How to complain to the IDP Commissioner about cameras and your data

2026-10-17

If you think a camera, public or private, is processing your data in a way that is unclear to you, you have the right to ask and, if you get no answer, to complain. The independent authority for this is the Commissioner for the Right to Information and Protection of Personal Data (IDP). The official website is idp.al.

This guide explains the process in general terms and is not legal advice. It does not claim that any camera or institution has broken the law. Only the Commissioner or a court can decide that. For exact forms and deadlines, always check the official website.

When does it make sense to complain to the IDP?

A complaint makes sense when you have a concrete concern about your own personal data, for example:

• a camera pointed at your front door or windows;
• a request to see footage in which you appear that has gone unanswered;
• no information about who runs a camera and how long it keeps footage.

A general concern about a whole programme (for example Smart City) is not the same as a complaint about your own data. For general questions, a right-to-information request (in Albanian) is usually a better fit.

Step 1: Ask the camera operator first

European standards (GDPR, Directive 2016/680) and Law No. 124/2024 give individuals a right of access and a right to information. It is usually useful to exercise this right in writing first, with whoever runs the camera: the police, the municipality, a school or a private company. See how to request camera footage of yourself.

Keep proof of your request: the date, how you sent it and any reply.

Step 2: Prepare the complaint

A clear complaint usually contains:

1. Your name and contact details.
2. Who you are complaining about: the institution or person running the camera, as far as you know.
3. What happened: the place, the date and what concerns you, with facts and without accusations.
4. What you have tried: copies of your request and the reply (or the fact that there was none).
5. What you are asking for: for example information, access, or a review of the camera's lawfulness.

What to leave out

• Footage showing other people's faces or licence plates.
• Other people's personal data (names, addresses) unrelated to the matter.
• Conclusions such as "this is illegal". Describe the facts and leave the legal assessment to the Commissioner.

What happens after the complaint?

The Commissioner reviews the complaint under its own procedure and may ask the operator for information. Deadlines and possible measures are set in law and in IDP guidance, so check them at idp.al. If you are not satisfied with the decision, you can seek judicial review.

Open questions about Smart City

For the national Smart City system, some questions have no public answer that this project has been able to find: whether a data protection impact assessment (DPIA) has been published, how long data is retained, how searches in the plate database are logged, what access the vendor has, and whether there is extra protection for minors. Read the EU standards on surveillance (in Albanian) and licence plate reader cameras explained.

See the known cameras on the map and report any that are missing.