FWIW the cameras on public transit (which have been the norm in Cologne for at least a decade I think) are legal (under the old data protection laws anyway) bec

FWIW the cameras on public transit (which have been the norm in Cologne for at least a decade I think) are legal (under the old data protection laws anyway) because the recordings are automatically destroyed after 24 hours or so. I think the GDPR would protect them because of a number of factors: * there's a legitimate security interest (vandalism, terrorism, rape and other personal crimes) * the recordings are not stored longer than necessary to fulfill that purpose * there is clear signage indicating you are entering an area with surveillance cameras (i.e. you are giving informed consent) The GDPR protects the individual's right to privacy but it's a balancing act and the security interests are fairly valid.