The Local Enforcement System Agency (LESA) operates a network of Closed-Circuit Television (CCTV) and other visual monitoring systems across Malta and Gozo.

This Privacy Notice explains how LESA processes personal data through these systems in accordance with the General Data Protection Regulation and applicable national laws.

The data controller responsible for processing personal data is:

Local Enforcement Systems Agency (LESA)
Chief Executive Officer
info@lesa.gov.mt

Data Protection Officer (DPO):
dpo@lesa.gov.mt

This notice applies to all camera systems operated or controlled by LESA, including but not limited to:

• Fixed CCTV cameras in public areas
• Mobile or temporary enforcement cameras
• Vehicle-mounted cameras
• Automatic Number Plate Recognition (ANPR) systems (where applicable)

These systems are deployed in various locations across Malta and Gozo, including public roads, parking zones, urban centres, and other areas where LESA is empowered to act.

Personal data is processed for the following purposes:

• Monitoring compliance with parking and traffic regulations
• Enforcement of applicable laws and regulations
• Detection, prevention, and investigation of unlawful or antisocial behaviour
• Protection of public order and safety
• Supporting administrative and legal proceedings
• Safeguarding LESA personnel and assets

CCTV systems are not used for automated decision-making that produces legal effects without human intervention.

Processing is carried out under:

Article 6(1)(e) GDPR – performance of a task carried out in the public interest or in the exercise of official authority vested in LESA.

Where applicable, processing may also be necessary for:

Compliance with a legal obligation (Article 6(1)(c))

Depending on the system used, LESA may process:

• Video footage and still images
• Vehicle registration numbers
• Date, time, and location data

LESA does not intentionally collect special categories of personal data, but such data may be incidentally captured.

Data is collected through overt surveillance systems. Clear signage is installed in monitored areas to inform individuals of CCTV presence and direct them to this Privacy Notice.

Personal data may be disclosed, where necessary and lawful, to:

• Law enforcement authorities (including the Malta Police Force)
• Courts and tribunals
• Government entities and regulatory bodies
• Legal representatives and insurance entities (where required)

Data is not transferred to third countries unless required by law or appropriate safeguards are in place.

Personal data is retained only for as long as necessary for the purposes for which it was collected.

As a general rule:

CCTV footage is retained for a limited period (e.g. up to 30 days),unless it is required for enforcement actions, investigations, or legal proceedings, in which case it may be retained for longer.

Retention periods are determined in line with legal and operational requirements.

LESA implements appropriate technical and organisational measures to protect personal data, including:

• Restricted access controls
• Secure storage systems
• Audit logging and monitoring
• Staff confidentiality obligations

Under GDPR, individuals have the right to:

• Access their personal data
• Request rectification or erasure (where applicable)
• Request restriction of processing
• Object to processing carried out under Article 6(1)(e)
• Lodge a complaint with the Information and Data Protection Commissioner

Requests will be assessed in accordance with legal obligations and may be subject to limitations, particularly where data relates to enforcement activities or third parties.

You may exercise your rights by submitting a request through:

GDPR

This page also provides access to the Data Subject Request Form and LESA’s broader Data Protection Policy.

Alternatively, you may contact the Data Protection Officer directly.

LESA is committed to ensuring that all CCTV systems are accompanied by appropriate signage that:

• Clearly indicates the presence of surveillance
• Identifies LESA as the data controller
• Provides a reference to this Privacy Notice
• Ongoing reviews are carried out to ensure compliance with transparency requirements.

This Privacy Notice may be updated from time to time to reflect legal, technical, or operational changes. The latest version will always be available on LESA’s website.