After a debate on video protection in transport in March 2021, in 2022 the CNIL is raising users’ awareness of how they can be tracked online. On February 2, 2022, the CNIL warned against new online tracing methods. Indeed, cookies are no longer the only method used to retrieve a user’s activity data on the internet.
Now, web players have perfected new techniques to retrieve the valuable information that makes up a browsing profile. This profile is then used to allow the use of browsing data and actions in order to offer advertisements by tracking. Thus, beyond the use of cookies, there is also digital fingerprinting, tracking via unique links, tracking via identifiers or tracking via the IP address. In order to find your way around and how to best protect yourself, the CNIL gives advice applicable to the different tracing methods.
The protective video to measure the wearing of masks in transport is authorized by a decree of March 10, 2021. The purpose of this scheme is to obtain statistics on the wearing of masks in transport. All this, without the will to verbalize the users. As early as June 2020, the CNIL had previously denounced the excesses to be prevented. After more than 9 months of work and the establishment of safeguards, she finally agreed. To better understand the ins and outs of this scheme, BORDEAUX Business spoke with Pauline DUCOIN,a lawyer specializing in information technology law,at the firm Cornet Vincent Ségurel. The firm is present in several major cities of France: Nantes, originally, then Bordeaux, Lille, Lyon, Paris and Rennes.
What is the context of the decree on video protection in transport?
First, we must understand that this decree of March 10, 2021 does not come out anywhere. While we have the Covid-19 health crisis that we know of, the situation has generated behaviours in a number of private companies aimed at controlling some of all the health security aspects put in place by the government. Whether it’s masks or PCR tests. Lots of people had lots of good ideas to control compliance with the measures. But they failed to question the applicable legal framework.
It was in this context that the CNIL intervened. It drew attention to the fact that all these ideas had to be compatible with the applicable legal framework. Starting with everything related to civil liberties and the processing of personal data.
The decree on video protection in transport is the result of all this reflection. It responds to a need and implementation of control of the wearing of masks in transport by technology,halfway between video surveillance and artificial intelligence. He therefore comes to frame this practice. To do this, it clarifies some questions, namely: in what framework this device intervenes, what safeguards are put at work, what is the duration of data retention…
What is the legal framework for this scheme?
The issue of video protection in transport is at the crossroads of several legal frameworks. In my business, I am very oriented technology and personal data. That is the main point here. But it is also much more general on civil liberties.
In practical terms, regulation is there to protect everyone. Theobjective of the CNIL is to ensure that surveillance is not generalized in public space. Let us not become China, with its social notes, in short. The risk, with such a device, is to trivialize the feeling of surveillance,to create a new standard. This would substantially change the behaviour of users. Also, the framework of video protection in transport also joins a more general framework. That of free movement, respect for privacy, the right to remain anonymous in the public space. And by extension, freedom of expression, freedom to protest.
There is also a more specific regulatory framework, with the processing of personal data, supervised by the RGPD at European level, and by the French law of 6 January 1978.
In fact, the publication of the decree of 10 March comes after various stages. These were used to ensure that the identifier data was processed. For example, the CNIL first issued notices in June 2020 on the call for vigilance for the use of smart cameras. It then provided a deliberation on December 17, 2020 to guide the legislature on the strict legal framework.
Is the video protection system compliant with the RGPD?
In the idea, you have public transport, run by a private company. You have a number of video surveillance already in place, regulated by public space surveillance. Until then, all this had existed before. As part of the monitoring of wearing the mask,the intention was to add a software layer on existing cameras or to add new smart cameras to draw statistics from the wearing of the mask in transport. To find out if passengers complied with the rules according to zones, hours, etc.
Except that, of course, when you have a continuous analysis and video, you deal with personal data. It remains to be seen in what context this video protection in transport is involved. Basic, all that is facial recognition, biometric data etc… is prohibited unless there are special conditions.
The question was whether the tool uses biometric data. But also, is there a real need to do so. Parliament therefore had to clarify its will. All the more so since this was an impossibility for the physical person to exercise a number of his or her usual rights, includingopposition to treatment. The CNIL had to position itself to say whether this was justified. After the various round trips, she finally gave her consent, judging the device in accordance with the RGPD.
Are there guarantees that the rights and freedom of the persons concerned are respected?
In order to obtain guarantees, the CNIL also had to encourage the legislator to clarify the scheme. In particular regarding the purpose, the essential characteristics, the analysis in real time. In fact, it asked Parliament to incorporate in the decree that it added an additional layer of software to the existing video surveillance system, but not a brand new device. He also focused on a second point of precision. Which concerned information about the limitation of rights and the very short-term deletion of video streams.
In addition, the decree specifies the time limit on the implementation of the process. Thus, video protection in transport is limited to one year from the publication of the decree. That is, it will no longer be applicable on March 10, 2022. Unless a new decree or text is published in the meantime, with the same details, safeguards, details of rights.
To arbitrate, the CNIL questions whether the device meets the principle of reflection of proportionality. If it respects the balance to be maintained between the objective pursued and the legitimacy of the objective pursued. Does the health crisis take precedence over freedoms? And, if justified, what are the means used? How can this be done to make it as weak and minimally invasive as possible?
In practice, the decree specifies that data is deleted every 20 minutes. Technically, the cameras film continuously, and the software analyzes the wearing of the mask in real time, resulting in statistical results. It is not able to identify people and images are deleted within a maximum of 20 minutes.
How can we ensure that video protection will not be used for punitive purposes?
According to the companies that have implemented this scheme, the objective is not to deploy the controls. On the other hand, they could use them to raise awareness about wearing masks in the areas concerned, send agents to inform, advise etc. However, the issue of the safe drift of verbalization remains.
Today, Parliament is committed to not doing so, but it is indeed complicated to ensure that. In France, and in Europe, we still have a very strict legal framework that should prevent these excesses. This is not the case in the United States, for example. There, Amazon has generalized video surveillance cameras to delivery drivers. Among other things, they record and analyze the driver’s driving, the driver’s behaviour, his identity… In practice, the brand even goes so far as to denounce them in case of infringement, or to go as far as dismissal.
In France, as in Europe, the treatment of traffic offences and criminal offences in general is only possible by specially dedicated authorities such as the police and gendarmerie. Businesses are not allowed to do so. So, if we go back to video protection in transport: on the one hand, it is not done to verbalize, it is specified in the texts; on the other hand, companies are not allowed to do so anyway.
Sources
Interview with Pauline Ducoin, Director of Lawyers at Cornet Vincent Ségurel, May 6, 2021
Photographer: Olivier Ramonteu
