National Commission of data processing and freedoms

The National Commission of data processing and freedoms ( CNIL ) is a independent Administrative authority French charged to take care of the and data protection in personal matter the private life. It was created by the law n° 78-17 of the January 6th 1978 relating to the Informatique, the file S and the Liberté S.

History

The CNIL was created in 1978, following the scandal of the project SAFARI ( Automated system for the Administrative Files and the Repertory of the Individuals ), which aimed at inter-connecting the name files of the French administration, in particular by the means of the Numéro INSEE. The revelation of this project, the March 21st 1974 by the daily newspaper Le Monde , had involved a sharp popular opposition, and the creation of the National Commission of Data processing and Freedoms a few years later.

Missions

The missions of the CNIL are directed around three axes:

information;
control;
repression.

In 2005, the CNIL recorded 80.677 new data processing personal, informed 3834 complaints, carried out 96 controls, sent 36 injunctions and pronounced 10 warnings.

Information

The CNIL informs the public authorities and the professionals implementing data processing personal on their duties, and the citizens on their rights. It also makes it possible to the citizens to exert their right of access known as indirect with certain files (e.g.: file of the general informations).

The means used for this information are in particular its Internet site (for general information on the law and its modes of enforcement), the annual report, the publicity made on key deliberations (via the press), the organization of meetings regional sets of themes bound for the professionals.

Control

The control of the respect of the law is carried out a priori (by the instruction of the files of declaration) and a posteriori (by visits in the companies and organizations, following a complaint or not).

Repression

The capacities of sanction conferred by the legislator are the warning, the injunction and the financial sanction. The CNIL can also seize the parquet floor in the most serious cases.

Composition and independence

The CNIL is made up of a pluralist college of seventeen members, the Police chiefs. Among them one counts:

twelve police chiefs elected by the organizations which they represent: French National Assembly, Senate, Council of State, Court of appeal, Court of Auditors, Economic and Social Council);
three qualified personalities named by decree;
two indicated respectively by the Presidents of the National Assembly and the Senate.

A government commissioner, appointed by the Prime Minister, seat near the Commission.

The term of the office of the police chiefs is five years, renewable once, except for the police chiefs resulting from the Economic and Social Council, the National Assembly and the Senate for which the term of the office corresponds to the duration of their mandate in their parent institution.

The seventeen police chiefs elect among them the office, composed of a President, a deputy Vice-president and a Vice-president. Since February 3rd, 2004, it is the senator Alex Türk who chairs the CNIL.

The statute of administrative authority of the CNIL confers to him a great independence in the choices and the actions which she undertakes. However, its capacities are limited and defined by the law. The CNIL is financed by the budget of the French State.

Means

In 2006, the CNIL employs 95 agents (correspondent with an equivalent in worked full-time of 90 people), against 82 in 2004 and 57 in 1995.

In 2006, the CNIL has a budget of 9 million euros (7 million in 2005). This increase in particular allowed the increase in manpower of 15 people. The will of its President is to improve information and control.

In 2007, the president of the CNIL, Alex Türk, denounced several times his lack of means to treat the files, going until cumulating several years of delay on certain types of complaints.

Legal context

The CNIL was instituted by the data-processing Loi and freedoms of 1978. This law constitutes the bases of the data protection in personal matter in the data processing implemented on the French territory.

The law of August 6th, 2004 largely amended the law of 1978 while transposing the European directive on the data protection in personal matter in French right. It reduces in a substantial way the declaratory obligations of the holders of files, increases the capacity of the CNIL (investigations on the spot and sanctions) and reinforces the rights of the people.

Broad outlines of the data law

Admissibility of the treatments

To be legal, the treatment must answer the following principles:

its finality is given, explicit and legitimate;
the collected and treated data are adequate, relevant and nonexcessive in comparison with the continued purpose;
the shelf life of the data should not go to beyond only the duration necessary to the continued purpose (except statistical, historical or scientific need);
the person in charge of the treatment must take care of the respect of the integrity and the data confidentiality;
the person in charge of the treatment must respect the rights of the thirds (right of access, of correction, opposition).

Declaration of the treatments

The law envisages various methods of declaration of the data processing according to the sensitivity of these last:

request for opinion (for the public sector only);
request for authorization for:

treatments using of the significant data, the such racial origins, the religion, the sexual life, etc,
exchanges of information apart from the European Union,
genetic data,
relative data with the infringements, judgment and with safety,
treatments aiming at excluding from a right, benefit or contract,
interconnection of files from which the finalities are different;

normal declaration;
simplified declaration (for certain current cases, if a simplified standard were created by Cnil);
exemption (for certain current cases, if the CNIL created an exemption).

Measurements of declarations can be reduced if the person responsible for the treatment appointed a Data-processing Correspondent and Freedom (LASH).

The declaration does not exempt a respect of the criteria of admissibility of the treatment.

European and international context

The Germany in 1971, the Sweden, in 1973, and the France in 1978 were the first three countries equipped with a data-processing Loi and freedoms. These laws institute the creation of independent controlling authorities.

Certain economic structures and international policies were inspired some, among which the economic Cooperation organization and by development (OECD) in 1980, the the Council of Europe in 1981 (Convention for the protection of the people with regard to the data processing automated in personal matter) and the the United Nations (UNO) in 1990. In 1995, the European commission emitted a directive in this direction, that the countries of the European Union must transpose.

Since the January 28th 2007, a European Journée of the personal data protection to character is organized by the Council of Europe and is relayed in France by the CNIL.

References

Random links: