APDP (video surveillance CCTV) • Opinion on the draft Ministerial Order implementing Articles 83 to 85 of Law No. 1.565 of 3 December 2024 on the protection of personal data (Deliberation No. 2026-17 of 16 September 2026)

Deliberation No. 2026-17 of 16 September 2026 of the Personal Data Protection Authority (APDP) sets out its opinion on the draft Ministerial Order implementing Articles 83 to 85 (Processing relating to video surveillance) of Law No. 1.565 of 3 December 2024 on the protection of personal data, following a referral by the Minister of State on 20 July 2026.

* * *

SUMMARY

In the Preamble, the APDP highlights the “convoluted legal context (which will become even more so should the Law on Remote Biometric Identification be passed, as this would regulate the matter through a third, separate piece of legislation)”:

• Title IV (Article 5) of Law No. 1.430 of 13 July 2016 on various measures relating to the preservation of national security, governing "video protection", and Section IV (Articles 83 to 86) of Chapter VII of Law No. 1.565 of 3 December 2024 on the protection of personal data, which deals with processing operations relating to "video surveillance", both provide for an authorisation scheme administered by the Minister of State “allowing recipients to film the same category of premises: places open to the public”.
• The APDP asks: “In this context, how, in particular, can one distinguish between places open to the public that fall under video protection and those that fall under video surveillance?”, and considers that this dual-regime solution “poses legal risks, the reality of which the APDP regularly observes.”

The "legal uncertainty" arising from the legal framework governing video protection and video surveillance was also analysed in APDP Deliberation No. 2025-022 of 10 December 2025 on Bill No. 1087 concerning the remote biometric identification of persons wanted or flagged in places accessible to the public.

The APDP concludes that:

• “The Ministerial Order provides for a minimal procedural framework concerning the formalities for applications for authorisation in relation to video surveillance.”
• “It appears necessary to impose a five-year limit on the authorisation granted, which must also be capable of being withdrawn by the issuing authority.”
• “Provision should also be made for verification of the security measures put in place, as well as restrictions on access to footage of public thoroughfares.”
• “The draft Ministerial Order cannot mitigate the legal risks faced by data controllers, particularly where undefined terms, such as "areas open to the public or to public traffic", are involved.”

* * *

MORE DETAILS

On the issue of an authorisation by the Minister of State and the notification to be made to the APDP:

The APDP considers "the authorisation scheme administered by the Minister of State to be of an undefined or poorly defined scope".

The proportionality analysis on which the Minister of State would rely to grant the authorisation “may pose difficulties”, in particular:

• "Given its interest in the roll-out of CCTV cameras, which could ultimately be linked to its own system, it is unlikely that the DSP [Public Security Directorate] would restrict a deployment plan proposed by an applicant";
• "Unlike the departmental video surveillance commission, the CNIL [in France] or the APDP, the DSP does not have any staff with specialist expertise in this field, nor any magistrates, within its ranks";
• "Where the DSP makes requests regarding a system (or where no such requests are made), the final assessment will be carried out by the APDP, which may take a different view of the situation; this exposes the applicant to legal risk and places the DSP in a difficult position";
• "Any impact assessments (...) are not required to be submitted as part of the application";
• "There are no provisions for the DSP to issue recommendations that the data controller is required to follow (regarding the suitability of persons with access to the processing, the security of the processing carried out, etc.), nor for the DSP to monitor the implementation of such recommendations where appropriate."

The APDP also notes that:

• "There is no provision for the withdrawal of authorisation".
• "The authorisation issued by the Minister of State is valid indefinitely, whereas it is limited to five years for the public authorities referred to in Article 5 of Law No. 1.430, pursuant to the Ministerial Order implementing that Law.’"

The APDP is of the view that the “APDP notification scheme (...) does not require regulation by Ministerial Order”:

• Article 10 of the draft Ministerial Order provides for “the procedures for submitting information to the APDP when a data controller deploys a video surveillance system installed in premises not open to the public, as well as the content of such information, for which the Authority shall issue an acknowledgement of receipt within ten days of receipt”.
• In the APDP’s view, the “potential value of this information [appears] limited, in that it enables the APDP, upon acknowledging receipt of the file, to reiterate the key guiding principles of video surveillance; indeed, if the data controller has provided a great deal of detail and certain elements appear to be non-compliant, it may even enable its Chair to take corrective action. In any event, the APDP has already been providing notifiers with a form for nearly two years and intends to manage the processing of these notifications in accordance with its internal rules."

On the content of the Ministerial Order:

The APDP, “which is frequently contacted by data controllers wishing to use cameras to combat anti-social behaviour, interpreted very broadly, whether in open spaces or in public or private venues”, believes that “the draft Ministerial Order should be amended to specify that video surveillance systems may only be used for the purposes of ensuring the safety of persons and property in relation to risks of assault or theft.”

• (Article 1) The APDP raises the question of whether it is appropriate to submit applications for authorisation “directly to the Minister of State, or failing that, to the Secretariat of the Ministry of the Interior” rather than to the Director of Public Security (DSP).
• (Article 2: mandatory content of an application for authorisation to install a system that films a place open to the public; and Article 3: sets out what information must be provided if the system films "the vicinity of public roads, spaces open to the public or to public traffic") According to the APDP, drawing an analogy with the Article R252-3 of the French Internal Security Code, a requirement or stipulation specifically designed to verify the security of the CCTV system should be mandated, particularly where CCTV is implemented in accordance with the provisions of Article 3. The APDP highlights the “accumulation of related, vague and undefined concepts” (“areas open to the public or to public traffic”, “public roads”) which creates legal uncertainty for data controllers who must determine which regime applies to them (for example, “passageways such as that in the Fontvieille shopping centre (which is, moreover, connected to public lifts)").
• (Articles 4 and 7 paragraph 2: application for authorisation submitted by an entity holding an authorisation issued by the CCIN [previous personal data controller] prior to the entry into force of Law No. 1.565 and which has not modified its system since then). To obtain a new authorisation from the Minister of State, “applicants must provide both their contact details and a sworn statement that the CCTV system was duly installed prior to the entry into force of Law No. 1.565.” The APDP considers that “the authorisation issued by the Minister of State should be valid for five years, and systems duly implemented before 3 December 2024 could benefit from a presumption of compliance for five years from that date.”
• No restrictions on the status of data controllers who may film the immediate vicinity of their premises, no restrictions on access to such footage. The ADPP considers, with regard to “systems filming public roads - which falls within the remit of public authorities -” that “the footage should only be accessible to legitimate public authorities in the event of a confirmed incident, and under no circumstances to the data controller” or their subordinates. By analogy with the Article L251-2, final paragraph and Article R251-2 of the French Internal Security Code, The APDP regrets the absence of "restrictions on "neither the status of the data controller who may rely on it, nor any requirement to demonstrate a risk of theft or assault".