Data-processing law and freedoms

The “ laws Data processing and freedoms ” (also called LiL) are laws intended to guarantee to the Protection of the private life citizens vis-a-vis the average of treatment automated of numerical data.

Indeed, the Informatique makes it possible to treat in mass of the data, a way much faster and “effective” that the files paper. The first malevolent use of the automated treatment was the sorting of the Jews by computers IBM by the mode Nazi in Germany ( via Dehomag, connects German of IBM at the time) starting from the data of the census which included/understood in particular the religion. Clearly, the computerized treatment facilitated the Déportation.

In France

In France, it is about the Loi of the January 6th 1978 relating to the Informatique, the file S and the Liberté S.

This law was later on amended by the law of the August 6th 2004 in order to transpose in the French right the provisions of an European directive.

A discussed birth

Although signed in 1978, the history of the Data-processing law and freedoms is approximately ten years older.

Indeed, as of 1970, the deputy Michel Poniatowski proposes with the National Assembly the creation of an inspection committee and of a court of data processing, this suggestion, recovery later by others, is rejected. However in 1971, INSEE, benefitting from the passage of the data processing of the perforated cards towards the magnetic bands, decided hitherto a41dernier $c-b1, e,10 $c-b26 ce $c-b16 $c-b43, bn,84 to centralize with Nantes the repertories of identification regional, by the project inopportunely named SAFARI for Automated system for the Administrative Files and the Repertory of the Individuals. And in a kind of giddiness technocratic, the administration planned to cumulate this centralization with that with Tours of the file of the National bank of old-age insurance (CNAV) and to inter-connect it with the files of the indentity card, managed by the ministry for the interior.

This perceived project as a serious obstacle with freedom made scandal when Le Monde titrated the March 21st 1974: “SAFARI or drives out it with the French”. This platform caused a political outcry, to which had to face the very recent Minister of Interior Department Jacques Chirac, which “had just exchanged” its station with agriculture with that of Raymond Marcellin since less than one month. One reproached this last, named following May 68, his management of the crisis of the Canard connected , kind of Watergate to the Frenchwoman, generated by the discovery of two agents of DST (Direction of the monitoring of the territory) posing microphones, disguised in agents of EDF, in the buildings of the famous satirical newspaper.

But the April 2nd 1974, Georges Pompidou, President of the Republic, that the official bulletins said reached of a simple influenza, dies of its disease of Waldenstrom (the shape of cancer). Valery Giscard d'Estaing is then elected president of the Republic, thanks to the support of Jacques Chirac and especially of the popularity of this last in rural world, acquired at the time of its passage to agriculture. It is appointed Prime Minister and calls with the ministry for the M.Poniatowski Interior, which vis-a-vis criticism, takes up its idea and creates the Commission of data processing and freedoms and set up the project, which in spite of its resignation in 1977, will lead to Data-processing law the “and Freedoms” of the January 6th 1978 and to the creation of CNIL (National Commission of Data processing and Freedoms). This precocity thus placed France in the European trinity at the side of the Land of Hesse (Germany, 1971) and of the Sweden (1973) and made the instigator of the EU law of it installation in the ten Community countries in 1981, inspiring the Convention of the Council of Europe on the data protection (1981) and Guidelines for the regulation of files of automated personal data (1990). Unfortunately, the France did not manage to preserve this advance: it was the last to transpose in 2004 a European directive of 1995, which amended the law deeply, by replacing the term in particular of “personal information”, by “data in personal matter”, by giving to article 2 a definition of these last in order to avoid doubtful interpretations of this concept and to include the most possible situations. Moreover the data-processing law and freedoms approached new technologies of information by specifying that she did not legislate for the temporary copies of files and by defining the exact conditions of admissibility of the data processing in personal matter. One can also note the disappearance of the distinction for the treatments between the public sector and the private sector, both being subjected today to the same procedure, that some find too laxist. Today the majority of the regroupings of the SAFARI project were carried out, the ones after the others, in better definite situations.

However it is very important to notice that the legislators, who had as an ambition only to recognize new rights to the citizens with regard to the centralized great systems of information, with which the administrations started to be equipped, could not would be this only to imagine the development of Internet and however succeeded in creating a “law monument”, pillar of the electronic legislation.

The base of the Data-processing law and freedoms: data and data processing in personal matter

Cut out in thirteen parts, whose only three first (Principles and definitions, Conditions of admissibility of the data processing in personal matter, National Commission of data processing and freedoms) concern the private individuals directly, the LIL registered as of the article first data processing within the framework of the human rights, certainly to remember it the diversions which the personal informations during the Nazism could undergo.

Article 1

data processing must be with the service of each citizen. Its development must take place within the framework of the international cooperation. It should carry reached neither to the human identity, neither with the human rights, neither with the private life, nor with individual freedoms or public. '

As of the second article, it defines its framework, being addressed to largest the number.

