Cookie consent

This site uses cookies that need consent. Learn more

Skip to content
Case Studies

University of Limerick: Building In-House Video Redaction Capability with Identity Cloak as Regulatory Landscape Shifts

The University of Limerick’s transition to in-house video redaction illustrates a broader shift in higher education generally. What began as a response to occasional data requests has become part of a comprehensive data governance strategy.
Posted in: Education

#Introduction: A Subtle Shift in Campus Risk

Sitting on the banks of the River Shannon, the University of Limerick has long been synonymous with academic excellence, strong graduate job prospects, and an international outlook. With more than 18,000 students and a staff of around 1,500, the university operates more like a small city than a typical campus.

Like many European higher education institutions, the university dealing with a growing tension between being open and being secure.

This tension shows up most clearly in the expanding role of surveillance. The university's 400 plus CCTV cameras and 24/7 security operation, supported by approximately 60 security officers, generate a huge volume of video data every day.

In the past, video footage was mostly used reactively - to look into incidents like car park collisions. Nowadays, however, the rules on how that footage is stored, processed and shared have changed significantly.

At the heart of this security evolution is a relatively under-discussed capability: video redaction.

#The Challenge: Rising Subject Access Requests

Bringing Video Redaction In-House

Until recently, the request for footage and subject access requests at the University of Limerick were handled internally by the IT department, and were potentially outsourced.

While the arrangement worked, this ad hoc compliance model created problems. Turnaround times were variable, costs were unpredictable, and the bigger concern was that there were doubts about the security of the data if and when it left the university.

The Facilities Management department made a strategic decision to take video redaction in house. This wasn't driven by volume - the university only gets a small number of requests each year - but by looking ahead. Most requests are related to minor incidents - car park damage, insurance claims, the odd dispute. Yet even these run-of-the-mill cases carry some legal weight.

As Kieran Tuite, Security and Events Manager notes, the expectation is that there will be an increase in subject access requests. Regulatory changes, people becoming more aware of their data rights, and the increasing use of surveillance technologies all point to a future in which data requests become more common and more complicated.

#Why Universities Now Need Video Redaction Software

The University of Limerick's experience reflects a broader trend across higher education. Universities are uniquely complex places: open campuses, diverse populations, and a mix of public and private spaces. This means they have a heightened need for redaction capability:

1. Rising Requests for Subject Access

Under GDPR, individuals have the right to ask for access to personal data that's held about them. And CCTV footage qualifies as personal data if people can be identified. Across the UK and Ireland, institutions are reporting a steady increase in SARs - especially when it comes to disputes, complaints and insurance claims.

The Information Commissioner's Office requires organisations to respond to SARs within a month, which puts operational pressure on institutions that do not have efficient compliance workflows in place.

2. The Complexity of Multi-Subject Footage

Unlike static data, video footage often captures lots of individuals all at once. Releasing unredacted footage risks exposing third parties who haven't consented to sharing their data. Data protection and privacy rights mean that you've got a legal obligation to obscure or anonymise any non-relevant individuals - which is a labour-intensive and risky undertaking without the right tools.

3. More Cameras, More Data

Universities have expanded their CCTV coverage considerably over the past ten years or so - driven by safety concerns and preventing incidents. More cameras mean more data and, inevitably, more requests to access that data.

4. Body Worn Cameras (BWC)

Security teams are now using body-worn cameras to help de-escalate incidents, and to gather and provide evidence. While currently at a low level at the University of Limerick, the expectation is that SARs for BWC footage will grow. BWC recordings bring extra challenges - not least the fact that you may have to redact audio and deal with dynamic movement.

5. The Reputational Risk

A single data breach involving video footage can have significant reputational consequences. Universities, as public-facing institutions, are particularly sensitive to such risks.

#The Regulatory Framework: UK and Ireland

United Kingdom Context

Although the University of Limerick operates in Ireland, its practices are informed by broader UK and EU standards - particularly through collaboration networks like the Association of University Chief Security Officers (AUCSO).

In the UK, universities have got to comply with:

  • UK GDPR
    The UK's post-Brexit version of GDPR that sets out how personal data gets processed.

  • Data Protection Act 2018
    Supplements UK GDPR and includes specific provisions for law enforcement and intelligence services.

  • ICO CCTV Code of Practice
    Provides guidance on surveillance - including transparency, proportionality, and data minimisation.

  • Freedom of Information Act 2000
    While not directly related to personal data, the Freedom of Information Act overlaps with disclosure obligations - especially when it comes to publicly funded institutions.

Failure to comply with data regulations can result in fines of up to £17.5 million or 4% of global turnover under UK GDPR.

Republic of Ireland Context

For the University of Limerick, compliance is all about making sure it has the right systems in place to meet various regulations, including:

  • General Data Protection Regulation (GDPR)
    Directly applicable across EU member states, including Ireland.

  • Data Protection Act 2018 Ireland
    This is the Irish law that enforces GDPR at a national level and gives the Data Protection Commission its teeth.

