In 2024, complaints related to the retail sector represented 19% of all complaints received by the French Data Protection Agency (CNIL). As in-store data capture technologies multiply, powered by IoT via smart cameras or counting sensors near screens, screens, Nacera Bekhat, Head of the Digital Economy and Financial Sector at the CNIL, presents the current stakes for the retail sector.
Several vendors, like Veesion and Alfred Eyes, provide smart camera technologies aimed at capturing customer data throughout the store to prevent theft. How do these systems fit with GDPR?
Some systems capture and analyse in real time people’s behaviour across all or almost all of the store to detect theft, and if needed, dispatch staff to handle the situation. The CNIL has considered that these systems cannot be deployed as they currently stand and require legal authorisation and legislative oversight. To authorise this type of in-store system, a law is needed with strong safeguards and allowing the exclusion of the objection right of customers (the associated bill is promoted by MP Paul Midy, former C.E.O. of Frichty and CMO of Jumia Group, Editor’s note). Indeed, we clearly see that these systems cannot work with an effective objection right given the pursued purpose (theft prevention). Moreover, shoppers cannot reasonably be required to exercise an objection right each time they go in a store. Without this legislative framework, the CNIL considers that these solutions cannot be used. In France, they have been deployed in a few stores of several retailers. Some were audited before we broadcast our position to the retailers and solution providers. The CNIL letter was challenged before the Conseil d’État (in an accelerated procedure, Editor’s note).
