CE - 440442 & 440445

From GDPRhub
CE - 440442 & 440445
Courts logo1.png
Court: CE (France)
Jurisdiction: France
Relevant Law:
DIRECTIVE (EU) 2016/680 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés
Decided: 18.05.2020
Published: 18.05.2020
Parties: La Quadrature du Net
La Ligue des Droits de l'Homme
National Case Number/Name: 440442 & 440445
European Case Law Identifier:
Appeal from: TA Paris
2006861
Appeal to: Not appealed
Original Language(s): French
Original Source: CE (in French)
Initial Contributor: JulesO3

The French Highest Administrative Court (CE) held that the Police Commissionner ('Prefet de Police') had to stop using drones to monitor the respect of sanitary rules in Paris. The CE stated that the use of drone by the government collected personal data without necessary measures of safeguard.

English Summary

Facts

In an appeal against the interim decision of the Administratif court of Paris, la Quadrature du Net and La Ligue des droits de l’homme seized the interim relief judge (référé liberté) to stop police forces to capture and process images of public using drones hovering over Paris streets in respect of sanitary measures justified by the exceptional circumstance of the COVID-19 pandemic.

Dispute

What are the conditions for the use of drones capable of collecting personal data in public spaces for administrative police measures?

Holding

Can drones collect personal data ?

As this decision is an appeal, the first request assessed that drones did not collect personal data since the police guidelines did not authorise it. The CE, for its part, recalled the definition of personal data and relevant laws. The 27 April 2016 directive is applicable in that case, since it concerns « the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security » (Article 1).

Relying on the -wide - definition of personal data outlined in Article 3(1) of the directive, the CE considered that drones were, in fact, capable of collecting such type of data. Indeed, as they are equipped with zoom and can fly at close distance, they are apt to collect personally identifiable information.

Moreover, such collection, transmission of video data to the police force and the video recording, constitute a processing of personal data as outlined in Article 3(2). Thus, the French Loi informatique et Libertés of the 6th January 1978 is applicable.

Minimum requirements under article 31 of 6th of January 1978 law

As processing of personal data by public bodies is at stake, article 31 of the French Loi informatique et Libertés of the 6th January 1978 is applicable. It « requires authorisation by order of the competent minister(s) or by decree, as the case may be, taken after a reasoned opinion has been issued and published by the Commission Nationale de l'Informatique et des Libertés (CNIL) ».

Considering that the use of drones could be contrary to data protection laws and in the absence of any legal framework, it constitute « a serious and manifestly unlawful infringement of the right to privacy ». Therefore, in order to conform, the State must either ensure anonymisation of the data or enact a decree, following a CNIL's approval. In the meantime, the use of drones is prohibited.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

BOARD OF STATE
     ruling

  to litigation



N ° s440442, 440445 FRENCH REPUBLIC
__________


LA QUADRATURE ASSOCIATION
NET
                                                        IN THE NAME OF THE FRENCH PEOPLE
HUMAN RIGHTS LEAGUE
__________

Ordinance of May 18, 2020

                                                            THE REFEREES JUDGE






                             Considering the following procedure:

                             The association "La Quadrature du Net" and the Human Rights League have
             requested from the judge of the administrative tribunal of Paris, ruling on the basis of
             Article L. 521-2 of the Administrative Justice Code, to suspend the execution of the decision of
             prefect of police having instituted since March 18, 2020 a device aiming to capture images
             by drones and operate them in order to enforce containment measures and order the

             prefect of police to cease immediately, from the issuance of the order to intervene,
             to capture images by drones, to record them, to transmit them or to use them, then to
             destroy any image already captured in this context, under penalty of 1,024 euros per day of
             delay.

                             By order n ° 2006861 of May 5, 2020, the summary judge of the court
             Paris administration rejected their request.


