2024 Olympics: CNIL's Q&A on your privacy and freedoms

The French Law relating to the 2024 Olympic and Paralympic Games provides for the establishment of various files for:

• the mobilization of police officers and volunteers;
• the processing of athlete accreditations and their results, and the accreditations of accompanying persons;
• security and ticketing for spectators.

A number of special systems will also be used, including :

• augmented cameras based, in part, on CCTV cameras already deployed: this is a temporary experiment authorized by the law of May 19, 2023 relating to the 2024 Olympic and Paralympic Games, on which the CNIL has issued an opinion (in French) (see the question "Will these devices be maintained after the Olympic Games?").
   
• a pass containing a QR Code will be mandatory, that will allow spectators to access certain areas in Paris and the surrounding departements. This system has been authorized by a decree issued by the Minister of the Interior, on which the CNIL has also issued an opinion (in French). 
   
• ticketing based on the collection of personal data: your identity may be verified in this context.

What are "augmented" cameras and what are they used for?

The term "augmented" camera refers to video devices with associated software for automatic image analysis (algorithmic processing).

In practice, these automated image analysis software programs, which are combined with CCTV cameras authorized by prefectural decree, can detect or "recognize" specific objects, behaviors or events.

In concrete terms, eight events can be detected:

• the presence of abandoned objects;
• the presence or use of weapons;
• the failure of a person or vehicle to follow the common direction of traffic;
• the crossing or presence of a person or vehicle in a prohibited or sensitive area;
• the presence of a person on the ground following a fall;
• a crowd movement;
• too high a density of people;
• a start of fire.

These "augmented" camera systems can only be used to ensure the security of large-scale events (such as the opening ceremony), which are particularly exposed to the risk of acts of terrorism or serious threats to personal safety.

In concrete terms, these devices can only be used at the event venue, in the vicinity of the event and in the means of public transport, i.e. on fixed cameras already present on the streets, in train stations or within the subway and suburban train facilities, but also on drones.

Please note:

• The systems enable the situations listed above to be reported to authorized agents, who check the alerts to validate them or not. They then decide what action to take and, in particular, whether it is necessary to alert the competent services.
  
  The events detected are therefore always subject to human analysis before any action is taken. You cannot thus be the subject of any individual decision or be prosecuted solely on the basis of these algorithmic processes. Furthermore, no cross-referencing with other files is possible.
   
• The data collected by the "augmented" cameras for the design of the software algorithm will be kept for a maximum of one year after recording (or until the end of the experiment if it ends earlier). Among other things, this may enable the devices to improve the quality of detection of predetermined events. Recordings of alerts are also kept for a period of one year after recording.

Will "augmented" cameras be used for facial recognition?

No.

As requested by the CNIL, the devices that will be used during the Olympic Games will not use facial recognition. The law explicitly excludes the use of any biometric identification system or facial recognition techniques.

The CNIL considers that facial recognition systems present significant risks, such as :

• the potential risk of unprecedented surveillance and the risk of undermining anonymity in the public sphere;
• the unique identification of individuals via particularly sensitive and permanent data (face);
• an imperfect and biased technology (error rates can vary according to gender or skin color, for example)

• Augmented cameras in public spaces: CNIL's position (in French)
• Facial recognition: for a debate living up to the challenges

Will these "augmented" camera devices be maintained after the Olympic Games?

Yes, but only temporarily.

The French Law relating to the 2024 Olympic and Paralympic Games allow an experimentation that ends on March 31, 2025. The systems can no longer be used after this date; it could only be extended by a new law.

In this respect, as it did throughout the discussions on the French Law relating to the 2024 Olympic and Paralympic Games, the CNIL calls for a democratic debate on the subject.

Please note: this experiment does not only concern the Olympic and Paralympic Games, but also other sporting, recreational and cultural events (concerts, matches).

How is the CNIL supervising experimentations with these "augmented" cameras?

The CNIL's role is to support and supervise experimentations with these systems, notably by alerting organizations of their obligations to comply with regulations.

The CNIL supported and supervised around ten companies supplying algorithmic devices during the call for tenders of the French Ministry of the Interior. It provided them with initial feedback on the legal and technical analysis of the solutions proposed in July 2023. The CNIL is also helping to ensure the compliance of operators implementing these systems.

The CNIL also attended the first real-life test organized by the Paris Police during the Depeche Mode concert at the Accor Arena in Paris on March 5, 2024: the device was able to check crowd density, detect people or vehicles crossing into prohibited areas, fire starts, etc.

