The French government published a new decree at the end of last week. Paris wants to use intelligent surveillance cameras to check whether the mandatory wearing of mouth masks is complied with in public transport.
However, the French authorities have not yet implemented the new decree published in the Official Gazette. The decree authorizes administrators who use the video security systems to use the system only for the following purposes:
- For the statistical evaluation in accordance with the established obligations.
- For customizing their information and awareness campaigns.
In other words, French public transport companies, such as the SNCF or the RATP, can now use their surveillance cameras to analyze what percentage of their customers wear a face mask on board their vehicles. And if it turns out that the measure is not being complied with enough, they can adjust their information and prevention campaign.
The decree also refers to intelligent cameras. Counting travelers with and without a mouth mask will therefore not be done manually, but via a system equipped with artificial intelligence, in real time. The temporary measure will end in a year.
In France, as in Belgium, wearing a mouth mask is mandatory on public transport. Anyone who does not comply with this law risks a fine of 135 euros.
GDPR not fully respected
According to European privacy legislation, the GDPR, data subjects must be informed of the processing of personal data. The decree indicates that this will also be the case. Travelers are therefore reminded in advance that smart cameras check whether they are wearing their mouth mask.
On the other hand, not all GDPR rules are complied with by the decree. This includes the right of access, rectification and opposition, as well as the right to have data deleted and to restrict processing. In order to get around these articles, the French government refers to another article that allows certain obligations to be limited “if such a restriction is a necessary and proportionate measure in a democratic society”.
In other words: France may set aside certain obligations and rights referred to in the GDPR if, among other things, public safety and public health are safeguarded.
Finally, the decree stipulates that other provisions must be observed in order to comply with the national law on data processing, files and freedoms:
- The images collected (…) will not be stored or passed on to third parties.
- These images will be immediately converted into anonymous data to record the percentage of people who meet the obligation to wear a face mask.
- The result of the processing excludes all other data that would allow the classification or re-identification of persons.
- All data from a single stop or train station can only be updated within a 20 minute period.
Similar systems have already been tested last year in the Parisian metro station Châtelet-les-Halles. The Commission Nationale de l’Informatique et des Libertés Civiles (CNIL) stated at the time that this process was in violation of the right to object to the recording of data in public places, as laid down in the GDPR. The Parisian suburban network RATP put an end to the experiment after just over a month.