CE - 495153

CE - 495153

Court:	CE (France)
Jurisdiction:	France
Relevant Law:	Article 21 GDPR Article R. 253-6 Code de la sécurité intérieure
Decided:	21.06.2024
Published:
Parties:	Veesion CNIL (France)
National Case Number/Name:	495153
European Case Law Identifier:	ECLI:FR:CEORD:2024:495153.20240621
Appeal from:
Appeal to:	Unknown
Original Language(s):	French
Original Source:	Légifrance (in French)
Initial Contributor:	wp

The French Supreme Administrative Court confirmed that the usage of a video surveillance system capable of real-time suspicious behavior detection violated Article 21 GDPR and could not be based on an exemption in national law.

English Summary

Facts

A French company, Veesion created a software for CCTV cameras aimed at detecting suspicious behaviour (gestures) of people. It was based on an algorithmic processing of the images collected by the cameras. The software was popular amongst shops, using it to monitor their commercial premises.

The French DPA (CNIL) found the software violated the GDPR, especially the right to object under Article 21 GDPR, and informed the company of the result of the investigation. Also, the DPA mentioned the company clients had to be informed about the outcome of the investigation.

In response, the company claimed the DPA's legal reasoning was wrong, mostly because the right to object didn’t apply to the processing of data within the system, pursuant to Article R. 253-6 of the Code of Internal Security (Code de la sécurité intérieure). Consequently, the company requested the French Supreme Administrative Court (Conseil d’Etat) to suspend the execution of the letter.

Holding

The court rejected the request as unfounded.

The Veesion software was not covered by Article R. 253-6 of the Code of Internal Security, as it was applicable only to certain category of the CCTV, namely the CCTV related to the national security, protection against threats to public security or their prevention. Hence, it didn't cover an algorithmic processing of the images collected by the cameras, which was the functionality of the software. The court didn’t come across with any other reasons to suspend the execution of the letter or making the software compliant with the provisions of law.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Full text

FRENCH REPUBLIC
IN THE NAME OF THE FRENCH PEOPLE

Having regard to the following procedure:
By a request, registered on 14 June 2024 with the litigation secretariat of the Council of State, the simplified joint-stock company Veesion requests the interim relief judge of the Council of State, ruling on the basis of Article L. 521-1 of the Code of Administrative Justice:

1°) to suspend the execution of the letter of 6 June 2024 by which the President of the National Commission for Information Technology and Civil Liberties (CNIL) informed it that she considered that its software did not comply with the provisions of the General Data Protection Regulation and that she would inform its customers thereof;

2°) to charge the CNIL the sum of 4,000 euros under Article L. 761-1 of the Code of Administrative Justice;

Having regard to the following procedure:
By a request, registered on 14 June 2024 with the litigation secretariat of the Council of State, the simplified joint-stock company Veesion requests the interim relief judge of the Council of State, ruling on the basis of Article L. 521-1 of the Code of Administrative Justice:

1°) to suspend the execution of the letter of 6 June 2024 by which the President of the National Commission for Information Technology and Civil Liberties (CNIL) informed it that she considered that its software did not comply with the provisions of the General Data Protection Regulation and that she would inform its customers;

2°) to charge the CNIL the sum of 4,000 euros under Article L. 761-1 of the Code of Administrative Justice;

Having regard to the other documents in the file;

Having regard to:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016;
- Law No. 2023-380 of 19 May 2023;
- the Internal Security Code;
- the Code of Administrative Justice;

Considering the following:

1. Under the terms of Article L. 521-1 of the Code of Administrative Justice: "When an administrative decision, even a rejection, is the subject of a request for annulment or reformation, the interim relief judge, hearing a request to this effect, may order the suspension of the execution of this decision, or of some of its effects, when the urgency justifies it and a means is provided that is likely to create, at the stage of the investigation, a serious doubt as to the legality of the decision". Pursuant to Article L. 522-3 of the same code, the interim relief judge may, by a reasoned order, dismiss an application without investigation or hearing when the condition of urgency is not met or when it appears clear, in view of the application, that it does not fall within the jurisdiction of the administrative court, that it is inadmissible or that it is unfounded.

2. Following a control procedure relating to the conformity of the processing of personal data necessary for the suspicious gesture detection solution developed and marketed by the company Veesion, in the form of software installed on boxes added to the video surveillance system, the President of the National Commission for Information Technology and Civil Liberties (CNIL) informed the company Veesion of the non-conformity of this suspicious gesture detection solution and of her decision to inform stores equipped with this solution of the non-conformity of the system.

3. In order to request the interim relief judge of the Council of State, ruling on the basis of Article L. 521-1 of the Code of Administrative Justice, to suspend the execution of this letter, the company Veesion maintains that it is a disguised sanction exceeding the powers of the CNIL and that it is tainted by errors of law and errors of assessment with regard to the provisions on the right of opposition of the general regulation on data protection. In particular, it argues that the specificity of the solution it has developed and the entry into force of the provisions of the Internal Security Code relating to video surveillance resulting from the decree of 27 November 2023, in particular those of paragraph V of Article R. 253-6 excluding any right of opposition for the processing of personal data from a video surveillance system, must lead to the CNIL's position of 19 July 2022 on the use of augmented cameras in public spaces being set aside.

4. However, on the one hand, the argument based on the fact that these provisions of the Internal Security Code resulting from the decree of 27 November 2023 would apply to augmented cameras within the meaning of the position of 19 July 2022 and, in particular, to the solution developed by the company Veesion, which constitutes an algorithmic processing of the analysis of images collected by the cameras, is not such as to create serious doubt. On the other hand, if Article 10 of the law of 19 May 2023 provides that "on an experimental basis (...) images collected using video protection systems authorised on the basis of Article L. 252-1 of the Internal Security Code (...) may be subject to algorithmic processing", this is "for the sole purpose of ensuring the security of sporting, recreational or cultural events which, due to the scale of their attendance or their circumstances, are particularly exposed to risks of acts of terrorism or serious attacks on the safety of people", whereas the device developed and marketed by the company Veesion does not pursue such an end. Under these conditions, it is clear that none of the grounds raised in support of this application are such as to create serious doubt as to the legality of the contested letter noting, as the texts stand, the non-compliance of its solution for detecting suspicious gestures.

5. It follows from the above that, without it being necessary to rule on the condition of urgency, the application of the company Veesion can only be dismissed, including its conclusions presented under Article L. 761-1 of the Code of Administrative Justice, according to the procedure provided for in Article L. 522-3 of the same code.

O R D E R S :
------------------
Article 1: The application of the company Veesion is dismissed.
Article 2: This order will be notified to the simplified joint-stock company Veesion.
Done in Paris, June 21, 2024
Signed: Suzanne von Coester

ECLI:FR:CEORD:2024:495153.20240621