Key Benefits:
The National Commission for Computer Science and Freedoms,
Seizure on May 4, 2007 by the Ministry of National Education, Higher Education and the search for a draft decree in the Council of State, taken in accordance with theArticle 12 of Act No. 2007-297 of 5 March 2007 on the prevention of crime;
Considering Council of Europe's Convention No. 108 of 28 January 1981 for the Protection of Persons with regard to the automated processing of personal data;
Considering Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to the processing of personal data and the free flow of such data;
Considering the education code, including its article L. 131-6;
Vu la Act No. 78-17 of 6 January 1978 related to computing, files and freedoms, as amended by Act No. 2004-801 of 6 August 2004 relating to the protection of natural persons with respect to personal data processing;
Vu la Act No. 2007-297 of 5 March 2007 on the prevention of crime;
Vu le Decree No. 2005-1309 of 20 October 2005 taken for application of Act No. 78-17 of 6 January 1978 related to computing, files and freedoms, modified by Decree No. 2007-451 of 25 March 2007 ;
After hearing Mr. Jean-Marie Cotteret, Commissioner in her report, and Ms. Catherine Pozzo di Borgo, Deputy Commissioner of the Government in her comments,
Provides the following notice:
The Ministry of National Education has taken the National Commission for Computer Science and Freedoms' opinion of a draft decree in the Council of State, taken for the purposes of Article L. 131-6 of the Code of Education and on the automated processing of personal data relating to the census of children subject to school obligations and to the improvement of the monitoring of the obligation of school attendance.
The new provisions of this article were introduced by theArticle 12 of Act No. 2007-297 of 5 March 2007 on the prevention of crime.
At the end of this article, the mayor is provided with an opportunity to implement an automated personal data processing in which personal data relating to children of school age domiciled in the municipality are recorded, which is transmitted to him by the agencies responsible for the payment of family benefits and by the academy inspector pursuant to section L. 131-8 and by the director or director of the educational establishment in accordance with the same article
On the purposes of the treatment:
The purpose of the treatment is to allow the mayor to conduct the census of the children of his municipality subject to the school obligation and to be informed of the situations relating to the school enrolment and absenteeism of these children, in order to take measures of a social or educational nature within the framework of the competences conferred upon him by the code of social action and families. These measures may be taken directly from the mayor's office, or may consist of seizing another authority by the mayor, in particular the president of the general council.
The Commission notes that the modalities for the implementation of these measures of a social or educational nature do not fall within the scope of this draft decree, and that the relevant information is not included in the file held by the mayor.
On the origin of the data:
The second paragraph of section L. 131-6 of the above-mentioned Education Code states that the data recorded in the mayor's file are "transmitted to it by the agencies responsible for the payment of family benefits, as well as by the academy inspector pursuant to section L. 131-8 and by the director or director of the educational institution under the same section, as well as in the event of a temporary or final exclusion of the student institution, »
Pursuant to this provision, Article 3 of the draft decree specifies the nature of the data transmitted to the mayors at his request.
In view of the sensitivity of the data transmitted, the Commission considers that the draft decree should state that in the event of electronic transmission it should be secure.
On the nature of the personal data processed:
Article 2 of the draft decree lists the categories of data that are recorded in the processing. These are related to the identification of the child, its legal officials and its school. They also deal with absenteeism and disciplinary measures (warning, temporary or final exclusion) taken.
The Commission notes that no data relating to the monitoring of social or educational measures is intended to be included in the treatment.
It also takes note of the fact that the mayor is not aware of the grounds for absenteeism, nor of those for which disciplinary measures (warning, temporary or final exclusion) have been taken.
On access to treatment and recipients of information:
The Commission notes that only elected officials who have received the mayor's delegation for school or social affairs and the duly authorized officials of the city hall will be able to access the treatment, as this will be necessary for the exercise of their duties.
In addition, only officers of the municipal social action centre and officers of the school caisse, the academy inspector, the president of the general council or his or her representatives and the agents of the departmental services responsible for the assistance and social action duly authorized, the coordinator provided for in article L. 121-6-2 of the code of social action and of the families will be entitled to receive the communication of the recorded data, to the extent that
On data retention period:
Article 4 of the draft decree provides that the data contained in 1°, 2°, 3° and 4° of Article 2, namely those relating to the identification of the child, its legal officials and its school, will not be retained beyond the school year in which the child reaches the age of sixteen.
With regard to information relating to absenteeism and sanctions and disciplinary measures (announcing, temporary or final exclusion) contained in the 5th, 6th and 7th of Article 2 of the draft decree, they will not be retained beyond the end of the school year in which they were the subject of automated treatment.
These provisions do not call for specific observations of the commission.
CNIL also notes that the data will be erased when the child no longer resides in the commune.
In this regard, the Commission requests that the draft decree recall the provisions set out in article R. 131-3 of the Code of Education that school directors and heads of establishment address to the mayor the state of the transfer of children attending their school at the end of each month.
About the information of people:
The commission notes that section 6 of the draft decree provides that the right of access and rectification shall be exercised with the mayor. Section 7 also states that the right of opposition provided for inArticle 38 of the Act of 6 January 1978 referred to above does not apply to this treatment.
The commission observes that other actors that the mayor is concerned with this system, namely educational institutions, academic inspections and organizations responsible for the payment of family benefits.
As a result, the commission draws the attention of the various ministers responsible for the execution of this decree on the need, for the various actors, to inform the persons from whom data are collected of what they can be communicated to the mayor for the purpose of controlling the academic obligation and monitoring of absenteeism.
On the applicable prior formalities:
The commission observes that the draft decree in the Council of State submitted to it defines a strict framework for the implementation of the files relating to the monitoring of the obligation and absenteism of schools regarding the purpose, origin and nature of the data processed, access to the processing and the recipients of the information, the duration of retention, the rights of access, rectification and opposition.
The commission noted, however, that the decree should be supplemented on the measures to be taken to ensure the security of treatment and the confidentiality of the data, including on the occasion of their transmission by the bodies responsible for the payment of family benefits. Similarly, she drew attention to the need for the various actors involved to inform people about the transmission of information about them.
She considers that she has been able, on the occasion of this review, to exercise a priori control over the files related to the monitoring of school bond and absenteeism, in order to ensure respect for the principles recognized by the principles recognized by the Law of 6 January 1978 amended.
As a result, it appears to it that the draft decree exempts from formalities the 36,000 municipalities, the bodies responsible for the payment of the family benefits referred to in Article 3 of the draft decree, the inspector of academy and the director of the institution pursuant to Article L. 131-8 of the Code of Education, as well as all other services rendered recipients of the data, subject to the full set of conditions for the processing of the text
Thus, the commission considers that the decree should be supplemented by a provision that provides that the treatments implemented by mayors will be exempted from reporting their salaries to CNIL.
It considers that this article, integrated as a final provision, should be formulated as follows:
"Organisms implementing personal data processing in compliance with all the provisions of this Decree shall be exempted, by derogation from theArticle 22 of the Act of 6 January 1978 referred to above, to declare these treatments to the National Commission of Computer Science and Freedoms.
"Any other processing of such data shall be the subject of prior formalities with the said commission in accordance with the provisions of the Act of 6 January 1978 referred to above. »
The president,
A. Türk