The CNIL will be informed every three months of the conditions under which the systems are implemented.

Access to certain areas of Paris and its suburbs will be restricted before and during the Olympic Games:

• the "SILT" or "grey" protection perimeter, within which vehicle and pedestrian traffic will be regulated and checks will be carried out (security checks, visual inspection and baggage search, etc.);
• the "red" perimeter, where only road traffic will be restricted.

All the information you need (data subjects, interactive map, periods concerned) can be found on the official “Anticiper les Jeux” (in French) and “Pass Jeux” websites.

Those wishing to access these restricted areas will need to request a pass containing a QR Code.

In order to issue this pass, the authorities may collect certain personal data:

• your first and last name;
• your date and place of birth;
• your postal and e-mail address;
• your telephone number;
• your photograph;
• the reason and proof of access to the zone (proof of residence, proof of employment, etc.);
• number and copy of identity card, driving license, passport or residence permit;
• dates and times of entry to and exit from the secure area.

For vehicles, the following data may be collected:

• license plate number;
• vehicle brand, model, type and color;
• a copy of the registration certificate.

All this data is kept for three months after the end of the event, except for the copy of the identity card, driving license, passport or residence permit, which will be kept only until your pass is prepared and sent to you.

No.

The "screening" or "administrative investigation" (in French) of people at certain major sporting events only concerns certain people (athletes, their teams, people working on site and volunteers).

Spectators will not be subject to an administrative inquiry prior to admission.

Yes.

When accessing certain venues during the Olympic and Paralympic Games, you will be able to choose to be inspected with a body scanner that verifies the absence of prohibited items. The stated aim of the system is to facilitate and secure access to the venues concerned.

Safeguards will be put in place for their use, including :

• a system that will blur your face;
• it will not be possible to simultaneously view your identity and the image produced by the scanner;
• the image will use a generic human body shape, not your own.

In all cases, you must give your explicit consent before the scanner is used. In the event of refusal, you may be subjected to another type of control, such as  a manual check.

Scanner images will not be recorded or stored.

In light of the issues at stake for privacy and individual freedoms, and concerns raised by the implementation of these systems, the CNIL will be carrying out controls before, during and after the Olympic and Paralympic Games. These controls are one of the CNIL's priorities for 2024.

The controls focus in particular on :

• "augmented" camera devices;
• QR codes for restricted areas;
• ticketing services;
• volunteer data.

If the CNIL finds any breaches during these controls, it will likely take all the repressive measures provided for by the law, in order to ensure that systems are brought into compliance.

You cannot object to the pass system or to the analysis of your image by the "augmented" cameras used during the Olympic and Paralympic Games.

Indeed, the possibility of objecting to the various systems put in place by the authorities would not enable them to pursue their security objectives.

However, you have certain rights with regards to the data collected.

About "augmented" cameras

You can exercise your right to access, delete, rectify or limit the use of images and alerts generated by the system, by contacting the organization actiong as data controller (see below). In practice, the organization may refuse to comply with your request in certain situations.

For data collected and used during the design phase (i.e. data used, for example, to develop, configure or improve tools), you may exercise your rights by contacting :

• the Paris Police, if it is responsible for the operational implementation of the cameras;
• the Ministry of the Interior in all other cases, via the dedicated e-mail address.

For data collected and used during the operational implementation of devices, you can exercise your rights at the organization responsible for the device, including :

• the national police and the gendarmerie, such as Paris Police (for street devices);
• the fire and rescue services;
• the municipal police;
• the French train company SNCF (for devices in stations) or Paris public transportation company RATP (for devices in the Paris metro and RER).

Please note: the contact details of the organization acting as data controller will be indicated on the information panels at the experimentation sites.

About the pass

For the information required for the pass, you may exercise your right to access, rectify, limit or delete your personal data by contacting the Paris Police via the dedicated e-mail address or by post:

Préfecture de Police de Paris

1bis rue de Lutèce

75004 Paris

France

Please note: these rights may be restricted in the event of a criminal investigation, for example.

About ticketing

For data concerning ticketing, you can exercise your rights with the Organizing Committee for the Olympic and Paralympic Games by sending an e-mail to the dedicated e-mail address.

As a general rule, if you do not receive a reply within a month, or if you receive an unsatisfactory response to your enquiries concerning one of these systems, you can lodge a complaint with the CNIL (complaints must be written in French).