French officials say they want to establish a legal framework for developing facial recognition for security and surveillance, extending concerns about the rapid spread of the new technology.
Facial recognition technology, a form of artificial intelligence that can identify a person by analysing a digital image of their face, is already widespread in France. In fact, the country is on track to become a European leader in its development and use.
Consistent with President Emmanuel Macron's wishes for France and Europe to compete on the same level as the United States and China, government officials and lawmakers have been consulting players in the fields of research, industry and civil liberties over how to best regulate the rapidly spreading technology.
The government has left the door open for extending its use in public services, marketing, managing the flow of people and security – an area where the technology brings to mind mass surveillance in China, including the real-time Skynet system.
“I hope we have a calm debate on a topic that raises many irrational fears,” Cédric O, junior minister for the digital economy, told Le Parisien newspaper when asked about video surveillance in December. “The government would like to open a test phase, of six months to a year, under supervision of civil society and researchers.”
Another newspaper, Les Echos, reported the government would devise an experiment in the “automatic detection of people in public places” and cited O's office giving the example of “a train station”.
Keeping tabs on industry
The government has not yet announced how such an experiment would actually work, nor how it would comply with European Union's General Data Protection Regulation (GDPR), which forbids the collection of any biometric data without a user's free consent.
But the minister's remarks correspond with a parliamentary report on facial recognition published last July, which recommends developing “a legislative framework for experimentation in order to test these systems” and “then to establish a regulatory framework that best suits uses”.
“When dealing with technologies that come into widespread use very quickly, as was the case with connected devices and as we're seeing now with facial recognition, I think experimentation and public consultation should be taken as principles,” says the report's author Didier Baichère, an MP with Macron's Republic on the Move (LaREM) party.
“Doing so would provide scientific and academic considerations of the technology's impact on an evolving society,” the MP says. “Failing to do so would give companies free rein in their marketing, to get us addicted to these technologies.”
Calls for moratorium
Baichère argues the French public is most concerned with the commercial use of the technology, but the official approach to the issue has raised concerns that there is too much emphasis on economic and security considerations, at the expense of social and ethical ones.
“The government is thinking of how to use facial recognition particularly because of the riots we had last year with the Yellow Vests,” argues Guillaume Klossa, a former advisor to the European Commissioner for digital affairs.
“France is very advanced in these technologies, because we have very good skills in artificial intelligence and digital imaging,” he adds. “There's a temptation to try facial recognition in France because there is large global market potential.”
Klossa co-authored a call for a moratorium on facial recognition until it was subject to wider debate and better oversight that would including the CNIL digital privacy watchdog. While not opposed to the technology in principle, the argument insists on the need for checks and balances when it comes to protecting civil liberties.
“You can see what Chinese society is doing now, and we don't want this kind of society,” Klossa says. “Democracy needs to preserve individual privacy, and that means defining limits, but so far there is no regulatory framework for facial recognition.”
Lawsuit over facial recognition app
The absence of such a framework has not stopped state departments from developing the technology in various domains, including the creation of a police database of digital images of past suspects.
In civilian use, travellers have the option of using a facial recognition system called Parafe at passport checks in airports and train stations, and real-time facial recognition was used during an experiment at a Carnival event in the city of Nice in February 2019.
The CNIL regulator approved that experiment, but it also ruled against two other state projects for failing to correspond to regulations – one involving facial scans in high schools, the other a smartphone application designed to access public services.
The app, called Alicem, compares a digital image of a user's face with information stored in the user's biometric identity card, such as a passport or resident card, to allow access to 500 public services.
Though it was not released as planned last autumn, the government has not dropped plans to release it, despite the CNIL ruling it did not respect GDPR rules on the terms of consent.
“When there is treatment of your data, your consent has to be explicit and free,” says Martin Drago, a lawyer with online civil liberties group La Quadrature du Net, which filed a lawsuit against the app in France's highest administrative court.
“In Alicem, if you want a digital identity, you have to pass through biometric treatment of your data. You have no choice but to use facial recognition.”
Call to ban facial recognition for surveillance
With facial recognition already being developed and deployed in various domains, Drago is puzzled by O's remarks about providing a legal framework for experiments.
“We have a lot of companies in France that are developing facial recognition technology,” he says. “I think they need a legal framework to ensure they will not be slowed down in their experimentation. So the French government is trying to reassure them, by saying, okay, you can experiment.”
But Drago does not believe the government could experiment with facial recognition in video surveillance in a way that conforms to GDPR rules, or even to a separate directive on what security services may use technology to do.
“Of course consent is not required for the police, but you have to prove the absolute necessity of your technology,” he says. “The fact is that in a lot of cases, facial recognition is not absolutely necessary, so it would be very difficult for the state to prove that.”
Arguing the only outcome would be state control over a population, La Quadrature du Net and 80 civil society groups have signed an open letter calling on France to ban facial recognition for any purposes of security and surveillance, arguing such bans have already been applied in San Francisco and other cities in the United States.