Key Benefits:
National Computer and Liberties Commission,
Entering the Ministry of the Interior, Overseas, Territorial and immigration authorities of a request for an opinion on a draft decree on the implementation of the processing of personal data referred to " New computerized current hand " (N-MCI);
Having regard to Convention 108 of the Council of Europe for the protection of persons with regard to the automatic processing of personal data;
Having regard to Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 Relating to the protection of individuals with regard to the processing of personal data and the free movement of such data;
Given the Code of Social Action and Families, in particular Article L. 121-1-1;
Seen Law n ° 78-17 of 6 January 1978 relating to computers, files and freedoms, as amended by Act No. 2004-801 of 6 August 2004 on the protection of natural persons The processing of personal data, in particular Article 26;
Given the decree n ° 2005-1309 of 20 October 2005 taken for the application of the Href=" /viewTexte.do?cidTexte=JORFTEXT000000886460 &categorieLink = cid"> Law n ° 78-17 of 6 January 1978 relating to computers, files and freedoms;
In view of the decree of 24 February 1995 authorizing the creation in the offices of Police for automated processing of the current handheld register;
In view of the decree of 21 January 2008 establishing an automated processing of personal data known as PEGASE;
Due to deliberation No 92-036 of 31 March 1992 Providing advice on automated processing of registered personal information Work by the Ministry of the Interior on the automated management of the current handbooks maintained by the police stations;
In view of deliberation No. 94-005 of 8 February 1994 on a draft regulation submitted by The Ministry of the Interior authorising the creation in police stations of an automated processing of the said register of " Common hand " ;
After hearing Mr. Jean-Marie Cotteret, Commissioner, in his report and Elisabeth Rolin, Commissioner of the Government, in his observations;
Emet the following opinion:
The Committee was seized by the Ministry of the Interior, The overseas, territorial and immigration authorities of a request for an opinion on a draft decree on the implementation of the processing of personal data referred to " New computerized current hand " (N-MCI).
This processing is intended to replace the computerized common hand (MCI) of the police stations established by the decree of February 24, 1995, taken after notice of the CNIL.
On the purpose of the processing:
The N-MCI processing will facilitate the processing of user reports and the events handled by the police services to ensure better effectiveness of interventions, to facilitate the operational direction of services And the monitoring and evaluation of their activities, improve the quality of the reception of the public and produce statistics on the activity of the services.
The Committee recalls that the multiplication of purposes Of the same treatment may affect their specific, explicit, and Required by Article 6 (2) of the Act of 6 January 1978 as amended. However, it notes that, like the MCI treatment so far, the N-MCI treatment is part of a more general purpose of monitoring the activity of the police services.
On the nature of the data processed:
The N-MCI processing Will focus on data relating to national police services officers, persons who have been present or who are affected by an event dealt with by police services and users who are welcomed in the police services. The categories of data processed, as specified in an annex to the draft decree, appear justified in the light of the purpose of the processing operation.
With regard specifically to national police officers, the Committee takes note that processing will cover only objective data relating to the activity of staff and that no hierarchical assessment will be recorded in it.
As regards users who have made a declaration or who are Concerned by an event processed by the police services, it appears that the Draft decree does not explicitly mention in the annex to that effect the processing of data relating to the content of " User declarations " And " Events processed by the police services ", even though these data are actually recorded.
The Commission also notes that these data relating to" Declarations " And " Events " May cover a very large number of situations. In this regard, it recalls that the legal form and the drafting of the draft text submitted to it do not permit the processing of data " Sensitive " Under Article 8 of the Act of 6 January 1978, as amended, namely those relating to racial or ethnic origin, political, philosophical or religious views or trade union membership of persons, or relating to The health or sexual life of such persons.
In any event, the Commission acknowledges that it will be impossible to search by keywords on the contents of the declarations or proceedings of the events processed.
On the Data retention period:
Data relating to national police personnel will be retained until the end of the posting of the officer in his or her direction of employment, with the exception of those relating to the control and evaluation of the activity which is destroyed in the Term of five years from the date of registration.
Data relating to persons who have made a declaration or who are affected by an event processed by the national police services will be kept for five years. Count of their registration. The Committee notes that this period is justified in particular by the possible judicial use of this information, mainly in corrections (declarations relating to facts relating to a criminal offence, events dealt with by the National police officers involved, etc.).
Finally, data concerning persons received in the police services will be anonymized after a period of one year from their registration.
On the Data recipients:
Unlike MCI processing, which is made up of locally implemented files in police stations, the N-MCI processing will be based on data centralization at the national level and will be implemented by several services Central Directorate General of the National Police (DCSP, DCPAF, DCCRS) and the Police Prefecture (DSPAP, DOPC and DOSTL) whose staff will directly access the processing.
