In December 2013, the Apple Retail France Company  received a first public notice concerning the video surveillance system implemented in the Opera Apple Store in Paris. On this occasion, the French Data Protection Authority (the ‘CNIL’) notably asked Apple to (i) redirect some cameras, which filmed employees in areas accessible to employees only on a continuous basis and (ii) inform them of the existence of this video surveillance system. The Opera Apple Store responded to correct the situation. However, other Apple Stores located on the French territory were found to have similar issues. On October 14, 2014, the CNIL issued a second public notice to Apple regarding 16 of its French Apple Stores. 

Obligations 

The installation of surveillance cameras imposes a number of obligations on the data controller. Following legislation on January 6, 1978 relating to computers, files and liberties (later amended) and the Labor Code, the employer wishing to install surveillance cameras in the workplace must firstly and notably:

- Inform the employees of the existence of the video surveillance system,

- Inform the employees of the existing procedure related to the right of access to visual records,

- Respect the employees’ right to privacy,

- Do not film the employees on their work station,

- Do not film break areas or employees’ rest areas, nor restrooms,

- Only collect the data strictly necessary for the pursuit of the predefined purposes of such a processing.

The obligation to ensure the adequacy, the relevance and the proportionality of the collected data

During the investigation carried out by the CNIL in all the 16 French Apple stores, it was found that the existing cameras recorded sensitive areas (access door or locked safe) but, also, directly and continuously the employees’ work stations, circulation spaces, the break room and the cloakroom. In its latest notice, the CNIL underlined the fact that if the monitoring is justified by security considerations for sensitive areas, "the placement of employees under a permanent surveillance, detrimental to their privacy, cannot be allowed except in exceptional circumstances relating, for example, to the nature of the task to accomplish according to Article L1121-1 of the Labour Code ".

In this case, the French authority considered that the continuous and general surveillance, in addition to other security measures (security door, access code, badges, alarms on motion detection, identification and passwords, etc.) is disproportionate in the light of the objective of preventing harm to people and property.

The obligation to inform the employees

The investigation carried out by the CNIL raised the fact that Apple’s employees were informed of the implementation of the video surveillance system through the internal bylaws, a copy of which they receive upon hiring.In some Apple stores, the information was supplemented by a hardly visible display, located in public areas, referring to the right of persons to access to the images relating to them. In two stores, the display referred to the law of January 6, 1978.

However, article 32 of the Law dated January 6, 1978 requires the data controller to provide the person from whom personal data are collected, with information, in writing, about, notably, the identity of the data controller, the purpose of the data processing, the data's recipients and their right to access.In this particular case, the information provided by Apple was not complete and did not meet the French legal requirements.

Apple's obligations

Consequently, Apple has been ordered to:

• Ensure that the implementation of each video surveillance system is not disproportionate to its purpose, and does not place employees under a permanent surveillance, for instance  by adopting masking measures or by repositioning cameras, unless specific circumstances in connection with the nature of the employees' tasks justify unmasking and positioning of the cameras,

• Inform the employees of the implementation of a video surveillance system, for example through a comprehensive display circulated within spaces reserved to employees and referring in particular to the access right.

Even if those public notices are not penalties as such (only failure to comply to the latter could trigger the implementation of sanctions), their advertising, decided by the CNIL, is not without consequences for the Apple's image and reputation. It underlines the importance for the (foreign) data controllers to ensure compliance with national rules governing the collection of personal data, especially when they relate to employees.

Laurent Guardelli & Aurélie Klein are lawyers at  Coblence & Associés. www.coblence-avocat.com