Cybersecurity Policy Report, CNIL Issues Q&A on Personal Data Use at Olympics, (Jun 25, 2024)

By Tony Foley

The French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), today released a series of questions and answers outlining the country’s plans regarding the use of personal data during the 2024 Summer Olympic and Paralympic Games.

The Q&As note that French law authorizes the establishment of various files to facilitate the mobilization of police officers and volunteers, athlete accreditations and results, and security and ticketing for Olympic spectators. CNIL outlines the devices that will be used during the games, including augmented cameras based on CCTV systems already deployed that will be used temporarily and the inclusion of QR codes on passes used to access certain areas in Paris and the surrounding venues.

According to the Q&As, the augmented cameras will conduct algorithmic processing to detect various specific objects, behaviors, and events, like the presence of weapons, a failure of a person to follow normal traffic routes, the crossing of a person or vehicle into a sensitive area, crowd movements and density, and fire detection.

The cameras may only be used to ensure the security of large events that are susceptible to terrorism or other threats to personal safety. In addition, the events detected by the augmented cameras will be subject to human analysis before any action is taken, and the data will be maintained only for one year after collection. CNIL added that facial recognition would not be employed and noted that the use of augmented cameras would expire on March 31, 2025, in the absence of intervening legislation.

To effectuate the use of QR codes for certain access purposes, authorities may collect personal data as specified in the Q&A, including names, dates and places of birth, and photographs, among other items. With respect to vehicles, authorities may collect license plate numbers, as well as make, model and registration information. In general, this data will be kept until three months after the event in question ends.

The Q&As specify that spectators will not be subject to administrative investigation prior to admission and outlines the consent requirements related to the use of body scanners, although individuals refusing consent will be subject to manual searches or other alternative security procedures. CNIL will monitor the controls listed above before, during, and after the games, and if it finds any breaches, will take appropriate action under French data protection law.

News: InternationalLegislation DataPrivacy