Texts transposed Directive 2002/58 / EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the the electronic communications sector (directive on privacy and electronic communications) implementing legislation Decree No. 2005-556 of 27 May 2005 on the establishment on an experimental basis of automated processing of personal data relating to passengers from the airport Roissy - Charles-de-Gaulle Décret No. 2005-937 of August 2, 2005 taken for the application of article L. 211 - 7 du code of the entry and stay of foreigners and asylum seekers and on the automatic processing of personal data relating to requests for validation of certificates home Decree No. 2005-1309 of 20 October 2005 taken for the application of Act No. 78-17 of 6 January 1978 relating to data processing the files and freedoms, amended by law No. 2004-801 of 6 August 2004 summary amendment of the penal code, the code of posts and telecommunications, the code of public health, social action and family code, the code of criminal procedure, of the rural code, the labour code, the code of social security, of the heritage code , of the code of consumption. Amendment of Act No. 78-17 of 6 January 1978 relative to information technology, files and freedoms: Modification: articles 2 to 5, and chapters II 'Conditions of lawfulness of the processing of personal data' (articles 6 to 10), III 'The national commission of computing and freedoms' (articles 11 to 21), IV "In implementing treatment formalities" (articles 22 to 31) V "Obligations responsible for treatment and rights of persons" (articles 32 to 43), VI "control the implementation of treatment" (article 44), VII "Sanctions by the National Commission of computing and freedoms" (articles 45 to 49), VA becoming the chapter IX, entitled: "processing of personal data with end research in the field of health". articles 40-1 to 40-8 modified becoming articles 53 to 60, chapter V ter becoming the chapter X, entitled: "processing of health data personal for the purposes of evaluation or analysis practices or care and prevention activities», articles 40-11 to 40-15 modified becoming articles 62-66; creation of Chapter VIII 'Criminal provisions' comprising sections 50 to 52, of section 61 in chapter IX, chapter XI "Treatment of personal data for the purposes of journalism and literary and artistic expression" including article 67 of chapter XII "transfers of data personal to States not belonging to the Community European" including articles 68 to 70 Chapter XIII "Miscellaneous provisions" including articles 71 and 72; repeal of articles 40-9, 40-10. Amendment of Act No. 95-73 of 21 January 1995 orientation and safety programming: amendment to article 10 (establishment of a VI a). Amendment of Act No. 99-944 of 15 November 1999 the civil Pact of solidarity: creation: after article 14 article 14-1. Amendment of Act No. 84-575 of July 9, 1984, containing various provisions of a social nature: amendment of article 1. Amendment of Act No. 85-10, January 3, 1985, containing various provisions of a social nature: amendment of article 78. Amendment of Act No. 95-116 of 4 February 1995 on the various provisions of a social nature: amendment: section 64. Amendment of Act No. 2003-239 of 18 March 2003 on internal security: amendment of article 24. Complete transposition of directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the sector of electronic communications (directive on privacy and electronic communications).

Key words JUSTICE, criminal CODE, CODE of P and T, CSP, ASF, MPC, RURAL CODE, labour CODE, CSS, CODE of heritage, of the consumer CODE, computing, processing automates, PROTECTION, no physics, data processing, personal, responsible for the treatment, recipient of the treatment, legality, CNIL, status, AAI, MISSION, OBLIGATION, security, confidentiality, right of access INDIRECT, SANCTION, community overseas, Bill, European DIRECTIVE
, DIRECTIVE life privacy and COMMUNICATIONS electronics, TRANSPOSITION COMPLETE folders statutory legislative record of the law n ° 2004-801 of 6 August 2004 JORF n ° 182, August 7, 2004 page 14063 text no. 2 Law No. 2004-801 of 6 August 2004 on the protection of individuals with regard to the processing of personal data and amending Act No. 78-17 of 6 January 1978 relating to data processing the files and freedoms (1) NOR: JUSX0100026L ELI: https://www.legifrance.gouv.fr/eli/loi/2004/8/6/JUSX0100026L/jo/texte Alias: https://www.legifrance.gouv.fr/eli/loi/2004/8/6/2004-801/jo/texte the National Assembly and the Senate have adopted, having regard to the Council decision constitutional No. 2004 - 499 DC of 29 July 2004;
The President of the Republic enacts the law whose content follows: title I:: provisions amending the Act of 6 January 1978 RELATIVE to information technology, files and freedoms Article 1 articles 2 to 5 of Act No. 78-17 of 6 January 1978 on data processing, files and freedoms read as follows: «art.» 2. - this Act applies to automated processing of personal data, as well as to non-automated processing of personal data or are intended to be included in files, with the exception of the treatments carried out in the exercise of activities exclusively personal, when their Manager fulfils the conditions laid down in article 5.
"Constitutes a personal data any information related to an individual identified or which can be identified, directly or indirectly, by reference to an identification number or to one or more elements that are specific. '' To determine whether a person is identifiable, should consider all the means to allow its identification available or which can access the person responsible for the processing or any other person.
"Constitutes processing of personal data any operation or any set of operations on such data, what make the process used, and including the collection, registration, organization, conservation, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or any other form of disposal, the approximation or the interconnection, and locking. erasure or destruction.
"Is a data file personal all structured and stable of personal data accessible according to specific criteria.
"The person concerned by a treatment of personal data is one to which relate the data that are the subject of treatment.
«Art.» 3. - i. - the head of a processing of personal data is, except Express designation by the legislative and regulatory provisions in this treatment, the person, public authority, service or body who determines the purposes and means.
«II.-the recipient of personal data processing is any person entitled to receive communication of these data other than the data subject, the controller, the sub-contractor and persons who, due to their functions, are responsible for processing the data. '' However, the authorities legally empowered, in a particular mission or the exercise of a right of communication, to ask the controller to inform them of personal data are not recipients.
«Art.» 4 - the provisions of this Act shall not apply to temporary copies that are made in the context of the technical activities of transmission and providing access to a digital network, for the automatic, intermediate and transient storage of data and sole purpose of allowing other recipients of the service the best possible access to transmitted information.
«Art.» 5. - i. - are subject to this Act the processing of personal data: "1 ° including the person in charge is established on french territory. The head of a treatment that pursues an activity in the french as part of a Setup territory, regardless of its legal form, is considered as established;
«2 ° Manager, without be established on french territory or on that of another State member of the European Community, which uses means of processing located on french territory, excluding treatments that are used only for purposes of transit on this territory or that of another State member of the Community European. ''

«II.-for treatments referred to in 2 ° of the I, the responsible officer refers to the National Commission of computing and freedoms a representative established on french territory, which replaces him in the fulfilment of the obligations laid down by this Act; This designation shall not preclude actions that might be brought against him. » Section 2 Chapter II of Act No. 78-17 of 6 January 1978 reads as follows: ' chapter II ' Conditions of lawfulness of the processing of personal data "Section 1" General provisions «Arts»»»»»» 6 - treatment cannot bear on data personal that meet the following conditions: "1 ° data are collected and treated fairly and lawfully;
«2 ° they are collected for specified, explicit and legitimate purposes and are not processed subsequently in a way incompatible with those purposes. However, further processing of data for statistical purposes or for purposes of scientific or historical research is considered compatible with the initial data collection purposes, if it is realized in respect of the principles and procedures provided for in this chapter, chapter IV and section 1 of chapter V as well as in chapters IX and X and if it is not used to make decisions with respect to the persons concerned;
«3 ° they are adequate, relevant and not excessive in relation to the purposes for which they are collected and their subsequent treatment;
«4 ° they are accurate, complete, and, if necessary, updated; appropriate measures must be taken to ensure that inaccurate or incomplete data having regard to the purposes for which they are collected or processed are erased or rectified;
"5 ° they are kept in a form which permits identification of data subjects for a period that does not exceed the time necessary for the purposes for which they are collected and processed.
«Art.» 7 - treatment of personal data must have received the consent of the person concerned or comply with any of the following conditions: "1 ° the compliance with a legal obligation incumbent on the controller;
«2 ° the protection of the life of the person concerned;
«3 ° the execution of a public service mission vested in the head or the recipient of the treatment;
«4 ° execution, either of a contract to which the concerned person is a party, or take steps at the request of it;
«5 ° the purposes of the legitimate interests pursued by the controller or by the recipient, subject to not ignore the interest or the fundamental rights and freedoms of the person concerned.» Section 2 "provisions specific to certain categories of data «Art» 8. - i. - it is forbidden to collect or process personal data that reveal, directly or indirectly, racial or ethnic origins or political, philosophical or religious opinions or trade-union membership of persons or relating to health or sex life of these.
«II. - insofar as the purpose of the processing required for certain categories of data, are not subject to the prohibition contained in the I: "1 ° treatments for which the person concerned has given his express consent, except in the case where the law provides that the prohibition in the I may be waived by the consent of the person concerned;
«2 ° treatments necessary for the safeguarding of human life, but to which the person concerned cannot give consent as the result of legal incapacity or physical impossibility;
«3 ° treatments implemented by an association or any other non-profit and religious, philosophical, political or trade union body: "-for the only data listed in the I corresponding to the subject of the association or of the said organization;
"- subject that they concern only the members of this association or of this organization and, where appropriate, persons who maintain with regular contacts in its activity;
"- and that they relate only to data not communicated to third parties, unless the persons concerned consent expressly;
«4 ° the processing of data personal made public by the person concerned;
«5 ° treatment required the recognition, exercise or defence of legal claims;
«6 ° treatments required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health services and implemented by a member of a profession of health, or by another person that is necessary because its functions the obligation of professional secrecy provided for in article 226-13 of the penal code;
«7 ° statistical treatments carried out by the national Institute of statistics and economic studies or one of the statistical departments in compliance with Act No. 51-711 of 7 June 1951 on the obligation, the coordination and the secret in statistics, after opinion of the national Council for statistical information and under the conditions laid down in article 25 of this Act;
«8 ° the treatments required for research in the field of health as laid down in chapter IX.»
"III. - If the personal data included in the I are to be promptly of a process of reducing the identifiability complies with the provisions of this Act by the National Commission of data processing and freedoms previously recognized, it may authorize, given their purpose, certain categories of treatments as laid down in article 25. The provisions of chapters IX and X shall not apply.
"IV.-Likewise, are not subject to the prohibition in the treatments, automated or not, I justified by the public interest and authorised under the conditions laid down in the I of article 25 or article II ' 26
«Art.» 9 - treatment of personal data relating to offences, convictions and security measures can be implemented only by: '1 ° the courts, public authorities and legal persons managing a public service, acting within the scope of their statutory responsibilities;
«2 ° auxiliary of justice, for the strict needs of the exercise of the tasks entrusted to them by law;
«3 ° [provisions declared non-conforming to the Constitution by Council decision of constitutional No. 2004 - 499 DC of 29 July 2004;]. 4 ° legal persons referred to in articles L. 321 - 1 and L. 331 - 1 of the intellectual property code, acting under the rights which they ensure the management or on behalf of victims of violations of the rights provided in the books I, II and III of the same code for the purposes of the defence of these rights.
«Art.» 10 - no court decision involving an assessment of a person's behavior cannot be based on automated processing of data intended to evaluate certain aspects of his personality.
"No other decision produces legal effects with respect to a person may be taken based solely on automated processing of data intended to define the profile of the person concerned or to assess some aspects of his personality.
"Are not regarded as taken solely on the basis of automated processing decisions taken in the context of the conclusion or performance of a contract and for which the person concerned has been able to present its observations, nor those satisfying the requests of the person concerned."


Article 3 read more on this article...

Chapter III of Act No. 78-17 of 6 January 1978 reads as follows: "chapter III" the National Commission for computing and liberties «Art»» 11 - computing and liberties National Commission is an independent administrative authority. It exercises the following missions: "1 ° it shall inform all persons concerned and all responsible treatment of their rights and obligations;
«2 ° it ensures that the processing of personal data are implemented in accordance with the provisions of this Act.
"As such: ' a) it authorizes the treatment referred to in article 25, gives an opinion on the treatment referred to in articles 26 and 27 and receives declarations on other treatments;
"(b) it establishes and publishes the standards mentioned in the I of article 24 and provides, where appropriate, model of regulations to ensure the safety of the systems;
"(c) it receives complaints, petitions and complaints relating to the implementation of the processing of personal data and shall inform their authors on the follow-up given to them;
"(d) she responds to requests for opinions of the public authorities and, where appropriate, of the courts, and advises individuals and organizations that are implementing or planning to implement the automated processing of personal data;

"(e) it shall inform without delay the Prosecutor of the Republic, in accordance with article 40 of the code of criminal procedure of the offences of which it has knowledge, and may submit observations in criminal proceedings, in accordance with section 52;
"(f) it may, by special decision, designate one or more of its members or officers of its services, in the conditions laid down in article 44, of conduct audits on all treatments and, where appropriate, to obtain copies of all documents or information materials useful to its missions;
"(g) it may, in the conditions laid down in Chapter VII, an opinion with respect to a controller in one of the measures provided for in article 45;
"(h) responds to requests for access to the treatment referred to in articles 41 and 42;
«3 ° at the request of organisations or institutions comprising mainly officials of treatments: ' a) it gives an opinion on compliance with the provisions of this Act of draft professional rules and procedures and products aimed at the protection of individuals with regard to the processing of data personal, or anonymization of data submitted;
"(b) it has an appreciation on the guarantees offered by professional rules that it has previously recognized comply with the provisions of this Act, with regard to respect for the fundamental rights of persons;
"(c) it issues a label to certain products or procedures for the protection of individuals with regard to the processing of personal data, after that they recognized in accordance with the provisions of this Act;
«4 ° it keeps informed of the progress of information technology and make public where appropriate appreciation of the consequences resulting therefrom for the enjoyment of the rights and freedoms referred to in article 1;
"As such: ' a) it is consulted on any draft law or decree on the protection of individuals with regard to automated processing;
"(b) proposed to the Government the legislative or regulatory measures of adaptation of the protection of freedoms in the evolution of processes and information technology;
"(c) at the request of other independent administrative authorities, it can support the data protection;
"(d) it can be associated, at the request of the Prime Minister, in the preparation and the definition of the French position in international negotiations in the field of the protection of the personal data. It can participate, at the request of the Prime Minister, the French representation in organizations international - organizations community and competent in this area.
"For the performance of its tasks, the commission may proceed by way of recommendation and individual or regulatory decisions in the cases provided by this Act.
' The commission shall submit each year to the President of the Republic, the Prime Minister and the Parliament a public report giving an account of the execution of its mission. ''
«Art.» 12. - the National Commission of computing and freedoms has credits necessary for the performance of its tasks. The provisions of the law of August 10, 1922 on financial control are not applicable to their management. The commission's accounts are presented to the control of the Court of Auditors.
«Art.» 13 - i. - the National Commission of computing and freedoms is composed of seventeen members: "1 ° two deputies and two senators, designated respectively by the National Assembly and the Senate;
«2 ° two members of the economic and social Council elected by this Assembly;
«3 ° two members or former members of the State Council, at a grade at least equal to that of Advisor, elected by the General Assembly of the Council of State;
«4 ° two members or former members of the Court of cassation, rank at least equal to that of Advisor, elected by the General Assembly of the Court of cassation;
«5 ° two members or former members of the Court of Auditors, a grade at least equal to that of conseiller Maître, elected by the General Assembly of the Court of Auditors;
«6 ° three personalities qualified for their knowledge of information technology or questions relating to individual freedoms, appointed by Decree;
«7 ° two personalities qualified for their knowledge of information technology, designated respectively by the President of the National Assembly and the President of the Senate. ''
"The commission shall elect its members a Chairperson and two Vice-Chairpersons, including an Executive Vice President. They make up the bureau.
"The formation of the commission is composed of the president, vice-presidents and three members elected by the commission in its midst for the duration of their mandate.
"In the case of equal division of votes, the president is dominating.
"II. the mandate of the members of the commission mentioned in the 3 °, 4 °, 5 °, 6 ° and 7 ° of the I is five years; It is renewable once. Members mentioned in 1 ° and 2 ° shall sit for the duration of the mandate to the origin of their designation; their mandates of Member of the National Commission of data processing and freedoms may not exceed a period of ten years.
"The Member of the commission who ceases to perform his duties while in office is replaced, in the same conditions, for the duration of his term.
"Except resignation, it cannot be put an end to the duties of a member in the event of impediment observed by the commission under the conditions that it sets.
'The commission shall establish rules of procedure. This regulation lays down the rules relating to the Organization and the functioning of the commission. It stipulates rules discussions, instruction files and their presentation before the commission.
«Art.» 14. - i. - membership of the commission is incompatible with that of Member of the Government.
«II. - no member of the commission may: «-participate in a deliberation or undertake verifications relating to a body in which it holds a direct or indirect interest, exercises functions or holds a mandate;
«-participate in a deliberation or undertake verifications relating to a body in a le sein de lequel which he has, during the 36 months preceding the deliberation or the verifications, held an interest, direct or indirect, exercised the functions or held a mandate. ''
"III. - any member of the commission shall inform the president of the direct or indirect interest that he holds or comes to hold, functions that he exercises or comes to exercise and any mandate that he holds or comes to hold within a legal person." This information, as well as those concerning the President, are held at the disposal of the members of the commission.
"The president of the commission shall take appropriate measures to ensure respect for the obligations arising from this section.
«Art.» 15. - subject to the office and restricted training skills, the commission meets in plenary.
"In case of equal division of votes, the vote of the president is dominating.
"The commission may entrust the Chairman or Vice-Chairman delegated to exercise those responsibilities mentioned: '-in the third paragraph I of article 23;
«- to the e and f of 2 ° of article 11;
«- to the c of 2 ° of article 11;
«- to the d of 4 ° of article 11;
'- in articles 41 and 42;
'- to article 54;
"- in articles 63, 64 and 65;
'- in the last paragraph of article 69;
'- in the first paragraph of section 70.
«Art.» 16 - office can be established by the commission to exercise the powers of the mentioned: '-in the last paragraph of article 19;
'- in article 25, in an emergency;
"- in the second paragraph of article 70.
'The Office may also be responsible, in an emergency, the decisions referred to in the first paragraph of the article I 45'
«Art.» 17 - the formation of the commission pronounced the measures laid down in the 1 ° of II of article 45 and the I.
«Art.» 18 - a Commissioner of the Government, appointed by the Prime Minister, sits with the commission. Deputy Commissioners may be appointed under the same conditions.
"The Commissioner of the Government attends all the deliberations of the commission en banc or limited training, as well as those of meetings of its bureau which have as their object the exercise of the powers delegated under section 16; He is recipient of all its opinions and decisions.
"He may, except in regard to sanctions, cause a second deliberation, which must take place within ten days of the initial deliberation.
«Art.» 19 - the commission has services headed by the president and placed under his authority.
"The staff of the commission are appointed by the president.
"If necessary, the Executive Vice President exercises the powers of the president.
"The Secretary general is responsible for the functioning and coordination of the services under the authority of the president.

