The French Data Protection Authority ("CNIL") issued
its guidelines on the use of facial recognition technologies in
airports. According to the CNIL's guidance, the use of facial
recognition in airports is permitted but only if the GDPR's
conditions for the processing of special categories of data are
met.
The CNIL reiterates that the use of such technologies must be
proportionate and for a legitimate purpose. For example, one
legitimate purpose is sequencing and scheduling passenger boarding
to avoid crowds and long queues for security reasons.
In addition, controllers must obtain the free, specific, and
informed consent of passengers in a way that allows a passenger to
choose between having their facial image processed and an
alternative that does not involve this type of processing and is
not inferior. This means that, for example, offering a special
incentive, such as "frequent flyer" club advantages to
those who agree to have their facial image processed, is
