French national police forces have been using AI-driven surveillance cameras on a national scale since 2015 without a valid legal basis. It is not yet known for what purposes and in what ways this technology is being used. What is clear is that it is being done on a large scale across the country. There is strong suspicion that multiple violations of privacy laws have been committed.
This is according to an investigation by Disclose, a French research platform that accessed internal documents from the French Ministry of the Interior (1). The documents show that French enforcement agencies have built a large-scale surveillance apparatus using video surveillance technology provided by Briefcam, an Israeli software manufacturer. The video software allows people to be tracked based on various characteristics, such as their clothing and car make. On its website, Briefcam states that facial recognition is also a part of their surveillance software (2).
Facial recognition is banned in France, with very limited exceptions in the context of judicial and administrative investigations. This ban remains in place even after the introduction of a law allowing temporary algorithmic surveillance ahead of the Paris Olympics next year. (3). Nevertheless, Disclose indicates based on reliable sources that national police forces continue to actively use this technology.
Briefcam's sales director for Europe cannot explain in what way and for what specific purposes its software is used. Nevertheless, he indicated to investigators that his company supports the police forces of more than a hundred French municipalities, as well as private organizations such as theme parks. Such large-scale use for general surveillance purposes without judicial intervention would seriously violate both European and French law, Philippe Latombe, a member of the French House of Representatives, told news organization EURACTIV (4). According to Latombe, that is not officially the case at the moment, but the findings of the investigation cast doubt on the actual use of the software.
For such large-scale processing activities, especially with new technology, European legislation (Directive 2016/680) requires national enforcement agencies to conduct a Data Protection Impact Assessment (5). This was not done by the French Ministry of Interior. Internal documents, accessed by Disclose, confirm that the national police agency never notified the application of Briefcam to the French privacy regulator, CNIL, as is required under the same law.
The CNIL appears surprised by the outcome of the investigation, considering it "does not have the relevant information to deny or confirm that the French national police are using Briefcam."
Meanwhile, the European Parliament (EP), the Council of Ministers and the European Commission are discussing the adoption of the AI Act (6). The use of AI-driven facial recognition by enforcement authorities is currently the subject of major discussion between the Council and the EP, as EURACTIV previously reported. The EP has been advocating a complete ban on such applications since the beginning. In the most recent compromise proposal, the Council presidency relaxed the ban in exchange for stricter regulation in other areas, such as foundational models and generative AI. This week, the three EU bodies are continuing negotiations behind closed doors.
https://disclose.ngo/fr/article/la-police-nationale-utilise-illegalement-un-logiciel-israelien-de-reconnaissance-faciale;
https://www.legifrance.gouv.fr/jorf/article_jo/JORFARTI000047561989;
https://www.legifrance.gouv.fr/jorf/article_jo/JORFARTI000047561989;
https://www.euractiv.com/section/data-privacy/news/french-police-accused-of-using-facial-recognition-software-illegally/;
https://eur-lex.europa.eu/legal-content/NL/TXT/PDF/?uri=CELEX:32016L0680;
https://privacy-web.nl/nieuws/onderhandelingen-rondom-ai-act-lopen-vast/.
