Huawei in Valenciennes: a bad romance

In 2017, Huawei offered the city of Valenciennes in France 240 facial recognition cameras. Privacy International explores four years of a partnership riddled with concerns.

Key findings
  • Huawei had given the city of Valenciennes 240 facial recognition cameras for free. Yet the city of Valenciennes is not allowed to use facial recognition as it is not generally authorised in France.
  •  In response to Privacy International’s questions, the city answered that the only safeguard against the activation of facial recognition features was the visit of a legal expert
  • The contract obtained by Privacy International reveals Huawei did so in the hope of extending its reach across France
  • Huawei has now withdrawn from Valenciennes 
Long Read

In a previous article, we mapped the influence of the Chinese company Huawei across the world and how their sales of smart city infrastructures are contributing to the reshaping of our public space.

We should be alarmed by some of their product deployments – such as the installation of facial recognition technologies in countries with concerning human rights records. But also the deployments of facial recognition technology in countries without strong data protection laws are as such concerning.

In this piece we look at how Huawei has been attempting to promote its facial recognition technology in France, a country where facial recognition is not generally authorised and where any deployment must be pre-approved by the data protection regulator. We will look at Huawei’s deployment in the city of Valenciennes and how the city has been trying to address the legal concerns inherent to this paradoxical situation.

A scrutinised collaboration

Back in 2017, the city of Valenciennes, in the north of France caught media attention for its peculiar partnership with Huawei. Huawei offered the city 240 facial recognition cameras, worth two million euros for free, despite facial recognition being banned. City officials simply promised the facial recognition features of the camera would not be used.

Despite the scrutiny we were left with many questions: how would the city go about ensuring that the facial recognition feature is not being used? How many cameras are there now in Valenciennes, since reports from 2019 suggested there were then 308 cameras? Why did Huawei agree to such an agreement?  

We decided to send a Freedom of Information (“FOI”) request to the city of Valenciennes asking them:

  1. To disclose a copy of the contracts between the city and Huawei from 2016 to 2020.
  2. To share with us all brochures, promotional documents, presentations and handbooks provided by Huawei.
  3. Whether a data protection impact assessment had been conducted prior to signing the contract with Huawei and/or before the cameras had been installed. If so, that they provide us with the assessment. If not, that they tell us why they have not.
  4. How many cameras provided by Huawei are currently in operation. Whether they were planning on installing more in the future and if so when and how many. To provide us with a map of where the cameras are located.
  5. How many times did the police request the extraction of images from cameras provided by Huawei as part of investigations.
  6. What the measures in place are to guarantee that facial recognition features are not used.

A person in charge of data protection for the city of Valenciennes thoroughly answered our FOI request and we welcome their intention to uphold transparency, both with the media and civil society.  

They disclosed their contract with Huawei, documents with the technical specifications of Huawei cameras used in the city and a map featuring where the cameras are located. All these documents can be accessed in the attached files on this page.  

Answering our questions, they explained they were currently conducting the data protection impact assessment (“DPIA”), despite the cameras being already in operation. This means the impact on the protection of individuals’ data, and on other fundamental rights, was not assessed before the cameras were deployed. DPIAs (and/or human rights impact assessments where appropriate) should always be performed prior to the deployment of a new technology, so that the assessment is not biased by the technology being already in place. DPIAs must also be a tool for selecting between technology providers, whereby the most rights-preserving provider should always be selected – and only if the DPIA concludes that any impact on human rights is necessary and proportionate, and can be properly mitigated.

In order to provide assurances that the facial recognition features are not being used, Valenciennes invited both an independent expert and a representative from the CNIL – the French data protection authority – to certify that they were not being used. While this may be satisfactory at a given point in time, we wonder why the cameras deployed were equipped with facial recognition features in the first place, instead of having deployed some cameras without facial recognition features. This may indicate an intention to deploy facial recognition in the future, or to be ready and available if and when France authorises the deployment of facial recognition systems.

Even without enabling facial recognition features, the cameras do have “Intelligence Analytics” functions, which enable things like “Loitering detection, Intrusion detection, Abandoned object detection, Removed object detection, Target color recognition, Humans and vehicles distinguish” (see Huawei’s camera datasheets in the attached documents). These sorts of “intelligent” functions can raise concerns about the underlying algorithms, and automatic detection features have led to mistakes in the past, as was the case of this woman who was fined in the UK after her t-shirt was identified as a license plate.

We were told that the number of times the police requested the extraction of images was not information we were entitled to obtain, for such information isn’t covered by France’s access to information laws – and yet Valenciennes’ website discloses that 205 requests for extraction were made by the national police as part of investigations in 2017. 

Huawei’s goal: establishing their presence in France

Huawei’s contract with Valenciennes reveals the reason for the company’s interest for such deployment – they intend on experimenting on the city’s population, to better understand the constraints of the French administration, legal system and territory, and ultimately move in on more French towns:

Translation in English by PI:

“This elaborated system put in place by the company [Huawei] in many cities in China and abroad is not yet established in French towns. In order to allow a perfect adjustment of this system to the technical and administrative constraints of the French local authorities and with the perspective of its sale and deployment in France, the company expressed its interest in installing its CCTV cameras and decision-making assistance integrated systems in the city of Valenciennes.”

This commercial approach is not unique to Huawei and is in fact very similar to a practice by IBM, we had highlighted in a previous report. The Smarter City Challenge, where IBM selected cities that were receiving some of its smart city infrastructures for free.

Huawei/Valenciennes: the end of a bad romance

Four months after we received the response from the city of Valenciennes, the mayor made an announcement: the partnership between Huawei and Valenciennes would come to an end.

The partnership was ended by Huawei, after their decision to leave the European market. As technicians will no longer be able to support the maintenance system, the cameras will become obsolete. Thus showing the limitations of this type of private-public partnerships that leave governments with unusable equipment once the contract with the company ends.

Shortly before the end of the partnership was announced, the CNIL (the French data protection authority) had issued a warning against the city of Valenciennes regarding this very partnership. They judged the use of these cameras disproportionate and highlighted in particular the fact

  • that those cameras were capturing private spaces,
  • that the cameras allowed the tracking of cameras by capturing number plates (something that the municipality is not allowed to do) and
  • that inhabitants struggled with obtaining their data when they requested them.

Despite limited disclosures, concerns remain

While we commend the willingness of Valenciennes to answer our questions and those of journalists who have covered the case, there nevertheless remains a systemic issue. A company approaching a city with free infrastructure offerings means the company gets to reshape public space, with no consideration of alternatives. Instead of having a citizen-focused approach, where the company has to respond to the needs and aspirations of the local residents, we have a situation where the city has to adapt to what the company has to offer. Facial recognition in this case is the perfect manifestation of this issue. Huawei was offering facial recognition technologies to a city that is not legally permitted to use it, so that as a result they had to have legal experts visit to assess the “non-use” of the technology.

This situation was both absurd and lacked proper safeguards for the privacy of the people of Valenciennes. The occasional visit of legal experts was not the guarantee the people of Valenciennes deserve. The very point of not generally authorising facial recognition is to subject any deployment to very strict safeguards, so that people can be in the public space without the constant threat of surveillance. Giving the city a “tool” they cannot use, and trusting the authorities they will not use it was a fragile situation and our position was confirmed by the findings of the CNIL.

The citizens of Valenciennes should not have been treated as guinea pigs for Huawei’s attempts to develop their market in Europe. If you are a European Union citizen and would like to see these sorts of practices end across Europe, you can sign our petition, led with forty other organisations, to demand that the European Commission bans biometric mass surveillance.

Sign the petition now.