DPA case Délibération 2023-076 – Violation Found (France, 2023)

The Minister of Interior (the controller) requested the French DPA for an opinion on a draft decree made pursuant to Act No. 2023-380 of 19 May 2023. Article 10 of this Act establishes a framework for the development and implementation of a system of algorithmic processing of images collected by aerial video surveillance, to be used during the 2024 Olympic Games for the purpose of identifying terrorism risks. The controller sought to rely on Article 6(1)(e) GDPR (public interest) as a legal basis for the processing, which to be lawful must be regulated either by Union law or Member State law to which the controller is subject (Article 6(3) GDPR). In the present case, Act No. 2023-380 of 19 May 2023 is the domestic law which regulates the processing, pursuant to the requirements of Article 6(3) GDPR. Article 10 of Act No. 2023-380 provides that for the processing to be lawful, it first must be authorised by a decree made after obtaining the opinion of the French DPA (CNIL). In pursuit of this, the Ministry of Interior conducted a data protection impact assessment (DPIA) as required by Article 35 GDPR and submitted it alongside the draft decree to the French DPA for approval as necessitated by Article 36 GDPR. The CNIL issued a favourable opinion on the draft decree and accompanying data protection impact assessment made pursuant to Act No. 2023-380 of 19 May 2023. The CNIL approved the use of algorithmic processing of images collected by aerial video surveillance as the measures outlined by the controller were deemed to sufficiently mitigate the risks that could arise from the high-risk processing. The controller exhaustively listed in the draft decree and DPIA, the predetermined events which the algorithmic processing was permitted to detect. The system was designed to mainly detect abandoned objects and only detect persons in the instance of a disruptive event through a disturbance of the premises, it was not permitted to detect and process images of persons wh