Cameras are allowed in parks. But cities can't install them on the fly.

Cameras in parks and other public places in Cyprus may be installed, among other things, to combat vandalism. This doesn't mean, however, that local governments can freely monitor streets, squares, or recreational areas. Before launching the system, they must conduct a special assessment of the impact on residents' privacy and submit it to the Office for Personal Data Protection.

The clarification comes after a discussion sparked, among other things, by the announcement by Paphos authorities that, following repeated instances of destruction of municipal property, they intend to install more cameras in parks and public spaces. Data Protection Commissioner Maria Christofidou emphasizes: Privacy laws do not block monitoring, but impose specific conditions for its use.

The city must first explain why it needs the camera.

The most important duty is to prepare the so-called Data Protection Impact Assessments.

It sounds technical, but the meaning is simple.

Before installation, the local government must answer, among other questions:

• what specific problem is the camera supposed to solve,
• why monitoring is needed,
• whether the same goal cannot be achieved in a less intrusive way,
• what area will be recorded,
• how long the recordings will be stored,
• who will be able to watch them,
• how the material will be secured.

Only the analysis prepared in this way is sent to the Personal Data Protection Office for prior consultation.

The Commissioner announced that such documents submitted by local governments are already being assessed by her office.

The camera cannot record everything around it.

One of the most important rules is to limit the camera's field of view.

If the monitoring is to protect a specific park, the device should include only the area actually needed to achieve this goal.

Therefore, it should not register nearby apartments, private properties or other places unrelated to the problem that the local government wants to solve without justification.

The Commissioner emphasises that the scope of recording should be kept to an absolute minimum.

This is one of the basic principles of GDPR – the solution used must be necessary and proportionate to the problem.

First you need to check if there is another solution

The mere fact that vandalism occurs in a park does not automatically mean consent to 24-hour monitoring.

The evaluation should examine whether less privacy-intrusive solutions would be effective.

This may include, for example, better lighting, additional patrols, security or other safeguards.

Only if monitoring is actually necessary can the local government justify its use.

This has happened before in Paphos.

In case of Park of Colours The Data Protection Office approved the cameras' nighttime operation after other security measures proved ineffective. The office's official position cited this case as an example of local government lawfully using surveillance.

How long can the city keep the recordings?

There is no single rule that allows each local government to store material for any period of time.

The storage period must be based on the purpose of the monitoring.

The local government must also clearly define:

who has access to the recordings, in what situations they can view them and what security measures protect the material against unauthorized use.

A good example are the rules previously approved for school surveillance. Cameras were to cover only school grounds, operate outside of normal operating hours, and the recordings were to be retained for 72 hours. This doesn't mean that identical rules will apply to parks, but it does demonstrate the meticulous planning required for such a system.

The resident must know that he or she is being recorded

Another obligation is to provide appropriate information to people using the monitored place.

It cannot be a system that operates in secret.

The area covered by the cameras should contain clear information about the monitoring and who is responsible for processing the recordings.

Therefore, the resident has the right to know that he or she is entering an area subject to image recording.

Cameras can protect against vandalism and fires

Current Cypriot regulations allow local governments to install surveillance systems as part of their tasks related to public safety and protection.

Legitimate purposes include, among others:

• preventing vandalism,
• protection against fires,
• prevention of environmental threats.

Therefore, it is not true that GDPR completely prevents the installation of cameras in public places.

Already in 2025, the data protection office explained that municipalities can use monitoring wherever they can demonstrate its necessity and proportionality.

What does this mean for Paphos' plans?

A few days ago, the acting mayor of Paphos, Angelos Onisiforou, announced that after further cases of vandalism, he wants to expand surveillance in parks and other public spaces.

The new position of the commissioner shows that such a plan it is legally possible.

However, a political decision or the purchase of cameras is not enough.

For each system, appropriate justification must be prepared, the impact on residents' privacy must be analyzed, and the required procedure must be followed before it is launched.

Only later will it be possible to talk about specific locations, the number of devices and the principles of their operation.

It's not about choosing between security and privacy

It is this element that the commissioner emphasizes most strongly.

Personal data protection it is not intended to be an obstacle to the protection of city property and residents.

The idea is to ensure that monitoring is only used where it is actually needed, and that a camera set up to protect one location does not turn the entire area into an uncontrolled surveillance space.

So cities can install cameras.

But first they must demonstrate why they are needed, what exactly will they record and how will they protect the data of people within their reach.

Source: Office of the Personal Data Protection Commissioner / Cyprus News Agency (KYPE)