Huawei in Valenciennes: a bad romance

In a previous article, we mapped the influence of the Chinese company Huawei across the world and how their sales of smart city infrastructures are contributing to the reshaping of our public space.

We should be alarmed by some of their product deployments – such as the installation of facial recognition technologies in countries with concerning human rights records. But also the deployments of facial recognition technology in countries without strong data protection laws are as such concerning.

In this piece we look at how Huawei has been attempting to promote its facial recognition technology in France, a country where facial recognition is not generally authorised and where any deployment must be pre-approved by the data protection regulator. We will look at Huawei’s deployment in the city of Valenciennes and how the city has been trying to address the legal concerns inherent to this paradoxical situation.

A scrutinised collaboration

Back in 2017, the city of Valenciennes, in the north of France caught media attention for its peculiar partnership with Huawei. Huawei offered the city 240 facial recognition cameras, worth two million euros for free, despite facial recognition being banned. City officials simply promised the facial recognition features of the camera would not be used.

Despite the scrutiny we were left with many questions: how would the city go about ensuring that the facial recognition feature is not being used? How many cameras are there now in Valenciennes, since reports from 2019 suggested there were then 308 cameras? Why did Huawei agree to such an agreement?  

We decided to send a Freedom of Information (“FOI”) request to the city of Valenciennes asking them:

1. To disclose a copy of the contracts between the city and Huawei from 2016 to 2020.
2. To share with us all brochures, promotional documents, presentations and handbooks provided by Huawei.
3. Whether a data protection impact assessment had been conducted prior to signing the contract with Huawei and/or before the cameras had been installed. If so, that they provide us with the assessment. If not, that they tell us why they have not.
4. How many cameras provided by Huawei are currently in operation. Whether they were planning on installing more in the future and if so when and how many. To provide us with a map of where the cameras are located.
5. How many times did the police request the extraction of images from cameras provided by Huawei as part of investigations.
6. What the measures in place are to guarantee that facial recognition features are not used.

A person in charge of data protection for the city of Valenciennes thoroughly answered our FOI request and we welcome their intention to uphold transparency, both with the media and civil society.  

They disclosed their contract with Huawei, documents with the technical specifications of Huawei cameras used in the city and a map featuring where the cameras are located. All these documents can be accessed in the attached files on this page.  

Answering our questions, they explained they were currently conducting the data protection impact assessment (“DPIA”), despite the cameras being already in operation. This means the impact on the protection of individuals’ data, and on other fundamental rights, was not assessed before the cameras were deployed. DPIAs (and/or human rights impact assessments where appropriate) should always be performed prior to the deployment of a new technology, so that the assessment is not biased by the technology being already in place. DPIAs must also be a tool for selecting between technology providers, whereby the most rights-preserving provider should always be selected – and only if the DPIA concludes that any impact on human rights is necessary and proportionate, and can be properly mitigated.

In order to provide assurances that the facial recognition features are not being used, Valenciennes invited both an independent expert and a representative from the CNIL – the French data protection authority – to certify that they were not being used. While this may be satisfactory at a given point in time, we wonder why the cameras deployed were equipped with facial recognition features in the first place, instead of having deployed some cameras without facial recognition features. This may indicate an intention to deploy facial recognition in the future, or to be ready and available if and when France authorises the deployment of facial recognition systems.

Even without enabling facial recognition features, the cameras do have “Intelligence Analytics” functions, which enable things like “Loitering detection, Intrusion detection, Abandoned object detection, Removed object detection, Target color recognition, Humans and vehicles distinguish” (see Huawei’s camera datasheets in the attached documents). These sorts of “intelligent” functions can raise concerns about the underlying algorithms, and automatic detection features have led to mistakes in the past, as was the case of this woman who was fined in the UK after her t-shirt was identified as a license plate.

We were told that the number of times the police requested the extraction of images was not information we were entitled to obtain, for such information isn’t covered by France’s access to information laws – and yet Valenciennes’ website discloses that 205 requests for extraction were made by the national police as part of investigations in 2017. 

Huawei’s goal: establishing their presence in France

Huawei’s contract with Valenciennes reveals the reason for the company’s interest for such deployment – they intend on experimenting on the city’s population, to better understand the constraints of the French administration, legal system and territory, and ultimately move in on more French towns: