Pieton and video-protection camera: the president of the CNIL puts a commune in notice

During an on-site check with a municipality with camera and video protection devices, the CNIL noted several shortcomings to the Data Protection Act and the Internal Security Code.The president of the CNIL therefore put the municipality in notice to put these two devices in accordance within 4 months.

This formal notice is not a sanction.Indeed, no continuation will be given to this procedure if the municipality complies with the law within the period which was given to it.

On the other hand, if the municipality does not comply with the formal notice, the president is likely to seize the restricted training of the CNIL which may pronounce a sanction, including a fine.

Regarding the shiny camera device

The CNIL control delegation first noted that certain data encrusted on the images recorded by the shiny camera, namely the horoditing as well as the identifier of the municipal police officer carrying the camera, wereInaccurate, which constitutes a breach of the provisions of article 4 of the Data Protection Act ("accuracy of the data").

Regarding storage times, the CNIL noted the presence in the video file of video files dating back more than 6 months.However, it is up to the municipality to ensure the erasure of the recordings carried out at the end of the period necessary for the prevention and detection of criminal offenses, in accordance with article 87 of the Data Protection Act.

The CNIL also noted that the information of the persons concerned was no longer accessible on the site of the municipality or by display on the day of control, which constitutes a breach of the provisions of article 104 of the IT lawand freedoms.

Furthermore, with regard to the security and confidentiality of the data, the CNIL found that the password allowing access to the camera software was not sufficiently robust and that no measure allowing traceabilityAccess to images was not implemented, which constitutes a breach of the provisions of articles 99 and 101 of the Data Protection Act.

Finally, the use of the shift has not been registered in the Treatment Register of the municipality, which constitutes a breach of the provisions of article 100 of the Data Protection Act and Liberties.

Regarding the video protection device

First of all, the device allows the visualization of the interior of residential buildings, which constitutes a breach of the provisions of article L.251-3 of the internal security code.

Then, the municipality does not comply with the maximum conservation duration provided for in the prefectural decree, which constitutes a breach of the provisions of article L.252-5 of the internal security code.

No impact analysis has been carried out while this treatment is likely to present a high risk for the rights and freedoms of natural persons as soon as the video protection system leads to systematic large -scale monitoring of a zone accessible topublic, which constitutes a breach of the provisions of article 90 of the Data Protection Act and Liberties.

Finally, the information panels affixed to each entry of the municipality do not allow correct information of the public, because they do not include all the mentions provided for in article 104 of the Data Protection Act.However, these information panels can only have summary information if they are completed, on another medium, by exhaustive information.