A charging station operator may film its charging area and apply video analytics to the footage, provided it complies with two overlapping legal frameworks. The first governs the recording system and depends on whether the location is open to the public. The second, the GDPR, governs the processing of the personal data collected, regardless of the nature of the location.

The practical question to be decided first is therefore the following: Is the charging area a location open to the public, or a space reserved for a specific group of people? A supermarket parking lot or a highway rest area is a location open to the public. A company parking lot closed off by a gate and reserved for employees is not. The resulting obligations differ significantly, and many projects stall because this question was not addressed from the outset.

What regulations apply to a charging area open to the public?

In a location open to the public, the system falls under video surveillance regulations governed by the Internal Security Code. This requires a prefectural authorization, issued for a limited list of purposes, including the prevention of property damage. Protecting a charging infrastructure against theft and vandalism falls within this framework.

The same code sets a maximum retention period of one month for the footage. The authorization specifies the number of cameras, their locations, and the approved purposes. Any substantial modification to the system—including the addition of cameras or a change in coverage area—requires an update to this authorization.

What about a private site not accessible to the public?

On a closed-off site—such as a bus depot or a company parking lot—prefectural authorization is not required. In such cases, the system is subject to the GDPR and the French Data Protection Act. The operator must record the processing activity in its register, establish a retention period proportionate to the purpose, inform individuals, and regulate access to the footage.

This lack of authorization does not mean there is no oversight. The CNIL retains jurisdiction and may impose sanctions for a disproportionate system—such as continuous surveillance of workstations presented as equipment protection.

What purposes justify video analysis at a kiosk?

The purpose determines everything else: the data collected, the retention period, and the authorized personnel. It must be documented in writing before deployment, not retroactively established afterward.

In a charging station area, there are few justifiable purposes, and they are clearly defined. Detecting unauthorized entry into a technical area outside of operating hours protects equipment cabinets and cables. Detecting an unusually long presence near equipment, or a vehicle parked next to a charging station when it is not in use, indicates an attempt to tamper with the equipment. Detecting damage—such as a torn-out charging station or a severed cable—triggers a maintenance response.

Conversely, a broadly defined purpose—such as general site security—does not hold up to scrutiny. It neither justifies the proportionality of the system nor defines its limits.

What data does video analysis actually produce?

A video stream analysis generates events and counters: an intrusion detected at a specific time in a specific zone, the number of vehicles present, or the duration of parking. These outputs do not contain any identifying information. The key concern lies elsewhere, in two specific elements.

The first is the license plate. A license plate constitutes personal data as soon as it can be traced back to an individual. Reading license plates to manage a subscription or billing is possible, but this constitutes a separate processing operation that requires its own legal basis, retention period, and notice.

The second is the image retained as evidence of an event. An image of an intrusion shows an identifiable person. Its retention follows the rules applicable to the recording device, and access to it must be logged.

What information should be provided to individuals who are filmed?

Information is provided in two stages. A visible sign at the entrance to the area indicates the presence of the system, its purpose, the identity of the data controller, and the procedures for exercising rights. Comprehensive information, in compliance with GDPR requirements, is made available in an accessible format, typically on a dedicated page of the operator’s website.

If employees or contractors are working in the area, two additional obligations apply. They must be individually informed about the system. And since this system may be used to monitor their activities, employee representatives must be consulted before the system is put into service, in accordance with the Labor Code.

When Is a Data Protection Impact Assessment Required?

The GDPR requires a data protection impact assessment when the processing poses a high risk to individuals, particularly in the case of systematic, large-scale surveillance of a publicly accessible area. A network of charging stations equipped with cameras that are continuously monitored falls into this category.

The impact assessment is not a mere paperwork formality. It requires a precise description of what is captured, what is calculated, what is retained, and who has access to it. In many projects, this exercise reveals that a camera is filming well beyond the necessary area, or that a retention period has been set by default that bears no relation to the purpose of the processing.

How can compliance be reconciled with operational efficiency?

The two objectives align more often than one might think. Limiting a camera’s field of view to the technical area reduces legal exposure while also decreasing the number of false alarms triggered by people passing by who are unrelated to the facility. Storing only specific events—rather than a continuous stream—reduces both storage requirements and risk.

This is the approach taken by analytics platforms that leverage existing cameras, such as CORE at XXII: the processing generates qualified alerts and metrics, while the video serves only as ad hoc evidence. The operator maintains a system that can be used on a daily basis by its maintenance and security teams, without building a blanket surveillance system that it could neither justify nor effectively operate.

One final point that is often overlooked: documenting the settings. The thresholds selected, the excluded zones, and the activation schedules for detection rules are all part of the compliance record. A system that is properly configured but not documented is difficult to defend.