Video Surveillance in Serbia, it is often used in violation of the laws on security and data protection, experts say.
At the corner of Zmaj od Noćaj and Tsar Uroš, near Kalemegdan, there is a new building, and on it several cameras bearing the markings of the Chinese state-owned video surveillance company Hikvision. The 360-degree rotating cameras can record both streets – far from the very entrance to the building they are securing, it says BIRN.
This corner may be quiet, but the powerful Hikvision cameras that secure it testify to the problem of excessive and often unregulated video surveillance and the collection and processing of personal data in Serbia.
From purchasing facial recognition cameras for schools, to tenants being able to watch the entrance to their building live on TV, experts say the use of video surveillance in Serbia is out of control and often violates both the Personal Data Protection Act and the private security.
Laws in force but often ignored
"One of the most common problems is improper installation of cameras or installation of cameras at all without a prior risk assessment and security plan," says Mila Kisić, a lawyer with a certificate in the field of personal data protection.
"Random placement of cameras not only does not comply with the Personal Data Protection Act, but also does not comply with the Private Security Act," she added.
These laws have been in force in Serbia for several years, but are often ignored.
"Like in the market, give me 35 cameras, give me 114 cameras, give me a doorman," describes how things are Mladen Raonic, security expert and founder of Absolut Support.
"A large part of the economy still does not have this area adequately organized, and a large number of residential buildings, schools, kindergartens also do not have this area adequately organized."
Mandatory risk assessment and safety plan
According to the 2018 Law on Private Security in Serbia, before installing a security system, which includes video surveillance, the company must conduct a risk assessment and develop a security plan.
However, the analysis of public procurement shows that even public institutions and companies still call for tenders for risk assessment only after they have already acquired security equipment.
Among them is the company Infrastruktura železnice Srbije, which in 2022 announced a tender for security services on the new high-speed line Belgrade - Novi Sad. When the bidders asked whether a risk assessment had been carried out, the company replied that it would do so within the year, according to the documentation published on the Public Procurement Portal.
Without a risk assessment, says Raonic, companies introduce security practically at random, and the measures are often unnecessarily invasive.
"The equipment is ordered as a lump sum," he told BIRN.
Embellishment or omission of information
Even when companies do a risk assessment and create a security plan, Raonic says they often embellish or omit information. However, even such assessments and plans meet the standards set by the Ministry of the Interior.
Risk assessments are carried out by licensed companies with at least one employee who has an appropriate license from the Ministry of the Interior, and some companies, in addition to this, also have a license to introduce security systems. However, this is a risky practice, says Raonic, because then these companies can state that they need to acquire equipment, for which there is no real need, in order to earn more money.
The law also states that private security equipment "must not be used in a way that violates the privacy of others", that a notice of video surveillance must be clearly displayed in the area covered by the cameras, and that companies must provide access to data upon request by individuals whose data is collected. However, this is not always the case.
Earlier this year, BIRN identified dozens of public companies, institutions, municipalities and schools that acquired cameras with facial recognition capabilities despite the collection of biometric data being allowed only in the most exceptional cases.
The Commissioner for Information of Public Importance and Personal Data Protection of Serbia contacted two schools in Požega, for which the Municipality of Požega acquired cameras with facial recognition function. One of them denied the purchase of these cameras, while the other said that they will not start the security system until they check its capabilities.
The Commissioner did not comment on other institutions that ordered this equipment and referred BIRN to the Ministry of Internal Affairs, writing that this Ministry is responsible for supervision under the Law on Private Security, technical means of private security and video surveillance.
Read the entire text at portal BIRN