  • Data Protection Commission
    The supervisory authority responsible for enforcement.

  • ePrivacy Regulations
    Relevant when surveillance overlaps with electronic communications.

In Ireland, penalties mirror GDPR standards, with significant financial and reputational consequences for non-compliance.

#The Emerging Impact of the EU AI Act

It's not all about GDPR, though. The EU AI Act is another layer of complexity that's on the horizon, whose enforcement mechanisms begin in 2026. Any surveillance systems that involve tracking or facial recognition are going to be classed as "high-risk AI systems" - and that brings its own set of rules.

These rules mean that we're going to have to be transparent about how we use AI to process data - among other things.

  • Transparency about how AI is used to process data

  • Risk assessments and mitigation strategies

  • Documentation and audit trails

  • Scrutiny of bias and fairness in AI decision-making

For universities, this means that even tools designed to simplify redaction, such as AI-assisted tracking, must be deployed carefully. While automation offers efficiency, it also brings regulatory accountability.

#Implementing Facit’s Identity Cloak: A Practical Shift

Against this backdrop, the University of Limerick selected Identity Cloak as its video redaction solution. The decision followed demonstrations from several vendors.

Kieran Tuite says: “The product’s ease of use and customer support were among the factors that decided us on Facit’s Identity Cloak.”

From an operational perspective, the university saw some immediate benefits:

  • Speed
    Tasks that used to take hours to complete were suddenly getting done in no time.

  • Accuracy
    Using automated and semi-automated tools cut down on the risk of human error.

  • Control
    Keeping the footage in-house meant that the university had more control and reduced its exposure to risks from third-party providers.

The software also provided some useful, valued features, such as the ability to create custom-shaped blur effects, or to zoom in on distant activities in footage, together with the capability to adjust the level of redaction to suit the situation.

For example, when sharing footage of a bus stop altercation, the university can obscure everyone except the person of interest without causing any issues with data protection.

Managing Real-World Events and Situations

The practical value of redaction software becomes clear in everyday cases:

Car Park Incidents

The most common requests received by the university involve vehicle damage. In these cases, footage must be edited so that only the requesting individual, or their vehicle, is visible. Other drivers, pedestrians and registration plates must be obscured.

Anti-Social Behaviour

Universities are increasingly proactive in addressing low-level disorder before it escalates. Redacted footage can be shared internally or with third parties without breaching privacy obligations.

Victim Access Requests

When individuals request footage of themselves, GDPR requires that their data be provided, but not the data of others. Redaction ensures regulatory compliance while respecting third-party rights.

Body-Worn Camera Footage

Although BWC SARs are currently few in number at the university, BWC usage introduces new dimensions, including the potential need for audio redaction. Identity Cloak’s ability to redact both video and audio means that the university is well positioned to cope with future demand.

Cultural and Organisational Impact

In addition to compliance, the university’s shift to in-house redaction has had some notable effects on its organisational culture:

  • Increased Confidence
    Security staff feel more comfortable handling requests internally now.

  • Improved Responsiveness
    The university is confident that it can act faster and turn compliant video around quicker.

  • Knowledge Retention
    The Facilities Management department is able to build its expertise so that it remains in-house, unlike when video redaction was sent to the IT department.

There is also a subtle but important shift in outlook: video footage is no longer just a piece of evidence; it is seen as regulated data that requires careful stewardship.

The Role of Collaboration

Membership of the Association of University Chief Security Officers provides the University of Limerick with access to a network of peers who face similar challenges. Within this forum, institutions share best practices, benchmark approaches and anticipate emerging risks.

This collaborative approach is particularly valuable in navigating new regulations such as the EU AI Act, as interpretation and implementation are still evolving.

The product’s ease of use and customer support were among the factors that decided us on Facit’s Identity Cloak.

Kieran Tuite Security and Events Manager, University of Limerick

#Conclusion: A Model for the Education Sector

The University of Limerick’s transition to in-house video redaction illustrates a broader shift in higher education generally. What began as a response to occasional data requests has become part of a comprehensive data governance strategy.

By investing in Facit’s Identity Cloak, the university has positioned itself to:

  • Meet current regulatory obligations

  • Anticipate future compliance challenges

  • Reduce operational risk

  • Enhance efficiency and control

As universities continue to balance openness with security, the ability to manage video data responsibly will only grow in importance.

In this evolving compliance landscape, redaction is not merely a technical function, it has become a cornerstone of accountability.

#Looking Ahead: From Reactive to Strategic

While the current redaction needs at the University of Limerick are relatively straightforward, developments are become clearer. Several factors will shape future demand:

  • Increased awareness of data rights among students and staff

  • Expansion of surveillance technologies

  • Greater regulatory scrutiny

  • Integration of AI into security systems

In this context, video redaction has become a strategic requirement.

Download the University of Limerick case study

To download any of our case studies, complete the form below.