                             1 ° Under n ° 440442, by an application and a memorandum in reply, registered
             on May 6 and 14, 2020 at the Litigation Secretariat of the Council of State, the association
             "La Quadrature du Net" asks the summary proceedings judge of the Council of State, ruling on the
             basis of Article L. 521-2 of the Code of Administrative Justice:

                             1) to cancel this order;


                             2) to grant its first instance requests;

                             3) to charge the State with the sum of 4,096 euros under Article
             L. 761-1 of the administrative justice code.

                             She maintains that:

                             - the contested order is vitiated by an error of law in that it
             makes the characterization of an infringement of the right to privacy subject to the condition that the
             device in question characterizes a processing of personal data; s
No. 440442, 440445 2

                                   - it is vitiated by an error of fact and an error of law in that it
                maintains that the prefect of police cannot be regarded as having carried out a treatment of
                personal data while it was apparent from its own findings that the characteristics

                techniques of the drones in question allow the identification of an individual;
                                   - it is vitiated by a procedural flaw when a
                illegal application of Article 9 of Ordinance No. 2020- 305 of March 25, 2020 on
                adaptation of the rules applicable before administrative courts;
                                   - the condition of urgency is met taking into account the seriousness and nature
                manifestly illegal infringement by the prefecture of the right to respect for private life and
                the right to protection of personal data in the use of dr ones, under the circumstances

                that this device is currently in progress and because it was not physically possible to
                request an emergency measure sooner as this practice was not revealed until April 25
                2020;
                                   - the use of drones flying over public space, outside any legal framework,
                associated with an image capture device, constitutes processing of personal data
                unlawful personnel and, at the very least, serious and manifestly unlawful interference with

                the exercise of the right to respect for private life and the right to data protection
                personal;
                                   - the absence of any explicit administrative act specifically framing the
                device in question violates Article 8 of the European Convention for the Protection of Human Rights
                man and fundamental freedoms, section I of article 31 of the Data Protection Act and
                Article 6 (3) of the General Data Protection Regulation;
                                   - the lack of data retention period seriously violates and

                obviously Article 8 of the European Convention for the Protection of Human Rights and
                fundamental freedoms, Article 5 of the General Data Protection Regulation,
                Article 4 of the Police-Justice Directive and Articles 4 and 87 of the Data Protection Act;
                                   - the lack of information of the persons concerned seriously violates and
                obviously Article 8 of the European Convention for the Protection of Human Rights and
                fundamental freedoms, Article 14 of the General Data Protection Regulation,
                Article 13 of the Police-Justice Directive and Articles 48 and 104 of the Data Protection Act;

                                   - the lack of organizational guarantee seriously and clearly violates
                Article 8 of the European Convention for the Protection of Human Rights and Freedoms
                fundamental, Article 25 of the General Data Protection Regulation and Article 20 of
                the police-justice directive;
                                   - the lack of proportionality of the device with regard to the purposes pursued
                disregards the general rules relating to the right to private life and the rules governing
                processing of personal data;

                                   - the prefect of police was incompetent to adopt the device in question.



                                   2 ° Under n ° 440445, by a request, registered on May 7, 2020 at the secretariat
                litigation before the Council of State, the League of Human Rights asks the judge for summary proceedings
                Council of State, ruling on the basis of Article L. 521-2 of the Code of Administrative Justice:

                                   1) to cancel this order;

                                   2) to grant its first instance requests;


                                   3) to charge the State for the sum of 4,000 euros under Article
                L. 761-1 of the administrative justice code No. 440442, 440445 3


                                  She maintains that:

                                  - the condition of urgency is fulfilled when the contested measure, which has
                was revealed by the press that on April 25, 2020 and should continue after deconfinement, has
                intended to cause sufficiently serious and immediate prejudice to a public interest, to its
                situation as well as the interests it intends to defend and causes serious, illegal harm,
                unjustified and disproportionate to fundamental freedoms;

                                  - the decision of the prefect of police seriously and clearly
                illegal to the right to respect for private and family life, to the right to data protection
                personal and the freedom to come and go;

                                  - the contested order is vitiated by an error of law and a distortion
                of the facts of the case in so far as it concludes that there was no such infringement.

