TA Marseille - N°1901249

TA Marseille - N°1901249
Court:	TA Marseille (France)
Jurisdiction:	France
Relevant Law:	Article 4(11) GDPR Article 7 GDPR Article 9(2)(a) GDPR Article 9(2)(g) GDPR Article 6 de la loi du 6 janvier 1978 ("LIL")
Decided:	27. 2.2020
Published:	n/a
Parties:	La Quadrature du Net la Ligue des droits de l’Homme La fédération des conseils des parents d’élèves des écoles publiques des Alpes-Maritimes Le syndicat CGT Educ’Action des Alpes-Maritimes Vs. the Provence-Alpes-Côte d’Azur region (PACA)
National Case Number/Name:	N°1901249
European Case Law Identifier:	n/a
Appeal from:
Appeal to:	Not possible
Original Language(s):	French
Original Source:	La Quadrature du Net (in French)
Initial Contributor:	n/a

The Administrative Tribunal of Marseille annulled the virtual control access system experimentation launched in two high schools because underage’s biometric data were processed without any legal basis.

English Summary

Facts

The Provence-Alpes-Côte d’Azur French region (PACA region) authorized a new virtual control access system experimentation in two high schools. This system used facial recognition technologies and was aimed at controlling and ensuring the security. Four associations challenged the lawfulness of the decision aforementioned before the Administrative judge.

Dispute

The Court had to assess whether the control access system processed the students’ biometric data lawfully.

Holding

The Court upheld the applicants’ arguments by ruling that the decision authorizing the experimentation was unlawful. First, the Court pointed out that the facial recognition system processed underage’s biometric data without a free and informed consent. Hence, the consent was given contrary to Article 9(2)(a), read in the lights of Articles 4 and 7 GDPR. Secondly, the processing purposes mentioned in the disputed decision which were linked to the schools' access and security, could not fall under the scope of Article 9(2)(g) GDPR. Therefore, the Court annulled the regional decision which had authorized the virtual access control system experimentation in the two high schools.

Comment

Add your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the French original for more details.

TRIBUNAL ADMINISTRATIFDE MARSEILLEN° 1901249___________LA QUADRATURE DU NETand others___________Mr. Youssef KhiatRapporteur___________Mr. Pierre-Yves GonneauPublic rapporteur___________Hearing of February 3, 2020Reading of February 27, 2020___________FRENCH REPUBLIC NAME OF THE FRENCH PEOPLEThe Administrative Court of Marseille(9th chamber)26-07-01-02135-04-02-01 

C+Have regard to the following procedure:
By an application, registered on 14 February 2019, the association "La Quadrature du Net" and the Human Rights League, the federation of the councils of parents of pupils of the public schools of the Alpes-Maritimes and the CGT Educ'Action union of the Alpes-Maritimes, represented by Me Alexis Fitzjean O Cobhthaigh, ask the Court:
1°) to annul, on the grounds of misuse of powers, Deliberation No 18-893 of 14 December 2018 by which the Regional Council of Provence-Alpes-Côte d'Azur approved the tripartite agreement for experimentation between the region, the Lycee and Cisco International Limited relating to the implementation of a system of access control by facial comparison and trajectory monitoring, authorised its president to sign that agreement and launched that experimentation in the Ampère (Marseilles) and Les Eucalyptus (Nice) high schools;
2°) to charge the Provence-Alpes-Côte d'Azur region the sum of 1,024 euros under Article L. 761-1 of the Code of Administrative Justice.
They maintain that :
- the contested decision is vitiated by incompetence: as regards security at the entrance to secondary schools, it falls within the competence of the heads of schools alone;
- it is vitiated by a procedural defect in that it authorises the implementation of biometric data processing when no impact study was carried out at the time of its adoption, thereby hindering the proper information of the population and the regional council;
N° 19012492
- it infringes the provisions of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, in that it provides for processing operations involving interference with the right to privacy of data subjects without any legal basis ;
- it disregards the provisions of Articles 5 and 9 of the general data protection regulation since, first, the purposes put forward to justify the processing in question are neither explicit nor legitimate and, second, the data collected are neither adequate nor relevant and are, in any event, manifestly excessive in relation to the purposes for which they are collected and processed.

By a statement of defence, registered on 29 November 2019, the Provence-Alpes-Côte d'Azur region, represented by AARPI Baron, Aidenbaum & associés, acting through Baron, requests the dismissal of the claim and asks that the sum of 2,500 euros be charged to the claimants under Article L. 761-1 of the Code of Administrative Justice.
She submits that :
- the co-secretary general of the CGT Educ'Action des Alpes-Maritimes trade union does not have the right to take legal action on behalf of this organisation;
- the pleas of external legality raised by the applicants are unfounded;
- their means of internal legality are devoid of purpose.