"Those officers who may be called upon to participate in the implementation of the tasks of verification referred to in article 44 shall there be authorized by the commission; This authorization does not exempt from the application of the provisions defining the procedures authorising access to secrets protected by law.
«Art.» 20 - members and officers of the commission are obliged to confidentiality for the facts, acts or information of which they have knowledge by reason of their duties, under conditions laid down in article 413-10 of the criminal code and, subject to what is necessary for the preparation of the annual report, in article 226-13 of the code.
«Art.» 21 - in the exercise of their functions, the members of the commission receive instruction from any authority.
"Ministers, public authorities, public or private business executives, officials of various groups and more generally the holders or users of treatments or personal data files cannot oppose the action of the commission or its members and instead must take all necessary measures to facilitate its task.
"Except in the case where they are bound to professional secrecy, respondents in the context of the checks made by the commission in application of the f 2 ° of article 11 are required to provide the information requested by it for the performance of its duties.".


Article 4 more on this article...

Chapter IV of Act No. 78-17 of 6 January 1978 reads as follows: "chapter IV" requirements before implementing treatments «Art»» 22 - i. - with the exception of those falling within the provisions laid down in articles 25, 26 and 27 or which are referred to in the second subparagraph of article 36, the treatment automated of personal data are the subject of a declaration to the national data processing and Liberties Commission.
«II.-However, are subject to any of the formalities provided for in this chapter: "1 ° treatments with the single object of a register which, under legislative or regulatory provisions, is intended exclusively for the public information and is open for viewing or any person with a legitimate interest;»
"2 ° processing mentioned in 3 ° of article 8 II.
"III.-treatments for which the Manager has designated a correspondent to the protection of the personal data to ensure compliance with the obligations laid down in this Act in an independent manner, are exempted from the formalities provided for in articles 23 and 24, except when a transfer of data to a State not member of the Community European is envisaged."
"The designation of the correspondent shall be notified to the National Commission of computing and freedoms. It is brought to the attention of bodies representing staff.
"The correspondent is a person enjoying the qualifications required to carry out its tasks. It maintains a list of the treatments carried out immediately accessible to any person upon request and cannot be subject to any sanction on the part of the employer by reason of the performance of its tasks. It can enter the National Commission of data processing and freedoms of the difficulties it faced in carrying out its missions.
"In the event of failure to comply with the provisions of the Act, the responsible for the treatment is directed by the National Commission of computing and freedoms of carry out the formalities laid down in articles 23 and 24. In the event of failure to perform the duties, correspondent is discharged from his functions on demand, or after consultation, of the National Commission of data processing and freedoms.
«IV. - the head of a processing of personal data which is subject to any of the formalities provided for in this chapter communicates to any person who requests information about this treatment referred to the 2 ° to 6 ° of the I of article 31. "» Section 1 "Declaration «Art» 23. - i. - the declaration includes the commitment that the treatment meets the requirements of the Act.
"It can be addressed to the National Commission of computing and freedoms electronically.
'The commission shall immediately issue a receipt, if any electronically. The applicant can implement treatment on receipt of this receipt; It is exempt from any of its responsibilities.
«II. - treatments under a single agency and with identical purposes or may be the subject of a single declaration. In this case, the information required pursuant to section 30 are provided for each of the treatments only insofar as they are clean.
«Art.» 24 - i. - for the most common categories of processing of personal data, whose implementation is not likely to violate privacy or liberties, the National Commission for computing and liberties shall establish and publish, after receiving appropriate proposals made by representatives of public and private agencies representative standards intended to simplify the reporting obligation.
"These standards specify:" 1 ° the purposes of salaries subject to a declaration simplified;
«2 ° data personal or categories of personal data processed;
«3 ° the categories of persons concerned;
«4 ° the recipients or categories of recipients to whom the personal data are communicated;
"(5) the duration of retention of personal data.
"Treatments that conform to these standards are a simplified declaration of compliance electronically to the commission, where appropriate.
«II.-the commission may define, among the categories of treatments mentioned in the I, those which, given their purposes of their recipients or categories of recipients, the personal data processed, the shelf life of these and the categories of persons concerned, are exempted from declaration. ''
«Under the same conditions, the commission may authorise officials of certain categories of treatments to make a unique statement according to the provisions of article 23 II. «» Section 2 ' permission «Art» 25. - i. - are being implemented after authorization by the National Commission of computing and freedoms, excluding those mentioned in articles 26 and 27: "1 ° treatments, automated or not, mentioned in 7 of the II, III and IV of article 8;
«2 ° treatments automated genetic data, with the exception of those which are being implemented by physicians or biologists and which are necessary for the purposes of preventive medicine, medical diagnosis or the administration of care or treatment;
«3 ° treatments, automated or not, bearing data relating to offences, convictions or security measures, except those that are implemented by auxiliaries of justice for the purposes of their defence missions persons concerned;
«4 ° likely automated treatment, by virtue of their nature, their scope or their purposes of excluding individuals from a right, benefit or a contract in the absence of any legislative or regulatory provision;
«5 ° treatments automated aimed: "-the interconnection of files of one or several legal entities managing public service and whose purposes correspond to different public interests;
«- the interconnection of files of others and whose main purposes are different;
«6 ° treatments with data which include the number of persons to the national Repertory of identification of natural persons and those who require a consultation of this directory without including the number of persons;
«7 ° treatment automated of data with assessments on the social difficulties of the people;
«8 ° treatment automated of biometric data necessary for the control of the identity of persons.
«II. - for the purposes of this article, treatments that respond to a same purpose, relate to categories of identical data and have the same recipients or categories of recipients may be authorized by a single decision of the commission. In this case, each data controller addressed to the commission a commitment to compliance to the description given in the authorisation.
"III. - the National Commission of computing and freedoms shall decide within a period of two months from the receipt of the request. However, this period may be renewed once on reasoned decision of its Chairman. When the commission was not taken within these deadlines, the application for authorisation is deemed rejected.

«Art.» 26 - i. - authorized by order of the Ministers competent, taken after notice reasoned and published by the national data processing and Liberties Commission, the processing of data personal implemented on behalf of the State and: "1 ° affecting the security of the State, defence or public security;
«2 ° or which have as their object the prevention, investigation, finding or the prosecution of criminal offences or the execution of criminal sentences or security measures.
"The opinion of the Committee is published with the Decree authorising the processing.
'II. - those of these treatments that focus on data listed in the I of article 8 shall be authorized by Decree in Council of State opinion reasoned and published by the commission; This notice is published with the Decree authorising the processing.
"III. - Some treatments mentioned in the I and II can be exempted, by a decree in Conseil d'Etat, the publication of the regulatory act that allows; for these treatments, is published as Decree authorizing exemption from publication of the Act, the meaning of the opinion delivered by the Committee.
"IV. - for the purposes of this article, the treatments that respond to a same purpose, relate to categories of identical data and have the same recipients or categories of recipients may be authorized by a single regulatory act. In this case, each data controller addressed to the commission a commitment to compliance to the description given in the authorisation.
«Art.» 27. - i. - are authorized by Decree in Council of State, taken after opinion reasoned and published by the national data processing and Liberties Commission: "1 ° the processing of data personal implemented on behalf of the State, a legal person under public law or a legal person of private law manages a public service, covering data which include the number of persons to the national identification of natural persons directory;
«2 ° the processing of data personal implemented on behalf of the State covering necessary biometric authentication or the control of the identity of the people. ''
«II.-authorized by order or, in the case of treatment carried out on behalf of a public institution or a legal person of private law manages a public service, by decision of the deliberative body responsible for their organisation, taken after opinion reasoned and published by the national data processing and Liberties Commission: "1 ° treatments implemented by the State or legal entities mentioned in the I which require a consultation of the national identification of natural persons directory without include» the number of entry in this directory;
«2 ° those treatments mentioned in the I: '-which contain any of the data mentioned in the I of article 8 or article 9;
'- which do not give rise to an interconnection between processing or files corresponding to different public interests;
"- and which are implemented by services whose mission, either of the conditions or the extent of a right of citizens to establish base, to control or to recover charges or taxes of any nature, either for statistical purposes;
«3 ° the processing of census of the population, in metropolitan France and in communities located overseas;
«4 ° treatments implemented by the State or legal entities mentioned in the I for the purposes of putting at the disposal of the users of the administration one or more online services of e-Government, if these treatments relate to data which include the number of the entry of persons to the national identification directory or any other identifying individuals. ''
'III. - the provisions of the IV of article 26 shall apply to the treatment of this article.
«Art.» 28 - i. - the National Commission of computing and freedoms, entered under sections 26 or 27 shall decide within a period of two months from the receipt of the request. However, this period may be renewed once by reasoned decision of the president.
"II. - the opinion asked the commission on treatment, which is not rendered upon the expiry of the time limit under the I is deemed favourable."
«Art.» 29 - the acts authorizing the creation of a treatment in accordance with articles 25, 26 and 27 shall specify: '1 ° the name and the purpose of the processing;
«2 ° service which is exercising the right of access defined in Chapter VII;
«3 ° the categories of personal data recorded;
«4 ° the recipients or categories of recipients eligible to receive communication of such data;
«5 ° where appropriate, derogations from the obligation to provide information laid down in article 32 V. «» Section 3 «common provisions «Art» 30 - i. - declarations, applications for permission and advice to the National Commission of computing and freedoms under the provisions of sections 1 and 2 specify: "1 ° the identity and address of the data controller or, if he is established neither on the national territory nor to that of another State member of the European Community, that of his representative and. where applicable, the person making the request;
«2 ° the purposes of the processing, as well as for treatment under articles 25, 26 and 27, the General description of its functions;
«3 ° where appropriate, interconnectors, reconciliations, or any other forms of relationship with other treatments;
«4 ° the personal data processed, their origin and the categories of persons concerned by the treatment;
«5 ° the shelf life of processed information;
«6 ° the services responsible to implement the treatment as well as for treatment pursuant to articles 25, 26 and 27, the categories of persons who, because of their duties or for the purposes of the service, have direct access to the recorded data;
«7 ° the recipients or categories of recipients eligible to receive communication of data;
«8 ° the function of the person or the service from which is exercised the right of access provided for in article 39, as well as measures relating to the exercise of this right;
«9 ° the provisions taken to ensure the security of processing and data and the guarantee of secrets protected by law and, where appropriate, the indication of the use of a subcontractor;
«10 ° where appropriate, the transfer of personal data envisaged in a non Member State of the European Community, in any form whatsoever, excluding treatments that are used only for purposes of transit through the territory of french or in that of another Member of the Community European within the meaning of the provisions of the 2 ° of article 5 I..
«II. - the head of a treatment already declared or authorized shall inform without delay the commission: "-any change affecting the information referred to in I;
"- of any deletion treatment.
«Art.» 31 - i. - the commission is available to the public the list of automated processing having been the subject of one of the formalities provided for in articles 23 to 27, with the exception of those mentioned in III of article 26.
"This list accurate for each of these treatments:" 1 ° the Act determining the creation of treatment or the date of the declaration of this processing;
'2 ° the name and the purpose of the processing;
«3 ° the identity and the address of the data controller or, if it is established on national territory or that of another State member of the European Community, those of his representative;
«4 ° the function of the person or service with which to exercising the right of access provided for in article 39;
«5 ° the categories of personal data making the object of the processing and the recipients and categories of recipients eligible to receive communication;
"6 ° where appropriate, the transfer of personal data envisaged to a State not a member of the European Community.
"II. - the commission is available to the public its opinions, decisions or recommendations.
'III. - the National Commission of computing and freedoms shall publish the list of States which the Commission of the European communities has established that they ensure a sufficient level of protection with respect to a transfer or a category of transfers of data personal.'


Article 5 read more on this article...

Chapter V of Act No. 78-17 of January 6, 1978 is entitled: «obligations responsible for treatment and rights of people. This chapter includes sections 32 to 42 and article 40, which becomes article 43. It includes two sections thus written: "Section 1" obligations managers of treatments «Art»» 32 - i. - the person with which are collected data to personal the is informed, unless it has been previously, by the controller or his representative:

"1 ° of the identity of the data controller and, where applicable, that of his representative;
«2 ° the aim pursued by the processing for which the data are intended;
«3 ° the character obligatory or optional answers;
«4 ° of the possible consequences, in respect of a failure to reply;
«5 ° the recipients or categories of recipients of the data;
«6 ° of the rights that it takes the provisions of section 2 of this chapter;
«7 ° where appropriate, the transfer of personal data envisaged to a State not a member of the European Community.
"When such data are collected by means of questionnaires, they shall bear reference to the requirements of 1 °, 2 °, 3 ° and 6 °.
«II. - any person user of electronic communications networks shall be informed in a clear and complete manner by the controller or his representative: '-the purpose of any action to access, by way of electronic transmission, to information stored in his connection terminal equipment, or register, by the same way, information in his connection terminal equipment;
«- means at its disposal to oppose it.
"These provisions are not applicable if the access to the information stored in the terminal equipment of the user or the inclusion of information in the terminal equipment of the user:"- either a purpose is exclusive to allow or facilitate communication by electronic means;
"- or is strictly necessary for the provision of a service of communication line at the express request of the user.
"III.-when the personal data have not been collected from the person concerned, the data controller or his representative must provide it the information listed in the I on the registration of the data or, if a disclosure of data to third parties is envisaged, no later than during the first submission of the data. ''
"When the personal data originally collected for another object, the provisions of the preceding paragraph are not treatments necessary for the storage of these data for historical, statistical or scientific, in the conditions laid down in book II of the code of the heritage or the re-use of these data for statistical purposes under the conditions of article 7 bis Act No. 51-711 of 7 June 1951 on the obligation the coordination and the secret in statistics. These provisions do not apply either where the person concerned is already informed or when its information proves impossible or requires effort disproportionate to the interest of the approach.
"IV.-If the personal data collected are called to be promptly of a process of anonymization previously recognized in conformity with the provisions of this Act by the national data processing and Liberties Commission, information provided by the controller to the person concerned may be limited to those mentioned at the 1 ° and 2 ° of the I.. V. - The provisions of the I does not apply to data collected under the conditions provided for in III and used during a treatment implemented on behalf of the State and interesting security of the State, defence, public safety or the execution of criminal sentences or security measures of producing, insofar as such a restriction is necessary for compliance with the purposes of the processing.
«VI. - the provisions of this section do not apply to the processing of data relating to prevention, research, finding or prosecution of criminal offences.
«Art.» 33 - except with the consent from the person concerned, the personal data collected by the providers of electronic certification services for the needs of the issuance and the retention of certificates related to electronic signatures must be directly from the person concerned and cannot be processed only for the purposes for which they were collected.
«Art.» 34 - the data controller shall take all useful precautions, with regard to the nature of the data and risks presented by the processing, to preserve the security of the data and, inter alia, prevent them being misrepresented, damaged, or that of third parties unauthorized access.
'Decrees, taken after consultation with the National Commission of data processing and freedoms, may lay down the technical requirements which must be complied with the treatments mentioned 2 ° and 6 ° of section II 8'
«Art.» 35. - the personal data cannot be the subject of surgery for treatment on the part of a subcontractor, a person acting under the authority of the responsible for the treatment or the subcontractor, only on instructions from the controller.
"Anyone dealing with the personal data on behalf of the responsible for the treatment is regarded as a sub-contractor within the meaning of this Act.
"The subcontractor must provide sufficient guarantees to ensure the implementation of the security and confidentiality measures mentioned in article 34" This requirement does not relieve the responsible for the treatment of its obligation to ensure compliance with these measures.
"The binding contract the subcontractor in charge of the treatment includes the indication of the obligations of the sub-contractor for the protection of the security and confidentiality of the data and provides that the processor can act only on instructions from the controller.
«Art.» 36. - personal data may be retained beyond the period provided for in 5 ° of article 6 to be treated for historical, statistical or scientific; the choice of thus retained data is made under the conditions laid down in article L. 212 - 4 of the code of the heritage.
«Treatments whose purpose is limited to long-term conservation of archival documents in the context of book II of the code are exempted from the implementation of treatment formalities laid down in chapter IV of this Act.
"It may be a treatment with purposes other than those referred to in the first subparagraph: '-either with the consent of the person concerned;
'- or with the authorization of the National Commission of data processing and freedoms;
'- or in the conditions laid down to 8 ° of II and IV of article 8 with regard to data referred to in this article I.
«Art.» 37. - the provisions of this Act shall not preclude the application, for the benefit of third parties, of the provisions of title I of Act No. 78-753 of 17 July 1978 on various measures to improve relations between the administration and the public and various provisions of administrative, social and tax and the provisions of book II of the code of the heritage.
' As a result, cannot be regarded as a third party not authorized within the meaning of article 34 the holder of a right of access to administrative documents or public archives exercised in accordance with Act No. 78-753 of 17 July 1978 supra and in book II of the code. ' Section 2 "rights of individuals with regard to the processing of data personal «Art» 38. - any natural person has the right to oppose, for legitimate reasons, what personal data relating to be subject to a treatment.
"She has the right to oppose, free of charge, that the data are used for purposes including commercial prospecting, the current maintainer of the processing or further processing.
"The provisions of the first paragraph does not apply when processing satisfies a legal obligation or the application of these provisions has been ruled out by an express provision of the Act authorizing the treatment.
«Art.» 39. - i. - any natural person justifying of its identity has the right to question the head of a processing of personal data for: "1 ° confirmation that personal data concerning the are or are not the subject of this treatment;
«2 ° of the information for the purposes of the processing, the categories of personal data processed and the recipients or categories of recipients to whom the data are transmitted;
«3 ° where appropriate, information on envisaged transfers of personal data to a State not a member of the European Community;
«4 ° communication, in an accessible form, of the personal data which is of concern as well as any available information on the origin of these;
«5 ° information allowing to know and challenge the logic that underlies the automated processing in the event of a decision taken on the basis of it and produces legal effects with respect to the person concerned.» However, the information provided to the person concerned must not infringe copyright within the meaning of the provisions of book I and title IV of Book III of the code of intellectual property.

