“Data processing must be with the service of each citizen. Its development must take place within the framework of the international co-operation. It should carry reached neither to the human identity, neither with the human rights, neither with the private life, nor with the personal freedoms or public”.
Thus starts the law of January 6, 1978 relating to data processing, the files and freedoms, known as “law Informatique and Freedoms” (LIL).
Genuine angular stone of the French company computerized for 26 years, the LIL has been instituted in response to the SAFARI project of 1974. The ministry for the Interior wished to set up a system automated for the administrative files and the repertory of the individuals. Thanks to a single identifier, the administration could question the system and have the totality of the information recorded on the same person.
Vis-a-vis the scandal caused by the SAFARI project, the government created an administrative independent authority: data-processing Commission and freedom. The Data-processing law and Freedoms were thus born: it was a question of controlling the data-processing phenomenon to dam up the possible abuses.
A modification of the LIL was necessary to allow a better adaptation to the current situations. On July 18, 2001, a bill is born. On July 15, 2004, the Senators definitively adopted, in second reading, the bill. On July 29, 2004, the constitutional Council validated the modified LIL.
The recasting of the LIL has for main goal to transpose in national law the European directive of October 24, 1995 relating to the protection of the physical people with regard to the data processing in personal matter.
The object of the Directive was to establish “a high level equivalent procedure in all the Member States of the Community in order to eliminate the obstacles with the data exchanges necessary to operation of the domestic market”.
This directive should have been transposed in French right since October 1998: France remained the last European Convention country not to have done it.
In addition, the bill has also as an ambition to adapt the LIL “to the development of the automated treatment of personal information in the sector deprived as in the public sector and more largely to the many technological developments of our company of information”.
The LIL version 2004 makes many modifications which are highly discussed by the professionals of the right and data processing:
its field of application is specified to allow a better adaptation to the current legal stakes of the computerized French company (1),
the procedure of declaration of the files and automated treatments wants to be reduced and simplified (2),
the CNIL is seen equipped with new sanction and supervisory powers (3).
A field of application of the specified LIL
in Abandon of the term: “personal information”
When the law of 1978 is instituted, the chapter 1 “Principles and definitions” speak primarily about “personal information”.
The LIL version 2004 transposes the European directive from 1995 and chooses a term plus general (“given in personal matter”) in order to include the most possible situations.
A definition is given to new article 2 of the law: “a data in personal matter any information relating to an identified individual constitutes or who can be identified, directly or indirectly, by reference to an identification number or to one or more elements which are clean for him”.
The use of this term makes it possible to aim all the data allowing the identification of a person: name, identification number, voice, image and fingerprints.
with textual precise details
The new law details many concepts: data in personal matter, treatments automated, files, the person concerned with the treatments, the person in charge for the treatments.
New article 4 specifies that the temporary copies made within the framework of technical activities of transmission or supply of access to a network to give best possible access to transmitted information are not concerned with the present law.
In addition, the LIL version 2004 indicates that it finds to apply since an element is attached to the French territory: person in charge for the automated treatment established in France, means of treatments located in France or representing in France.
The law creates a new chapter 2 relating to the “conditions of admissibility of the processings of data in personal matter”. The data in personal matter must meet several conditions, envisaged in new article 6, to be licit:
to be collected and treated in a honest way and sells by auction,
to be collected for determined purposes,
to be adequate, relevant and nonexcessive vis-a-vis their finality,
to be exact, complete and updates,
to be preserved by respecting the times of conservations.
The stress is laid on the assent of the person concerned with the collection and the processing of its data in personal matter.
with Responsabilité and rights
Chapter 5 is entirely devoted to the responsibility falling to the persons in charge for the processings of data and on the rights of the people concerned with these treatments.
The person in charge for the treatments has the obligation to inform the people concerned, in particular when the data with regard to them are not collected directly from them. The obligation of information is thus reinforced. Moreover, the bill specifies that the person in charge for the treatments must preserve the data and to preserve safety under penalty of sanction of it.
The people concerned with the treatment have new rights. The law of 1978 subordinated the right of opposition to the justification of “legitimate reasons”. The LIL version 2004 maintains this right but specifies that this right of opposition will be discrétionnaire and without expenses when the data are used at ends of prospection, in particular commercial.
In addition, files relating to the safety of the State, defense and public safety and accessible that via the CNIL could be communicated to the person concerned if the public interests are not blamed.
Lastly, the law envisages, without change, the right of access and to correction of the data in personal matter by the interested parties.
All these precise details make it possible to better frame the application of the LIL.
A procedure of declaration of the files reduced and simplified
with the correspondent with the data protection
The bill proposes to simplify the preliminary formalities of declaration when the files do not relate to significant data.
The legal entities will be to exempt of any declaration if they obtain a correspondent to the data protection, a person who will be used as intermediary between the company and the CNIL and will thus take care of the respect of the provisions of the law.
The bill transposes article 18 of the European directive of 1995. This article states, indeed, that the person in charge for the treatment can indicate “one detached with the data protection in personal matter in particular charged to ensure, in an independent way, the internal application of the national provisions taken pursuant to the present directive, to hold a register of the treatments carried out by the person in charge for the treatment, and guaranteeing kind which the treatments are not likely to attack the rights and freedoms of the people concerned”.