                                                                                                s
                                  By a defense common to applications nos. 440442 and 440445,
                registered on May 13, 2020, the Minister of the Interior concluded that the requests were rejected. He maintains that
                the plea alleging that the contested order was made at the end of a procedure
                irregularity is ineffective and, in any event, ill-founded, that the request for
                suspension of the execution of the decision of the prefect of police having instituted a system aimed at
                capture images by drones and use them in order to ensure compliance with the

                confinement is deprived of purpose, that the emergency condition has not been met and that the device
                contested does not seriously and clearly illegal infringe a fundamental freedom.


                                  Both requests were communicated to the Prime Minister who did not
                product of observations.


                                  Having regard to the other documents in the file;

                                  Seen:
                                  - the Constitution, in particular its Preamble;
                                  - the European convention for the protection of human rights and freedoms
                fundamental;

                                  - the Charter of Fundamental Rights of the European Union;
                                  - Directive No. 2016/680 of April 27, 2016;
                                  - Law n ° 78-17 of January 6, 1978 as amended;
                                  - Law n ° 2020-290 of March 23, 2020;

                                  - Law n ° 2020-546 of May 11, 2020;
                                  - Decree No. 2020-545 of May 11, 2020;
                                  - Decree No. 2020-548 of May 11, 2020;

                                  - the code of administrative justice;


                                  After summoning to a public hearing, on the one hand, the association "La
                Quadrature du Net "and the League of Human Rights and, on the other hand, the Prime Minister and the

                Minister of the Interior ;

                                  Were heard during the public hearing on May 15, 2020 at 10 a.m .: s
No. 440442, 440445 4

                                  - Me Rameix, lawyer at the Council of State and at the Court of Cassation, lawyer for
               the association "La Quadrature du Net";


                                  - Me Spinosi, lawyer at the Council of State and at the Court of Cassation, lawyer for the
               League for Human Rights;

                                  - the representative of the association "La Quadrature du Net";

                                  - the representative of the League of Human Rights;


                                  - representatives of the Minister of the Interior;

                                  and at the end of which the investigation was closed;



                                  Considering the following:

                                  1. Article L. 511 -1 of the Administrative Justice Code provides that: "The judge

               summary proceedings rule by measures which are of a provisional nature. It is not before
               principal and is delivered as soon as possible. "Under Article L. 521-2 of the same
               code: "When seized of a request to this effect justified by urgency, the summary judge may order
               all measures necessary to safeguard a fundamental freedom to which a person

               public law legal entity or a private law body responsible for the management of a public service
               would have caused serious and manifestly unlawful interference in the exercise of one of his powers.
               The summary judge makes a decision within forty-eight hours. ".


                                  On the circumstances:


                                  2. The emergence of a new coronavirus (covid-19), pathogenic and
               particularly contagious and its spread on French territory led the Minister of
               solidarity and health to be taken, by several decrees from March 4, 2020, measures
               on the basis of the provisions of Article L. 3131-1 of the Public Health Code. In
               in particular, by a decree of March 14, 2020, a large number of establishments open to the public

               were closed to the public, gatherings of more than 100 people were banned and
               the reception of children, pupils and students in establishments receiving them and establishments
               schools and universities was suspended. Then, by a decree of March 16, 2020 motivated by the
               exceptional circumstances arising from the covid -19 epidemic, amended by decree of
               March 19, the Prime Minister banned the movement of anyone outside their home,
               subject to the exhaustively listed exceptions which must be duly justified, from
               from March 17 at 12 noon, without prejudice to more stringent measures that may be ordered by the

               state representative in the department. The Minister of Solidarity and Health has taken
               additional measures by several successive decrees.

                                  3. By article 4 of the law of 23 March 2020 emergency to deal with

               the covid -19 epidemic, was declared a state of health emergency for a period of two months on
               the entire national territory. By a new decree of March 23, 2020 taken on the basis
               of article L. 3131-15 of the public health code resulting from the law of 23 March 2020, several times
               amended and supplemented since then, the Prime Minister reiterated the measures previously s
No. 440442, 440445 5

               ordered while providing them with additional details or restrictions. Their effects have
               were last extended by decree of April 14, 2020. By a new decree of May 11, 2020,
               applicable on 11 and 12 May 2020, the Prime Minister modified the measures previously

               ordered by the decree of March 23, 2020. Finally, by a decree of May 11, 2020, taken on
               basis of the law of 11 May 2020 extending the state of health emergency and supplementing its
               provisions, the Prime Minister prescribed the new general measures necessary to make
               in the face of the covid-19 epidemic in the context of the state of health emergency.


                                  On the legal framework of the dispute, the office of the summary judge and freedoms
               fundamentals involved:


                                  4. In the current period of health emergency, it is up to the
               various competent authorities to take, in order to safeguard the health of the population,
               any measures likely to prevent or limit the effects of the epidemic. These measures, which

               may limit the exercise of fundamental rights and freedoms must, to this extent, be
               necessary, adapted and proportionate to the objective of safeguarding public health that they
               continue.


                                  5. It results from the combination of the provisions of Articles L. 511-1 and L. 521-2
               of the administrative justice code that belongs to the summary judge, when seized on the
               basis of Article L. 521 -2 and that it finds a serious and clearly illegal
               brought by a legal person of public law to a fundamental freedom, resulting from the action
               or the failure of this public person, to prescribe the measures which are likely to
               disappear the effects of this attack, when there is a characterized emergency

               justifying the pronouncement of my safeguard measures at a very short notice. These measures must, in
               principle, be provisional, except when no such measure is
               capable of safeguarding the effective exercise of the fundamental freedom to which it is brought
               reached. On the basis of Article L. 521-2, the summary judge may order the authority
               competent to take, on a provisional basis, organizational measures for the services placed under
               its authority, when it comes to emergency measures which appear necessary to
               safeguard, in a very short time, the fundamental freedom to which it is gravely, and in a manner

               clearly illegal, infringed. The manifestly illegal nature of the infringement must
               assess themselves in particular by taking into account the means available to the administrative authority
               competent authority and the actions it has already taken.


                                  6. For the application of Article L. 521 -2 of the Administrative Justice Code, the
               right to respect for private life which includes the right to the protection of personal data and
               the freedom to come and go constitute fundamental freedoms within the meaning of the provisions of this
               article.


                                  On the request for interim relief:


                                  7. "La Quadrature du Net" and the League of Human Rights seized, the
               May 2, 2020, the summary judge of the Paris administrative court, on the basis of article
               L. 521-2 of the code of administrative justice, of a request that he be ordered to
               prefect of police to stop using the device aimed at capturing images by drones,
               record, transmit and use them for the purpose of enforcing containment measures
               in force in Paris during the period of health emergency. By two requests that it takes
No. 440442, 440445 6

               to join, they are subject to an appeal against the order of May 5, 2020 by which the summary judge
               rejected their requests on the grounds that there was no serious and clearly illegal interference
               to the fundamental freedoms invoked.


                                  8. It results from the instruction, in particular from the technical sheet of the management
               of public order and traffic (DOPC) of the police headquarters dated May 14, 2020

               relating to the modalities of engagement of drones when monitoring compliance with
               covid-19 confinement in Paris which has been poured into adversarial debate as well as elements
               exchanged during the public hearing, that the air resources unit of the prefecture of
               police was engaged to monitor compliance with
               containment in place from March 17, 2020. Since March 18, 2020, a drone
               the fleet of fifteen devices in the police headquarters was thus used
               daily to carry out this administrative police mission. It is common ground that

               the prefecture of police continues to use these surveillance and control measures in the
               framework of the deconfinement plan implemented from May 11, 2020. It follows that the
               conclusions of the requesting associations which tend to order the prefect of police
               to cease resorting to such measures have retained their purpose.


                                  Regarding the emergency condition:


                                  9. Having regard, on the one hand, to the number of persons likely to be subject to it
               and, on the other hand, to their effects, the frequency and repetition of monitoring measures
               litigious create an emergency situation within the meaning of Article L. 521-2 of the Justice Code
               administrative.


