France - Mobile Authentication System (2019-452)

Overview

Decree No. 2019-452 of 13 May 2019 authorised the French State, via the Ministry of the Interior in partnership with the Agence nationale des titres sécurisés (ANTS), to create and operate a mobile electronic identification scheme known as ALICEM ("Authentification en ligne certifiée sur mobile"). The system allowed adult holders of biometric passports or electronic biometric residence permits to create a high-assurance digital identity on a smartphone using contactless reading of the travel-document chip and facial-recognition checks at enrolment. The Decree referenced EU and national data-protection and e‑ID rules (in particular eIDAS Regulation (EU) No 910/2014 and the GDPR), defined permitted data flows, and set safeguards, retention and transparency obligations. The text was published in the Journal Officiel on 16 May 2019 and later abrogated and replaced by a subsequent identity-service decree in April 2022 (Decree No. 2022-676).

Definitions

Key terms used or implied by the Decree included: "ALICEM" (the named treatment / mobile application and service), "electronic identification means" (a means enabling electronic identification and authentication), "biometric passport" and "electronic residence permit" (documents with an electronic component and biometric data), "contactless reading" (NFC or equivalent reading of the document chip), "static and dynamic facial recognition" (image comparison methods used at enrolment and liveness checks), "FranceConnect" (national authentication gateway), "data controller(s)" (Ministry/ANTS jointly), and "teleservice providers" (public or private services receiving authentication assertions under convention).

Governance and Institutional Framework

The Decree placed governance responsibility with the Minister of the Interior and designated ANTS as the implementation/operational agency. Operational rules and supervisory links connected ALICEM to FranceConnect (authorising transmission of a limited set of attributes to convention-linked teleservice providers). The Commission Nationale de l'Informatique et des Libertés (CNIL) was the supervisory authority responsible for assessing compliance with data-protection obligations; CNIL examined the draft and issued a formal opinion process (see the CNIL plenary agenda and deliberation references of October 2018). Judicial oversight occurred through administrative courts and ultimately the Conseil d'État, which reviewed challenges (notably Decision No. 432656, 4 Nov 2020) and interpreted necessity and proportionality in light of the GDPR. Implementation also required coordination with other ministries and conformity to eIDAS technical assurance specifications (Commission Implementing Regulation (EU) 2015/1502).

Key Focus Areas

The Decree focused on several core technical and policy areas: (1) the lawful basis and narrow purposes for processing personal and biometric data to permit high-assurance, remote digital identity creation and authentication; (2) the exact categories of data readable from the electronic component of travel documents (identity attributes, document identifiers, cryptographic keys and authenticity data; expressly excluding the stored scanned image of fingerprints); (3) the use of static and dynamic facial-recognition systems limited to enrolment / verification with explicit consent and subject to erasure once recognition tasks finish; (4) integration with FranceConnect so that ALICEM identities could be used by teleservice providers under convention; (5) limitations on recipients and strict access rules for administrative staff and service providers in the "need-to-know" scope; (6) required information and rights of data subjects (right to information, access, rectification, deletion, limitation) consistent with the GDPR and French law; (7) logging, recordkeeping and retention periods for transactional and operational logs; and (8) security and confidentiality obligations placed on implementers (technical protections, access controls, audit capabilities). The policy balanced the State’s interest in enabling remote high-assurance authentication for public services with data-protection safeguards and oversight mechanisms.

Implementation Framework

Operationalising the Decree required technical, organisational and legal steps: ANTS built the mobile application and backend services; NFC/contactless readers in compatible mobile devices were required to read passport/residence-permit chips; facial-recognition modules performed static photo comparison and dynamic liveness checks during enrolment; cryptographic key generation tied identities to mobile devices and phone numbers; privacy notices, consent collection flows and user interfaces were developed to meet GDPR requirements; data retention and erasure routines were established; secure servers and logging systems were provisioned; agreements (conventions) with FranceConnect and teleservice providers were drafted to govern attribute exchanges; staff authorisations and training were implemented; and data-protection impact assessments (DPIAs) and CNIL consultations were completed as part of the pre-deployment compliance process.

Monitoring and Evaluation

The Decree required logging of key operations (creation, consultation, use, revocation, deletion) including actor identity, timestamps and operation purpose, with retention of those logs for specified durations (the Decree and implementing notices set defined retention windows). CNIL oversight, periodic audits, DPIAs and reporting obligations were the primary evaluation mechanisms. Judicial review (administrative litigation) served as an additional monitoring channel; for example, after the Decree’s adoption La Quadrature du Net filed a challenge that led to the Conseil d'État review and ruling in 2020. Metrics for technical evaluation included false-acceptance/false-rejection rates for facial recognition, failure/retry rates for contactless reading, user retention and incidence of security incidents. The Ministry and ANTS were expected to publish lists of authorised teleservice providers and to make transparency information available to users.

Penalties, Liability, and Appeals

The Decree itself did not create bespoke criminal penalties but it operated within the enforcement landscape of the GDPR and French data-protection law (law no. 78-17 as amended). Non-compliance exposed implementing authorities and suppliers to CNIL administrative sanctions (including fines under the GDPR) and to civil liability for damages. Users could exercise rights before CNIL and pursue judicial remedies; administrative actors and associations could challenge the Decree by bringing cases before the administrative courts (as happened). Liability allocation among the Ministry, ANTS and contracted vendors was managed through conventions and procurement contracts. The Conseil d'État’s decision (4 Nov 2020) provides precedent on proportionality and consent interpretation for biometric processing in government identity projects.

Relationship to Other Instruments

ALICEM was explicitly framed to comply with or complement: (1) Regulation (EU) No 910/2014 (eIDAS) concerning electronic identification and trust services; (2) GDPR (2016/679) concerning processing, special categories (biometrics) and consent; (3) Commission Implementing Regulation (EU) 2015/1502 for assurance-level technical specifications; (4) French Data-Protection Act (Law No. 78-17) and successor national provisions; and (5) the FranceConnect interop framework. The Decree also interacted with immigration and identity statutes (codes governing passports, residence permits and civil-status documents). It was later superseded/abrogated by Decree No. 2022-676 (SGIN), which replaced the ALICEM-specific authorisation with a broader national identity-guarantee service regime.

International Alignment

From a legal and technical perspective the Decree sought alignment with EU frameworks: eIDAS assured interoperability and defined assurance-level requirements; GDPR governed biometric data as a special category with strict conditions for processing; and EU implementing acts defined technical measures and attestation levels. The Conseil d'État’s analysis referenced EU law and indicated that, at the time of the Decree, no equivalent fully dematerialised method assured the same remote enrolment guarantees, so the limited biometric processing was permissible. The Decree and subsequent jurisprudence are frequently cited in EU debates on state-led electronic identity, biometric authentication, and the limits of consent for government digital services. Internationally, the ALICEM experience has been referenced in policy discussions about balancing biometric convenience with fundamental-rights safeguards.

Implementation Timeline

Sources and References