AI, video surveillance and smart cities: what legal framework for local authorities?

At the time of development of Smart Cities, the integration of artificial intelligence into the devices of Video protection Transform the management of public space. So-called “augmented” or “intelligent” cameras no longer only capture images: they automatically analyze video streams in particular to detect behaviors, generate statistics or search for information.

‍

These new capabilities, based on the addition of AI in cameras or the use of specific software, are profoundly changing the very nature of traditional video protection in public spaces. The CNIL conducted a Series of Targeted Checks on Local Authorities and the Ministry of the Interior between 2022 and 2024. These checks revealed numerous shortcomings, in particular the use of devices for prohibited purposes, which led to several formal notices.

‍

In the same vein, the administrative judge has strengthened the controls related to these devices: after a first ruling by the Council of State in 2023, the Grenoble Administrative Court recently cancelled the decision of a municipality to implement software allowing the analysis of video surveillance images via AI.

‍

The challenge is therefore as follows: how to combine the growing use of AI by municipalities with the necessary protection of the privacy of people in public spaces, while taking into account European regulations, such as the RGPD and the AI Act?

‍

1. The legal and regulatory framework for smart cameras in public spaces

‍

The use in France and by public authorities of technologies for the algorithmic analysis of images in the context of video protection is based on a set of texts strictly framing their implementation.

‍

The Code of Criminal Procedure Authorizes the use of deferred video analysis software, based on images already recorded, within the framework of judicial police prerogatives and for the purposes of judicial investigations. La Directive (EU) 2016/680 known as “Police-Justice”, transposed into French law by the ordinance of 12 December 2018, specifically regulates data processing by the competent public authorities. In particular, this directive provides for strengthened requirements for biometric data, which allow the identification of a person based on physical, physiological or behavioral characteristics.

‍

At the same time, the Homeland Security Code, tea RGPD, as well as the Data Protection Law and Freedoms Define the rules applicable to the processing of personal data in a context of public security.

‍

In addition, the CNIL Has taken a stand on the subject of smart cameras by publishing a Guide in July 2022 And a Summary of applicable legal references.

‍

On the occasion of Olympic and Paralympic Games 2024, a temporary derogatory regime was established by Law No. 2023-380 of 19 May 2023, authorizing, on an experimental basis, the use of algorithmic image processing to secure risky events. This framework was specified by the decree of 28 August 2023 and validated by the Constitutional Council. However, this authorization remained strictly limited to the experimental period, ended on 31 March 2025 and cannot be transposed to other contexts as recalled by the Council of State in the Veesion case below for commercial use.

‍

Finally, at a time when smart cities are deploying AI and intelligent video surveillance, municipalities must also anticipate the application ofIA Act Recently Came Into Force.

‍

2. The legal framework for the use of smart cameras by the administrative judge

‍

The administrative judge was required to supervise the use of intelligent video analysis technologies such as BriefCam, which are now deployed in nearly 200 French municipalities.

‍

In the case Coeur Côte Fleurie (CE, December 21, 2023), the Council of State authorized the use of such software subject to compliance with the following three conditions:

- sensitive functionalities, such as Facial recognition, are deactivated;

- The Algorithmic Analysis Is Carried Out In deferred;

- exclusively for purposes Stats.

‍

The Council of State recalled that any use of this technology beyond what is provided for by the purpose initially chosen by the data controller, exposes local authorities to the risk of cancellation or sanctions.

‍

This requirement to respect the purpose has been confirmed in other recent decisions. In 2024, the Council of State Rejected, in the Case Veesion (CE, June 21, 2024), the argument consisting in relying on the law of 19 May 2023 relating to the Olympic and Paralympic Games with the aim of public security to justify the use of intelligent video surveillance devices.The administrative judges justifies the company publishing the company publishing the software installed on boxes added to the video surveillance device, that the Commercial Purpose of the Treatment (Namely to Allow Traders to Fight Against Theft) Did not correspond to the scope of application of this law, limited to securing high-risk public events.

‍

Entitled, in the case Commune of Moirans (TA Grenoble, January 24, 2025), the court annulled the municipality's decision to use the BriefCam tool. In fact, the judge blamed the community for the following three breaches:

‍

- lack of explicit purpose,

- Lack of sufficient guarantees for privacy and

- absence of administrative decision on the basis of the use of such a tool

3. Securing your smart video surveillance projects: GDPR best practices and administrative compliance

‍

Below, we have listed the essential actions to be implemented to ensure that video protection complies with the GDPR. It is essential to carry out the analysis on a case-by-case basis specific to the envisaged needs and uses of the entity concerned.

3.1. Analysis of the use of smart cameras:

• Check if personal or biometric data will be processed.
• Clearly define the purposes (statistics, information, alert) and the locations of establishment (attention to sensitive areas: schools, hospitals).
• Review the decisions that will be made based on the data.
• Ensure the existence of a clear legal basis (public interest mission or specific legal norm).

3.2. Assess the proportionality and necessity of using this technology

• Look for less intrusive alternatives.
• Document the usefulness of the device, the sensitivity and the volume of data processed.
• Conduct an impact analysis in case of large-scale surveillance.

3.3. Ensuring data protection by design (or “Privacy by Design”)

• Implement the blurring and anonymization of collected data and limit the preservation of images.
• Prioritize local data processing and quickly delete collected information.

3.4. Inform the persons concerned and supervise the use of technology

• Clearly inform users through appropriate signage (QR code, floor marking, sound announcements).
• Train internal teams that are likely to use the technology and data collected.
• Verify the compliance of service providers with the RGPD.

3.5. Disable sensitive features, such as facial recognition, and analyze data offline only

‍

4. Anticipating the future: integrating the AI Act into your smart video surveillance projects

‍

The IA Act introduces a fundamental distinction between remote biometric identification in real time and that carried out a posteriori which is possible and supervised. In fact, the systems of Real-time biometric recognition is prohibited, with rare exceptions (search for victims, prevention of serious threats, location of perpetrators of serious offenses, etc.) and always subject to the prior authorization of an independent judicial or administrative authority.

‍

Municipalities must therefore be particularly vigilant in the face of the activation of new biometric functionalities, such as facial recognition, which are now sometimes offered as an option by software publishers. Their activation without supervision exposes local authorities to major risks of administrative and litigation sanctions.

‍

In addition, the AI act classifies biometric identification systems, emotion recognition systems and, more generally, AI systems used by public authorities for profiling among the high-risk AI systems. The devices used by local authorities classified among these High-risk AI, require compliance with the following elements:

‍

• Ongoing risk management;
• Detailed technical documentation;
• Full traceability;
• Effective human supervision.

‍

Finally, the IA Act expressly prohibits the use of base-creating systems facial recognition data by untargeted harvesting of images from the Internet or video surveillance streams, thus consolidating an approach based on the strict protection of public freedoms.

‍

To secure your smart video surveillance projects with AI algorithms, you must anticipate the cumulative obligations of the GDPR and the AI Act now. A legal audit and a precise framework are essential to secure any smart city initiative.

‍

For any questions or support, do not hesitate to contact us by writing to cbeaussier@squairlaw.com.

‍

Clémentine Beaussier, partner lawyer at Squair