Since June 2019, the French government has been working on a digital identity solution that offers a “high level of authentication”: the ALICEM application. Initially scheduled for release at the end of 2019 but delayed, the ALICEM application should enable individuals to use their verified digital identity to access a multitude of different online services. In order to ensure a ‘’high level of authentication’’, the application uses facial recognition technology and biometric data to verify the identity of the user. It is the ALICEM application’s use of biometric data that has been challenged by the association La Quadrature du Net at the French Supreme Administrative Court (the Conseil d’Etat) and a decision has just been announced.
In July 2019, the association La Quadrature du Net (LQDN) challenged the implementation of this application on the main grounds that consent requirements, the legal basis for processing biometric data in ALICEM, do not satisfy requirements around freedom of consent. According to the association, the application does not offer any other option to users but to accept the use of facial recognition technology as a secure means of identifying themselves digitally, depriving freedom of consent as per European legal requirements’. Moreover, LQDN asked the Conseil d’Etat to submit two questions to the European Court of Justice: the first question asks about the level of of equivalence of service that would be required by an alternative application;the second question asks whether the kind of data collection envisaged is adequate, relevant and not excessive.
In its decision of November 4, 2020, the Conseil d’Etat chose not to submit these questions to the European Court of Justice and rejected the association’s action. First and foremost, the Court considers that, in the absence of an alternative technical solution offering a mean of digitally identifying oneself with the same level of security, the use of biometric data is justified and thus required for data processing purposes. The Conseil d’Etat has therefore approved the four types of data checks used by the application, considering that such uses are adequate and proportionate for data processing purposes. Finally, the Court considers that the services to which ALICEM provides access can also be accessed by non-biometric authentication means, which ensures freedom of consent.
The Conseil d’Etat has therefore approved the system’s use of biometric authentication, even though the French Data Protection Authority (CNIL) was more reserved in its judgement in 2018. The Quadrature du Net association, despite rejection of their claim, is nevertheless satisfied to see these technologies enter into public debate.
Sources:
https://www.legifrance.gouv.fr/download/pdf?id=JQDkiVqbiPoVpbHfpdweSZcrPSXYo-T8chbNahjpRk0=
https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2020-11-04/432656
https://www.laquadrature.net/wp-content/uploads/sites/8/2019/07/1084951458_DECR_ALICEM_REQ.pdf
