ILLEGAL SURVEILLANCE BY DRONES: LESSONS FROM THE JANUARY 2021, FRENCH DATA PROTECTION AUTHORITY’S (CNIL) DECISIONS.

ILLEGAL SURVEILLANCE BY DRONES: LESSONS FROM THE JANUARY 2021, FRENCH DATA PROTECTION AUTHORITY’S (CNIL) DECISIONS.

The use of Unmanned Aerial Vehicles (hereafter “UAVs” or “drones”) equipped with cameras, by French State security forces, in order to monitor the compliance of containment measures, outside any legal framework, has not escaped the control of the CNIL (French Data Protection Authority).
Revisiting the CNIL’s January 12, 2021 decision as well as the incidental decision of the 26th of January 2021: lessons and outlooks.

Following a control procedure initiated in May 2020, the CNIL issued a warning to the French Interior Ministry on the 12th of January “for having carried out flights of camera-enabled drones outside any legal framework”. This decision illustrates, once again, the difficulty of reconciling population surveillance by UAVs with the right to privacy and to protection of personal data.

For all intents and purposes, it should be reminded that UAVs are legally assimilated to “aircraft”, i.e aircrafts capable of rising and circulating in the air. However, they have the particularity of being very stealthy, discreet and able to fly without a pilot on board; they are known as “unmanned“. As early as March 2020, the press revealed that the police and gendarmerie used “unmanned aircraft” equipped with cameras, particularly for monitoring containment measures.

The use of drones intensified during the pandemic. However, these devices had already been used previously, notably for video protection of events (as an example, they were used in 2018 during the evacuation of the Notre-Dame-des-Landes, i.e Nantes new airport project). The Paris police prefecture, the Haute-Garonne gendarmerie and the Cergy-Pontoise police have acknowledged having used UAVs equipped with cameras.

UAVs on the lookout for personal data

On July 9, 2020, the CNIL sent a delegation to the Paris police prefecture to carry out an inspection. It was found that the equipment used was very elaborate .UAVs can fly at an altitude of between 30 and 120 meters and their cameras have a 12 million pixel lens that can magnify the image up to twenty times. The UAVs can therefore records images on which people are easily identifiable. Contrary to what the Ministry of Interior had maintained, the UAVs used therefore make it possible to collect personal data7 within the meaning of Article 4 of the General Data Protection Regulation.

Although the Ministry of the Interior has developed a mechanism for blurring images, this was not implemented from the very beginning of the use of UAVs. Images cannot be directly blurred. With the use of the UAVs, pictures are therefore collected, transmitted and processed with, potentially, identifiable persons.

The CNIL designates the Ministry of the Interior as the controller, responsible for the processing of this data. The CNIL considers that the Ministry of the Interior has failed to comply with several obligations under the French Data Protection Law of 1978 (Loi Informatique et Libertés). Indeed, this law is intended to apply when picture capture by UAV leads to the collection of personal data.

In accordance with articles 87 and 89 of this legal text, a legislative or regulatory framework should have been put in place prior to the Ministry’s use of camera-equipped UAVs.

Moreover, it was considered that the processing operations in question are “likely to present a high risk to the rights and freedoms of data subjects”. This high risk stems from the UAVs inherent technical characteristics. As previously mentioned, UAVs can film in high resolution any person moving in the public space with their knowledge. They can reveal, at least indirectly, such as during demonstrations, people’s political and religious opinions, or even their trade union membership11. Faced with this risk, an impact study on the protection of personal data should have been conducted, as specified in article 90 of the 1978’s law.

The Ministry of the Interior has also failed in its duty to inform individuals. Article 104 of the 1978’s law obliges the data controller to make certain information available to the person concerned, such as the purposes of the processing. Nevertheless, it emerges from the responses provided that no information, meeting the requirements of this article, has been communicates by the Ministry.

The end of surveillance by drones?

Can we go so far as to affirm that this warning by the CNIL marks the end of the use of UAVs by the law enforcement agencies? Nothing is less certain.

This sanction, taken in by the CNIL is in line with decisions of the French State Council of May 18 and December 22, 202012. The use of drones had already been banned, but within the restricted framework of their use by the Paris police headquarters. The CNIL’s decision is broader in scope: it applies to all law enforcement agencies under the authority of the Ministry of the Interior and throughout French territory. Moreover, the injunction is not limited to treatment aimed at monitoring demonstrations or containment measures. It concerns treatment
“Which aims to prevent, detect, investigate and prosecute criminal offences or to protect against threats to public security”

Nevertheless, the CNIL has only a very limited power towards the State, it cannot condemn it to pay a fine14. On the other hand, it can decide to make its sanction public, which is the case here.
A legislative framework could soon be put in place to regulate the use of UAVs, by the Ministry of the Interior. Article 22 of the French Global Security Law has been adopted at first reading in the French National Assembly. Its purpose is it introduce a chapter on “airborne cameras” into the French Internal Security code15. Article L 242-5 of said code authorises the use of UAVs to monitor demonstrations “where circumstances give rise to fears of serious disturbance of public order”.

These provisions could, if finally adopted, serve as legislative framework for the use UAVs. In this respect, the President of the French Senate’s Law Commission sought the CNIL’s opinion on November 30, 2020.

In its decision of January 26, 202116 on a proposal for a law relating to global security, the CNIL deemed that it would be advisable for the legislator to make the use of airborne cameras subject to prior experimentation.
Generally speaking, the CNIL rightly demands additional guarantees to protect personal data when public authorities use camera-equipped UAVs. It specifies that “the framework to be developed for the use of new video devices, in particular UAVs, must ensure that, once their necessity has been proven, any violation of privacy is strictly proportionate to the purposes pursued”.

Beyond this technical discussion, one may think that if the drones used by the public authorities do not currently have a very good “reputation”, we cannot affirm for all that they will certainly disappear from our landscape….

Laurent ARCHAMBAULT aviation and IT Lawyer
He is above all an air enthusiast and a “jack of all trades”: drone, glider, and IFR/VFR aircraft pilot (flatland and mountain). He is also a lawyer who specialises in aviation law and founding director of SELENE Avocats, which is a member of the Council for Civilian Drones (Paris, France) and the European Business Aviation Association (EBAA). In addition, he is a lecturer in aviation law at the IFURTA (Institute for University Training and Air Transport Research at the University of Air-Marseille) and the University of Toulouse (LL.M in Aviation law).