The French government issued a decree on March 10, 2021 authorising automated analysis of the rate of compliance with the obligation to wear a mask on public transport by means of smart cameras, as the wearing of masks has been mandatory on public transport in France since May 11, 2020. In the lead-up to the draft decree, the French Data Protection Authority (CNIL) issued an opinion on December 17, 2020 which was published on March 11, 2021.

Highlighting that public spaces are places where people have the right to exercise individual freedoms, the CNIL states that “the systematic capture and analysis of people’s images in these spaces undoubtedly carries risks for their fundamental rights and freedoms”. However, it admits that the fight against Covid-19, though in everyone’s interests, can lead to limitations on the latter. Nevertheless, these restrictions must be relevant and proportionate, in order to satisfy the requirements of the European Convention on Human Rights.

To this end, the CNIL’s Commission notes in their opinion that the purpose of these smart devices is not to “prosecute breaches of the obligation to wear masks”, but to enable reasonable, non-targeted announcements to be communicated, as well as the deployment of staff to assist the public when it is observed that the mask is not being worn properly.

The CNIL therefore considers that the purpose of the proposed data processing should be “specified, explicit and legitimate within the meaning of Article 5.1.b of the GDPR”. The French DPA (Data Protection Authority) is providing its backing based on the fact that the data processing will not involve biometric data (since it will not involve identifying individuals) and on the fact that it will not be used for law enforcement purposes. Indeed, the devices would not  be used to facilitate the prosecution of individuals who do not abide by mask wearing regulations, nor would they even constitute mechanisms for the deployment of officers responsible for enforcing these regulations.

However, the CNIL is more concerned about the non-inclusion, in the government’s plans, of a  data subject’s right to object to the processing of their data. Although the DPA approves of the government’s reasoning, which is that the fight against Covid-19 justifies the non-inclusion of the right to object, it warns of the risks posed by increased surveillance, and habituation to and trivialisation of intrusive technologies:

“Even if it is limited to the framework of the state of health emergency, such a deployment presents the real risk of generalising a feeling of surveillance among citizens, of creating a phenomenon of habituation and trivialisation of intrusive technologies and, ultimately, of generating increased surveillance.”

The CNIL has already clearly stated in its call for a “debate that meets the challenge” of Facial Recognition that trials which experiment with this technology “should not ethically have the effect or purpose of accustoming people to intrusive surveillance techniques”.

Furthermore, the DPA invites the government to add two points to the decree on smart video surveillance in order to meet the requirements around the exclusion of the right to object. The CNIL recommends that the decree explicitly state the algorithmic and automated nature of the data processing, in accordance with the requirement to specify the purpose and essential characteristics of the operation. Secondly, the CNIL would like the government to include in the decree an obligation on data controllers to inform individuals that they do not have the right to object to the surveillance taking place.

Indeed, in accordance with the GDPR, such information must be explicitly provided, as long as in doing so, the data processing is not harmed. The CNIL has emphasised the importance of providing this information, noting that exercising one’s right to access, rectification, deletion or limitation is made impossible by the deletion of the images at very short notice.

Finally, as regards the duration of such surveillance operations, the CNIL welcomes the maximum duration of one year set by the decree due to the intrusive nature of the surveillance. It notes, however, that such an operation should not be allowed to continue beyond the time when obligatory mask wearing on public transport comes to an end.

French NGO “La Quadrature du Net” (LQDN) reacted on Twitter against the French decree authorizing this automated video surveillance considering that there was a “manifest absence of necessity” and other legal problems with this measure.

Update: In a subsequent post, published on Monday 15, 2021, LQDN explained why it considers the decree in question to be “illegal”. Firstly, the NGO points out that the collection of statistics (which is one of the government’s purposes for the data processing) is not contained in the 11 purposes authorised by law in relation to the use of video surveillance cameras. Secondly, the NGO contests the necessity and proportionality of the planned automated processing. According to the NGO, it may be possible to employ an alternative measure which pursues the same goal, generates statistics, but is less intrusive in nature. For instance, statistics could be produced by means of a manual count by human operators placed at particular locations on the public transport network.

MB