Flemish municipalities are using invasive ANPR cameras too easily

The Vlaamse Toezichthouder voor de Verwerking van Persoonsgegevens (VTC) is criticizing the frequent use of ANPR cameras by local governments. There should be more balanced measures to address traffic issues while at the same time respecting the privacy of motorists.

The regulator has discovered that more and more Flemish cities and municipalities are installing so-called ANPR cameras.

‘ANPR’ stands for Automatic Number Plate Recognition. In other words, ANPR cameras are cameras that automatically collect and process license plate information from cars and other vehicles as they pass by.

These cameras are primarily used for traffic control, but also for identifying motorists who are speeding.

In 2024, the VTC received several complaints regarding the deployment of ANPR cameras. After careful investigation, the regulator has come to the conclusion that local authorities often fail to properly assess what needs to be considered before installing these cameras.

In a letter addressed to the majors of Flemish cities and municipalities, the VTC emphasizes that there are significant risks to the citizens’ rights and freedoms due to the invasive nature of ANPR cameras. These cameras not only capture license plates in real-time, but also record faces and travel movements of motorists.

Local governments often think they aren’t the data controllers for the images and metadata captured by ANPR cameras, but according to the General Data Protection Regulation (GDPR) they are. This means they must perform a data protection impact assessment (DPIA) in order to identify and mitigate privacy risks for motorists. In addition, municipalities have to evaluate less invasive alternatives to ANPR cameras for traffic control.

However, in reality, ANPR cameras are often too easily presented as the best solution by Flemish cities and municipalities.

The VTC stresses that ANPR camera usage must have a specific and well-defined purpose. Referring to upholding public safety isn’t specific enough for such invasive processing.

Another risk the regulator refers to is the expansion of the use of ANPR cameras beyond its initial purpose without new and thorough consideration. This is called function creep and may lead to unlawful processing of sensitive motorist information.

“The risks for those involved are serious. The risks currently are insufficiently detected to begin with. Too few protective measures are being taken against them,” the VTC says.

The regulator summarizes several recommendations to find a balance between addressing traffic issues and respecting motorists’ privacy and fundamental rights. For starters, measures like the use of ANPR cameras should be temporary or limited.

Second, since cities and municipalities don’t have a legal basis for collecting and processing images of motorists and passengers, they should blur identifiable features of non-targeted individuals. In addition, the data controller should implement robust data security. Lastly, data should be anonymized or pseudonymized when possible.

The VTC warns local governments that non-compliance may lead to the suspension of the use of ANPR cameras. It’s unclear whether the supervisor wants to implement this measure in the short term.