"A copy of the personal data is issued to the person concerned at his request. The controller may require the issuance of this copy to the payment of an amount which shall not exceed the cost of reproduction.
"In the event of risk of concealment or disappearance of the personal data, the competent judge may order, including summary proceedings, all measures to avoid this concealment or this disappearance.
«II. - the controller may oppose clearly abusive applications, including their number, their repetitive or systematic nature. In case of dispute, the burden of proof of the obviously abusive nature of applications is lead responsibility with which they are addressed.
"The provisions of this section do not apply when the personal data are kept in a form excluding clearly any risk to the privacy of the persons concerned and for no longer than is necessary for the only purpose of establishment statistics or scientific or historical research. Except as otherwise stated in the second paragraph of article 36, the derogations envisaged by the responsible for the treatment are mentioned in the application for authorisation or in the statement addressed to the National Commission of data processing and freedoms.
«Art.» 40. - any person justifying of its identity may require the head of a treatment that are, where appropriate, corrected, completed, updates, locked or erased data personal on it, which is inaccurate, incomplete, ambiguous, outdated or whose collection, use, disclosure or retention is prohibited.
"When requested by the person concerned, the controller must justify, without cost to the applicant, he proceeded to the operations required under the preceding paragraph.
"In case of dispute, the burden of proof is lead responsibility with which is exercised the right of access except where it is established that the disputed data have been transmitted by the person concerned or with his consent."
"When he gets a change of registration, the person concerned is entitled to obtain reimbursement of the fee corresponding to the cost of the copy mentioned in the I of article 39.
"If data has been transferred to a third party, the controller must accomplish the stagecoaches useful to notify him of the operations undertaken in accordance with the first subparagraph.
"The heirs of a deceased justifying their identity can, if brought to their attention their evidence assume that the personal data relating to the subject of treatment has not been refreshed, require the person in charge of this treatment that he takes into consideration the death and carries out the updates that must be the consequence. ''
"When the heirs upon request, the controller must justify, without cost to the applicant, he proceeded to the operations required under the preceding paragraph.
«Art.» 41 - by way of derogation from articles 39 and 40, when treatment are interested in the safety of the State, defence or public safety, the right of access is exercised under the conditions provided for in this section for all the information it contains.
"Demand is addressed to the commission, which shall designate one of its members owned or belonged to the Council of State, the Supreme Court or the Court of Auditors to carry out the relevant investigations and carry out the necessary changes. It may be assisted by an officer of the commission. It is notified to the applicant that conducted audits.
' Where the commission finds, in agreement with the controller, that the communication of the data contained therein does not cause its purposes, State security, defence or public safety, these data can be communicated to the applicant. ".
"When the treatment is likely to understand information the disclosure of which would not put in question the purposes assigned to him, the regulatory Act concerning the creation of the file can provide that such information may be communicated to the applicant by the Manager of the file directly before it.
«Art.» 42. - the provisions of article 41 shall apply to the treatments implemented by public administrations and private individuals charged with a mission of public service who's mission is to prevent, find, or see offences, or to control or recover taxes levied, if such a right was provided for by the authorisation referred to in articles 25, 26 or 27. ' Article 6 more on this article...

Chapter VI of Act No. 78-17 of 6 January 1978 reads as follows: "chapter VI" the control of implementation of treatments «Art»» 44 - i. - the members of the National Commission of computing and freedoms as well as the services authorized under the conditions laid down in the last paragraph of article 19 have access, from 6 hours to 9 pm, for the exercise of their missions, to the local places, pregnant, installations or establishments for the implementation of a processing of personal data, which are for professional use excluding parts thereof assigned to the private home.
"The Prosecutor of the Republic has territorial jurisdiction is about previously.
«II. - in the event of opposition by the head of places, visit cannot take place only with the authorization of the president of the Court of major jurisdiction in the area in which the premises to visit are located or the judge delegated by him.
"This judge is seized at the request of the president of the commission. It shall act by a reasoned order in accordance with the provisions laid down in articles 493 to 498 of the new code of civil procedure. The procedure is without compulsory representation.
"The visit is carried out under the authority and control of the judge who permitted it. It can go to the premises during the intervention. At any time, he may decide the termination or suspension of the visit.
"III. - members of the commission and the agents referred to in the first paragraph of the I can request all documents necessary for the accomplishment of their mission, whatever the support, and take copies; they can collect on the spot or on convening, any information and any useful justification; they can access to computer programs and data, as well as ask for transcription by any treatment appropriate in documents directly usable for the purposes of control.
"They can, at the request of the president of the commission, be assisted by experts appointed by the authority upon which they depend.
"Only a physician can require the communication of individual medical data included in treatment necessary for the purposes of preventive medicine, medical research, medical diagnosis, the administration of care or treatment, or health service management, and which is being implemented by a member of a health profession.
"He is pitched contradictorily minutes of the verifications and visits carried out in application of this article.
"IV.-for interesting treatments the security of the State and which are exempted from the publication of the regulatory act that allows implementation of III of article 26, the decree in Council of State which provides for this exemption may also provide that the processing is not subject to the provisions of this article. '.


Article 7 Chapter VII of Act No. 78-17 of 6 January 1978 reads as follows: "Chapter VII" Sanctions by the National Commission of computing and freedoms «Art»» 45 - i. - the National Commission of computing and freedoms may give a warning to the head of a treatment that does not respect the obligations arising from this Act. It may also require the official to stop the breach found within a time limit which it fixes.
"If the head of treatment does not comply with the formal notice which is addressed to him, the commission may take action against him after an adversarial procedure, the following sanctions:" 1 ° a monetary penalty, under the conditions laid down in article 47, except in cases where the treatment is being implemented by the State;
«2 ° an injunction to stop the treatment where it is governed by the provisions of article 22, or a withdrawal of the authorisation granted in accordance with article 25.»
«II.-in an emergency, when implementation of a treatment or operation of processed data leads to a violation of the rights and freedoms referred to in article 1, the commission may, after an adversarial procedure: "1 ° decide the interruption of the implementation of treatment, for a maximum period of three months, if the treatment is not among those mentioned in the I and II of article 26» , or those mentioned in article 27 put in place by the State;
«2 ° decide lock some of the personal data processed, for a maximum period of three months, if the treatment is not among those mentioned in the I and II of article 26;

