France - Biometric Recognition Bill (n°505)

Overview

The proposition de loi relative to biometric recognition in public spaces (Senate text n°505, report registered 31 May 2023) establishes statutory "red lines" that prohibit mass or untargeted biometric identification in public and publicly accessible spaces while authorising a narrow, experimental set of uses subject to strict controls, oversight and evaluation. The text responds directly to the Senate commission's 2022 information report, "La reconnaissance biométrique dans l'espace public : 30 propositions pour écarter le risque d'une société de surveillance", and is intended to reconcile the legitimate public-security or operational benefits of biometric tools with protection of privacy and fundamental rights. The bill frames exceptions as experiments with limited duration, subject to judicial or executive authorisations and continuous oversight; see the primary bill text and report at Senate report (May 31, 2023) and the deposited proposition PDF at Senate proposition PDF.

Definitions

The proposition distinguishes key concepts to reduce ambiguity: "biometric data" (data resulting from specific technical processing relating to physical, physiological or behavioral characteristics enabling unique identification), "authentication" (1:1 comparison verifying that a person is who they claim to be), "identification" (1:N comparison to find a person among a database), "real-time identification" (live processing enabling immediate action), and "a posteriori exploitation" (processing of recorded images after the fact). The bill also defines "spaces accessible to the public" and sets boundaries between police administrative functions and police judiciaire (judicial police) uses. These definitions are designed to shape the permitted, prohibited and experimental regimes in subsequent articles.

Governance and Institutional Framework

The governance architecture established by the proposition is multi-layered and centred on judicial, parliamentary and independent oversight. Authorisations for a posteriori identification in judicial investigations must originate from the magistrate in charge or the relevant prosecutor and are strictly time-limited; intelligence uses by first-circle services require prime-ministerial authorization after advice from the CNCTR (Commission nationale de contrôle des techniques de renseignement). The proposal mandates a scientific and ethical committee to evaluate experiments and publish reports, and strengthens reporting to Parliament: immediate information to both Assemblée nationale and Sénat for administrative measures, and an annual public report summarizing authorisations, deployments, incidents and outcomes. The CNIL (Commission nationale de l'informatique et des libertés) retains a central regulatory and supervisory role regarding data-protection compliance and technical safeguards; see the CNIL's role referenced in the report at Senate report. The bill seeks to balance executive functionality with independent and parliamentary scrutiny.

Key Focus Areas

The bill concentrates on several interlocking focus areas: (1) Rights and prohibitions – a clear ban on remote, untargeted biometric identification in public spaces and on the scoring/categorization of individuals on biometric grounds; (2) Narrow experiments – tightly defined contexts where biometric tools can be trialled (authentication at secured access points for major events, a posteriori criminal investigations limited to the most serious offences, narrowly circumscribed intelligence applications); (3) Authorization and human oversight – all automated signals must be reviewed by trained human operators and authorisations are time-bound, reasoned, and revocable; (4) Technical and organisational safeguards – data minimisation, encryption, secure storage, access controls, and mandatory audit logs; (5) Transparency and evaluation – obligation to publish evaluation reports, public summaries, and to permit parliamentary inquiry; (6) Redress and remedies – mechanisms for individuals to contest wrongful identification or seek remedies; and (7) Compatibility with EU law and GDPR – particular attention to special-category nature of biometric data and the need for explicit legal bases and safeguards. By foregrounding these areas the bill attempts to enable limited beneficial uses without normalising pervasive biometric surveillance.

Implementation Framework

Implementation is framed through an experimental regime: authorisations are granted under precise legal conditions for a limited period (the Senate's amendments envisage a three-year experimental window). For judicial investigations, magistrates or prosecutors authorise short-duration a posteriori searches limited to defined spatial and temporal perimeters. For intelligence services, prime-ministerial authorisation after CNCTR advice is required, with strict lists of eligible objectives (national defence, prevention of terrorism, threats to republican institutions, major public order risks). Real-time deployments are permitted only in exceptional, narrowly targeted circumstances and subject to enhanced safeguards: separate dedicated cameras (distinct from general-purpose videoprotection), restricted numbers of cameras, limited geographic scope, and specialized training for operators. The bill mandates privacy and data-protection impact assessments (DPIAs), technical conformity checks, and the involvement of CNIL when applicable. A scientific and ethical committee advises on methodology, metrics and public reporting to inform the final governmental evaluation.

Monitoring and Evaluation

Monitoring is continuous and multi-stakeholder. The law requires immediate notification to both houses of Parliament of administrative measures, regular interim reports from the executive, and public annual reports detailing authorisations, deployments, error rates, incidents, security breaches and outcomes. The mandated scientific and ethics committee must produce public evaluation reports during the experimental period and the Government must deliver a final evaluation at the end of the experimentation that considers operational results, rights impacts and EU legal developments. Audit logs, independent audits and CNIL inspections are foreseen; the parliamentary right to request supplementary information enhances democratic oversight. These layers aim to ensure transparency, enable course-corrections and inform the decision on whether to pérenniser or terminate the experiments.

Penalties, Liability, and Appeals

While the proposition principally designs preventive and governance measures, it also contemplates enforcement mechanisms. Unlawful deployments or violations of safeguards can trigger administrative sanctions (including CNIL fines and injunctions), orders to suspend or cease processing, destruction of unlawfully-processed data, and potential criminal liability where illegal acts (unauthorised capture, illicit processing, or abuse of office) are established under existing penal provisions. The bill maintains individuals' rights of judicial appeal and CNIL complaint routes and envisages compensation avenues for unlawful identifications or rights infringements. The restitution and redress mechanisms are anchored in existing civil and administrative remedies and the supervisory remit of the CNIL.

Relationship to Other Instruments

The proposition is expressly designed to complement and supplement existing French and EU instruments. It amends parts of the French Data Protection Act (law n°78-17 of 6 January 1978) and interacts with the GDPR regime for special categories (biometric data). It also integrates with procedural law governing police judiciaire and administrative policing and with the CNCTR framework for intelligence techniques. The bill references the legal bases created for the 2024 Olympic Games (law n° 2023-380, May 19, 2023) to avoid regulatory fragmentation and proposes an experimental approach that keeps the text aligned with pending or evolving EU AI and biometric identification initiatives. The aim is not to supersede existing protections but to create a specific legal instrument calibrated to biometric risks in public spaces.

International Alignment

The bill situates France's approach within broader international and European discussions on biometric identification and AI governance. It echoes debates at EU level concerning remote biometric identification and the regulation of high-risk AI systems and seeks to preserve consistency with GDPR and with anticipated EU rules (such as the AI Act discussions extant at the time of drafting). The experimental and evaluative design is intended to permit France to adapt to EU developments while preserving national oversight for security-sensitive functions. The law also references best-practice principles from international human-rights and data-protection instruments, aiming for interoperability with cross-border judicial cooperation and data-exchange limitations.

Implementation Timeline

Sources and References