In a decision (French only) dated 27 February 2020, the French Administrative Court of Marseille invalidated the deliberation of the Provence-Alpes-Côte d’Azur Regional Council which allowed to set up, on an experimental basis, a facial recognition mechanism in two high schools in order to (i) better control and speed up entry of students into the high schools and (ii) control access to premises of occasional visitors.

This decision is important as this is the first administrative court decision in France about facial recognition. Since the GDPR entered into force, it is also the first French administrative court decision relating to data protection not based on a deliberation issued by the French Data Protection Authority (CNIL), which was already quite uncommon before GDPR’s entry into force.

Facts and procedure

On October 2017, the President of the Provence-Alpes-Côte d’Azur Regional Council consulted the CNIL to request its assistance in setting up, on an experimental basis, a facial recognition system in two high schools in the South of France to be used at the entry and inside the premises to control access of students and visitors. Although the experiment had not been authorized by the CNIL, the Regional Council, in a deliberation (French only) dated 14 December 2018, decided to launch it. Expressly opposed to this measure, several French data protection and human and civil rights associations, including the French association “La Quadrature du Net“, filed an action for annulment of the Regional Council’s deliberation before the French Administrative Court of Marseille on 14 February 2019.

In the meantime, the Regional Council pursued its discussions with the CNIL and communicated to it the data protection impact assessment (DPIA) drafted for the facial recognition experiment. On October 29, 2019, the CNIL finally published on its website a press release (French only), in which it considered, based on the finalized version of the DPIA communicated by the regional council, that the experiment, which concerned students, most of whom were minors, with the sole aim of making access to their high schools more fluid and secure, was neither necessary nor proportionate to achieve the intended purposes.

In its decision (French only) of 27 February 2020, the French Administrative Court of Marseille took up most of the points raised by the CNIL in its press release and invalidated the decision of the Regional Council insofar as it (i) had not provided sufficient guarantees to obtain free and informed consent of students to the processing and (ii) did not demonstrate that the purpose of checking the entrances to the high schools could not be achieved by other, less intrusive means.