A French court canceled today a decision by the South-Est Region of France (Provence-Alpes-Côte d’Azur – PACA) to undertake a series of tests using facial recognition at the entrance of two High schools considering that this would be illegal. This is the first decision ever by a French Court applying the General Data Protection Regulation (GDPR) on Facial Recognition Technologies (FRTs).
Context
In December 2018 the PACA region decided to conduct facial recognition tests at the entrance of a High School located in Nice and in another High School located in Marseille. The FRTs were used at the gates of these two establishments, granting or refusing access to the students of the two schools. The systems were put in place in February 2019 in order to “assist the personnel of the high schools” in controlling that only authorised students will enter and to avoid identity cards theft or misuse. The trials were supposedly based on the consent of the students involved. For the more general context of these trials check here.
Three NGOs, La Ligue des Droits de l’Homme, La Quadrature du Net and the federation of parents of pupils of the public schools of the Alpes-Maritimes, challenged the legality of this decision.
The Role of the French DPA, CNIL
While the case was still pending in the Administrative Court of Marseille, the French Data Protection Authority (CNIL) expressed in a notice published on October 29th, 2019, its great concerns in relation with such a system implementing facial recognition authentication systems for children for the purpose of controlling access to schools. The French data protection watchdog said that FRTs are especially intrusive biometric mechanisms which bear important risks for privacy and civil liberties – especially when the persons involved are minor persons. It explained that the GDPR requires a necessity and proportionality test: are there are other, less intrusive means, to achieve the same result? This was clearly the case here, according to the CNIL, as the objectives of increasing security and fluidity of traffic could have been achieved by means less intrusive for privacy and individual freedoms (such as badge/ID control). As a conclusion, the CNIL considered that the specific use of FRTs was contrary to the principles of proportionality and minimization of data laid down by the GDPR.
In a subsequent, more detailed report on facial recognition published on November 15th, 2010, the CNIL maintained its position, presenting this case as emblematic of the fact that “certain uses of facial recognition are forbidden in our society”.
The President of the Provence-Alpes Côtes d’Azur Region R. Muselier reacted angrily to these positions by CNIL accusing the French DPA of “being stacked in the previous century” and having a “dusty ideology”. The attacks against the French DPA by the politicians involved in the project continued during the subsequent months. In an interview given on November 12th, 2019, the Mayor of the city of Nice C. Estrosi accused the CNIL of being “a State within the State” and expressed his determination to move forward with the tests in the future. Later, in an Op-ed published with a French newspaper on December 24th, 2019 the same politician accused the CNIL of being an “autonomous organ” disconnected from reality and from the desires of the citizens and asked the French Prime Minister to review and downgrade the powers of the French DPA:
“We ask the government to reflect on the scope of intervention of the CNIL, to analyze its functioning, to determine if the concentration of as many powers, without any control, is desirable, if in the world other democracies also come up against this permanent censorship, if finally these ideological obstacles are likely to endanger our country and our fellow citizens”.
Interestingly, despite these attacks, the politicians involved suspended the FRT trials instead of moving forward with them and challenging an eventual fine by CNIL in French Courts.
The Court's decision of February 27th, 2020
The decision handed down on 27 February 2020 entirely confirms the position and the legal analysis of the GDPR by CNIL and seems to constitute a blow for the politicians who challenged the interpretation of the GDPR by the French DPA.
Indeed, the Administrative Court of Marseille overturned the December 2018 decision of the Southern region and upheld the request of the three associations involved.
The court justified its decision on the following basis:
1/ On competence. Responsibility for school safety lies with the Head of School, not the Region, so the latter acted ultra vires by engaging in such an FRT experiment.
2/ On consent as a legal basis for processing. The Court highlights that it is clear from the documents in the file that the PACA region intended to legally justify the
processing of the biometric data in question by the prior consent given by the high school students concerned or, in the case of minors, that of their legal representatives. The Court finds, nonetheless, that the receipt of consent by simple signature in a form, from the student or his legal guardian, is not sufficient to meet the conditions set out in the GDPR. Indeed, the fact that the students are placed under the direct authority of the heads of their schools does not offer sufficient guaranties that the consent was given in a free, specific, informed and univocal way.
3/ On the proportionality test. The Court reaffirms the need to assess strictly the proportionality of the processing and follows the CNIL interpretation of the GDPR on this issue and the “less intrusive means” requirement. The Court considers that the Region has not demonstrated why access control by badge/ID card, possibly coupled with video surveillance, was insufficient to achieve the purposes of the processing operation (access control). It concludes that the FRT test undertaken by the Region violates Article 9 of the GDPR and cannot be justified by the exceptions announced in para. 2 of this Article. As a consequence, it decides that the December 2018 decision authorizing the trials must be invalidated.
It will be interesting to see if the Region will appeal this decision.
The author will like to thank Mathias Becuywe for his assistance in drafting this piece
Sources:
Decision of the Marseille Administrative Court (in French)
Press Release of La Quadrature du Net (one of the claimants NGOs)
These statements are attributable only to the author, and their publication here does not necessarily reflect the view of the other members of the AI-Regulation Chair or any partner organizations.
This work has been partially supported by MIAI @ Grenoble Alpes, (ANR-19-P3IA-0003)
