The number of cameras installed in French public spaces has increased sharply over the last decade, notably to combat insecurity. Specific specific texts frame the video protection devices which are subject to authorisation by the prefect. What are the rules and what are the rights of people filmed in the public space?
At the heart of the French public space, video protection cameras can be installed for prevention purposes in order to secure people and property within the defined perimeter against the risks of aggression, theft, drug trafficking or terrorist acts.
These devices can also assist the authorities in enforcing and respecting the law. Video cameras can be used to detect traffic offences, regulate transport flows, protect public buildings and installations, protect installations used for national defence, prevent natural or technological risks, facilitate personal assistance, etc.
Who can record ont the street?
In France, only public authorities are allowed to film public roads.
Neither companies nor public institutions may film the public highway. They may simply film the immediate surroundings of their buildings / facilities / property (for example, it is possible to film the facades, but it is forbidden to film the street as such) in places likely to be exposed to acts of terrorism.
Individuals are only allowed to film inside their property. They may not film the street, including to ensure the safety of their vehicle parked in front of their home.
These cameras must not be able to view the interior of residential buildings or, specifically, those at their entrances. Irreversible masking of these areas must be implemented in video protection systems.
Who can view the images?
The implementation of a video protection system must comply with the obligation of data security, which is incumbent on data controllers. Consequently, the viewing of the images can only be carried out by specifically and individually authorised persons (for example: the agents of the urban supervision centre of a municipality), who can view the recorded images. These persons must be particularly trained and made aware of the rules for implementing a video protection system.
Article R.252-11 of the CSI stipulates that the holder of the authorization must keep a register mentioning in particular the recordings made, the date of destruction of the images and, where applicable, the date of their transmission to the public prosecutor’s office.
How long are the images kept?
The storage time of the images must be proportionate and correspond to the purpose for which the video-protection system is installed. As a general rule, a few days are sufficient to carry out checks, e.g. following an incident.
The duration deemed proportionate, in each case, is specified in the prefectoral authorization order, and may not exceed one month (art. L.252-3 of the CSI).
What information is required?
Persons filmed in a public space must be informed of this, by means of signs posted permanently and visibly in the places concerned, and must be comprehensible to all members of the public. They must at least include, in addition to a pictogram representing a camera indicating that the place is under video protection :
- the purposes of the installed treatment ;
- the length of time the images are kept;
- the name or position and telephone number of the data protection officer (DPO);
- the existence of “Data Protection” rights;
- the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), specifying his or her contact details.
In order to ensure that the signs displayed remain legible, all the information that must be made available to the public may be made available by other means, in particular through a website. Such other information shall include, in particular :
- the legal basis of the processing operation ;
- the recipients of the personal data, including those established outside the EU ;
- finally, if any, additional information that should be brought to the attention of the individual (automated decision making, profiling, etc.).
This information is provided for by article 13 of the RGPD and article 104 of the law “Informatique et Libertés”.
With the prefecture of the department
The Internal Security Code stipulates that the installation of a video protection system implies requesting authorisation from the territorially competent prefect (e.g. in Paris, this is the police prefect), an obligation maintained by European texts and the law of 20 June 2018.
Consequently, if the cameras film the public highway (streets), the device must be authorised by the prefect (the prefect of police in Paris) after the opinion of a departmental commission presided over by a magistrate. The authorisation is valid for 5 years and renewable.
The form can be obtained from the departmental prefecture or downloaded from the Ministry of the Interior website. It can also be completed online.
The application for authorisation must be submitted by the authority deciding on the implementation of the scheme, possibly accompanied in this procedure by its technical service provider.
In case of emergency and particular risks of terrorist acts, a provisional authorisation procedure (4 months) is provided for.
This procedure also applies when the authorities are informed of the imminent holding of a large-scale demonstration or gathering presenting particular risks to the safety of persons and property.
Lastly, the prefect may ask a municipality to install a video protection system to prevent acts of terrorism and to protect the surroundings of establishments vital to the country (nuclear power plants, drinking water networks, railway stations, airports, etc.). The municipal council must deliberate within 3 months.
With the CNIL
Carrying out a data protection impact assessment (DPA) is a new obligation under French law, which stems directly from European texts, if a processing operation is likely to create “a high risk for the rights and freedoms of natural persons”.
As soon as the implementation of a videoprotection device leads to the “systematic large-scale surveillance of an area accessible to the public”, a type of processing expressly mentioned in Article 35.1 of the RGPD as likely to present such a high risk, an AIPD must be carried out. In this way, an assessment of the necessity and proportionality of the envisaged measure, in the light of the aims pursued, will be carried out.
If a video protection device does not comply with these rules, you can enter :
The CNIL has the power to ensure that video protection systems are implemented in accordance with the applicable legal framework. It can carry out controls. The Commission’s investigations may relate to the existence and validity of the prefectoral authorization concerning the system, its purpose, its proportionate nature, the methods of information and access rights of the persons filmed, the quality of the personnel authorized to view the images, the measures to ensure the security of the processing (in particular the need to keep a register of consultations), and the length of time the images are kept.
The observation of shortcomings may lead the CNIL to send a formal notice to the organization concerned so that measures can be taken to ensure that the video protection system complies with data protection rules. In particular, in the event of a serious or persistent breach, or a body acting in bad faith, the Commission may also decide to adopt one of the sanctions provided for by the texts (call to order, temporary or definitive limitation of processing, financial penalty, etc.).
- the services of the prefecture;
- the police or gendarmerie services;
- the public prosecutor;
Got any question?
Voir l’article original sur www.cnil.fr