Camera surveillance and EU standards: what is required and what is still unanswered

2026-10-19

Albania is not yet an EU member, but as a candidate country it is aligning its laws with European standards. Law No. 124/2024 is built on the GDPR and on Directive (EU) 2016/680, which covers personal data processing by police. As a member of the Council of Europe, Albania is also bound by Article 8 of the European Convention on Human Rights (the right to respect for private life).

This guide presents standards and questions. It does not claim that any law has been breached. Findings of that kind belong to the IDP Commissioner and the courts.

This is the English version of the Albanian guide Mbikëqyrja me kamera dhe standardet e BE-së. See also the map of cameras.

Which principles apply to any public camera?

1. Lawfulness and legal basis. State surveillance should be provided for by law, in a clear and foreseeable way.
2. Necessity and proportionality. The interference with privacy should be necessary for a legitimate aim, not merely useful.
3. Purpose limitation. Data collected for road safety should not be freely reused for other purposes.
4. Data minimisation and storage limitation. Collect only what is needed, and keep it only as long as needed.
5. Transparency. People should know that they are being filmed, and by whom.
6. Impact assessment (DPIA). Systematic, large-scale monitoring of public space calls for a prior impact assessment.
7. Independent oversight. An independent authority with real powers of control should exist.

Why are licence plate readers (ALPR/ANPR) a special case?

An ordinary camera records images. A plate reader builds a database of movements: who passed, where and when. Over time such a database can reveal people's routines. For this reason European data protection authorities commonly ask for:

• short retention periods for plates that do not match any watch list;
• clear rules on who may search the database, with every search logged;
• strict limits on sharing with third parties.

Read more in our guide on plate reader cameras.

What about facial recognition and the EU AI Act?

The EU Artificial Intelligence Act prohibits in principle real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions and prior authorisation. Albania is not directly bound by it, but it is the standard against which alignment will be compared during accession.

7 questions that deserve public answers about Smart City

1. Has a DPIA been carried out and published for the system?
2. What is the retention period for footage and for plate reads?
3. Is facial recognition used, or can it be switched on?
4. Do the vendor (Presight AI) or other third parties have access to the data, and where are the servers?
5. Who can search the plate database, and are those searches logged?
6. Are there information signs near the cameras?
7. How can a citizen exercise the right of access? See our guide on requesting footage of yourself.

You can send these questions as a right-to-information request under Law No. 119/2014 to the Ministry of Interior or the State Police: see how to file one. If you receive no answer, you can complain to the IDP Commissioner. For schools, see questions parents can ask.