When the camera crosses the fence, the law loses its reach

Both the Agency for Personal Data Protection and Free Access to Information and the Police Directorate are right when they claim that they do not have jurisdiction over video surveillance that is carried out illegally, and the reason for this is the legal vacuum, i.e. the fact that this issue is not fully defined in the regulations.

This, among other things, he said Muhammad Gjokaj, an expert in the field of data protection and former president of the AZLP Council.

The UP recently publicly called on the AZLP to remove all illegally installed cameras, including the cameras in the Kavač settlement, which, they claim, are owned by Tamara Zvicer, the wife of the alleged leader of the Kavač clan Radoja ZvicerThe police also said a few days ago that since December 2023, they have repeatedly officially informed the AZLP that Zvicer is illegally supervising Kavač.

The Agency then announced that they were not authorized to act in cases in which video surveillance was carried out by individuals on private property.

AND THE PROSECUTOR'S HANDS ARE TIED

Commenting on the situation, Gjokaj told "Vijesti" that "the UP's concerns are completely understandable, especially when it comes to cases that may have a security dimension."

"However, the Agency's position is equally legally based; it is not a coercive body that can independently enter private property and remove equipment. Its role is regulatory, to determine illegality, order measures and possibly sanction through administrative proceedings," he told the editorial board.

Article 174 of the Criminal Code of Montenegro more precisely defines the criminal offense of unauthorized recording, while Articles 175 and 176, Gjokaj explains, are relevant in the context of unauthorized collection and use of personal data, including processing through video surveillance systems.

However, he adds, these acts are, in accordance with Article 183, prosecuted through private prosecution, which means that the State Prosecutor's Office of Montenegro does not have the ability to act ex officio, even when a large number of citizens are affected.

"This brings us to the first legal diagnosis of the problem. An additional layer of the problem lies in the application of data protection regulations. The Law on Personal Data Protection, which clearly regulates the Agency's actions, but primarily in relation to lawful data controllers and users. In these situations, however, we often have an unlawful controller, i.e. a natural person who installs a camera that covers a public area or part of it," says Gjokaj, adding that this means that such a subject goes beyond the scope of the so-called "personal or home use", i.e. data processing for one's own needs, and becomes a data controller, but without a legal basis for processing.

"In other words, the moment the camera crosses the boundaries of private property, one can no longer speak of legitimate video surveillance for one's own needs, but rather of illegal data processing by an illegal controller," he explains.

PRIVATE PROPERTY - LEGAL OBSTACLE

He points out the importance of the provisions of Articles 40 and 40a of the Personal Data Protection Act, which regulate the jurisdiction and conditions for data processing through video surveillance systems in public areas, including the obligation to remove illegally installed cameras. However, Gjokaj says, these norms should be interpreted restrictively and in the context of their actual scope.

"These provisions apply primarily in situations where there is a lawful data controller, i.e. when video surveillance is conducted by a legal entity or other entity that manages the facility or space where the camera is installed, whether it is state-owned property, the territory of a local government unit or other public area," says Gjokaj.

In such cases, he adds, after the competent authority conducts supervision, the obligation to remove illegally placed cameras falls on the person managing that area, while the action is taken within the authority of the Agency as a regulatory body.

The legal situation, Gjokaj adds, is significantly different when it comes to cameras installed on private property, which cover a public area. In these circumstances, he said, there is a collision between property rights and privacy protection, but also a pronounced limitation of institutional powers.

"AZLP controllers, within the current legal framework, do not have the authority to enter private property without consent or a court order to determine the factual situation, which in practice prevents the Agency Council from effectively conducting supervision and adopting executive measures," said Gjokaj.

LAWSUIT IS THE ONLY SOLUTION

In such cases, he explains, the protection of rights is effectively shifted to the civil law track.

"The entity managing a public area, or another interested party, who proves a legal interest, may initiate civil proceedings through a private lawsuit to remove a camera that illegally occupies a public space. Only after a final court decision are the conditions for its forced execution met, whereby the UP may act within its legally prescribed powers."

Gjokaj adds that such a normative solution, although formally and legally grounded, in practice produces serious shortcomings in terms of efficiency and timeliness of protection. “Procedures are lengthy, the initiative is left to private entities, and institutional reaction is excluded. Consequently, the norms that nominally regulate this area do not achieve their full regulatory effect in situations where illegal video surveillance is carried out from private property, which further deepens the existing gap between the normative framework and the real needs of legal protection.”

