GDPR and traffic measurement in public space
A public street is the most privacy-sensitive place to measure anything. Here is what traffic measurement may capture, what it must not, and how to buy measurement that walks through a legal review with nothing to explain.
Cities need movement data more than ever, and citizens tolerate surveillance in public space less than ever. Those two facts collide in every traffic measurement project: the planning department needs to know how many vehicles, cyclists and pedestrians use a street, and the legal department needs to know that finding out did not put anyone under observation. The good news is that the collision is avoidable, if the measurement is chosen with privacy as an input rather than a patch. As with our DPIA guide, this is orientation, not legal advice.
The count is innocent. The capture might not be.
Nothing about a number is personal data. “4,213 vehicles, 612 cyclists, southbound, Tuesday” identifies no one. GDPR enters through the method: a system that records identifiable video, or reads registration plates, processes personal data on the way to its count, and everything that follows, legal basis, retention, information duties, access requests, follows from that capture, not from the count it produced. The question to ask any measurement system is not “what does it report?” but “what does it hold, even for a second?”
Cameras and plates: justified sometimes, heavy always
There are legitimate reasons to read plates and record streets, enforcement being the obvious one, and the law provides frames for them. But those frames are heavy: assessments, signage, retention schedules, and a public conversation about being filmed. Carrying that weight makes sense when identification is the purpose. Carrying it accidentally, because the counting product a supplier offered happens to be a video product, is how measurement projects stall in legal review. In counting mode, modern AI cameras output numbers rather than footage, which changes the analysis substantially, but in the most sensitive public settings the strongest position is a method where imagery never exists at all.
Measurement with nothing to explain
LiDAR-based measurement counts by measuring moving geometry with eye-safe laser pulses. There is no image, no plate, no face, no identifier at any stage, not deleted, not blurred, simply never created. A street measured this way produces continuous series of vehicles, cyclists and pedestrians as separate classes, in any light, and its privacy review is as short as the technology note that explains it. Anonymity is not a policy promise; it is what the sensor physically outputs.
The pedigree question
Suppliers will all say “GDPR-compliant”; the phrase costs nothing. What separates claims is track record under scrutiny. Bumbee Labs is the company behind the only footfall method in Europe approved by a data protection authority, a regulatory examination passed where it matters most, and the same privacy-by-design engineering culture builds our street and traffic measurement. When your DPO asks the questions in our DPIA guide, we answer in writing, with the architecture to back it. For specification language, start with the procurement guide; for the measurement itself, talk to us.
Having the large flows we have is a challenge. We constantly strive to have as efficient a station as possible. With the help of reliable data from the new measurement system, we can better plan where different service functions or stores are to be located and how we can adapt doors or passages.
Frequently asked questions
Is counting vehicles in a public street a GDPR issue?
Counting as such needs no identity, and a count is not personal data. The GDPR question is what the measuring system captures along the way: registration plates and identifiable video are personal data, while a method that never captures imagery or identifiers keeps the measurement outside that territory by design.
Are traffic cameras and ANPR covered by GDPR?
Yes. Registration plates identify a keeper, and identifiable footage identifies people, so plate-reading and recorded video in public space carry a full data protection assessment, a legal basis, retention rules and information duties. That can be justified for enforcement, but it is a heavy frame to carry when the goal was only a count.
How does LiDAR-based measurement avoid the problem?
LiDAR measures moving geometry with laser light: position, size, direction, speed of movement. No image exists at any stage, no plate, no face, nothing to blur or delete. The privacy section of an assessment becomes short because there is nothing resembling personal data in the pipeline.
What should a municipality require from a supplier?
A technical statement of exactly what is captured, whether any imagery or identifier exists at any stage, and anonymity by design rather than by policy. Our procurement guide for traffic counting covers the requirements in specification-ready form.