
Photo by Med Amine CB on Unsplash
In 2017, Huawei offered the city of Valenciennes in France 240 facial recognition cameras. Privacy International explores four years of a partnership riddled with concerns.
Photo by Med Amine CB on Unsplash
In a previous article, we mapped the influence of the Chinese company Huawei across the world and how their sales of smart city infrastructures are contributing to the reshaping of our public space.
We should be alarmed by some of their product deployments – such as the installation of facial recognition technologies in countries with concerning human rights records. But also the deployments of facial recognition technology in countries without strong data protection laws are as such concerning.
In this piece we look at how Huawei has been attempting to promote its facial recognition technology in France, a country where facial recognition is not generally authorised and where any deployment must be pre-approved by the data protection regulator. We will look at Huawei’s deployment in the city of Valenciennes and how the city has been trying to address the legal concerns inherent to this paradoxical situation.
Back in 2017, the city of Valenciennes, in the north of France caught media attention for its peculiar partnership with Huawei. Huawei offered the city 240 facial recognition cameras, worth two million euros for free, despite facial recognition being banned. City officials simply promised the facial recognition features of the camera would not be used.
Despite the scrutiny we were left with many questions: how would the city go about ensuring that the facial recognition feature is not being used? How many cameras are there now in Valenciennes, since reports from 2019 suggested there were then 308 cameras? Why did Huawei agree to such an agreement?
We decided to send a Freedom of Information (“FOI”) request to the city of Valenciennes asking them:
A person in charge of data protection for the city of Valenciennes thoroughly answered our FOI request and we welcome their intention to uphold transparency, both with the media and civil society.
They disclosed their contract with Huawei, documents with the technical specifications of Huawei cameras used in the city and a map featuring where the cameras are located. All these documents can be accessed in the attached files on this page.
Answering our questions, they explained they were currently conducting the data protection impact assessment (“DPIA”), despite the cameras being already in operation. This means the impact on the protection of individuals’ data, and on other fundamental rights, was not assessed before the cameras were deployed. DPIAs (and/or human rights impact assessments where appropriate) should always be performed prior to the deployment of a new technology, so that the assessment is not biased by the technology being already in place. DPIAs must also be a tool for selecting between technology providers, whereby the most rights-preserving provider should always be selected – and only if the DPIA concludes that any impact on human rights is necessary and proportionate, and can be properly mitigated.
In order to provide assurances that the facial recognition features are not being used, Valenciennes invited both an independent expert and a representative from the CNIL – the French data protection authority – to certify that they were not being used. While this may be satisfactory at a given point in time, we wonder why the cameras deployed were equipped with facial recognition features in the first place, instead of having deployed some cameras without facial recognition features. This may indicate an intention to deploy facial recognition in the future, or to be ready and available if and when France authorises the deployment of facial recognition systems.
Even without enabling facial recognition features, the cameras do have “Intelligence Analytics” functions, which enable things like “Loitering detection, Intrusion detection, Abandoned object detection, Removed object detection, Target color recognition, Humans and vehicles distinguish” (see Huawei’s camera datasheets in the attached documents). These sorts of “intelligent” functions can raise concerns about the underlying algorithms, and automatic detection features have led to mistakes in the past, as was the case of this woman who was fined in the UK after her t-shirt was identified as a license plate.
We were told that the number of times the police requested the extraction of images was not information we were entitled to obtain, for such information isn’t covered by France’s access to information laws – and yet Valenciennes’ website discloses that 205 requests for extraction were made by the national police as part of investigations in 2017.
Huawei’s contract with Valenciennes reveals the reason for the company’s interest for such deployment – they intend on experimenting on the city’s population, to better understand the constraints of the French administration, legal system and territory, and ultimately move in on more French towns:
Translation in English by PI:
“This elaborated system put in place by the company [Huawei] in many cities in China and abroad is not yet established in French towns. In order to allow a perfect adjustment of this system to the technical and administrative constraints of the French local authorities and with the perspective of its sale and deployment in France, the company expressed its interest in installing its CCTV cameras and decision-making assistance integrated systems in the city of Valenciennes.”
This commercial approach is not unique to Huawei and is in fact very similar to a practice by IBM, we had highlighted in a previous report. The Smarter City Challenge, where IBM selected cities that were receiving some of its smart city infrastructures for free.
Four months after we received the response from the city of Valenciennes, the mayor made an announcement: the partnership between Huawei and Valenciennes would come to an end.
The partnership was ended by Huawei, after their decision to leave the European market. As technicians will no longer be able to support the maintenance system, the cameras will become obsolete. Thus showing the limitations of this type of private-public partnerships that leave governments with unusable equipment once the contract with the company ends.
Shortly before the end of the partnership was announced, the CNIL (the French data protection authority) had issued a warning against the city of Valenciennes regarding this very partnership. They judged the use of these cameras disproportionate and highlighted in particular the fact
While we commend the willingness of Valenciennes to answer our questions and those of journalists who have covered the case, there nevertheless remains a systemic issue. A company approaching a city with free infrastructure offerings means the company gets to reshape public space, with no consideration of alternatives. Instead of having a citizen-focused approach, where the company has to respond to the needs and aspirations of the local residents, we have a situation where the city has to adapt to what the company has to offer. Facial recognition in this case is the perfect manifestation of this issue. Huawei was offering facial recognition technologies to a city that is not legally permitted to use it, so that as a result they had to have legal experts visit to assess the “non-use” of the technology.
This situation was both absurd and lacked proper safeguards for the privacy of the people of Valenciennes. The occasional visit of legal experts was not the guarantee the people of Valenciennes deserve. The very point of not generally authorising facial recognition is to subject any deployment to very strict safeguards, so that people can be in the public space without the constant threat of surveillance. Giving the city a “tool” they cannot use, and trusting the authorities they will not use it was a fragile situation and our position was confirmed by the findings of the CNIL.
The citizens of Valenciennes should not have been treated as guinea pigs for Huawei’s attempts to develop their market in Europe. If you are a European Union citizen and would like to see these sorts of practices end across Europe, you can sign our petition, led with forty other organisations, to demand that the European Commission bans biometric mass surveillance.
Sign the petition now.