                                  Regarding the serious and manifestly illegal infringement of freedoms
               fundamental invoked:


                                  10. It results from the instruction, in particular from the sheet cited in point 8 and from
               elements exchanged during the public hearing, that all flights are carried out at
               from the four D.JJtype Mavic Enterprise cameras, equipped with an optical zoom
               X 3 and a loudspeaker. Only one drone is used at a time. He does not film continuously
               but only two to three hours on average per day. The implementation of this device

               monitoring is based on the simultaneous mobilization of an on-site team and staff located
               at the information and command center of the police headquarters. The first is
               composed of three people, the remote pilot in charge of handling the drone, an assistant remote pilot and
               an officer responsible for their protection. The remote pilot guides the aircraft from his
               own video screen or by performing a visual flight to access the site where the operator has
               requested, from the command room, the flyby. When the drone flies over the designated site,
               the remote pilot retransmits images in real time to the command center

               so that the operator there can, if necessary, decide what to do. he can
               also be decided to use the loudspeaker fitted to the device in order to broadcast
               messages for people on the site.


                                  11. It follows from the investigation that the use of these surveillance measures is
               only intended, in the state of the doctrine of use as it has been formalized by the sheet of
               May 14, 2020 and reaffirmed at the public hearing by representatives of the State, to be given to
               law enforcement agencies responsible for effectively enforcing health safety rules
No. 440442, 440445 7

                general appearance of the crowds in the Parisian territory by helping to detect, on
                determined sectors exclusively located on the road or in public spaces,
                gatherings of the public contrary to the restrictive measures in force during the period

                of deconfinement. The purpose of the disputed device is not to find the
                offenses or to identify their perpetrator but to inform the staff of the prefecture of
                police so that a decision can be taken, in good time, to deploy an intervention unit on
                place responsible for dispersing the gathering in question or evacuating the premises
                closed to the public in order to put an end to or prevent the public disorder caused by
                ignorance of health safety rules.


                                  12. It also follows from the investigation that in the state of current practice
                formalized by the note of May 14, 2020, flights are carried out at a height of 80 to 100 meters
                so as to give a general appearance of the monitored area, which is filmed using a

                wide angle without activating the zoom which is equipped with each device. In addition, as part of
                This customary doctrine, drones are no longer equipped with a memory card so that it is
                made no recording or image retention.


                                  13. First, as described in point 11, the purpose pursued
                by the disputed device, which is, in particular in the present circumstances, necessary for
                public safety is legitimate.


                                  14. Second, it is common ground that use of the monitoring device
                by drone carried out in accordance with the employment policy set by the note of May 14, 2020 is
                not of such a nature as to cause, by itself, a serious and manifestly illegal interference with freedoms
                fundamental invoked.


                                  15. Thirdly, having lost sight of the purpose it pursues, the
                litigious surveillance falls within the material scope of the directive of April 27, 2016
                on the protection of individuals with regard to the processing of personal data
                personnel by the competent authorities for the purpose of preventing and detecting infringements

                criminal proceedings, investigations and prosecutions in the matter or the execution of criminal sanctions, and the
                free movement of these data, and repealing Council Framework Decision 2008/977 / JHA of which
                Article 1 provides that it applies to the processing of personal data instituted
                "Including [for] the protection against threats to public safety and the prevention of
                such threats ”.


                                  16. On the one hand, Article 3 of the Directive of 27 April 2016 defines, in point 1,
                personal data such as "any information relating to a person
                identified or identifiable person "and specifies that he is deemed to be a" natural person
                identifiable "" a natural person who can be identified, directly or indirectly,

                in particular by reference to an identifier, such as a name, an identification number, data
                location, an online identifier, or one or more specific elements specific to its
                physical, physiological, genetic, psychic, economic, cultural or social identity ”.
                Even though it is argued that the data collected by the drones used by the prefecture
                police do not have a personal character since, on the one hand, the use which is made of
                these devices, as provided for in the note of May 14, 2020, do not lead, in practice, to
                the identification of the people filmed and, on the other hand, in the absence of any preservation