The interviewee of "Vijesti" points out the importance of the ruling Ryneš v. Czech Republic, which, he says, represents a reference standard in European data protection law.

In the specific case, the applicant installed video surveillance on his family home with the aim of protecting his property after repeated incidents. However, in addition to the private property, the camera also covered part of the public area, the street and the entrance to the neighboring house.

"The key legal question was whether such surveillance could be considered 'for own purposes', which would exempt it from the application of data protection rules. The Court of Justice of the European Union has taken a clear position: the moment video surveillance goes beyond the scope of private space and encompasses a public area, such processing can no longer be qualified as a personal or household activity for own purposes. Consequently, the person carrying out the recording becomes a data controller and is subject to all relevant personal data protection rules," he said, adding that it is in this context that the domestic legal framework should also be viewed.

When a natural person in Montenegro installs a camera on his property, but it covers a public area, in accordance with the standards of the Rajneš judgment, Gjokaj explains, he ceases to be in the regime for his own needs and becomes a data controller.

"However, unlike typical lawful controllers, such a person most often does not meet the legal requirements for processing, thus effectively becoming an unlawful controller. In our case, the problem arises precisely in the gap between the normative and the operational," he said.

REMOVAL ONLY BY COURT PROCEEDINGS

The police, Gjokaj adds, point to the problem and security risks, the Agency has limited powers without a coercive mechanism, and the prosecution is bound by procedural restrictions.

This, it explains, creates a legal vacuum in which there is a violation of rights, but no effective emergency response mechanism to resolve the problem.

"Although the UP's request is essentially justified from the aspect of protecting security and legality, the manner of its implementation must be in accordance with the legal order. The physical removal of cameras is possible only through court proceedings and enforcement, and not through direct action by administrative bodies, i.e. the Agency," he says, adding that this situation "clearly demonstrates the need for more precise legal solutions that would bridge the gap between formal jurisdictions and real needs in practice."

"Without that, we remain in a paradox, everyone is partially right, but the system as a whole does not provide an effective response. The UP's request is essentially justified from the aspect of protecting the public interest, but its implementation must be in accordance with the principle of legality. The physical removal of cameras is possible exclusively through appropriate court proceedings and enforcement, and not through direct action by administrative bodies," says Gjokaj, adding that this legal situation indicates the need for normative intervention.

"Either through amendments to criminal legislation in the direction of expanding ex officio prosecution, or through a more precise definition of jurisdiction and coordination mechanisms between institutions, or legally empowering the Agency so that it can act as in the Rajneš case."

And deepfake under the radar

Commenting recently on the misuse of modern technologies such as so-called deepfake content, Gjokaj pointed to the same systemic problem and the limited scope of criminal law protection due to the regime of prosecution by private lawsuit. This deficiency, he says, becomes even more pronounced in situations such as illegal video surveillance of public areas.

"In this sense, it is necessary to consider intervention within the Criminal Code, primarily through amendments to Article 183, which regulates the manner of prosecution for criminal offenses against the rights and freedoms of the individual. De lege ferenda, it would be justified to prescribe that for certain forms of criminal offenses from Articles 174, 175 and 176, and especially in cases where there is a broader public interest, a larger number of injured parties or when the action is carried out through technical means that enable systematic and continuous data collection, prosecution is undertaken ex officio," explains the interlocutor of "Vijesti".

Such a solution, he said, would require precise and exhaustive regulation of specific forms of enforcement that would fall under the regime of mandatory action by the prosecution, police and the Agency. This, he added, would avoid legal uncertainty and ensure uniform application of the law. At the same time, Gjokaj said, it would enable the State Prosecutor's Office and the Police, as well as the Agency, through additional legal designation of the procedure, to react in cases that clearly go beyond individual interest and encroach on the sphere of protection of the rights of a larger number of citizens.

"This would overcome the existing paradox that in situations of mass or systemic violations of rights, including illegal filming of public areas or misuse of digital technologies, the state's reaction depends solely on the private initiative of the injured parties. By introducing at least a partial regime of ex officio prosecution, criminal law protection would gain the necessary functionality and efficiency in modern conditions," says Gjokaj.

Otherwise, he adds, the system remains trapped in a paradox of shared responsibility:

"In which each institution acts within its authority, but without a synchronized and effective response to a problem that is clearly of public importance."