ABSTRACT

As the Paris 2024 Summer Olympic and Paralympic Games (hereinafter referred to as the “Games”) approach their final stretch, the Games have once again captured the attention of the world, both on and off the track. With over 15.3 million visitors in Paris for the Games this summer, data security has become a critical issue. To enhance the safety of athletes, spectators and residents, the French government has implemented specific measures, including the draft law on the Games (hereinafter referred to as the “OG law”), a legislative measure passed on 19 May 2023 to strengthen security during the Games⁽¹⁾.

“GI Law” introduces advanced security measures, in particular the use of experimental algorithmic video surveillance systems. This article focuses on the implementation of these enhanced surveillance systems during the Games and examines the associated GDPR compliance and privacy issues that arise thereafter.

Experimental use of ‘augmented cameras’ to ensure security at Games

The GI law allows for the use of AI-powered “augmented cameras” for unprecedented analysis with algorithmic video surveillance to monitor and ensure security at major events. These systems can detect unusual crowd movements, abandoned items, suspicious behavior and generally identify potential security threats by processing data in real time using AI.

While these measures are intended to increase security, they also raise serious concerns about GDPR compliance. The French data protection authority, National Commission for Information Technology and Freedom (CNIL) was consulted on the GI Law and submitted to the Constitutional Council recommendations for its review in order to ensure a fair balance between security requirements and respect for the rights and freedoms of individuals (the “Opinion”)⁽²⁾. The opinion specifically raised issues of the GI Law’s compliance with the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), in particular with regard to the use of algorithmic image processing of drone footage. The CNIL concluded in its opinion that the safeguards in place, such as limiting the duration and scope of the experiment, prohibiting the use of biometric data (including facial recognition), preventing the merging of data with other data files and avoiding automated decisions, were sufficient to ensure the protection of personal data.

The Constitutional Council also examined the duration of the experiment, which was initially scheduled to last until March 31, 2025, despite the Games ending in early September 2024. The council ruled that the Paris police commissioner must immediately withdraw the authorization if the conditions justifying the law are no longer met⁽³⁾.

Additionally, Commission Nationale Consultative des Droits de l’Homme (hereinafter “CNCDH”) expressed concerns about the privacy risks resulting from algorithmic video surveillance, highlighting the challenges of clearly informing the data subjects about the processing of their data and enabling them to exercise their rights in relation to data processing⁽⁴⁾.

In order to meet the transparency requirement of the GDPR, the regulation issued on 27 November 2023 specifies the conditions under which the public must be informed about the processing of personal data by video surveillance systems in accordance with GI law.⁽⁵⁾The decree requires that information be displayed by means of signs or pictograms representing a camera and, if it is not possible to provide all the mandatory information, the signs must at least indicate the identity of the system operator, the purposes of the processing and the rights of the data subjects, with additional information to be provided “in any other way”.“.

In practice, the presence of cameras monitoring public areas must be indicated. However, the CNCDH notes that these signs are often rare, small and unnoticeable. Article 10 of the GI Law introduces two exceptions that justify not informing the public; when circumstances prohibit it or when such information would be contrary to the security objectives pursued.

CNCDH also raised concerns about the decision-making processes involved in video surveillance. While the GI law specifies that systems should be under human control and regularly monitored, it warns of automation bias, where agents trust and rely on software without challenge, scrutiny or verification.

In response to these concerns, CNCDH recommended:

• Ensuring that video surveillance systems are both necessary and proportionate;
• Providing appropriate data protection training for agents responsible for video analysis;
• Increased resources for the CNIL to strengthen its capacity to monitor video surveillance systems.

These recommendations reflect the principles set out in the recently adopted EU Artificial Intelligence Act, which sets a strict framework for AI systems and automated decision-making, while also emphasising the need for human oversight and transparency. The AI ​​Act requires clear explanations on the role of AI in decision-making, increasing transparency and enabling individuals to understand and challenge decisions that affect them, and requires human oversight of high-risk AI systems to protect the fundamental rights of individuals.

As Paris presents its epic Games, it is important to understand some of the security measures that are in place, behind what we see on our screens, to improve the smooth running of the Games and the safety of the city. The implementation of advanced security measures, such as AI-powered augmented cameras, highlights the unique and delicate balance between security and privacy. While these technologies work to provide a safer environment, they also require rigorous adherence to GDPR and the principles of transparency and human oversight enshrined in the EU AI Act. The measures and safeguards in place at the Games could serve as a benchmark for future global events, underlining the need to protect individual rights in an age of advanced technology.

Footnotes

(1) Act No. 2023-380 of 19 May 2023 on the 2024 Olympic and Paralympic Games.

(2) Deliberation No. 2022-118 of 8 December 2022 on the draft act on the 2024 Olympic and Paralympic Games.

(3) Decision No. 2023-850 DC of 17 May 2023, the 2024 Olympic and Paralympic Games Act and various other regulations

(4) CNCDH, Opinion on the surveillance of public spaces (A-2024-5), 24 June 2024.

(5) Decree No. 2023-1102 of 27 November 2023 implementing articles L. 251-1 and following of the Internal Security Code and concerning the implementation of the processing of personal data from video security systems and cameras installed on board aircraft

(See source.)