«3 ° inform the Prime Minister for taking, where appropriate, measures to put an end to the violation found, if the treatment in question is among those mentioned in the I and II of article 26; the Prime Minister then made known to commission suites he has given to this information no later than fifteen days after receiving.
"III. - in the event of immediate and serious infringement of the rights and freedoms referred to in article 1, the Chairman of the Committee may request, through the summary to the competent court to order, where appropriate on-call, any measure of security needed to safeguard those rights and freedoms. ''
«Art.» 46 - the sanctions laid down in the 1 ° of II of article 45 and the I are pronounced on the basis of a report prepared by one of the members of the National Commission of computing and freedoms, designated by the president among the members not belonging to the restricted training. This report shall be communicated to the person in charge of the treatment, which can submit comments and to be represented or assisted. The rapporteur may make oral submissions to the commission but did not take part in its deliberations. The commission may hear any person whose hearing seemed likely to contribute useful information.
'The commission may make public the warnings as she speaks. It can also, in the event of bad faith on the controller, order the insertion of other sanctions as it speaks in publications, newspapers and media which it designates. The costs are borne by punished people.
"The decisions taken by the commission under section 45 are motivated and notified to the responsible for the treatment. Decisions pronouncing a sanction may be the subject of recourse of full jurisdiction before the Council of State.
«Art.» 47 - the amount of the penalty laid down in article 45 I is proportionate to the seriousness of the breaches committed and the benefits derived from the breach.
"When the first failure, it may not exceed 150 000 EUR. Breach reiterated in the five years from the date on which the previously imposed penalty became final, it may not exceed EUR 300,000 or, in the case of a company, 5% of the total turnover excluding taxes for the last year ended in the limit of 300 000 EUR.
"When the National Commission of computing and freedoms gave a penalty became final before the criminal judge has ruled definitively on the same or related facts, it may order that the penalty shall be entered on the fine as he speaks.
"The penalties are recovered as the claims of the foreign tax and the field State.
«Art.» 48 - the commission may exercise the powers provided for in article 44 as well as I, 1 ° of the II and III of article 45 with regard to the processing operations are implemented, in whole or in part, on the national territory, including where the data controller is established on the territory of an another Member State of the Community European.
«Art.» 49 - the commission may, at the request of an authority exercising powers similar to his own in another State member of the European Community, conduct audits under the same conditions, according to the same procedures and the same penalties as those provided for in article 45, unless it is a treatment referred to in I or II of article 26.
"The commission is empowered to communicate the information that it collects or holds, at their request, to the authorities exercising powers similar to his own in other States members of the European Community."


Article 8 more on this article...

Act No. 78-17 of January 6, 1978 is supplemented by a chapter VIII as follows: ' chapter VIII ' penal provisions «Art»» 50 - infringements of the provisions of this Act are provided for and punished under articles 226-16-226-24 of the criminal code.
«Art.» 51 - is punishable by one year imprisonment and of 15 000 EUR to fine the fact to hinder the work of the National Commission of data processing and freedoms: "1 ° either opposed to the exercise of the tasks entrusted to its members or officers empowered pursuant to the last paragraph of article 19;
«2 ° either by refusing to communicate to its members or officers empowered pursuant to the last paragraph of article 19 the information and documents needed for their mission, or concealing such documents or information, or making them disappear;
«3 ° be communicating information which do not are not in conformity with the content of the records as it was at the time the application was made or who do not have this content directly accessible form.
«Art.» 52 - the public prosecutor shall notify the president of the National Commission of computing and freedoms of all prosecution of infringements of the provisions of section 5 of Chapter VI of title II of book II of the penal code and, where appropriate, the follow-up given to them. He informed him of the date and the subject of the hearing of judgment by registered letter sent at least ten days before that date.
"The Court of instruction or judgment can call the president of the National Commission of data processing and freedoms or his representative to submit its observations or to develop orally at the hearing."


Article 9 read more on this article...

I. - Chapter V bis of Act No. 78-17 of 6 January 1978 supra becomes chapter IX and is entitled: "processing of personal data with end research in the field of health".
II. Articles 40-1 to 40-8 of the Act become articles 53 to 60 and are thus modified: 1 ° in the first paragraph of articles 40-1, 40-3 and 40-8, the word: 'automated' is deleted;
2 ° in the first paragraph of articles 40-1, 40-2, 40-3 and 40-5, as well as article 40-7, the words: "personal data" shall be replaced by the words: "personal data";
3 ° to the first paragraph of article 40-1, the words: 'with the exception of articles 15, 16, 17, 26 and 27"are replaced by the words: 'with the exception of articles 23 to 26, 32 and 38 ';
4 ° the fourth paragraph of article 40-2 is replaced by five well written paragraphs: 'implementation of the processing of data is then submitted to the authority of the National Commission of computing and freedoms, which is pronounced in the conditions laid down in article 25.
"For categories the most usual treatments automated for the purpose of research in the field of health and with data not identifiable not direct of the persons concerned, the commission may approve and publish methodologies of reference, established in consultation with the Advisory as well as with public bodies and private representative and intended to simplify the procedure in the first four paragraphs of this article. '.
"These methodologies shall specify, having regard to the characteristics mentioned in article 30, standards to match the treatments that can be the subject of a request for notice and a request for simplified authorisation.
"For treatments meet these standards, only a commitment to compliance with one of them is sent to the commission. The Chairman of the Committee may authorize these treatments on the basis of a simplified examination procedure.
'For other categories of treatments, the Advisory Committee fixed, in consultation with the National Commission of data processing and freedoms, the conditions under which its opinion is not required.';
5 ° the last sentence of the second subparagraph of article 40 (3) is replaced by two sentences thus written: "the application for authorisation includes justification scientific and technical of the derogation and the indication of the period needed for the research. At the end of this period, the data are stored and processed under the conditions laid down in article 36. » ;
6 ° the first paragraph of article 40 paragraph 4 reads as follows: 'everyone has the right to oppose what the personal data relating to the subject of the lifting of professional secrecy necessitated by treatment of the nature of those referred to in article 53.';
7 ° in the fifth paragraph of article 40-5, the words: 'established in chapter V' shall be replaced by the words: "established in articles 39 and 40.
8 ° the 40-6 article, the word: 'guardian' shall be replaced by the words: "legal representative" and the words: "legal protection" with the word: "guardianship".
9 ° to the second paragraph of article 40-8, the words: "controlled by 2 ° of article 21" are replaced by the words: "to the checks listed in the f 2 ° of article 11.
III. - Sections 40-9 and 40-10 of the Act are repealed.
IV. Chapter IX of the Act is supplemented by a section 61 worded as follows:

«Art.» 61 - transmission to a State not belonging to the Community European non-encoded personal data subject to treatment to end research in the health field is allowed, under the conditions laid down in article 54, subject to compliance with the rules set out in chapter XII. ' Article 10 more on this article...

I. - Chapter V ter of law No. 78-17 of 6 January 1978 supra became chapter X and is entitled: "Treatments of health data personal for the purposes of evaluation or analysis of practices or care and prevention activities".
II. - Articles 40-11 to 40-15 of the Act are renumbered as sections 62 to 66 and are thus modified: 1 ° to the first paragraph of article 40-11, the words: 'personal health data treatments' are replaced by the words: 'health personal data treatments' and, in the second paragraph of the same article, the words: "personal data" are replaced by the words : "personal data". The reference to article L. 710 - 6 of the public health code is replaced by a reference to article l. 6113-7;
2 ° to the first paragraph of article 40-13, the words: "personal data" shall be replaced by the words: "personal data";
3 ° the last sentence of the first paragraph of article 40-14 is deleted;
4 ° to the first paragraph of article 40-15, the words: "where they remain indirectly nominative' are replaced by the words:"when they indirectly to identify the persons concerned.


Article 11 read more on this article...

Act No. 78-17 of January 6, 1978 is supplemented by a chapter XI which reads as follows: ' chapter XI ' treatment of personal data for the purposes of journalism and literary and artistic expression «Art»» 67 - 5 ° of article 6, sections 8, 9, 22, 1 ° and 3 ° of the I of article 25, articles 32, 39, 40 and 68-70 do not apply to the processing of personal data carried out solely: "1 ° literary and artistic expression;
«2 ° exercise, professionally, journalist activity, in compliance with the ethical rules of this profession.
"However, for treatments referred to in 2 °, the exemption from the obligation to declare laid down in article 22 shall be subject to the designation by the controller of a correspondent to the protection of data belonging to an organization of print or audiovisual, responsible for maintaining a register of the treatments implemented by this responsible and ensure, in an independent manner. the application of the provisions of this Act. This designation is brought to the attention of the National Commission of data processing and freedoms.
"In the event of failure to comply with the provisions of the Act applicable to the treatment provided for by the present article, the controller is directed by the National Commission of computing and freedoms to get in compliance with the law. In the event of failure to perform the duties, correspondent is discharged from his functions on demand, or after consultation, of the National Commission of data processing and freedoms.
"The provisions of the preceding paragraphs shall not preclude the application of the provisions of the civil code, laws relating to the written or audiovisual media and the penal code, which provide for the conditions for the exercise of the right of reply and which prevent, restrict, repair and, where appropriate, punish violations of privacy and reputation of persons. ''


Article 12 read more on this article...

