La Quadrature du Net – Court Ruling (France, 2020)

The Provence-Alpes-Côte d’Azur French region (PACA region) authorized a new virtual control access system experimentation in two high schools. This system used facial recognition technologies and was aimed at controlling and ensuring the security. Four associations challenged the lawfulness of the decision aforementioned before the Administrative judge. The Court had to assess whether the control access system processed the students’ biometric data lawfully. The Court upheld the applicants’ arguments by ruling that the decision authorizing the experimentation was unlawful. First, the Court pointed out that the facial recognition system processed underage’s biometric data without a free and informed consent. Hence, the consent was given contrary to Article 9(2)(a), read in the lights of Articles 4 and 7 GDPR. Secondly, the purposes of the processing mentioned in the disputed decision which were linked to the schools' access and security, could not fall under the scope of Article 9(2)(g) GDPR. Therefore, the Court annulled the regional decision which had authorized the virtual access control system experimentation in the two high schools.