Article 2 Constitutes a data in personal matter any relative information with identified natural person or who can be identified, directly or indirectly, by reference to an identification number or to one or more elements which are clean for him. To determine if a person is identifiable, it is advisable to consider the whole of the means in order to allow its identification available to or to which access the person in charge of the treatment or any other person can have. Constitute a data processing in personal matter any operation or any whole of operations relating to such data, whatever the process used, and in particular the collection, the recording, the organization, the conservation, the adaptation or the modification, the extraction, the consultation, the use, the communication by transmission, diffusion or any other form of provision, the bringing together or the interconnection, as well as locking, obliteration or the destruction. Constitute a data file in personal matter any unit structured and stable of data in personal matter accessible according to given criteria. The person concerned with a data processing in personal matter is that to which the data are referred which are the subject of the treatment.

Thereafter, it specifies which are the obligations of a person in charge of treatment, which can-being recipients of this treatment (Article 3): any person entitled to receive communication of these data , which data can be collected: the origins racial, ethnic, political opinions, philosophical or religious, trade-union membership, or those relating to health and sexuality are prohibited, except express assent of the people and under certain conditions (Article 8), and how owe beings collected and preserved (Article 6 and 7).

Article 6

a treatment can relate only to data in personal matter which satisfy the following conditions: 1° the data are collected and treated in a honest and licit way; 2° They are collected for purposes determined, explicit and legitimate and are not treated later on in a way incompatible with these finalities. However, a secondary treatment of data to fine statistics or ends of scientific research or history is regarded as compatible with the initial purposes of the data-gathering, if it is carried out in the respect of the principles and the procedures envisaged in the present chapter, chapter IV and section 1 of the chapter V like in chapters IX and X and if it is not used to make decisions with regard to the people concerned; 3° They are adequate, relevant and nonexcessive taking into consideration finality for which they are collected and their secondary treatments; 4° They are exact, complete and, if necessary, updates; the appropriate measures must be taken so that the inaccurate or incomplete data taking into consideration finality for which they are collected or treated are erased or rectified; 5° They are preserved in a form allowing the identification of the people concerned for one length of time which does not exceed the duration necessary to the finalities for which they are collected and treated.

Article 7

a data processing in personal matter must have received the assent of the person concerned or to satisfy the one of the following conditions : 1° the respect of a legal requirement falling to the person in charge of the treatment; 2° safeguard of the life of the person concerned; 3° execution of a public service mission of which the person in charge or the recipient of the treatment is invested; 4° the execution, is of a contract to which the person concerned left, that is to say précontractuelles measures taken at the request of this one; 5° the realization of the legitimate interest continued by the person in charge of the treatment or the recipient, subject to not ignoring the interest or the rights and freedoms fundamental of the person concerned.

Finally in articles 9 and 10, it specifies that only the jurisdictions, public authorities, managing people of a public service or auxiliary of law can implement data processing relating to the infringements, judgment and measurement of safety and that no legal decision or implying legal consequences perhaps based on a data processing in personal matter, thus protecting the people from any embezzlement.

Particular essential laws recognized by this law

The Data-processing law and freedoms concentrate the rights of the private individuals in four points which are:

Right of information

Article 3 of the law indicates that any person has the right to know if it is card-indexed and, if so, in which files, it is the right of information, basic right bases of all the others.

Right of opposition

The right of opposition authorizes any person to be opposed, for a legitimate reason, so that it appears in a file. Moreover it can be opposed, without justification, so that the data relating to it is used at ends of prospection, in particular commercial. Majority of the files of the public sector (tax services, police force, justice,…) are not concerned with this right.

Right of access

The right of access is complementary to right of information, since it allows by justifying of its identity the consultation of its personal data. This one gives the possibility of checking the exactitude of the data and of obtaining from it a copy at a cost not exceeding that of the reproduction. However, this right is limited: if the person in charge of the treatment estimates that the request is abusive or if the data are preserved in a form not presenting any risk, their consultation is then refused, if they are data contiguous to safety of the State, defense, or public safety (police force, gendarmerie), a member of CNIL is indicated to examine these data and thefalling due one to modify them, if this modification is not of a nature to carry damage to the national security. The treatments implemented by the public administrations, the people in charge of a public service mission and the services of imposition are also concerned with preceding measurement.

Right of correction

The right of correction, complement essential of the right of access, makes it possible any person to rectify, supplement, bring up to date, lock or make erase erroneous data relating to it. The application of this right is done primarily by written letter at the organization holder of known as information, the person in charge of the treatment will have then to justify that it carried out corrections requested, and to forward free, at the request of the person concerned, a copy of the modified recording.

Article 40 Any natural person justifying of its identity can require of the person in charge of a treatment that are, according to the cases, rectified, supplemented, updated, locked or erased the data in personal matter relating to it, which are inaccurate, incomplete, ambiguities, out-of-date, or of which collection, the use, the communication or the conservation is prohibited. source: http://www.cnil.fr/index.php?id=301

Modifications made by the law of August 6th, 2004

The law of August 6th, 2004, which transposes in the French right the provisions of European directive 95/46, makes many modifications to the law Informatique and freedoms. It was supplemented by decrees taken on October 21st, 2005 and on March 25th, 2007.