Act No. 78-17 of January 6, 1978 is supplemented by a chapter XIl worded as follows: ' chapter XII "transfers of personal data to States not belonging to the European Community «Art»» 68 - the head of a treatment may transfer data personal to a State not belonging to the European Community that if this State ensures an adequate level of protection of the privacy and fundamental rights and freedoms persons with regard to processing which these data are or may be subject.
"The adequacy of the level of protection provided by a State appreciates in particular of the provisions in force in that State, security measures are applied, characteristics treatment, such as its purposes and its duration, as well as the nature, origin and destination of the processed data.
«Art.» 69. - However, the head of a treatment may transfer the personal data to a State does not meet the conditions laid down in article 68 if the person to whom the data relates has consented expressly to their transfer or if the transfer is necessary to either of the following conditions: "1 ° A safeguarding of the life of this person;
«2 ° A the safeguarding of the public interest;
«3 ° to the fulfilment of obligations ensuring the establishment, exercise or defence of legal claims;
«4 ° a consultation, in regular conditions, of a public register which, under legislative or regulatory provisions, is intended for the information of the public and is open to consultation or any person with a legitimate interest;
"5 ° has the performance of a contract between the data controller and the person concerned, or to take steps at the request of it;
«6 ° to the conclusion or execution of a contract or to conclude, in the interest of the data subject between the controller and a third party. ''
"It can also be made exception to the prohibition laid down in article 68, by decision of the National Commission of data processing and freedoms or, if it is a treatment referred to in I or II of article 26, by Decree in Council of State after reasoned opinion and published by the commission, when the treatment guarantees a sufficient level of protection of privacy and freedoms and fundamental rights of persons. because of the contractual clauses or internal rules which made the object.
"The National Commission of computing and freedoms is to the knowledge of the Commission of the European communities and the supervisory authorities of the other Member States of the European Community authorization decisions of transfer of personal data which it takes in respect of the preceding paragraph.
«Art.» 70. - If the Commission of the communities European has found that a State not belonging to the Community European does not a level of protection adequate with respect to a transfer or a category of transfers of personal data, the National Commission of computing and freedoms, before it a statement filed pursuant to articles 23 or 24, indicating that personal data will be transferred to this State delivers the receipt with reference to the prohibition of the transfer of the data.
"Where it considers that a State not belonging to the European Community is not a sufficient level of protection with respect to a transfer or a category of transfers of data, the national data processing and Liberties Commission shall inform without delay the Commission of the communities European. '' When it had before it a statement filed pursuant to articles 23 or 24 and showing that personal data will be transferred to this State, the National Commission of computing and freedoms shall issue the receipt and may direct the controller to suspend the transfer of data. If the Commission of the European communities notes that the State towards which the transfer is intended provides an adequate level of protection, the National Commission of computing and freedoms shall notify the controller termination of the suspension of the transfer. If the Commission of the European communities notes that the State towards which the transfer is intended ensure not a level of sufficient protection, the national data processing and Liberties Commission shall notify the controller the prohibition of the transfer of data to this State. «Article 13 Act No. 78-17 of January 6, 1978 is supplemented by a chapter XIII as follows: ' chapter XIII ' provisions various «art»» 71 - decrees in Council of State, taken after consultation with the National Commission of data processing and freedoms, shall lay down detailed rules for the application of this Act.
«Art.» 72. - this Act is applicable in French Polynesia, Islands Wallis and Futuna, in southern and Antarctic Territories, New Caledonia and Mayotte.
'By way of derogation from the provisions of the second paragraph of article 54, the Advisory Committee has a period of two months to transmit its opinion to the applicant when it resides in one of these communities. In an emergency, this period may be reduced to one month. ' Title II: provisions amending of other texts statutory Article 14 I. - articles 226-16-226-23 of the penal code are replaced by fourteen articles so written:

«Art.» 226-16.-the fact, including negligence, to proceed or to carry out treatments of personal data without that have met their implementation formalities provided by law is punishable by five years imprisonment and a fine of EUR 300,000.
"Is punishable by the same penalties as a result, including negligence, to carry out or to have a treatment that has been the subject of one of the measures provided for in the 2nd I of section 45 of Act No. 78-17 of 6 January 1978 relating to data processing, files and freedoms. ''
«Art.» 226-16-1.-when conducted or caused to a processing of personal data under the conditions provided by the I or II of article 24 of Act No. 78-17 of 6 January 1978, supra, the fact of not respecting, including negligence, standards simplified or exemption to this effect by the national data processing and Liberties Commission is punishable by five years imprisonment and a fine of EUR 300,000.
«Art.» 226-16-1.-the fact, out cases where treatment has been authorised under the conditions provided by law No. 78-17 of January 6, 1978, supra, undertake or arrange for treatment of personal data including the data on which it bears the registration number of the persons to the national identification of natural persons directory, is punishable by five years imprisonment and a fine of EUR 300,000.
«Art.» 226-17.-perform or carry out treatment of personal data without implementing the measures prescribed in article 34 of the law No. 78-17 of January 6, 1978, supra is punishable by five years imprisonment and a fine of EUR 300,000.
«Art.» 226-18.-collect personal by fraudulent, unfair or illicit means is punishable by five years imprisonment and a fine of EUR 300,000.
«Art.» 226 18-1.-proceed to treatment of personal data concerning an individual despite the opposition of this person, when this treatment meets including commercial prospecting purposes, or where the opposition is based on legitimate grounds, is punishable by five years imprisonment and a fine of EUR 300,000.
«Art.» 226-19.-the fact, except in the cases provided by law, offer or saving in electronic form, without the express consent of the person concerned, of personal data which directly or indirectly reveal racial or ethnic origins or political, philosophical or religious opinions or trade union of people membership, or relating to health or sexuality of these is punishable by five years imprisonment and a fine of EUR 300,000.
"Is punishable by the same penalties for the fact, except in the cases provided by law, put or maintained in electronic form to personal data relating to offences, convictions or security measures.
«Art.» 226 19-1.-in case of processing of personal data with the end research in the field of health, is punishable by five years imprisonment and a fine of EUR 300,000 due to treatment: "1 ° without having previously notified individually to the account, which the personal data are collected or transmitted of their right of access rectification and opposition, the nature of the transmitted data and recipients;
«2 ° despite the opposition of the person concerned or, where it is provided by law, in the absence of informed and the person's express consent, or if it comes to a deceased person, despite the refusal of his lifetime.
«Art.» 226-20.-keeping of personal data beyond the period provided for by the Act or the regulations, by the application for permission or notice, or by the prior declaration addressed to the national data processing and Liberties Commission, is punishable by five years imprisonment and EUR 300 000 fine, unless this retention is done for historical purposes statistics or scientists under the conditions provided by law.
"Is punishable by the same penalties for the fact, except in the cases provided by law, to treat non-historical, statistical or scientific of the personal data stored beyond the period referred to in the first subparagraph.
«Art.» 226-21.-the fact by any person holder of personal data during their registration, their classification, their transmission or any other form of treatment, to divert these information in such purpose as defined by the legislation, the regulatory act or the national data processing and Liberties Commission decision authorizing the automated processing , or by the prior statements to the implementation of this treatment, is punishable by five years imprisonment and a fine of EUR 300,000.
«Art.» 226-22.-, by anyone who has collected, on the occasion of their registration, their classification, their transmission or another form of treatment, personal, the disclosure of which would affect the consideration of the concerned or in the intimacy of her privacy, to wear, without permission of the person concerned, these data to the knowledge of a third party who is not entitled to receive them is punishable by five years imprisonment and EUR 300,000 to fine.
"The disclosure provided for in the preceding paragraph is punishable by three years imprisonment and a fine of EUR 100 000 when it has been committed by imprudence or negligence.
'In the cases provided for in the two preceding paragraphs, the prosecution cannot be exercised only on complaint of the victim, his legal representative or his successors in title.
«Art.» 226 22-1.-the fact, except in the cases provided by law, to conduct or arrange for a transfer of personal data subject or to be the subject of a treatment to a State not belonging to the Community European in violation of the measures taken by the Commission of the communities European or by the National Commission for computing and liberties mentioned in article 70 of law No. 78 - 17 of January 6, 1978, supra is punishable by five years imprisonment and a fine of EUR 300,000.
«Art.» 226 22-2.-in the cases provided for in articles 226 - 16 at 226-22-1, erase all or part of the personal data subject to processing which gave rise to the offence may be ordered. Members and officials of the National Commission of data processing and freedoms are entitled to see the deletion of these data.
«Art.» 226-23.-the provisions of article 226-19 are applicable to non automated of personal data processing whose implementation is not confined to the exercise of exclusively personal activities. "II. - in the first paragraph of article 226-24 of the code, the words: «in articles 226-16-226-21 and 226-23 as well as the first paragraph of article 226-22» are replaced by the words: 'in this section '.


Section 15 i. - I of article 10 of Act No. 95-73 of 21 January 1995 orientation and safety programming is as follows: "i.-recordings CCTV meeting the conditions laid down in the II are subject to the following provisions, excluding those that are used in automated or treatment contained in files structured according to criteria for identifying". directly or indirectly, of natural persons, who are subject to Act No. 78-17 of 6 January 1978 on data processing, files and freedoms. "II. - it is inserted, after the VI of the same article, a bis VI as follows:"bis VI. -The Government shall forward annually to the National Commission of computing and freedoms a report referring to the activity of the departmental commissions referred to the III and the conditions for the application of this article. «Article 16 after article 14 of Act No. 99-944 of 15 November 1999 concerning the civil solidarity pact, it is inserted an article 14-1 worded as follows: «art.» 14-1.-the courts establish biannual statistics number of civil solidarity pacts concluded within their jurisdiction. These statistics also identify the number of the Covenants having ended by distinguishing the cases mentioned in article 515-7 of the civil code, the average duration of the Covenants as well as the average age of the persons concerned. By derogation from the provisions of the I of article 8 of Act No. 78-17 of 6 January 1978 relative to information technology, files and freedoms, they distinguish data relating to the covenants concluded: "-between individuals of different sex;
"- between persons of the female sex;
"- between persons of the male sex."


Article 17 i. - In the second paragraph of article L. 33 - 4 of the code of posts and telecommunications, references: '35 and 36' shall be replaced by references: '39 and 40.
II. - In the first sentence of the first paragraph of article l 1131-4 of the public health code, the reference: 'chapter V bis' shall be replaced by the reference: 'chapter IX '.

III. - in the first sentence of the last paragraph of article L. 262 - 33 of the code of social action and families, the reference: 'in article 15' is replaced by the reference: 'in chapter IV.
IV. - in the last paragraph of article L. 522 - 8 of the same code, the reference: 'in article 15' is replaced by the reference: 'in chapter IV.
V. - 1. The first paragraph of article 777-3 of the code of criminal procedure reads as follows: "no interconnection within the meaning of 3 ° of the I of article 30 of Act No. 78-17 of 6 January 1978 relating to data processing, files and freedoms can only be performed between the automated national criminal record and any other file or treatment of personal data held by a person any or a service of the State not dependent on the Ministry of. justice. ' 2. in the second paragraph of the same article, the words: "collection of personal data" are replaced by: 'treatment of personal data '.
VI. - The last paragraph of article L. 723 - 43 of the rural code provides as follows: 'content, employment and the conditions of this communication are established under the terms of article 27 of Act No. 78-17 of 6 January 1978 relative to information technology, files and freedoms.'
VII. - In the second paragraph of article L. 311-5-1 of the labour code, the reference: 'in article 15' is replaced by the reference: 'in chapter IV.
VIII. - in the last paragraph of article L. 115 - 2 of the code of social security, the reference: 'article 15' is replaced by: "article 27".
IX. - in the last paragraph of article 1 of Act No. 84-575 of July 9, 1984, containing various provisions of a social nature, the reference: 'article 15' is replaced by: "article 27".
X. - In III of article 78 of Act No. 85 - 10 of 3 January 1985 containing various provisions of a social nature, the reference: 'article 15' is replaced by: "article 27".
XI. - In the penultimate paragraph I of article 64 of Act No. 95-116 of 4 February 1995 on the various provisions of a social nature, the reference: 'article 15' is replaced by: "article 27".


Article 18. - in article L. 262 - 51 of the code of social action and families, the words: ' article 15' are replaced by the words: "in chapter IV.
II. - in the first paragraph of article 60-2 of the code of criminal procedure, the words: "article 31 and article 33" are replaced by the words: 'of 3 ° of the II of article 8 and 2 ° of article 67.
III. - In the first paragraph of article 706-53-11 of the code of criminal procedure, the reference: '19' is replaced by: '30 '.
IV. - In the second sentence of the third paragraph of article l. 1111-8 of the code of public health, the reference: '29' is replaced by: '34 '.
V. - in the last paragraph of article L. 115 - 7 of the code of social security, the words: "authorised under the conditions laid down in article 15" are replaced by the words: "in the manner provided for in chapter IV.
VI. - The penultimate paragraph of article L. 161-28-1 of the social security code reads as follows: "this order is made after reasoned opinion of the National Commission of computing and freedoms."
VII. - The beginning of the seventh paragraph of article 7 bis of Act No. 51-711 of 7 June 1951 on the obligation, coordination and secrecy in statistics is as follows: 'assignments with data personal, as defined in article 2 of the law... ". (rest unchanged). "VIII. - article L. 212 - 4 of the code of the heritage is amended as follows: 1 ° the first paragraph reads as follows: 'when the documents referred to in article L. 211 - 4 contain personal data collected in the context of automated processing governed by Act No. 78-17 of 6 January 1978 on data processing, files and freedoms, these data shall be '. upon expiry of the period provided for in 5 ° of article 6 of the Act, a sort to determine the data to be preserved and, devoid of interest scientific, statistical, or historical, destined to be destroyed. » ;
2 ° in the last paragraph, the words: ' information' shall be replaced by the words: "database".
IX. - in the last paragraph of article L. 333 - 4 of the code of consumption, the reference: "35" is replaced by the reference: "39".


Article 19 the first sentence of article 24 of Act No. 2003-239 of 18 March 2003 on internal security is replaced by two sentences thus written: "the data contained in the treatment automated of personal data managed by the police and gendarmerie services national may be transmitted through international commitments regularly introduced into the domestic legal order international cooperation on judicial police agencies or foreign police services, representing a sufficient level of protection of privacy, freedoms and fundamental rights of individuals with regard to the treatment that these data are or may be subject. The adequacy of the level of protection provided by a State appreciates in particular of the provisions in force in that State, security measures are applied, characteristics treatment, such as its purposes and its duration, as well as the nature, origin and destination of the processed data. ' Title III: provisions transitional Article 20 I. - makers of processing of personal data whose implementation has regularly intervened before the publication of this Act have, from this date, a period of three years to put their salaries in accordance with the provisions of Act No. 78-17 of 6 January 1978 relative to information technology the files and freedoms, in their issue drafting of this Act. When this ensuring compliance was not to alter the characteristics of the treatments referred to in article 30 of Act No. 78-17 of 6 January 1978 cited above, as amended by this Act, treatments are deemed satisfactory to the provisions laid down in chapter IV.
The provisions of Act No. 78-17 of 6 January 1978 supra, as drafted prior to this Act, shall continue to apply to treatments that were submitted until they have brought into conformity with the provisions of Act No. 78-17 of 6 January 1978 supra, in their drafting of this Act, and, at the latest , until the expiry of the period of three years provided for in the preceding paragraph. However, the provisions of articles 38, 44-49 and 68 to 70 of Act No. 78-17 of January 6, 1978, in their issue drafting of this Act, apply to them immediately.
II. - By way of derogation from the provisions of the makers of non-automated processing of personal data whose implementation is regularly occurred before the date of publication of this Act have, to put their salaries in accordance with articles 6 to 9 of Act No. 78-17 of 6 January 1978, supra, as their of this Act , a period up to October 24, 2007.
The provisions of article 25, the I of article 28 as well as articles 30, 31 and 37 of the Act No. 78-17 of 6 January 1978 supra, in their preparation prior to this Act, shall continue to apply to non-automated treatments which were submitted until they have brought into conformity with the provisions of articles 6 to 9 of Act No. 78-17 of January 6, 1978, supra in their issue drafting of this Act, and at the latest until October 24, 2007.


Makers of treatments not automated personal data interesting article 21 the State security, defence and public safety, whose implementation is regularly occurred before the date of publication of this Act have, to put their salaries in accordance with articles 6 to 9 of Act No. 78-17 of January 6, 1978 , in their issue drafting of this Act, for a period up to October 24, 2010.


Article 22 i. - The members of the National Commission of computing and freedoms in-office at the time of the publication of this Act shall remain in office until the normal term of their mandate.
II. - The appointments and reappointments of members of the National Commission of data processing and freedoms occurred before the publication of this Act are not supported account for the application of the rules mentioned in the first paragraph of article 13 of the Act II No. 78-17 of January 6, 1978, supra as amended by this Act.
This Act will be enforced as law of the State.

Made in St. Paul, August 6, 2004.
Jacques Chirac by the President of the Republic: Prime Minister Jean-Pierre Raffarin the keeper of the seals, Minister of justice, Dominique Perben Minister of the overseas territories, Brigitte Girardin (1) Law No. 2004-801.
-Community directives:

Directive 95/46 of the Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of data personal and on the free movement of such data.
-Preparatory work: National Assembly: draft law No. 3250;
Report of Mr. Gérard Gouzes, on behalf of the commission of laws, no. 3526;
Discussion and adoption on 30 January 2002.
Senate: Bill, adopted by the National Assembly, no. 203 (2001-2002);
Report of Mr. Alex Türk, on behalf of the commission of laws, no. 218 (2002-2003);
Discussion and adoption on 1 April 2003.
National Assembly: Bill, amended by the Senate, no. 762;
Report of Mr. Francis Delattre, on behalf of the commission of laws, no. 1537;
Discussion and adoption on 29 April 2004.
Senate: Bill, adopted with amendments by the National Assembly, no. 285 (2003-2004);
Report of Mr. Alex Türk, on behalf of the commission of laws, no. 367 (2003-2004);
Discussion and adoption on July 15, 2004.
-Constitutional Council: Decision No. 2004-499 DC of 29 July 2004, published in the Official Journal of that day.