The investigation was closed on 8 January 2020 by an order of the same day, pursuant to the provisions of articles R. 611-11-1 and R. 613-1 of the code of administrative justice.

The parties have been informed, pursuant to the provisions of Article R. The parties were informed, pursuant to the provisions of Article R. 611-7 of the Code of Administrative Justice, that the judgment was likely to be based on the arguments raised ex officio, based on the one hand on the inadmissibility of the request presented by the association "LaQuadrature du Net" in that it does not justify an interest in acting against the deliberation in dispute, and on the other hand,  of the inadmissibility of the conclusions seeking annulment of the decision of the PACA Regional Council of 14 December 2018 in so far as it approves the tripartite experimentation agreement with Cisco International Limited and each of the two high schools and authorises its president to sign them, in so far as those decisions constitute detachable acts which cannot be appealed on the ground of misuse of powers.Having regard to the other documents in the file.

Having regard to:- Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016;- Law No. 78-17 of 6 January 1978;- the Education Code;- the Code of Administrative Justice. The parties were regularly notified of the day of the hearing. The parties were heard during the public hearing:
- Mr Khiat's report,- the conclusions of Mr Gonneau, public rapporteur, 
- the observations of Mr Fitzjean O Cobhthaigh for the applicants and of Mr Baron for the Provence-Alpes-Côte d'Azur region. 

No. 19012493Considering the following:
1. By Deliberation No 13-893 of 14 December 2018, the Regional Council of the Provence-Alpes-Côte d'Azur (PACA) region, firstly, launched the experimentation of the virtual access control system in the "Ampère" (Marseille) and "Les Eucalyptus" (Nice) high schools and, secondly, approved the tripartite experimentation agreement concluded with the company Cisco International Limited and each of the two high schools and authorised its president to sign them. By the present application, the association "La Quadrature du Net", the Ligue des droits de l'Homme, the federation of parents' councils of the public schools of the Alpes-Maritimes and the CGT Educ'Action des Alpes-Maritimes union request that the Court annul this deliberation on the grounds of excess of power.

On the exception of dismissal of the case by the PACA region:
2. By arguing that the pleas of internal legality are devoid of purpose inasmuch as the experimentation could not be implemented for lack of authorisation given by the Commission nationale de l'informatique et des libertés, the PACA region must be regarded as opposing an objection of dismissal to the conclusions of the application.  The mere fact that the experiment was not implemented is not, however, such as to deprive of object the conclusions in excess of power directed against the decision of the PACA Regional Council of 14 December 2018, since that decision was neither repealed nor withdrawn. It follows that the PACA region's objection that there is no need to rule on the case must be dismissed.

On the admissibility of the application :
With regard to the region's objection to the dismissal of the case:
3. Under the terms of article 23 of XI of the statutes of the CGT Educ'Action des Alpes-Maritimes trade union: "The general secretary or, in the event of absence or impossibility, a secretary mandated by the bureau, is authorised to represent the trade union in court and in all acts of civil life. ». The CGT Educ'Action des Alpes-Maritimes trade union does not justify any mandate from its bureau authorising its co-secretary general to go to court on its behalf within the framework of the present proceedings. Under these conditions, the end of non-receipt drawn from the absence of justification of the quality of the co-secretary general to act in the name of the CGT Educ'Action des Alpes-Maritimes trade union must be accepted.

As regards the admissibility of the conclusions seeking the annulment of the disputed deliberation in so far as it approves the tripartite experimentation agreements and authorises the president of the regional council to sign them :
4. Independently of the actions available to the parties to an administrative contract and actions brought before the judge of excess of power against the regulatory clauses of a contract or before the judge of contractual summary proceedings on the basis of Articles L. 551-13 et seq. of the Code of Administrative Justice, any third party to an administrative contract likely to be harmed in its interests in a sufficiently direct and certain manner by its conclusion or its clauses is admissible to bring an action before the contract judge challenging the validity of the contract or of some of its non-regulatory clauses which are divisible from it. The legality of the choice of the contracting party, of the deliberation authorising the conclusion of the contract and of the decision to sign it can only be contested on the occasion of the appeal thus defined. It follows that claims that a third party has exceeded his powers against those acts which are severable from the contract are inadmissible. 
N° 19012494

5. By its decision no. 358994 of April 4, 2014, the Council of State, ruling on the contentious proceedings, ruled that the above-mentioned appeal is only applicable, in accordance with the above-mentioned procedures and regardless of the status of the third party, against contracts signed as of the reading of this same decision.

