France’s Conseil D’Etat (“CE”) has ruled the use of thermal imaging cameras to detect temperature symptoms of COVID-19 is governed by the GDPR.
This is thought provoking because in this case the cameras did not record personal data. The cameras had no memory and operated by giving the person being measured (and no-one else) an indication of whether their temperature was elevated (by way of a colour code). Nobody had access to the camera or the results it was giving. Nevertheless, the CE considered this to be automated processing of personal data and so within the scope of the GDPR (Article 2, processing of personal data wholly or partly by automated means).
Of particular interest was the notion that a device reporting a body temperature deviation (from the norm) resulted in automated processing, whereas a device simply reporting the temperature was not automated because it is “limited to the measurement of a quantified variable”.
Of course, data is only personal data if it relates to someone who is identified or can be identified from the data being processed. In this case the CE said:
“Even though the identification of the persons whose temperature is recorded by the agents does not allow this data to be viewed as personal, it is possible that the image processed by the system, even if not stored, is sufficiently precise to be identifying. In any event, it follows from the very context in which the cameras are implemented that the identity of the people giving rise to their use is necessarily known before the data is collected and in order to use it. The data processed are therefore personal within the meaning of the GDPR.”
This was clearly a surprise to the City of Versailles who had not applied the GDPR to this activity at all and whose use of the cameras was ruled as unlawful. It may also come as a surprise to other operators of similar systems who (perhaps quite reasonably) might not appreciate that the nuances of the GDPR may bring this type of activity into scope.
So, whilst this is a French decision, it is worth bearing in mind when considering the data protection implications of temperature monitoring.
To see the full decision (in French), go to: https://www.conseil-etat.fr/ressources/decisions-contentieuses/dernieres-decisions-importantes/conseil-d-etat-26-juin-2020-cameras-thermiques-a-lisses
