2024 Olympics: CNIL's Q&A on your privacy and freedoms

The French Law relating to the 2024 Olympic and Paralympic Games provides for the establishment of various files to:

• the mobilization of police officers and volunteers;
• athlete accreditations and results, and accreditation of accompanying persons;
• security and ticketing for spectators.

A number of special systems will also be used, including :

• augmented cameras based, in part, on CCTV cameras already deployed: this is a temporary experiment authorized by the law of May 19, 2023 relating to the 2024 Olympic and Paralympic Games, on which the CNIL has issued an opinion (see the question "Will these devices be maintained after the Olympic Games?").
   
• in order to access certain areas in Paris and the surrounding departements, a pass containing a QR Code will be mandatory. This system has been authorized by a decree issued by the Minister of the Interior, on which the CNIL has also issued an opinion.
   
• ticketing is based on the collection of personal data: your identity may be verified in this context.

What are "augmented" cameras and what are they used for?

The term "augmented" camera refers to video devices with associated software for automatic image analysis (algorithmic processing).

In practice, these automated image analysis software programs, which are coupled with CCTV cameras authorized by prefectural decree, can detect or "recognize" specific objects, behaviors or events.

In concrete terms, eight events can be detected:

• the presence of abandoned objects;
• the presence or use of weapons;
• the failure of a person or vehicle to follow the common direction of traffic;
• the crossing or presence of a person or vehicle in a prohibited or sensitive area;
• the presence of a person on the ground following a fall;
• a crowd movement;
• too high a density of people;
• a start of fire.

These "augmented" camera systems can only be used to ensure the security of large-scale events (such as the opening ceremony), which are particularly exposed to the risk of acts of terrorism or serious threats to personal safety.

In concrete terms, these devices can only be used at the event venue, in the vicinity of the event and on the transport serving it, i.e. on fixed cameras already present on the streets, in SNCF stations or within RATP facilities (subway trains, regional trains), but also on drones.

Please note:

• The systems enable the situations listed above to be reported to authorized agents, who check the alerts to validate them or not. They then decide what action to take and, in particular, whether it is necessary to call in the appropriate services.
  
  The events detected are therefore always subject to human analysis before any action is taken. You cannot therefore be the subject of any individual decision or be prosecuted solely on the basis of these algorithmic processes. Furthermore, no cross-referencing with other files is possible.
   
• The data collected by the "augmented" cameras for the design of the software algorithm will be kept for a maximum of one year after recording (or until the end of the experiment if it ends earlier). Among other things, this may enable the devices to improve the quality of detection of predetermined events. Recordings of alerts are also kept for a period of one year during camera deployment.

Is facial recognition planned?

No.

As requested by the CNIL, the devices to be used during the Olympic Games will not incorporate facial recognition. The law explicitly excludes the use of any biometric identification system or facial recognition technique.

The CNIL considers that facial recognition systems carry significant risks, such as :

• the potential for unprecedented surveillance and the risk of undermining anonymity in the public sphere;
• the unique identification of individuals via particularly sensitive and permanent data (face);
• a fallible and biased technology (error rates can vary according to gender or skin color, for example)

• Augmented cameras in public spaces: CNIL's position (in French)
• Facial recognition: for a debate living up to the challenges

Will these "augmented" camera devices be maintained after the Olympic Games?

Yes, but only temporarily.

The French 2024 Olympics Act sets up an experiment that ends on March 31, 2025. The systems can no longer be used after this date, and can only be extended by a new law.

In this respect, as it did throughout the discussions on the Olympics Law, the CNIL calls for a democratic debate on the subject.

Please note: this experiment does not only concern the Olympic and Paralympic Games, but also other sporting, recreational and cultural events (concerts, matches).

How is the CNIL supervising experiments with these "augmented" cameras?

CNIL's role is to support and supervise experiments with these systems, notably by reminding organizations of their obligations to comply with regulations.

It provided upstream support to around ten companies supplying algorithmic devices for the Ministry of the Interior's call for tenders. It provided them with initial feedback on the legal and technical analysis of the solutions proposed in July 2023. The CNIL is also helping to ensure the compliance of operators implementing these systems.

It also attended the first real-life test organized by the Paris Police Prefecture during the Depeche Mode concert at the Accor Arena in Paris on March 5, 2024: the device was thus able to check crowd density, detect people or vehicles crossing into prohibited areas, fire starts, etc.

It will be informed every three months of the conditions under which the systems are implemented.

Access to certain areas of Paris and its suburbs will be restricted before and during the Olympic Games:

• the "SILT" or "grey" protection perimeter, within which motorized and pedestrian traffic will be regulated and checks carried out (security palpation, visual inspection and baggage search, etc.);
• the "red" perimeter, where only road traffic will be restricted.

All the information you need (people concerned, interactive map, periods concerned) can be found on the official “Anticiper les Jeux” and “Pass Jeux” websites.

Those wishing to access these restricted areas will need to request a pass containing a QR Code.

In order to issue this pass, the authorities may collect certain personal data:

• your first and last name ;
• your date and place of birth ;
• your postal and e-mail address;
• your telephone number ;
• your photograph ;
• the reason and proof of access to the zone (proof of residence, proof of employment, etc.);
• number and copy of identity card, driving license, passport or residence permit;
• dates and times of entry to and exit from the secure area.

For vehicles, the following data may be collected:

• license plate number ;
• vehicle brand, model, type and color;
• a copy of the registration certificate.

All this data is kept for three months from the end of the event, except for the copy of the identity card, driving license, passport or residence permit, which is kept only until your pass is sent.

No.

The "screening" or "administrative investigation" of people at certain major sporting events only concerns certain people (athletes, their teams, people working on site and volunteers).

Spectators are not subject to an administrative inquiry prior to admission.

Yes.

When accessing certain venues during the Olympic and Paralympic Games, you can choose to be inspected with a body scanner to check for prohibited items. The stated aim of the system is to facilitate and secure access to the venues concerned.

Safeguards will be put in place for their use, including :

• a system will have to blur your face;
• it will not be possible to simultaneously view your identity and the image produced by the scanner;
• finally, the image will use a generic human body shape, not your own.

In all cases, you must give your explicit consent before the scanner is used. In the event of refusal, you may be subjected to another control device, such as manual palpation.

Scanner images cannot be recorded or stored.

In view of the major issues at stake for privacy and individual freedoms, and the concerns raised by the implementation of these systems, the CNIL will be carrying out checks before, during and after the Olympic and Paralympic Games. These controls are one of the CNIL's priorities for 2024.

The controls focus in particular on :

• "augmented" camera devices;
• QR codes for restricted areas;
• ticketing services; and
• volunteer data.

If it finds any breaches during its inspections, the CNIL is likely to take all the repressive measures provided for by the law, in order to ensure that systems are brought into compliance.

You cannot object to the pass system or to the analysis of your image by the "augmented" cameras used during the Olympic and Paralympic Games.

Indeed, the possibility of objecting to the various systems put in place by the authorities would not enable them to pursue their security objectives.

However, you have certain rights with regard to the data collected.

About "augmented" cameras

You can exercise your right to access, delete, rectify or limit the use of images and alerts generated by the system, by contacting the organization responsible for processing them (see below). In practice, these organizations may refuse to comply with your request in certain situations.

For data collected and used during the design phase (i.e. data used, for example, to develop, configure or improve tools), you may exercise your rights by contacting :

• the Paris Police Prefecture, if it is also responsible for the operational implementation of ;
• the Ministry of the Interior in all other cases, via the dedicated e-mail address.

For data collected and used during the operational implementation of devices, you can exercise your rights with the organization responsible for the device, including :

• national police and gendarmerie services, such as Paris Police Prefecture (for street devices);
• fire and rescue services ;
• municipal police ;
• SNCF (for devices in stations) or RATP (for devices in the Paris metro and RER).

Please note: the contact details of the organization responsible for processing your data will be indicated on the information panels at the experiment sites.

About the pass

For the information required for the pass, you may exercise your right to access, rectify, limit or delete your personal data by contacting the Paris Police Prefecture via the dedicated e-mail address or by post:

Préfecture de Police de Paris

1bis rue de Lutèce

75004 Paris

France

Please note: these rights may be restricted in the event of a criminal investigation, for example.

About ticketing

For data concerning ticketing, you can exercise your rights with the Organizing Committee for the Olympic and Paralympic Games by sending an e-mail to the dedicated e-mail address.

As a general rule, if you do not receive a reply within a month, or if you receive an unsatisfactory response to your enquiries concerning one of these systems, you can lodge a complaint with the CNIL (complaints must be written in French).