camera so the irrelevant area is never in frame.

1. 1
   Frame against a wall, not against the room

   Put the arm between the camera and a blank surface: pegboard, foam board, a curtain. One afternoon of rearranging removes more personal data than any blurring pipeline.

   bash

   # Preview each camera first, and look past the arm
   lerobot-find-cameras
   # writes test frames to lerobot/outputs/captured_images

2. 2
   Count your cameras and justify each one

   A top view and a wrist view is the common setup. A third camera needs a reason you would write down.

   bash

   lerobot-record \
     --robot.type=so101_follower \
     --robot.port=/dev/ttyACM0 \
     --robot.id=my_follower_arm \
     --robot.cameras="{ top: {type: opencv, index_or_path: 1, width: 640, height: 480, fps: 30}, wrist: {type: opencv, index_or_path: 0, width: 640, height: 480, fps: 30} }" \
     --teleop.type=so101_leader \
     --teleop.port=/dev/ttyACM1 \
     --dataset.repo_id=${HF_USER}/so101_dataset_test \
     --dataset.num_episodes=30 \
     --dataset.single_task="put the red brick in a bowl"

3. 3
   Write the task string as if a stranger will read it

   The --dataset.single_task value lands in meta/tasks.jsonl and ships with the dataset. "put the red brick in a bowl" is fine. "sort Dr Weber's samples, bench 3" is a disclosure you will not notice until someone else does.

4. 4
   Tell the room in writing, before the first episode

   Guidelines 3/2019 describes two layers: a sign carrying purpose, controller identity and data subject rights, pointing at a fuller notice elsewhere. Paragraph 113 adds that people must be able to tell which area is covered so they can avoid it.

5. 5
   Set the retention period now

   Article 5(1)(e) applies to rejected takes too. Sweep them on a schedule.

   bash

   find ~/lerobot_raw -type d -name 'rectest_*' -mtime +30 -print

Redacting footage you already have

If the episodes exist and people are in them, three free tools work. The order below runs from least to most destructive to the signal your imitation learning run depends on.

1. 1
   Strip container metadata, because it is free

   We tested this: a file tagged with a comment and a location keeps both until stripped, and -map_metadata -1 removes them while leaving major_brand, minor_version, compatible_brands and encoder behind. Harmless residue, but check rather than assume.

   bash

   ffprobe -v error -show_entries format_tags -of default in.mp4
   ffmpeg -i in.mp4 -map_metadata -1 -c copy out.mp4
   ffprobe -v error -show_entries format_tags -of default out.mp4

2. 2
   Mask a fixed region if the problem never moves

   A doorway in the corner, a monitor at the edge of frame, a window. For a static region drawbox is exact and provably irreversible. ffmpeg defaults are color=black and thickness=3, so pass t=fill for a solid box rather than an outline.

   bash

   ffmpeg -i in.mp4 -vf "drawbox=x=0:y=0:w=200:h=160:color=black:t=fill" -c:a copy out.mp4
   
   # boxblur defaults are luma_radius=2 and luma_power=2, which is far too weak to redact
   ffmpeg -i in.mp4 -vf "boxblur=luma_radius=20:luma_power=3" out.mp4

3. 3
   Run a face detector if people move through the frame

   deface is the pragmatic choice: MIT licensed, pip installable, CenterFace on ONNX Runtime, and it globs directories. The defaults that matter are --thresh 0.2, --mask-scale 1.3 and --replacewith blur. It discards audio by default.

   bash

   python3 -m pip install deface
   
   deface videos/top/chunk-000/*.mp4 \
     --replacewith solid \
     --mask-scale 1.6 \
     --thresh 0.15

4. 4
   Use EgoBlur when faces are small, turned away or motion blurred

   EgoBlur (arXiv 2308.13093, August 2023, Apache 2.0) ships two FasterRCNN detectors, face and licence plate, about 400 MB each at roughly 104 million parameters, trained on 23 million images and 790 million boxes. Heavier than deface, better on hard frames.

   bash

   egoblur-gen1 \
     --input_video_path episode_000.mp4 \
     --output_video_path episode_000_blur.mp4 \
     --face_model_path ego_blur_face.jit \
     --face_model_score_threshold 0.9 \
     --nms_iou_threshold 0.3 \
     --scale_factor_detections 1.15

