Personal data: a decree authorizing the automatic detection of mask wearing in French public transport has been published
05/05/2021Published in the French Official Journal on 11, March 2021, Decree No. 2021-269 authorizes for a year the use of intelligent video to measure mask-wearing rates on public transportation (hereinafter “the Decree”).
The decree begins by recalling that in territories where, in order to address the Covid-19 pandemic, a law or decree requires to wear a protective mask in vehicles or spaces accessible to the public and assigned to public passenger transportation, operators of public passenger transportation services and managers of spaces assigned to such services must ensure compliance with this obligation.
To this end, the decree authorizes them to use intelligent video under the conditions provided for in Article L.252-1 of the French Internal Security[1] Code.
They may thus use intelligent video (i) for statistical evaluation purposes and (ii) to adapt their public information and awareness actions, provided that they comply with the rules on personal data protection.
Thus, the images, collected exclusively by fixed cameras located in vehicles or spaces accessible to the public assigned to public transportation of passengers, must not be stored or transmitted to third parties. They must be instantly transformed into anonymous data. Furthermore, the product of the processing of such images, which will gather all the data from a single subway or train station and cannot be updated in less than twenty minutes, will only provide the number of people detected and the percentage of these people wearing a mask, excluding any other data allowing the classification or re-identification of people.
From the point of view of public transport users, the particularity of this processing will lie in the fact that they will not be able to exercise the rights of access, rectification, opposition and the rights to erasure and restriction provided for in Articles 15, 16, 17 of the GDPR – in accordance with the exception provided for in Article 23-1 of the GDPR.
However, the data controllers will be required to inform them about the main features of the processing and the limitation of their rights.
In any case, UGGC Law Firm and its team specialized in personal data law are at your disposal for any question you may have on this subject.
By the IP/IT team of UGGC Law Firm
Source : Legifrance
[1] Article L. 252-1 of the Code of Internal Security: “The installation of a video protection system under this title is subject to authorization by the representative of the State in the department and, in Paris, by the police prefect, given, except in matters of national defense, after consulting the departmental video protection commission. When the system includes cameras installed on the territory of several departments, the authorization is issued by the representative of the State in the department in which the applicant’s head office is located and, when this head office is located in Paris, by the prefect of police, after the opinion of the departmental video protection commission. The representatives of the State in the departments in which cameras are installed are informed.
Systems installed on the public highway or in places open to the public, whose recordings are used in automated processing or contained in files structured according to criteria that make it possible to identify, directly or indirectly, natural persons, are authorized under the conditions set forth in Law No. 78-17 of January 6, 1978, on information technology, files and freedoms.