AI -powered cameras offer new methods of analyzing driving behavior to assist drivers. Employers must ensure that these devices respect drivers’ personal data and privacy.
Some employers of transport companies wish to install augmented cameras embedded in the professional vehicles used by their employees/agents. These cameras are used, for example, to detect in real time fatigue (warning signs of driver fatigue, as well as falling asleep while driving) or distraction (detection of the driver’s gaze off the road axis or an action that could alter driving such as using a mobile phone, smoking, etc.).
These devices can be used to send technical data from alerts or video sequences to a platform accessible to the service provider or even the employer.
The right to privacy continues at work (Article L. 1121-1 of the Labor Code). Also, if an employer can adjust the working conditions of its employees in order to ensure the safety of property and people, it must ensure that the restrictions are justified and proportionate to the objective pursued.
Given the high risks of breaching the privacy of the persons concerned, the employer must take all necessary measures to ensure the compliance of such cameras before their installation.
What could be the objectives of these “augmented” cameras?
Transport companies, particularly those transporting dangerous materials, are subject to safety obligations towards their employees but also towards third parties, such as other road users.
The measures they put in place in the interest of ensuring the safety of property and people may legitimately pursue the following objectives:
- reduce the risk of road accidents and improve the safety of people, property and the environment during transport operations;
- raise awareness/train drivers;
- evaluate drivers.
The pursuit of these purposes, however, requires a balance with regard to the right to protection of drivers’ personal data, as well as respect for their privacy.
As such, the systems implemented cannot lead to continuous monitoring of employees during their working hours, even for the aforementioned purposes.
As these systems are particularly intrusive, conditions must be met to ensure their proportionality.
What legal basis should be used?
Only the legitimate interest of the employer appears likely to be mobilized for these devices. Indeed:
- in the absence of a text imposing such measures, it is not possible to base the processing on the legal obligation;
- the collection of the free, specific, informed and unequivocal consent of the persons concerned, i.e. the employed drivers, does not appear possible due to the relationship of subordination with the company;
- such a device does not appear strictly necessary for the execution of the drivers’ employment contract; and
- This type of processing, most often implemented by private transport companies, does not concern the safeguarding of vital interests or the execution of a public service mission.
Also, an internal augmented camera device (filming a private space – the passenger compartment of the vehicle), can, under certain conditions, be implemented on the basis of the employer’s legitimate interest in ensuring the safety of property and people.
The guarantees to be put in place by the employer must ensure the necessary nature of the system and the balance between the rights of individuals and the interests of the organization.
What guarantees can the employer put in place?
When the camera is installed to prevent road accidents
What data?
Only the data necessary to generate the alert in real time (images of the person) can be processed. However, after the alert, neither the images nor the technical data (timestamp, geolocation), alert type) generated as part of the alert should not in principle be retained.
In the European Union , driver drowsiness and attention warning devices and advanced driver distraction warning systems are required for transport and goods vehicles and must be installed in new vehicles since July 2024 ( EU Regulation 2019/2144 ).
However, this regulation specifies that these systems must operate in a closed circuit and not allow the identification of drivers (neither the employer nor the solution provider must access them, except for persons authorized to provide technical support).
When the camera is installed to train and raise awareness among employees
Employee training and awareness-raising may justify the collection of technical data relating to alerts and their transmission to the employer, provided that the employer demonstrates the need to access them in light of the nature of the awareness-raising and training actions actually implemented.
For whom?
In accordance with the principle of minimisation, which requires that the data collected be adequate, relevant and limited to what is necessary, augmented cameras can only be installed for positions where the risk of accidents and the consequences are particularly high (full-time transport of dangerous goods, for example).
How ?
The guarantees that the employer must put in place depend on the context of the collection and more particularly on the balance between the interests: rights and freedoms of the employer on the one hand, and those of the employees on the other.
Also, in order to avoid permanent surveillance, the employer may, for example, decide to:
- only collect personal data during specific driver evaluation periods;
- only collect aggregated data corresponding to the number of risky situations encountered by a driver over a given period;
- only trigger the reporting of information from a certain threshold of detected events;
- etc.
What data?
The categories of data collected must be determined on a case-by-case basis depending on the objective pursued and the guarantees put in place. For example, in the event of anonymous reporting of alerts from all drivers, the vehicle registration number, the timestamp data of the alert cannot be collected, nor of course the images.
In any case
Regardless of the objective pursued, the employer must demonstrate in a documented manner how the data is necessary to ensure the safety of property and people in order to enable their recording.
In this respect, the employer could question the effectiveness of such devices and the accuracy of the data collected in order to demonstrate the relevance of the devices envisaged to effectively ensure the safety of people and property and the training of drivers.
This is all the more important as errors in the system can have significant negative consequences for employed drivers since the data may be taken into account to form the basis for disciplinary decisions against them.
Furthermore, drivers must be able to exercise their rights over their personal data with the employer ( right of access , right of opposition , etc.).
The employer must also inform stakeholders:
- Employees must be informed about the terms of the control and processing of their personal data. If these data may be used for disciplinary purposes, they must also be informed of this (for example by indicating this in the internal regulations) in order to be able to determine in advance the extent and consequences of the processing.
- The employer must inform and consult before deciding to implement the system:
- in companies with more than 11 employees, the social and economic committee (CSE);
- in the civil service, the social administration council.
He must also ensure that the orientation of the camera does not allow other people to be filmed , such as other drivers or passers-by visible through the window.
Finally, the carrying out of a DPIA is most of the time necessary and recommended, even when it is not mandatory, given the particularly significant risk of infringement of drivers’ privacy and the criteria established by the European Data Protection Board .