Already sanctioned twice in 2020 by the Council of State on the same subject (the May 18, 2020 and the December 22, 2020), the Ministry of the Interior has now been called to order by the CNIL for its use of video surveillance drones outside any legal framework.
Following the publication of several press articles reporting on the use by the security forces of drones equipped with a camera in order in particular to ensure compliance with containment measures, the president of the CNIL asked the ministry to inside explanations.
The ministry decides not to follow up on the letter and the CNIL then applies its power of control in order to verify compliance with all the provisions of the RGPD (Regulation 2016/679), the Data Protection Act (no. 78/17) and the police-justice directive (Directive 2016/680) by the ministry.
While the ministry initially considers that the flight of the drones did not give rise to any processing of personal data, “People who are not identifiable”, the CNIL notes the zoom capabilities and the quality of resolution of the drone’s camera by requesting a test flight.
The CNIL’s finding is clear: the technical capacities of the camera are such that the use of the drone gives rise to the processing of personal data when people are filmed in conditions allowing their identification.
The ministry could not ignore that the use of these surveillance cameras constituted a processing of personal data as this was clearly stated on several occasions.
Indeed, the CJEU recognized in 2014 that “the image of a person recorded by a camera constitutes personal data […] insofar as it allows the person concerned to be identified ”(CJEU, 11 December 2014, Ryneš, case C-212/13).
In the same sense, the EDPS Guidelines 3/2019 clearly state that “Systematic and automated surveillance of a specific space by optical or audiovisual means […] entails the collection and retention of pictorial or audiovisual information on all persons entering the monitored space which are identifiable on the basis of their appearance or other specific elements ”.
Finally, the Council of State had already considered at the beginning of the year that the ministry’s drone image capture system did indeed constitute the processing of personal data, the State having then been ordered to cease their use without delay. (Council of State, May 18, 2020, n ° 440442 and 440445).
The authority also quickly sweeps away the second argument of the ministry indicating that a blurring system implemented excluded any processing of personal data, in that the CNIL did not find any such device during its control and that in any event, this device is incompatible with the piloting of the drone.
The CNIL’s position is final, the ministry processes personal data by flying its surveillance drones.
The problem is that the processing is not provided for by any legislative or regulatory provision, and more precisely by any decree in the Council of State taken after a reasoned and published opinion from the CNIL in the case of processing of sensitive data since data relating to political opinions and / or religious beliefs can be collected by the drone.
In addition, no impact analysis was carried out and sent to the CNIL before the processing was implemented, and the data subjects were obviously not provided with the information relating to the processing of data concerning them when it was collected. .
The shortcomings noted by the CNIL are numerous and the risks for the rights and freedoms of people are real with regard to the characteristics of the drones which are capable of filming in important resolutions, anywhere and at any time, generally without the knowledge of people who are not aware of their presence. Thus, these recordings can take place in particular during demonstrations, occasions during which political opinions, religious or philosophical convictions, or their trade union membership, are likely to be revealed.
The CNIL then decides to exercise its weak power of sanction against the ministry by issuing a call to order as well as an injunction to bring the treatments concerned into conformity, but above all by making its decision public.
Aware of its impunity, the ministry indicated in its observations to the CNIL that “The injunction to cease the use of drones is not possible, this use now constituting an undeniable operational necessity”.
As the Council of State and the CNIL obviously have no effect on the practices of the Ministry of the Interior, an individual appeal to the European Court of Human Rights for violation of article 8 of the ECHR, could be a game-changer.
Florian Viel, personal data lawyer at Bouchara & Avocats
– .