6. The deliberation of the PACA Regional Council of 14 December 2018 presents the character of a detachable act to the tripartite experimentation agreements concluded between the region, Cisco International Limited and each of the two high schools concerned in that it approves their content and authorises its chairman to sign them. Consequently, the applicants, who are third parties to those administrative contracts concluded after 4 April 2014, could only bring an action before the contract court to challenge the validity of those agreements. It follows that the conclusions seeking annulment of the contested decision are inadmissible in so far as that decision approves the content of the tripartite experimentation agreements concluded between the region, Cisco International Limited and each of the two high schools in question and authorises the President of the PACA Regional Council to sign them.  

On the legality of the PACA Regional Council's decision of 14 December 2018 in that it launches the experimentation of the virtual access control system in the "Ampère" (Marseille) and "Les Eucalyptus" (Nice) high schools:
7. Firstly, under the terms of the second paragraph of Article L. 214-6 of the Education Code, as it stood on the date of the decision in dispute: "The region shall provide reception, catering, accommodation and general and technical maintenance, with the exception of supervision and monitoring of pupils, in the establishments for which it is responsible. ». Furthermore, under the terms of Article R. 421-10 of the same code: "As the representative of the State within the school, the headteacher: / (...) 3° Takes all measures, in liaison with the competent administrative authorities, to ensure the safety of persons and property, hygiene and sanitation of the school; (...)".

8. It emerges from the documents in the file that, through the decision in dispute, the PACA Regional Council has begun testing a system known as virtual access control in the "Ampère" and "Les Eucalyptus" high schools, consisting of the installation of facial recognition gantries at the entrance to these establishments. This experimentation includes, on the one hand, a "biometric access control" component concerning identified persons (high school students) and, on the other hand, a "trajectory tracking" component concerning identified and unidentified persons (occasional visitors). Such an experiment, one of the objectives of which was to strengthen security in schools, was not part of the task of receiving, housing or maintaining secondary schools, but of supervising and monitoring pupils. Moreover, contrary to what it claims, the PACA region did not merely provide the schools in question with facial recognition equipment or even propose the adoption of an experimental facial recognition system, but took the decision itself to initiate this experiment. Consequently, by initiating this experimentation, even though it is part of the supervision and monitoring of pupils who fall within the competence of school principals, the PACA region has exceeded its competence under the aforementioned provisions of Article L. 214-6 of the Education Code, even though the schools selected would have given their consent.  Consequently, the applicants are entitled to submit that the disputed deliberation is vitiated by lack of competence.

9. Secondly, article 6 of the Act of 6 January 1978 provides, in its applicable wording, that: "I.- It is prohibited to process personal data revealing alleged racial or ethnic origin, political opinions, religious beliefs, etc.". 
No. 19012495 or philosophical or trade union membership of a natural person or to process genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning the sexual life or sexual orientation of a natural person. / II- The exceptions to the prohibition mentioned in I are set out in the conditions provided for in Article 9, paragraph 2 of Regulation (EU) 2016/679 of 27 April 2016 and in this Law". These provisions ensure the implementation in national law of those of Article 9 of the general regulation on data protection, which repealed and replaced those of Article 8 (1) of Directive 95/46/EC of 24 October 1995.

10. Under Article 9 of the General Data Protection Regulation, applicable to the processing of biometric data, which includes data collected by facial recognition: "1. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, and the processing of genetic data, biometric data for the purpose of identifying a natural person uniquely, data concerning health or data concerning the sex life or sexual orientation of a natural person are prohibited / 2. Paragraph 1 shall not apply if one of the following conditions is fulfilled: / (a) the data subject has given his explicit consent to the processing of such personal data for one or more specific purposes, except where Union law or the law of the Member State provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject; (.(g) processing is necessary on grounds of substantial public interest on the basis of Union law or the law of a Member State which must be proportionate to the objective pursued, respect the essence of the right to data protection and provide for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject (...)".

