A New Era in Traffic Surveillance: How Estonia's New Automatic Number Plate Recognition Camera Law Protects Your Privacy

22 October 2025

Estonia has taken an important step in protecting citizens' privacy in the digital age. On 20 October 2025, President Alar Karis promulgated amendments to the Police and Border Guard Act that establish strict rules for the use of automatic number plate recognition (ANPR) cameras. This law is not merely a technical update, but a fundamental decision that seeks to strike a balance between ensuring national security and protecting individual freedoms. In this article, we examine the details of the new law, analyse its impact on ordinary citizens, and explain why this is a pivotal moment in Estonia's legal landscape.

The Legislative Journey: From Controversy to Clarity

The new regulation was not adopted overnight. It was the result of months of discussion, reflecting public concern about the potential expansion of mass surveillance. Riigikogu approved the legislative amendments on 8 October 2025 by 49 votes to 16, indicating that the issue sparked lively debate in parliament. The seriousness of the situation was underscored by the fact that the use of automatic number plate recognition cameras was suspended in the summer of 2025 until politicians clarified the legislation.

When promulgating the law, President Alar Karis made no concessions. He stressed that his signature did not signify approval of the previous practice, under which cameras were often installed without sufficient justification. This was a clear signal that the new law must put an end to “just in case” surveillance and establish a system in which technology is used purposefully and with justification.

The Core of the Law: A Risk-Based and Proportionate Approach

The most important change introduced by the new law is the requirement that the installation of every automatic number plate recognition camera must be justified a specific and real threat. This is a fundamental shift from previous practice, where expansion of the camera network was often justified by general assumptions, such as covering potential routes used by criminals. As President Karis aptly noted, following this logic, Estonia's entire road network could be covered with cameras.

The new law is based on the existing Law Enforcement Act and establishes strict requirements that must be followed when installing cameras. These requirements are designed to ensure that surveillance is always a last resort, not the first choice.

The following table summarizes the key requirements of the new law:

Requirement	Description
Specific Threat	Cameras may only be installed to identify or prevent a real, rather than abstract or hypothetical, threat or to remedy a public order violation.
Written Threat Assessment	A thorough written risk assessment must be prepared for each camera location, demonstrating the absolute necessity of installing it at that specific location.
Temporary Installation	The installation of cameras is inherently temporary. The need for them must be continuously and regularly reassessed.
Dismantling Requirement	If the threat assessment indicates that the specific threat has disappeared or diminished, the camera must be removed from that location.

This framework ensures that surveillance devices, including ANPR Cameras in Estonia, would not be used for indiscriminate data collection, but only for targeted and time-limited operations. The law also extends to other surveillance devices, such as drones, ensuring a technology-neutral approach to privacy protection.

President Karis's Message: A Warning Against Excesses

President Alar Karis’s position when promulgating the law was exceptionally significant. He did not limit himself to formally signing it but used the opportunity to send a clear message to both those implementing the law and the public. His criticism of the previous practice was direct:

“In practice, however, this requirement [the requirement for a written risk assessment] has not always been followed. An internal review by Politsei- ja Piirivalveamet showed that cameras have sometimes been installed on the basis of insufficient supporting evidence or with none at all.”

This statement confirms that concerns about privacy violations were not unfounded. The President stressed that although the police must have modern tools at their disposal, this must not come at the expense of citizens’ fundamental rights. “It is extremely important to ensure that road users do not feel as though they are being monitored everywhere,” Karis said.

His remarks highlighted the fundamental question at the heart of the new law: should the state engage in preventive and extensive surveillance, or should it collect data only when there is a specific suspected threat? The new law clearly chooses the latter path, prioritising citizens' right to privacy.

Data: Who Can See It and for How Long?

One of the most important issues with any surveillance technology is data management. The new law establishes clear rules on who can access the collected data and how long it is retained. This is data protection is of critical importance.

The collected data – image, licence plate number, location, and time – may be used only for strictly limited purposes:

•To collect evidence in criminal proceedings.

•For detecting, preventing, or countering an elevated or significant threat.

•To address public order violations associated with such a threat.

•To locate wanted persons.

It is important to note that the data must be deleted after 45 days. This period is a compromise between the need to retain data for possible proceedings and the aim of preventing the creation of long-term movement profiles.

The data can be accessed by:

1.Politsei- ja Piirivalveamet (PPA)

2.Security authorities (e.g. Kaitsepolitseiamet)

3.Maksu- ja Tolliamet (MTA)

It was the addition of MTA to the list of entities with access to the data that sparked the most debate in parliament. The original bill did not provide for this, but the amendment was added during the second reading to bring the law into line with current practice, under which MTA already has certain access rights. Nevertheless, MTA must also adhere to the strict purposes and principle of proportionality laid down by law when using the data.

What Does This Mean for You?

For ordinary citizens, the main message of the new law is reassuring. It significantly reduces the risk that information about your daily journeys will become part of a government database without a specific reason. The law does not eliminate automatic number plate recognition cameras, but ensures that they are used with surgical precision to combat crime and real threats, rather than for extensive for traffic surveillance.

You can be more confident that your freedom of movement and privacy are respected. If you encounter an ANPR camera, its presence is likely due to a specific and documented threat, rather than simply a desire to collect data. This is an important victory for civil society and a sign that Estonia takes the privacy risks associated with technological development seriously.

A Technology Called ANPR

Finally, what is automatic number plate recognition or ANPR? It is a technology that uses optical character recognition to read vehicle number plates. A camera takes a picture of a passing vehicle, and the software analyses the image, extracts the number plate and converts it into digital text. The number can then be checked against various databases, such as lists of wanted vehicles or uninsured cars.

The technology itself is neutral, but the way it is used determines its impact on society. This is precisely why establishing a strict legal framework is essential.

Summary: A Balanced Future

Estonia's new license plate recognition camera law is an exemplary illustration of how a democratic state can and should regulate new technologies. It prioritizes citizens' fundamental rights, limiting state intervention to cases where it is strictly necessary and proportionate. The law sends a clear message: security can also be ensured without the gaze of Big Brother.

This is an important step forward privacy protection in Estonia, reinforcing our reputation as a digitally advanced country that nevertheless respects the freedoms of its citizens. It remains to be hoped that the law will be implemented in the same spirit in which it was written—transparently, with justification and with respect for every road user.