This extension of the number of recipients and data Available to them is, however, limited by the existence of a policy Developed data access profiles. Indeed, depending on the direction to which it is attached, its hierarchical position and its functions, a user will only access certain data from the N-MCI processing in consultation or even modification. For example, a national police officer assigned to a public security electoral district will only be able to modify the information recorded in his or her electoral district, but will access the data recorded by all To the exclusion of any data from another departmental directorate.
The Commission takes note that, in each central direction implementing the Treatment, some national police officers will access all of the Data processed within their management at national level, in accordance with the principle of hierarchical visibility, for statistical production purposes.
On the other hand, the Committee notes that it was originally intended to allow the Office to Central for the Repression of Irregular Immigration and the Use of Untitled Foreigners (OCRIEST) to access certain data at national level in the context of its tasks of coordinating the collection and centralization of the Intelligence and the fight against organized crime. The Commission takes note that, at its request, and in accordance with the above-mentioned purposes of the processing, such access will ultimately not be implemented.
In addition, the draft decree provides that national police officers do not access Directly to the treatment, as well as the members of the national gendarmerie justifying a need to know, may be recipients of the data. The communication of the data will then have to be preceded by an express request, which is validated hierarchically, specifying the identity of the consultant, the object and the reasons for the consultation
Persons in difficulty, the social workers assigned to the police stations, under the conditions laid down in Article L. 121-1-1 of the Code of Social Action and Families, may be recipients of the data without access Directly to the processing.
On the information of individuals:
Persons whose data are processed will be informed in accordance with the conditions laid down in Article 32 of the law of 6 January 1978, as amended.
As such, national police personnel will be informed by way of posting in the Local police services, a document containing this information which may also be given to them on request.
Persons admitted to a police service will be addressed by means of posting In the public accessible parts of the police services premises. In addition, with regard specifically to persons who are already on hand, a reference to information will be placed on the receipt issued to them.
Finally, the persons concerned by an event processed by the police services will be Addressees of oral information, a document mentioning this information which may also be given to them on request. The Commission considers that the effectiveness of this oral information could be random in the context of the treatment of events by national police officers, in particular as part of their daily interventions. It therefore recommends increased vigilance with regard to the effectiveness of information by posting in the public accessible parts of the national police premises.
On the rights of access, rectification and opposition of the People:
Persons whose data are processed will be able to exercise their rights of access and rectification directly with the services of the national police, in accordance with article 41, paragraph 4, of the law of January 6, 1978, as amended
Draft decree specifies that national police officers will have to enter their duty station while other persons (persons depositing on a regular basis, persons affected by an event processed by the police services) National, persons received in a national police service) shall Apply to the appropriate police service. The Commission takes note that this service is, more specifically, the person who received the person or processed the event.
In any event, the Commission takes note that, irrespective of the rules governing the right of access to the data, any person The
of opposition provided for in section 38 of the amended Act of January 6, 1978, as amended, does not apply to the N-MCI processing.
On Interconnections, Reconciliations And other related links:
The Commission takes note that, as part of the management of the events handled by the police services, the N-MCI processing will be interconnected with PEGASE processing (event steering, activity management and security of the Crews). This treatment, governed by the decree of 21 January 2008 mentioned above, is implemented within the information and command centres of the national police, in particular to manage telephone solicitations (calls from " 17 ") And the transmission of missions to terminals embedded in geolocalised patrol vehicles.
The Commission considers that this interconnection is justified by the purposes of these treatments and that its technical conditions for its implementation
On Data Security and Action Traceability:
N-MCI processing will be deployed on the private network of the Ministry of the Interior. Communications between workstations and the server hosting this application ensure the confidentiality of operations. Access to treatment presupposes the prior identification of the user by his or her regimental number, and then authentication by entering a password. The Commission notes that the Ministry recently issued directives on the robustness of passwords and the automatic locking of computer stations in its services. However, it recommends a blocking of the user account after a number of attempts to connect from wrong access codes.
Regarding the traceability of the actions, the draft order indicates that the consultations are The purpose of a registration involving the identification of the consultant, the date and time of the consultation, the information being kept for three years. The committee stresses the importance of these traceability measures for consultations. It notes, however, that these measures do not allow for the retention of information relating to the subject matter of the consultations, as well as possible modification or printing
. National police do not directly access the treatment, by the military members of the national gendarmerie and by the social workers assigned to the police stations, the committee takes note that each communication of information in this Framework will be journaled with the date of Transmission, the recipient of the data and the reasons for the request. The Panel further recommends that the subject matter of the application be retained and that all of this information be retained for three years.
The President,
A. Türk