New rules relating to the declaration of the files

The new law harmonizes partially the rules of declaration of the files between Private sector and Public sector. The general scheme for the public sector is not any more to require an authorization to the CNIL, but to make a simple statement of these files, as was already the case for the private sector.

The law envisages in addition cases in which files can profit from a simplified declaration, even are exempted of declaration.

However, the public distinction between Nobody and Individual completely disappeared. The law of August 6th, 2004 indeed envisages a new procedure of request for opinion imposed on the organizations of the public sector for the creation of certain files containing of the significant data. The procedure of authorization remains for the private companies and extends to new categories of data. The files having to be the subject of a request for authorization are, inter alia, those which use the social security number (allotted by INSEE).

The Data-processing correspondent and Freedoms

The law envisages the possibility for a private or public organization of naming a “correspondent with the data protection in personal matter”, usually called “corresponding Informatique and Freedoms” (LASH). This correspondent is charged to ensure the application of the provisions of the law inside the organization. The formalities of declaration to the CNIL then are largely simplified, except for the most significant treatments, such as the automated treatments of biometric data or those which relate to the state security. Generally, he advises the company on all the relative questions with the respect of the data in personal matter.

Named by the company, either among his collaborators, or outside, it must act in an independent way compared to it. It can seize the CNIL.

This station already exists, in various forms, in other countries like the Germany ( Datenschutzbeauftragte , created in the years 1970), the Netherlands ( functionaris gegevensbescherming ) and the Sweden ( personuppgiftsombud ).

New prerogatives of the CNIL

The CNIL can from now on search in the buildings of a company between 6:00 and 21:00.

The control committee: the CNIL

The January 6th 1978, the Parlement founded not only the data-processing law and freedoms but also the controlling authority allowing its good application: the National IT commission and Libertés (CNIL).

The CNIL is directed by a pluralist college of seventeen police chiefs: 4 members of Parliament (2 deputies, 2 senators), 2 members of the Economic and Social Council, 6 representatives of the high jurisdictions (2 advisers of State, 2 advisers with the Court of appeal, 2 advisers with the Court of Auditors), 5 qualified personalities indicated by the President of the National Assembly (1 personality), by the President of the Senate (1 personality), by the Council of Ministers (3 personalities). , twelve are elected or indicated by assembled or jurisdiction to which they belong. These is currently the body which elects the president among these members, it acts of Alex Türk. The remainder of the Commission is formed of the whole of the agents of the administrative authority, contractual of the State. The CNIL is an independent authority, which cannot receive instructions of the Gouvernement or any other authority or company but whose budget is charged to that of the State. Its role is divided into five essential missions:

to inform the people of their rights and their obligations, and the government of a desirable modification of the legislation;
to guarantee the right of access, in particular while being used as intermediary for the files contiguous to the national security;
to count the data processing in personal matter;
to control, certainly its main mission, it consists in making sure of the respect of the laws;
to regulate.

Limits of the LIL: case Interpol

The OIPC (International organization of Criminal Police force), commonly called Interpol is an organization of collaboration of the international criminal police forces, born in 1923 under the impulse of the prince Albert Ier of Monaco. Placed under the direction of the Austria, which had the immense files resulting from the Empire Austro-Hungarian, she knew one black period during the Second world war, while becoming a base of the Jewish genocide, at the time of her command Nazi. Having survived thanks to the tenacity of a Belgian police officer, it obtained in 1955 a charter, base of its principles. Installed in Lyon since 1989, this famous organization, which counts today 182 participating members actively with the fight against the serious crime and in particular terrorism, had been pointed out in 1982, while refusing to take part in the arrest of Klaus Barbie, former Nazi criminal, chief of Gestapo rhônalpine, of torture of Jean Moulin, it had taken refuge in Bolivia and was expelled after the fall of the Général Banzer (militarist dictator of 1971 with 1978, then President of 1997 with 2001) to be judged with Lyon.

At the end of the Seventies, Interpol decided to computerize its base of information, still treated manually. This computerization caused conflict between the organization, based with Saint-Cloud at the time, and the French Republic which supported that its law Informatique and freedoms were applicable to the data contained in the buildings of the organization, to which it had right of access. Interpol estimated that the application of this law was impossible for two reasons: information which it holds is property of the Member States, it is only the agent, the fact of subjecting it to a legislative system gives him an off-shore character, moreover that would be likely to compromise the international police co-operation, certain countries preferring to give up communicating information to which would have access freely the French State.

After several years of conflicts, the two parts are reflected agreement by the signature of a new headquarters agreement on November 3rd, 1983 and an exchange of letters in 1984. The first text defines not only the general framework of the organization (imperceptible property, diplomatic immunity of its dignitaries, very little tender to the tax…), but also the inviolability of the files and the files of Interpol; the second preaches the installation of an authority of internal control of the files and not main road. Thus France gave up making apply its law to the files of the Organization thanks to the guarantees that the latter provided, to ensure the international cooperation.

Random links: