Panama has a basic legal framework for data protection that applies to video surveillance recordings. Law 81 of March 26, 2019, establishes principles such as purpose, proportionality, security, and transparency, and recognizes rights of access, rectification, cancellation, objection, and portability (ARCOP), applicable to images and biometric data. However, this law is of a general nature and leaves practical gaps when it comes to the mass deployment of cameras in public spaces and the handling of recordings by authorities and municipalities. The main weaknesses of the current system are the lack of uniform rules on retention periods (except those already established for body cameras in Law 466), the absence of public and auditable records of who accesses recordings in general CCTV systems, uneven implementation among municipalities and security forces, and the limited technical and independent supervision by ANTAI to ensure compliance with the principles of Law 81. These gaps create real risks of misuse, unauthorized dissemination, and disproportionate surveillance, especially in sensitive contexts such as the protection of minors or victims of violence. To mitigate risks and improve regulatory efficiency in Panama, it is advisable to adopt concrete measures inspired by these models: mandatory DPIA for mass video surveillance projects or those using facial recognition; set maximum retention periods (e.g., 30–90 days for general CCTV, except for judicial causes) and clear anonymization rules before any public dissemination; create a public registry of cameras installed by state entities and an internal auditable access registry with a chain of custody; and publish usage policies and accessible citizen complaint channels. Furthermore, it is necessary to modernize Law 81 of 2019 so that it stops being just a general framework and incorporates specific and operational provisions on video surveillance (the draft of January 2026 already points in this direction). In practice, successful models show that the combination of technical rules (DPIA, deadlines, anonymization), transparency (signage, accessible public policies), and supervision (access logs, independent audits) is effective in reducing abuses and increasing public trust. At the operational level, municipalities and operators must implement immediate procedures: conduct DPIA before installing systems, visibly mark monitored areas, document the purpose and retention period, maintain access logs with periodic audits, apply anonymization techniques for dissemination, and have protocols for responding to security breaches and notifying ANTAI. For the police and security forces, Law 466 already establishes a model that must be complemented with continuous training in human rights and external supervision: complete storage without editing, restricted access for investigative purposes, differentiated retention periods, and procedures for publishing recordings that protect the privacy of third parties. Finally, strategic recommendations include promoting periodic external audits, creating public registries of cameras installed by state entities, demanding transparency on algorithms or automated analysis systems, and fostering citizen participation in defining local video surveillance policies. In January 2026, a draft reform to Law 81 was also presented, aimed at increasing sanctions and creating a public registry. In the European Union, the General Data Protection Regulation (GDPR) and the guidelines of the European Data Protection Board require a clear legal basis, Privacy Impact Assessments (DPIA) when there is a high risk, and documentation of the balancing of interests before deploying mass surveillance systems. In Spain, data protection regulations are applied to CCTV with practical guides from the Spanish Agency for Data Protection on deadlines, signage, and security measures; and the United Kingdom combines the UK GDPR with the guidance of the Information Commissioner's Office, which obliges registering systems, justifying retention, and maintaining access and audit logs. Implementation must be gradual, with technical and social assessment before massive scales, to balance public safety with the effective protection of fundamental rights. Modernization must consider technological neutrality and rules on algorithms and facial recognition, provisions on cross-border transfers of images, and measures to protect vulnerable groups. The author is a researcher, teacher, and doctor of law.
