City surveillance cameras will recognize faces sooner or later. Residents need to know their rights.

• Video surveillance is one of the most invasive forms of personal data processing, therefore its use requires a strict legal basis and transparent rules.
• Local authorities must remember that citizens have the right to privacy, and any decision to install monitoring should be preceded by a risk assessment.
• Experts warn that if the technology falls into the hands of a populist or authoritarian government, it could be used to surveil citizens, not just to fight crime.

Does city surveillance violate citizens' privacy? When we're in public spaces, we usually don't notice cameras, and by law, every city covered by surveillance should have information about it posted in a clearly visible location—usually at the city entrance.

The Personal Data Protection Office explains that "information boards should be visible and permanently placed. Pictograms informing about the presence of cameras may also be used."

It should be emphasized that by being in public space, we are, in a sense, giving consent to the recording of our image, but not to its dissemination.

The use of video surveillance by municipalities is regulated in the Local Government Act (Journal of Laws of 2022, item 559). Article 9a, paragraph 1 of this Act defines the purpose for which it may be used, including to ensure public order and the safety of citizens, as well as fire and flood protection. In paragraph 3 of this provision, the legislator stipulates that video recordings containing personal data shall be processed only for the purposes for which they were collected. It also recognized the need to secure the personal data processed there , in particular against loss or unlawful dissemination, as well as unauthorized access.

Similar solutions were introduced in the Act on District Self-Government and the Act on Voivodeship Self-Government.

It's important to remember that monitoring is one of the most intrusive forms of personal data processing and should only be used to ensure security. Therefore, when deciding to implement monitoring, the controller must remember to conduct a data protection impact assessment. This is required when a processing operation, due to its nature, scope, context, and purposes, is likely to result in a high risk to the rights and freedoms of natural persons . Pursuant to Article 35(3)(c) of the GDPR, monitoring is mandatory for publicly accessible areas.

- explains the spokesman of the Personal Data Protection Office, Karol Witowski.

As the development of artificial intelligence continues to accelerate, cities are increasingly eager to adopt tools that utilize it. In China and India, governments have installed facial recognition cameras in cities, so it's a valid question whether we can expect similar solutions in Poland.

Under European law, member states are prohibited from implementing technology that would enable real-time citizen recognition. This provision aims to protect the freedom of Europeans if their governments were to develop authoritarian tendencies and seek to surveil their citizens—especially during protests. Hungary has circumvented this rule somewhat, and its monitoring system allows for facial recognition, but only after some time.

The key issue, which I believe is worth emphasizing here, is the purpose of using cameras. Sure, they're officially intended to fight crime . But what happens if an undemocratic, populist government gains access to these technologies? After all, it's the government—regardless of whether we're talking about the highest levels or the services—that decides what it considers "good" or "bad" and what it will use technology for. And if such a government ends up with tools as effective as surveillance, it could have very serious consequences for our rights and freedoms.

- notes Mateusz Wrotny from the Panoptykon Foundation.

Wrotny also points out that digital transformation will mean that Polish services will eventually implement tools that will enable biometric recognition.

The UODO spokesman notes that such technology is even more invasive than monitoring itself and its use involves the processing of biometric data, which the GDPR classifies as a special category of data.

Processing of this data is only permissible in strictly defined circumstances. One of the grounds is that processing is necessary for reasons of important public interest, based on EU or Member State law. However, the aforementioned provisions on local government do not provide such a basis.

- he explains.

City cameras don't have to be used solely to catch criminals. Sometimes, footage of other unusual behavior by citizens also surfaces online – some of whom were aware they were being recorded, but many certainly weren't.

However, the Data Protection Inspector from the Warsaw Monitoring System Service Plant assures that ZOSM does not analyze how the presence of cameras affects the behavior of citizens.

The primary purpose of the Department's monitoring centers is to provide the Capital Police Headquarters and the Municipal Guard of the Capital City of Warsaw with real-time, fast and accurate information on crimes , offenses and other events occurring in places covered by monitoring.

- he explains.

The Warsaw Zoo for Municipal Social Welfare (ZOSM) is not authorized to use technology that enables facial recognition, among other things. Furthermore, the video monitoring system is not integrated with any systems or databases that would enable the identification of individuals captured by cameras.

However, Poland also has intelligent solutions implemented in urban monitoring. For example, in Leszno, Greater Poland, the monitoring system has implemented automatic event detection. Artificial intelligence algorithms continuously analyze camera images and, if predefined events, such as property damage, immediately send a notification to the operator.

While there are many concerns surrounding surveillance, it cannot be denied that it also has many benefits. Primarily, it can increase safety by deterring criminals and supporting police in detecting them. It also aids in traffic management, enabling better control of traffic flow and response to disruptions. In crisis situations, such as fires or natural disasters, it allows for faster rescue operations.

At the same time, residents must be aware of their rights. Local authorities should operate transparently and be accountable to the community for how surveillance is used. Clear rules are necessary regarding how data is collected, how it is processed, and how long it is stored. The UODO spokesperson reminds that in the event of a privacy violation, anyone can file a complaint with the Office.