GDPR and traffic measurement in public space
A public street is the most privacy-sensitive place to measure anything. This guide covers what traffic measurement may capture, what it must not, and how to buy measurement that passes a legal review without further questions.
On this page
It can be, and the method decides. Under GDPR a traffic count is not personal data, but a system that records identifiable video or reads number plates processes personal data on the way to its count. A method built never to capture imagery or identifiers stays clear of that.
Cities need movement data, and citizens have less patience than they used to for surveillance in public space. The planning department needs to know how many vehicles, cyclists and pedestrians use a street, and the legal department needs to know that finding out did not put anyone under observation. There is no conflict if privacy is a criterion when the method is chosen, instead of a patch added afterwards. As with our DPIA guide, this page is general orientation and not legal advice.
What makes a traffic measurement system a GDPR matter?
What the system captures. A number such as “4,213 vehicles, 612 cyclists, southbound, Tuesday” identifies no one. Legal basis, retention, information duties and access requests all follow from what a system records on the way to its count. So the question to put to any measurement system is what it holds, even for a second.
Why do cameras and number plate reading carry a heavy legal frame?
There are legitimate reasons to read plates (ANPR) and record streets, most obviously enforcement, and the law provides frames for them: assessments, signage, retention schedules and a public conversation about being filmed. That weight makes sense when identification is the purpose. Projects stall in legal review when they carry it by accident, because the counting product on offer happens to be a video product. In counting mode, modern AI cameras output numbers rather than footage, which changes the analysis substantially.
Do you read number plates when you count traffic?
Not for counting. A count needs no identity, so it needs no plate. Plate reading identifies a keeper, which brings an assessment, a legal basis, retention rules and information duties; that frame is built for enforcement. With LiDAR, the street produces no plate at any stage, and the count is the same.
Cameras in the street: will it pass politically?
This page cannot promise a political outcome, but it can say what makes the review long or short. A camera opens the conversation about being filmed. In the most sensitive public settings, the strongest position is a method where imagery never exists at all, because then the review is as short as the technology note that explains it.
What does measurement look like when no image is ever created?
LiDAR-based measurement counts by measuring moving geometry with eye-safe laser pulses. At no stage is there an image, a plate, a face or an identifier, so nothing is deleted or blurred. A street measured this way yields continuous series from traffic counting of vehicles, cyclists and pedestrians as separate classes, in any light. Its anonymity rests on what the sensor physically outputs.
Citizens call and ask whether we are filming them. What do we say?
Answer with what the system captures, and be exact about the method. LiDAR measures moving geometry, so no face, plate or image exists at any stage. An AI camera in counting mode outputs numbers rather than footage. A plain description of the sensor and its output is the answer to give, since the question is about what is recorded.
How do we write the data protection requirement so the DPO says yes?
No wording guarantees a yes, but these criteria give the DPO facts to assess. Require a technical statement of exactly what is captured, whether any imagery or identifier exists at any stage, and anonymity built into the design instead of left to policy. The procurement guide sets out the requirements that matter and the questions that separate suppliers.
What separates a supplier from a “GDPR-compliant” label?
Every supplier says “GDPR-compliant”. What separates the claims is a track record under scrutiny. Bumbee Labs is the company behind the only footfall method in Europe approved by a data protection authority, and the same privacy-by-design engineering goes into our street and traffic measurement. When your DPO asks the questions in our DPIA guide, we answer in writing, with the architecture to back it. For the measurement itself, talk to us.
Curious what this looks like for your venue?
Frequently asked questions
Is counting vehicles in a public street a GDPR issue?
Only if the system captures something that identifies people. Counting needs no identity, so the numbers are not personal data. Number plates and identifiable video are, so the choice of sensor is where the GDPR question is settled. A sensor that produces no imagery and no identifiers keeps personal data out of the measurement.
Are traffic cameras and ANPR covered by GDPR?
Yes. Number plates identify a keeper, and identifiable footage identifies people, so plate-reading and recorded video in public space carry a full data protection assessment, a legal basis, retention rules and information duties. That can be justified for enforcement, but it is a heavy frame to carry when the goal was only a count.
How does LiDAR-based measurement avoid the problem?
LiDAR measures moving geometry with laser light: position, size, direction, speed of movement. No image exists at any stage, so there is no plate or face, and nothing to blur or delete. The privacy section of an assessment becomes short because there is nothing resembling personal data in the pipeline.
What should a municipality require from a supplier?
Three things in writing: what the sensor captures, whether an image or identifier exists at any stage, and how the design keeps the data anonymous. Our procurement guide for traffic counting covers the requirements that matter and the questions that separate suppliers.