During this Covid-19 epidemic, and in particular in this actual period of lockdown, is planned the implementation of the new cameras called “smart” and thermal cameras in order to simplify the management from public and private authors, health crisis and its consequences.

If the CNIL is aware of the health situation, it seems that many systems are not in compliance with the legal framework which is applicable to personal data protection. So the vigilation is required.

Reconciling health goals with individual freedoms.

The public space is a place where many individual freedoms are exercised: the right to privacy and the protection of personal data, freedom to come and go, expression and assembly, the right to protest, freedom of conscience and the exercise of cults, etc. The anonymity preservation in the public space is an essential dimension for the exercise of these freedoms; capturing the image of people in these spaces unquestionably carries risks for the fundamental rights and freedoms of these spaces.

While the objectives assigned to these new devices are most often legitimate, the CNIL finds that their deployment would involve systematic collection and analysis of data from individuals circulating in public spaces or in places open to the public.

Their uncontrolled development presents the risk of generalizing a sense of surveillance among citizens, creating a phenomenon of habituation and trivialization of intrusive technologies, and of generating increased surveillance, which could undermine the proper functioning of our democratic society.

The massive deployment of these devices for capturing the image of individuals and detecting some of their attributes or behaviours could lead to a change – intended or suffered – in the individuals concerned.

More generally, these specific uses of “smart” video devices in the context of the current state of health emergencies raise important issues on which the CNIL has already stressed. She called for a democratic debate on new video uses in September 2018 and more specifically on facial recognition in November 2019.

With regard to thermal imaging cameras, it should be noted that the health authorities interviewed by the CNIL have expressed reservations about this device. It presents the risk of not spotting infected people since some are asymptomatic and can also be circumvented by taking antipyretic drugs (which reduce body temperature without treating the causes of fever).

The guarantees that need to be insured.

The rights of individuals must be respected and are neither restricted nor suspended by the context of a health emergency.

The possible implementation of such surveillance systems must respect the applicable legal framework (RGPD, Computer and Freedoms Act, Police-Justice Directive) and be accompanied by safeguards to preserve individual freedoms and in particular the right to privacy. It is for these reasons that video protection devices, like other image capture devices in public spaces, are subject to specific legislative framework in the Internal Security Code. The CNIL recalls that the use of “smart” cameras, on the other hand, is not currently provided for by a specific text. Their real usefulness and interest, depending on specific circumstances, could not be evaluated and debated at a more general level than the organizations deciding on their establishment.

The CNIL stresses the need for adequate textual guidance, which is required as long as:

• Sensitive data is processed
• or that the right of opposition cannot be applied in practice in the public space.

This framework – necessary but insufficient – would be in addition to all the guarantees that must be provided by these possible “smart” video devices in relation to the GDPR (demonstration of their necessity and proportionality, limited shelf life, measures of pseudonymization or anonymization, lack of individual monitoring, etc.). In addition, the deployment of thermal imaging cameras, which deal with health data (body temperature), must be given special attention.

A call for vigilance against the deployment of irregular devices

The fight against the COVID-19 epidemic has led some actors to consider deploying such so-called “smart” cameras to measure temperature, detect presence or ensure compliance with social distancing or mask use. Without in any way questioning the legitimacy of the objective of combating the spread of the epidemic, the CNIL considers it necessary to alert to the fact that, subject to a case-by-case analysis, it appears to it that a large part of these devices do not comply with the legal framework applicable to the protection of personal data.

Indeed, when they constitute automated processing of personal data and as such fall under the RGPD, such devices most often lead either to process sensitive data without the consent of the interested parties (including temperature), or to exclude the right of objection. In both cases, these arrangements must then be subject to a specific normative framework, which will require upstream to consider the proportionality of the use of such devices and the necessary safeguards. For all the reasons outlined above, the CNIL calls on actors to be very vigilant in order not to multiply and perpetuate camera surveillance instruments in public places or open to the public, whether they are street, professional premises or other types of establishments.

SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DELLA FRANCIA – CNIL