Cameras have been installed in many public institutions, such as post offices, banks, pharmacies, counter halls in municipalities, health institutions, police stations, shopping centers, companies….
Any camera that records the space in which people move can collect data that enables identification.
This means that video surveillance footage is not only material, but also a person’s personal data that must be protected.
For example, cameras are installed in banks so that they record not only the visitor’s hands, but also his face. The situation is the same in other institutions and companies.
Both workers and patients are filmed in healthcare institutions. Most of these others don’t even know about it.
A serious breach of privacy
Lawyer Lana Sarajlić says that it is evident that the use of video surveillance is very common, both in the private and in the real sector, and whether a recording is legal or illegal depends on each case.
The new law on the protection of personal data in Bosnia and Herzegovina defines where it is forbidden to install cameras. This primarily applies to toilets, changing rooms, changing rooms, showers, employee rest rooms and similar areas.
Placing cameras in such spaces would represent a serious violation of privacy and could lead to high fines, but also criminal liability, depending on the situation.
– There are many situations where video surveillance is out of control. Every day we see cameras in different places, so the question arises – to what extent is it legal and whether excessive video surveillance is carried out, which brings us into a bigger problem, and whether the data obtained through video surveillance is adequately processed. So, do only authorized persons have the right to access such data or do those who are prohibited from doing so also have access – says Sarajlić and adds that private video surveillance is often out of control.
First of all, as she says, citizens should familiarize themselves with their rights and powers of personal data protection, at least to a basic extent so that they can exercise their rights.
– If you notice that data is being processed through video surveillance, which could have elements of a violation of the Law on the Protection of Personal Data in Bosnia and Herzegovina, the advice is to first of all apply for the protection of your rights to the entity that performs the recording, and there are other protection mechanisms that include the Agency for the Protection of Personal Data. Citizens must be sufficiently informed in order to be able to recognize misuse of their personal data – notes Sarajlić.
The Law on the Protection of Personal Data in Bosnia and Herzegovina was published on February 28, 2025, and its official application began in October of the same year.
The Agency for the Protection of Personal Data in Bosnia and Herzegovina says that audio, visual and possibly other records (date and time of video surveillance) and their storage are obtained through video surveillance.
– Video surveillance represents the processing of personal data when a recording of the monitoring of a natural person is made. Since it is a systematic collection of personal data, the use of video surveillance must be prescribed by law or the controller is allowed to use this type of personal data processing as a necessary measure of technical protection. When video surveillance is not prescribed by law, the controller must determine the purpose of its establishment. In that case, monitoring of a certain area through video surveillance is allowed only if it is necessary for the protection of persons and property and if the interests of the data holder do not prevail – the Agency states.
They add that video surveillance can cover only spaces or parts of spaces whose surveillance is necessary to achieve the purpose.
– The establishment of video surveillance over publicly accessible facilities of large areas, such as sports facilities, entertainment centers, shopping centers or parking lots or public transport vehicles, is permitted solely for the purpose of protecting life, health and freedom of persons and property. The data controller who uses video surveillance is obliged to make a decision that will contain the rules of processing with the aim of respecting the right to protection of privacy and personal life of the data holder. If video surveillance is not prescribed by law, the data controller or processor is obliged to display a video surveillance sign in a visible place – the Agency explains.
They note that the video surveillance label contains the following information: that the space is under video surveillance, information about the data controller, that is, the processor, and contact information through which the data holder can exercise his rights.
– The mark should be visible at the latest when entering the shooting range. The data controller or processor is obliged to record records of the use of the system in the video surveillance system of publicly accessible facilities and keep them for at least 12 months. According to the above, public and other institutions, such as post offices, banks, pharmacies, municipalities, health institutions, police stations, companies, if they do not have a legally prescribed obligation to install video surveillance, must find a legal basis, make a decision on the establishment of video surveillance, ensure protective and security measures, that is, mechanisms to ensure the protection of personal data – reads the answer from the Agency for the Protection of Personal Data in BiH.
High penalties for law breakers
However, numerous complaints from citizens refer to the lack of information about installed cameras in institutions or the lack of contact from controllers.
– The notice that the space is being recorded should be displayed in the place so that it is visible to everyone who enters. If there is a valid reason for setting up video surveillance, a person cannot prohibit it, but he must know it so that he can decide for himself whether he wants to be in that space and whether he wants to be recorded or not? Every individual, if the recording is carried out, has the right to know – who is being recorded, in what way and what is being done with their personal data – emphasized Sarajlić.
The most common reason for establishing video surveillance in practice is the protection of people and property. But in addition to a valid legal basis, it is also important, according to the lawyer, to define the way video surveillance functions.
– It must be prescribed at the level of each entity that has video surveillance – how it is carried out, whether the cameras are pointed in the right direction, whether what should be recorded or whether someone’s privacy is being violated. The rules should define the way video surveillance is carried out in order not to intrude excessively on someone’s privacy, and on the other hand, to achieve the purpose of video surveillance – Sarajlić points out.
Violations of the Law are subject to significant fines ranging from 500 KM for employees who commit a violation, to 40,000,000 marks for legal entities.
In the case of an entrepreneur, it is possible to impose a sanction of up to four percent of the total annual income at the world level.
For specific categories of violations, the law foresees different limits: for employees who cause a violation of the regulations by their actions, the fine is between 500 and 5,000 KM, for responsible natural persons (directors, managers, employees) from 5,000 to 70,000 marks, while for legal entities (controllers) fines from 10,000 to 20,000,000 KM or up to two percent of the total annual turnover on the global level, if that value is higher.
In more serious cases, for legal entities (data processing), the fine can reach 20,000 to 40,000,000 KM or, for entrepreneurs, the amount of four percent of the total global income, it says. Factor.
– High fines follow European legislation, and as such fines were introduced at the level of the European Union, this topic became very serious. I expect that it will be the same here, because high penalties are also applicable in Bosnia and Herzegovina for the entire range of possible violations of the Law on the Protection of Personal Data – concluded Sarajlić.
