THE LEGISLATION ON VIDEO SURVEILLANCE IN ALBANIA

Video surveillance is an important tool in protecting life and property, as well as in preventing, detecting and combating crime. The need for video surveillance appears both in terms of private security (protection of life and property by citizens themselves) and public security, as camera surveillance systems facilitate the process of crime prevention and control. In this sense, these systems are a great help for individuals, for the creation of their sense of security, as well as for the well-being of public institutions, which have the function of maintaining and guaranteeing public safety.

Traditionally, when we talk about the impact of legislation on video surveillance, we have had in mind issues related to the protection of personal data. In this context, Law no. 9887, dated 10.3.2008, “On the protection of personal data” is very important.

Law on Personal Data Protection

This law defines the data that is called personal, as well as the obligations of the subjects that collect, process and store this data. For the purposes of this law, the data collected by camera surveillance systems: such as faces, locations, movements of persons, etc., are personal data and, as such, enjoy special legal protection. To detail the legal obligations, the Commissioner for the Right to Information and Personal Data Protection has approved instruction no. 3, dated 05/03/2010 “On the processing of personal data with the video surveillance system in buildings and other facilities” and, further, in its implementation, has approved a more detailed guide that applies in the field of video surveillance.

This Guide contains general recommendations aimed at orienting different controllers (public or private) in the design and use of video surveillance systems, and CCTV «closed-circuit television» systems.

The guide is addressed to the persons who have decided to install CCTV systems and who are responsible for their operation, as well as to other suppliers or contractors involved in the installation and operation of CCTVs.

This Guide includes rules on the use of CCTV and other systems which capture images of identifiable individuals and information about individuals for any of the following purposes:

• To see what an individual is doing, (for example monitoring them in a store or walking down the street).
• Using an individual’s images in some way will affect their privacy (for example, transferring images to a television company).
• Potentially to take some action regarding an individual, (for example submitting footage to the police to investigate a criminal offence).

According to the guide, the data stored in the video surveillance system, images or sounds, are personal data provided that an individual can be identified directly or indirectly on the basis of these recordings. An individual is identifiable if the image in which he is recorded reveals his distinguishing marks such as face, etc., and enables his full identification when these characteristics are compared with other available data. Also, the rules of this guide apply even if the images are not recorded. This is because data security and respect for privacy can be compromised even if the images are not recorded and if they are transferred directly to another destination via an internal network. There is a possibility that these images may be intercepted by pirates or simply used for other illegal purposes by the persons receiving this data.

Law on Additional Public Safety Measures

In the field of video surveillance, an important but also controversial development was the adoption of Law no. 19/2016, “On Additional Public Safety Measures”, which provides for a number of new measures, that public and private institutions are obliged to implement in the framework of guaranteeing public safety. Article 1 of this law provides that the purpose of this law is to create legal conditions for ensuring cooperation between the State Police and public and private entities, whose activity is a source of increased security risk, with the aim of detecting, preventing and cracking down. of any criminal activity, in the protection of property, life and guarantee of public safety.

Law no. 19/2016 “On Additional Public Security Measures” not only defines the measures that institutions must take to ensure public safety but also provides the limit to which the process of surveillance with cameras of open or closed premises can be carried out, guaranteeing personal data protection.

In the framework of Law no. 19/2016 “On Additional Public Security Measures”, additional security measures are among others:

use of a high-resolution CCTV camera system, with infrared rays, which store film images on NRV / Server for up to 2 months.

While the categories of entities that are obliged to take additional security measures (after the assessment of the risk analysis made by the State Police) are:

• entities that have their headquarters and work premises and carry out commercial activity in places exposed to increased security risk;
• entities that have more than 50 employees and/or attendees, who, continuously, accommodate or attend at the same time an open or closed environment;
• entities that exercise commercial activity from 23:00 – 06:00;
• entities that have economic activity, whose annual turnover is over 10 million ALL;
• entities that exercise activities in the field of gambling;
• entities that administer open or closed environments for children, such as schools, playgrounds and that are assessed by the State Police as a source of increased risk;
• entities that perform public transport activities for passengers, pupils, and students, as well as transport of monetary values ​​and dangerous goods.

So not every entity is required to use these security systems, which are based on the processing of personal data. All other entities are allowed, under the provisions mentioned above for the protection of personal data.

However, the law stipulates that every individual/institution which is subject to these measures must ensure that the processing of personal data obtained from security systems is done in accordance with applicable legislation on personal data protection. The general rules for the collection, processing, use, storage and destruction of personal data are defined in the law “On personal data protection”.

The subjects that implement measures according to this law are obliged, before the beginning of the processing of personal data, to notify in writing the Office of the Commissioner according to the provisions of article 21 of Law no. 9887, dated 10.03.2008 “On the protection of personal data”, as well as to fulfill all the rights and obligations provided in this law.

Camera security protection systems are systems that have special and essential importance in guaranteeing the protection of public safety but remain in the hands of the subjects in balancing the protection of security and public order, as a right with public character as well as the private right to personal data protection. However, taking into account the significant increase in crime in our country recently, one cannot deny and highlight the importance of security systems with cameras, to identify suspects, detect a crime, to lead an investigation into a criminal offence in a certain course, etc.