The CNIL publishes an article on the use of “smart cameras and thermal cameras”.
Perhaps, to emphasize that the authority mentions that the data collected by the thermal cameras, are medical (personal) data. Whose treatment is prohibited, unless expressly authorized, by Article 9.2 of the RGPD. Furthermore, even if there is a public interest (or a legitimate interest) in such processing of personal data, the rights of the data subjects must be respected. For example, the right of opposition of the persons concerned should be respected. If “the right of opposition cannot be applied in practice, the provisions in question must be specifically authorised by a specific legal framework provided by the European Union or by French law”.
Likewise, the CNIL considers that the vast majority of these types of devices and technologies do not respect the applicable legal framework on data protection.
Full length analysis
In the context of deconfination following the COV-19 epidemic, new so-called “smart” video camera devices are being deployed, especially in public space or places open to the public.
These devices must provide guarantees with respect to GDPR:
– the demonstration of its proportionality;
– a limited life span;
– pseudonymisation or anonymisation measures;
– lack of individual monitoring;
Its uncontrolled development risks spreading a sense of surveillance among citizens, creating a phenomenon of habituation and trivialization of intrusive technologies, and generating greater surveillance, which is likely to undermine the proper functioning of our democratic society.
Public space is, in fact, a place where many individual freedoms are exercised: right to privacy and protection of personal data, freedom to come and go, expression and assembly, right to demonstrate, freedom of conscience and exercise of worship, etc. The preservation of anonymity in public space is an essential dimension for the exercise of these freedoms and capturing the image of people in these spaces undoubtedly entails risks for their rights and fundamental freedoms.
Specific guarantees must be provided.
The use of “smart” cameras is not currently foreseen in any specific text. Organizations that decide to implement this type of device, even on an experimental basis, must have clearly characterized the purposes pursued and the appropriate legal basis for data processing. Necessity and proportionality must be proven
The specific case of thermographic cameras.
The data collected by these devices are processed as personal data. In particular, health data, the processing of which is prohibited by Article 9.2 of the RGPD.
The rights of individuals regarding their personal data must be respected.
This right of objection must be guaranteed by the data controller when it is based on a public interest or his legitimate interest. If the right of opposition cannot be applied in practice, the provisions in question must be specifically authorised by a specific legal framework provided by the European Union or by French law.
Without in any way calling into question the legitimacy of the objective of combating the spread of the epidemic, the CNIL considers it necessary to warn that, subject to a case-by-case analysis, it appears that most of these devices do not comply with the legal framework applicable to the protection of personal data.
When they constitute the automated processing of personal data and fall within the scope of this RGPD, such devices often lead to the processing of sensitive data without the consent of the parties concerned (in particular, temperature) or to the waiver of the right to object. In both cases, these systems must be subject to a specific regulatory framework, which will require the proportionality of the use of these systems and the necessary guarantees to be questioned. For all the reasons explained above, the CNIL calls on the actors to be very careful not to multiply and perpetuate camera surveillance tools in public places or places open to the public, whether it be ”a street, commercial premises or other types of establishments.