11. Article 4(11) of the Data Protection Regulation defines consent as "any freely given specific, specific, informed and unambiguous expression of his or her wishes by which the data subject signifies his or her agreement, by means of a declaration or a clear positive act, to personal data relating to him or her being processed". Furthermore, Article 7 of the same Regulation on the conditions applicable to consent provides: "1. where the processing is based on consent, the controller shall be able to demonstrate that the data subject has given his or her consent to the processing of personal data relating to him or her"; / 2. where the consent of the data subject is given in the context of a written statement which also relates to other matters, the request for consent shall be in a form which clearly distinguishes it from those other matters, in a form which is understandable and easily accessible, and shall be formulated in clear and simple terms. No part of such a statement which constitutes a breach of this Regulation shall be binding / (...) In determining whether consent is given freely, the utmost account should be taken of, inter alia, whether the performance of a contract, including the provision of a service, is conditional upon consent to the processing of personal data which is not necessary for the performance of that contract. ».

12. The documents in the file show that the PACA region has sought to legally justify the processing of biometric data in question by the prior consent of the high school students concerned or, in the case of minors, by that of their legal representatives. However, by limiting itself to stipulating that this consent would be obtained by simply signing a form, when the target public is in a relationship of authority with regard to the heads of the public educational establishments concerned, the region does not justify having provided sufficient guarantees in order to obtain the consent of the high school students or their legal representatives to the collection of their personal data in a free and informed manner.

13. Finally, according to the terms of the decision in question, the purpose of this system is "(...) to provide assistance to the agents in charge of controlling access to the school and reception in order to facilitate and reduce the duration of the checks (for regular users of the site as well as for occasional visitors), to combat identity theft and to detect undesired movements". However, the PACA region neither establishes nor argues that the aims pursued in terms of making checks at the entrance to the high schools concerned more fluid and secure constitute a public interest motive, nor even that these aims could not be achieved in a sufficiently effective manner by badge checks, accompanied, if necessary, by the use of video surveillance. The applicants are therefore entitled to submit that the processing of biometric data instituted by the PACA Region does not meet the requirements laid down in Article 9(a) of the General Data Protection Regulation, as clarified in particular by Articles 4 and 7 thereof, nor does it meet the conditions laid down in Article 9(g) of the same regulation, nor does it fall within any of the exceptions listed in Article 9(2) of the General Data Protection Regulation. They are, therefore, entitled to argue that the contested decision is unlawful under Article 9 of the general data protection regulation.

14.It follows from the foregoing, and without the need to examine the other pleas in the application, that the association "La Quadrature du Net", The Human Rights League and the federation of the councils of parents of pupils in the public schools of the Alpes-Maritimes are entitled to request the cancellation of the deliberation of the regional council of Provence-Alpes-Côte d'Azur of 14 December 2018 in so far as it launched the experimentation of the virtual access control system in the high schools "Ampère" (Marseille) and "Les Eucalyptus" (Nice).On costs not included in the expenses :

15. The PACA region should be made liable for the payment of a total sum of 1,000 euros to the association "La Quadrature du Net", the Human Rights League and the federation of parents' councils of public schools in the Alpes-Maritimes under Article L. 761-1 of the Code of Administrative Justice. On the other hand, these provisions prevent the applicants, who are not the losing party in the proceedings, from paying the PACA region a sum in respect of costs incurred and not included in the costs.

D E C I D E :
Article 1: The deliberation of the Provence-Alpes-Côte d'Azur Regional Council of 14 December 2018 is annulled in so far as it launched the experimentation of the virtual access control system in the "Ampère" (Marseille) and "Les Eucalyptus" (Nice) high schools.
Article 2: The Provence-Alpes-Côte d'Azur region will pay to the association "La Quadrature du Net", the Human Rights League and the federation of parents' councils of public schools in the Alpes-Maritimes a total sum of 1,000 euros under Article L. 761-1 of the Code of Administrative Justice.
Article 3: The remainder of the parties' submissions is rejected.
N° 19012497
Article 4: The present judgment will be notified to the association "La Quadrature du Net", to the League of Human Rights, to the federation of the councils of parents of pupils of the public schools of the Alpes-Maritimes, to the CGT Educ'Action union of the Alpes-Maritimes and to the Provence-Alpes-Côte d'Azur region.

Deliberated after the hearing of 3 February 2020, at which the following sat:Mrs Hogedez, President, Mrs Balussou, First Counsellor, Mr Khiat, Counsellor. Assisted by Mrs Renard-Martinez, Registrar.

Read at a public hearing on 27 February 2020. KhiatThe President,SignedI. HogedezThe clerk,Signed N. Renard-MartinezThe Republic orders and orders the Prefect of the Provence-Alpes-Côte d'Azur region as regards him or any judicial officers to this request as regards the common law remedies against private parties, to provide for the execution of this decision. For dispatch in conformity,The clerk,