Many technologies have been tested in France since the beginning of the COVID-19 crisis.
Among them, the French police – notably in Paris – have deployed surveillance drones to capture images to help them enforce the lockdown measures. Despite the lockdown being eased, the police continue to use drones to check that social-distancing rules are being observed.
In early May, two associations that promote and defend human rights and fundamental freedoms in the digital environment asked the Paris administrative court to order the city's police to stop using the drones. After the court rejected their request, the associations appealed the decision to the Council of State, the highest administrative court in France.
In an interim order issued on 18 May 2020, the Council of State ordered the government 'to cease, without delay, the carrying out of surveillance measures using drones to monitor compliance, in Paris, with the health security rules applicable during the ease of confinement period'.
While the Council of State permitted the Paris police to continue using the drones to help them locate and disperse unlawful gatherings the drones should not, in the current legal framework, be used to identify individuals who have breached the social-distancing rules.
In its judgment, the Council of State confirmed as legitimate the current Paris police practice of flying drones at a height of 80 to 100 metres to give a general overview of the area under surveillance without activating the zoom that each drone is equipped with and not equipping drones with a memory card, so that no data storage is carried out.
However, the Council of State considered that, since the drones are equipped with a zoom and can fly lower than is current police practice, the drones can still collect data that can identify an individual.
In addition, it specified that:
- such drones do not have any technical device capable of preventing the information collected from being used to identify an individual; and
- that, from a legal point of view, it is irrelevant that the police do not currently make use of the drones’ identification capabilities.
For this reason, the Council of State decided that the data likely to be collected by the drones must be regarded as personal data. It therefore follows that monitoring by drone amounts to the processing of personal data, which falls within the scope of French and EU data protection regulations – both the EU general data protection regulation (GDPR) and the 2016 directive on the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences carried out on behalf of the state.
On this basis, the Council of State ruled that, in order for the use of surveillance drones by the Paris police to be legal, one of the following was required:
- further to article 31 of the French data protection law (Loi Informatique et Libertés), an authorisation by order of the competent minister (or by decree) issued after an opinion by the French data protection authority (the CNIL); or
- having the drones fitted with technical devices that make it impossible, independently of the use made of these drones, to identify the persons filmed (so that the use of drones would not amount to the processing of personal data).
In a press release issued a few hours after the publication of the Council of State's judgement, the CNIL announced that it had started carrying out checks with the Ministry of the Interior concerning the use of drones in several cities in mid-April. Its ongoing investigations cover both the current situation and what happened during the lockdown period. The CNIL stated that it would take a position on this issue at the end of the ongoing control procedures.
The Council of State decision is likely to more generally impact the use of drones for security purposes during events such as demonstrations (eg 'Nuit Debout') or major sporting tournaments (eg the 2016 European football championships).
Technical solutions may have to be developed to prevent the possibility of identifying the persons filmed, although this may be difficult to implement in practice, unless a specific regulation is enacted.