                images, real-time viewing of the people filmed is in any case an obstacle to
                that they can be identified, it follows from the instruction that the devices in question which are
No. 440442, 440445 8

                equipped with an optical zoom and which can fly at a distance less than that fixed by the note
                of May 14, 2020 are likely to collect identifying data and do not include any
                technical device such as to avoid, in all cases, that the information collected can

                lead, for the benefit of a use other than that currently practiced, to make people
                to which they relate identifiable. Under these conditions, the data likely to be
                collected by the processing at issue must be regarded as of a
                staff.


                                   17. On the other hand, article 3 of the directive of April 27, 2016 defines, in its point
                2, a treatment such as "any transaction or any set of transactions carried out or not at
                using automated processes applied to personal data or data
                sets of personal data, such as collection, recording,
                organization, structuring, conservation, adaptation or modification, extraction,

                consultation, use, communication by transmission, dissemination or any other form
                provision, reconciliation or interconnection, limitation, erasure or
                destruction ”. It follows from these provisions that the disputed monitoring arrangement described in
                points 10 to 12 which consists in collecting data, thanks to the capture of images by drone, to
                transmit, in certain cases, to the command center of the prefecture of police for a
                real-time viewing and use them for carrying out administrative police missions
                constitutes processing within the meaning of this directive.


                                   18. It follows that the disputed device constitutes processing of data to
                personal character which falls within the scope of the directive of April 27, 2016. This

                processing, which is carried out on behalf of the State, therefore falls under the provisions of the
                Law of January 6, 1978 relating to data processing, files and freedoms which are applicable
                to processing within the scope of this directive, including Article
                31 imposes an authorization by decree of the competent minister or ministers or by decree, as the case may be,
                taken after a reasoned and published opinion of the National Commission for Informatics and Freedoms
                (CNIL). Taking into account the risks of use contrary to data protection rules
                personal data it involves, the implementation, on behalf of the State, of this processing of

                personal data without the prior intervention of a regulatory text by authorizing
                the creation and setting the terms of use that must be respected as well as
                the guarantees with which it must be surrounded characterize a serious and manifestly unlawful
                right to respect for private life.


                                   19. It follows from the foregoing that the State should be ordered to cease,
                from the notification of this Ordinance, to carry out surveillance measures
                by drone, compliance in Paris with the health safety rules applicable to the period of
                deconfinement as long as the breach characterized in the previous point has not been remedied, either
                by the intervention of a regulatory text, taken after consulting the CNIL, authorizing, in compliance

                the provisions of the law of 6 January 1978 applicable to processing within the scope
                of application of the directive of April 27, 2016, the creation of a processing of personal data
                personnel, or by equipping the devices used by the police prefecture with technical devices
                such as to make it impossible, whatever the uses retained, the identification of
                people filmed.

                                   20. The association "La Quadrature du Net" and the Human Rights League
                are therefore justified in maintaining that it is wrong that, by the order they are attacking, the judge of
                summary proceedings of the Paris administrative court rejected their requests. It is necessary, under the circumstances No. 440442, 440445 9

                in this case, to charge the State with the sum of 3,000 euros to be paid to each of the

                applicants under Article L. 761-1 of the Code of Administrative Justice.



                                                          O R D O N N E:
                                                           ------------------

                Article 1: The order of the summary judge of the Paris administrative court of May 5, 2020

                is canceled.

                Article 2: In accordance with the reasons for this ordinance, the State is ordered to cease,
                without delay, to carry out surveillance measures by drone, to respect, in Paris, the rules of
                health security applicable to the deconfinement period.


                Article 3: The State will pay the association "La Quadrature du Net" and the League of Rights of
                the man each the sum of 3,000 euros under Article L. 761 -1 of the Code of Justice
                administrative.

                Article 4: This ordinance will be notified to the association "La Quadrature du Net", at the

                League for Human Rights and the Home Secretary.
                A copy will be sent to the Prime Minister.