5. 5
   Re-check the format after re-encoding

   Rewriting MP4 shards outside the LeRobot tooling is what breaks datasets. Frame counts must still match the offsets in meta/episodes/, and codebase_version must match what the trainer expects.

   bash

   python3 -c "import json;d=json.load(open('meta/info.json'));print(d['codebase_version'], d['total_episodes'], d['fps'])"

Two ways to run this

Publishing: licence, gate, and the delete that is not a delete

Published datasets are how the field moves. DROID gathered 76,000 trajectories and 350 hours across 564 scenes and 84 tasks from 50 collectors, and Open X-Embodiment pooled 60 datasets from 34 labs into over a million trajectories. None of that exists if everyone stays private. The question is what you publish and on what terms.

Gating is a few lines of YAML, with one consequence people miss. Hugging Face then collects the username and email of everyone requesting access and hands you a report containing user, fullname, status, email, time and reviewedAt. You solved one problem by creating a smaller one, and you control that list too.

---
license: apache-2.0
gated: true
extra_gated_heading: "Request access to this dataset"
extra_gated_description: "Recorded in a working lab. Access is reviewed manually."
extra_gated_prompt: "You agree not to attempt to identify any person appearing in this footage."
extra_gated_fields:
  Institution: text
  Country: country
  I want to use this dataset for:
    type: select
    options:
      - Research
      - Education
      - label: Other
        value: other
  I agree not to redistribute the raw video: checkbox
---

Does the trained policy still carry the data?

In Opinion 28/2024, adopted 17 December 2024, the EDPB held that AI models trained with personal data "cannot, in all cases, be considered anonymous", and set a two-part test: both the likelihood of extracting personal data directly from the model and of obtaining it from queries must be "insignificant", judged against all the means reasonably likely to be used.

For a manipulation checkpoint emitting joint angles, the risk of reconstructing a face from the weights is low. It is not zero, and not a claim to make casually about a vision-language-action model with a large pretrained backbone. The EDPB's own position is case by case, with the burden on you. A fine-tuning run costs 4 to 12 USD on the A100 tier, so re-running on a cleaned dataset is cheap. Re-recording is not.

When someone else does the recording

Paying people to record changes the analysis twice over. The driver becomes a data subject in an employment relationship, and the per-frame timestamps record their working behaviour. In Germany, section 26(1) BDSG permits processing employee data where necessary for that relationship, and 26(2) requires you to assess whether consent was genuinely voluntary given "the dependency of the employee within the employment relationship". That is the statute warning you that employee consent is weak ground.

A second-order point the RoboTurk work hit early: teleoperation means an operator elsewhere sees a live view of your room, which is a real-time disclosure whether or not anything is recorded. If you use remote operators, the operator guide is where to set expectations on both sides.

Where this platform does not help you

It would be convenient to end with a feature that solves this. There is not one, and pretending otherwise would be worse than useless.

• No face detection or blurring. The client records what the cameras see. Redaction happens in your pipeline with deface, EgoBlur or ffmpeg.
• No consent management or signage. No register of who agreed to be filmed, no notice generator. That is a folder and a laminated sheet in your building.
• Cloud training moves your frames. The backend rents a GPU on a spot market and writes checkpoints to object storage. GR00T and Pi0.5 are cloud-only.
• No retention automation for raw takes. Rejected episodes live wherever you put them, and Article 5(1)(e) still applies.
• /live is a public stream by design. A physical arm streams there with no signup. Keep that workspace empty of anyone else.
• Remote inference has a latency ceiling anyway. The control loop runs 20 to 485 ms per action step, and internet round trips turn a working policy into a hesitant one. Fast tasks need inference next to the servos. That is physics, not a privacy feature.

What the platform does give you is the option to train from a dataset on your own machine rather than a published repo, and to run ACT or SmolVLA locally on a 24 GB card. If footage cannot leave the site, that combination is the answer, and the security and dataset documentation are the next pages. If footage cannot contain identifiable people, the answer is upstream, in how you pointed the camera.