Alex Türk, president of the CNIL, declared that the installation of these correspondents to the data protection will make it possible “to throw advantages of footbridges between a series of actors (undertaken, local communities, associations) and the CNIL”. It specifies that these correspondents “will make pedagogy and internal formation, they will be capable to draw the alarms” and will be in connection systematically with the CNIL.
The constitutional Council specified, in its decision of July 29, 2004, that the designation of a correspondent exempts only declarations but the treatments subjected to authorization or the file transfers out of the European Union do not concern. This designation does not withdraw besides the treatments not declared from the other obligations envisaged by the law whose nonrespect will be sanctioned.
with Public files and private
Until there, the public files and private did not have the same mode: the first were to be authorized beforehand by the CNIL, the seconds were to be only declared.
The CNIL thus carried out a control a priori public files and a control a posteriori of the private files.
From now on, the files created by the authorities concern the mode of the private files. The government makes the point that the distinction between public files and private files is exceeded: a many public files collect alleviating data implemented, most of the time, by private operators, which presents risks of attack at the personal freedom and the protection of the private life.
In addition, it is it should be noted that before this bill, the CNIL however had a capacity of authorization on the administrative files but forever been able to sit its authority. For example, the STIC (data file including/understanding of the data on the authors and the victims of crimes and offences) was set up and used in 1996 but obtained legal recognition by decree only in July 2001.
With the bill, the opinion of the CNIL will be only purely optional, the government will not have to hold account of it more. The Commission will not be able thus to be opposed any more to the new files of the State. The police files will not need more to obtain the downstream of the CNIL to be activated.
The Data-processing Federation and Freedoms (WIRE) which gathers several associations, the collective Délis (Rights and freedoms vis-a-vis computerization of the company) and leagues it Human rights denounce these provisions which, according to them, “constitute a very serious lowering of the level of protection of the citizens vis-a-vis the processings of their personal data”.
in Fichiers relating to the significant data
From now on, it is the finality of the file and the nature of the collected data which will determine the applicable mode, it does not matter that it is about a public file or deprived.
The LIL envisages two modes: the declaration of the files relating to alleviating data and the authorization by the CNIL for the files relating to more significant data such as data genetic or relating to the infringements and judgments.
In the same way, the data which have as a finality the exclusion of the benefit of a right, of a service or of a contract since this exclusion does not rest on a condition legal or lawful or which have as a finality the interconnection of the files of different nature will be also subjected to authorization of the CNIL.
In addition, it should be noted that new article 8 states that it is interdict to collect and record significant data such as data relating to the ethnic origin, the political opinions, the religious convictions, manners of the person.
Only it could be derogated from this prohibition on the processings of data if they are justified by the public interest and are authorized.
It should be known that these files relating to the significant data were to be authorized by decree after assent of the CNIL and the Council of State. The LIL version 2004 indicates that the opinion of the CNIL for these sensitive files will not bind any more the Council of State and the government. Indeed, the opinion of the CNIL will not need more to be “in conformity” so that the decree authorizes the sensitive file; what translates an obvious lack of guarantee during the establishment and the authorization of these sensitive files.
with the files of infringements and judgments
Only the jurisdictions and certain public authorities could until now constitute such files. But an amendment initiated by Alex Türk also makes it possible to the people morals to resort to these files of infringements and judgments.
Indeed, new article 9, 3° lay out that the processings of data in personal matter relating to the infringements, judgments and measures of safety can from now on be taken by “the people morals victims of infringements or acting for the account of the aforesaid victims for the strict needs for the prevention and the fight against the fraud as well as repair of the undergone damage”. This 3° of article 9 was cancelled by the constitutional Council estimating that in “reason of the width that could cover the treatments of personal data thus implemented and of the nature of the processed data, this provision could affect the right to the respect of the private life and the fundamental guarantees granted to the citizens for the exercise of public freedoms”. In addition, the term of “fraud” was considered to be too broad. This provision was too vague to be ratified by the constitutional Council.
On the other hand, the constitutional Council maintains the provision 4° of article 9: files could be created in a precise situation: the fight counters the hacking on Internet.
The LIL thus envisages the legalization of the “black lists” in particular made up by the companies of perception of royalty, the professional organizations which suspect of the people of hacking on Internet, via networks peer-to-peer, for example.
These private criminal records will have to be authorized by the CNIL. It will be necessary to effectively control these files to avoid any drift.
New sanction and supervisory powers for the CNIL
With the new LIL, the CNIL sees its reduced supervisory powers in an important way with regard to the public files. Nevertheless, the LIL also envisages the installation of new sanction and supervisory powers for the CNIL.
It should be known that at the present time, the CNIL can inquire but does not have any constraining means to implement its investigations. If it notes nonthe conformity of a treatment with the law, it can emit only one warning or transmit the file to the Parquet floor which is given the responsability to determine the continuation appropriateness.
With the LIL version 2004, the supervisory powers of the CNIL are reinforced: in the event of opposition of the owner of the places, it will be able from now on, on legal authorization, to reach any professional room and the materials which allow the data processing.
In addition, in addition to a possible warning (new article 45), the CNIL will be able to put in residence the person in charge for the treatment to conform to the provisions of the law under penalty of administrative and in particular pecuniary sanctions important being able to go up to 300 000 euros.
The CNIL from now on will thus be equipped with supervisory powers a posteriori effective enabling him to check if the existing files are in conformity with the obligations envisaged by the law. It will be able to sanction the ignorance of these obligations
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment