Who: JC Decaux and the French Conseil d’Etat
Where: Paris
When: 8 February 2017
Law stated as at: May 2017
What happened:
In order to thrive in an increasingly growing digital advertising market, which can nowadays be easily measured through the use of more and more sophisticated data analysis, ad industry players have long tried to measure the impact of their advertising billboards and panels on passing consumers..
Back in February 2015, French outdoor advertiser JCDecaux, wishing to benefit from such potentially lucrative technique, asked the French Data protection watchdog (the CNIL) for the authorisation to set up, for a four-week test, a pedestrian tracking system composed of six electronic devices added to its advertising panels, capable of capturing smartphones’ MAC address routers within a 25 meters radius of the panels. The device would allow JCDecaux to quantify the flux of pedestrians around its advertising panels in Paris business district La Défense, as well as the travel routes carried out by them within a 25 meters perimeter around the panels.
Once the MAC addresses had been collected, JCDecaux had planned to anonymise these by means of the “salting” technique and “key hashing” method, which involves combining the collected data with other metrics and ultimately scrambling them.
The CNIL refused to authorise JCDecaux’s device, on the basis that it did not use a proper anonymisation technique capable of protecting pedestrians’ personal data and that consequently, pedestrians would not be sufficiently informed of the processing of their personal data. Indeed, the CNIL considered that since the electronic device would have automatically collected personal data of pedestrians carrying a smartphone with a Wi-Fi interface activated when passing by a 25 meters radius of the panels; individuals would be extremely unlikely to see the sign which JCDecaux planned to put on the panels in order to notify them of their rights – and consequently, to consent to such processing.
Further to the CNIL’s decision, JCDecaux engaged with France’s highest administrative authority, the Conseil d’Etat asking it:
- to annul, as ultra vires, the CNIL’s decision; and
- to grant JCDecaux authorisation to implement its tracking device, or to order the CNIL to issue such authorisation; and
On 8th February 2017, the Conseil d’Etat upheld the CNIL’s decision, thereby preventing JCDecaux from testing its devices in France. While not strictly speaking prohibiting tracking of mobile phones, the Conseil d’Etat reminded advertising sector businesses that it is key to ensure that data is properly anonymised and thereby that tracking systems meet all the provisions of the French Loi Informatique et Libertés of 6 January 1978.
Why this matters:
This subject is not new, but is particularly interesting in light of the upcoming General Data Protection Regulation (GDPR), which has been the result of lengthy reflections on new ways of collecting an increasing amount of individuals’ personal data at large and of consumers in particular. The GDPR introduces the notions of “profiling” as well as “monitoring” of individuals’ behaviour; and imposes that any processing of personal data related to such activity, whether it is online (e.g. in the context of IP tracking or cookies) or offline (sensors, outdoor tracking, facial recognition, geolocation) must imperatively, if such data is not entirely anonymised, respect the data protection principles set out in the GDPR and in particular the key principles of information and prior consent of consumers on the one hand, and security and proportionality on the other.
Advertising industry businesses wishing to carry out outdoor tracking will therefore have to provide real anonymization solutions guaranteeing an optimal level of protection for the persons whose personal data will be collected.
