Advanced Search

Deliberation No. 2011-021 Of January 20, 2011 Opinion On A Draft Decree In Council Of State On The Establishment Of A Processing Of Data Personal Management Of Ecrouees Persons Referred To As "management Information System...".

Original Language Title: Délibération n° 2011-021 du 20 janvier 2011 portant avis sur un projet de décret en Conseil d'Etat portant création d'un traitement de données à caractère personnel relatif à la gestion des personnes écrouées dénommé « gestion informat...

Subscribe to a Global-Regulation Premium Membership Today!

Key Benefits:

Subscribe Now for only USD$40 per month.

Text information




JORF n ° 0157 of July 8, 2011
text no. 97




Deliberation n ° 2011-021 of 20 January 2011 giving notice of a draft decree in Council d 'Etat appointing d ' a processing of personal data relating to the management of the ecroused persons named " Computerized management of institutional inmates " (GIDE) (Notice No. 10024143)

NOR: CNIX1118227X ELI: Not available


The National Commission on Informatics and Liberties,
Seizure for opinion by the Ministry of Justice and Freedoms of a draft decree in the Council of State establishing the processing of personal data relating to the Management of the "ecruised persons" Computerized management of institutional inmates " (GIDE);
Having regard to Convention 108 of the Council of Europe for the protection of persons with regard to the automatic processing of personal data;
Having regard to Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 Relating to the protection of natural persons with regard to the processing of personal data and the free movement of such data;
Seen the code Criminal ;
Seen Criminal Procedure Code ;
Seen Act No. 78-17 of January 6, 1978 Computers, files and freedoms, as amended by Act No. 2004-801 of 6 August 2004 on the protection of natural persons with regard to the treatment of Personal data, and in particular its Sections 26 and 8;
Due to Prison Law n ° 2009-1436 of 24 November 2009;
Seen Decree No. 2005-1309 of 20 October 2005 for the application of law n ° 78-17 of January 6, 1978 relating to data processing, files and freedoms, as amended by Decree No. 2007-401 of 25 March 2007;
After hearing Ms. Claire Daval, Commissioner, in his report and Elisabeth Rollin, Commissioner of the Government, in its observations,
Emet the following opinion:



The Commission has been referred by the Ministry of Justice and The freedoms of a request for an opinion on a draft decree of the Council of State concerning the treatment referred to " Computerized management of institutional inmates " (GIDE), in accordance with Articles 8 and 26 of the Act of 6 January 1978, as amended in August 2004. GIDE processing includes a module called " Electronic link book " (CEL).
The prison law of 24 November 2009 is part of an overall policy of modernisation of the penitentiary system, giving it new prospects, in particular by taking into account the individualisation of the prison system. Detention regimes.
Under terms of article D. 88 of the Code of Criminal, the execution of the sentence of the Inmates is established " On the basis of the evidence gathered during a period of observation, and then throughout the detention, with all the services known to be aware of the situation of the detained person concerned ", in particular on the basis of their personality and Their dangerousness. Finally, this law places the rehabilitation of prisoners at the heart of the intervention of the prison public service.
The envisaged system is at the centre of this reform, since the committee, which has already ruled on certain features of the On 20 October 2002, the computerised management system of institutional inmates (GIDE) was seized for an opinion on the addition of two new modules. The modules " Workshop-work-training " And, in particular, " Electronic link book " Are the translation of the main orientations of the reform.
As a preliminary remark, the Committee notes that the two new modules were experienced without the prior notice being collected as provided for in the law of 6 January 1978. Amended in August 2004.
The amendments submitted to it extend considerably the recipients and the list of data, some of which fall within the category of sensitive data listed in Article 8 of the Computer Law and Freedoms.
For purposes:
The purpose of the GIDE treatment is the enforcement of criminal sentences, security measures and judicial decisions. Only Modules " Workshop-work-training " (ATF) and " Electronic link book " (CEL) are now added to this application.
The Commission considers that the purpose pursued by the ATF module, namely to ensure the management of socio-cultural data for the purpose of social and professional reintegration of the person Is determined, explicit and legitimate.
If the Commission notes that the CEL is presented by the Authority as having as its purpose an individualised care enabling the implementation of a detention path adapted to each However, it considers that the latter has a dual purpose: The prevention of risk behaviour and the prevention of possible threats to the responsibility of the administration.
The Committee considers that the objective pursued by the CEL is explicit, legitimate and determined, while considering With regard to the sensitivity of the data collected it is necessary to be particularly attentive to the purpose of the collection of each data.
On the data collected:
The data recorded in the ATF module is adequate, relevant and not excessive in terms of the purpose of this module.
On the other hand, with regard to the CEL module, if the Commission considers that the usefulness of the CEL does not appear to be Have to be called into question, the arrangements for its implementation raise several points, in particular as to whether the search for information can find limits, especially in the particular context of the deprivation of liberty Which makes it difficult to preserve privacy and thus personal data.
Failing to limit the nature of the data collected, which would be contrary to the spirit of the CEL, its very purpose being to be able to centralise all the information relating to the daily life of the prisoner, the Committee considers that it is appropriate to be Attentive to the purpose of the collection of each of these data and to the number and quality of the recipients, each data to be collected for a specific purpose and transmitted to certain duly authorised recipients and for the exercise of Specified missions.
If many topics do not raise Problems, some of them call comment.
The topic " Relationships with others " Of the CEL:
The Commission considers the following items: " Propensity to manage leadership through negative means "," Depressed "" Inability to live with others/non-adherence to the rules of the community "should be reformulated in order to objectify, on the model of the other items in this heading which are relevant to the observation and are relevant to it:" Refusal to walk "," No visits to the A320 Family, " Desire to meet a prison visitor "," Does not receive mail "," Does not send mail "," Complains "," Isole "," Does not express itself ".
Evaluation grids for suicide risk or dangerousness:
The topics in these grids do not require any particular comment as they are formulated in the form of questions filled in Interview with the inmate. However, some have taken the Committee's attention, such as " Apparently delirious "," Appears to be in psychological shock, " Seems depressed "," Seems anxious-sad-aggressive.
The administration argued in response that these officers have received specific training to enable them to complete these evaluation grids and that they do not wish to restrict to medical personnel only Their updating to the extent that prison staff can, through their permanent contact with inmates, identify a state of suicidal crisis.
Inmate requests:
The Commission considers that the observations of the medical staff should not be made in the CEL as long as they are subject to medical confidentiality and should be included in the prisoner's medical file. Only medical prescriptions should be included in the CEL without being able to be consulted without the specific authorisation of the head of the institution and only to the extent that it corresponds to a need.
Similarly, it considers the system Management of inmate requests should not provide that the ground for requesting medical appointments be filled in.
In this regard, the Commission notes that the department has specified that the CEL terminals have application-specific tab Appointment without informing the reason for the appointment.
On geographic or ethnic origin data:
The Commission notes that if the administrative record attached to the draft order refers to the collection of the geographical or ethnic origin of the person being hatched, the draft order does not mention it.
In fact, Article 5 Sensitive data in the draft decree only mentions data on the political, philosophical, religious and health opinions of prisoners, confining itself to the second paragraph to refer to other personal data falling within the scope of the decree. Section 8 of the Computer Law and Freedoms, without further elaboration.
In The extent to which this clearly refers to the collection of ethnic data, the Commission considers that this article should be completed in order to specifically mention the collection of ethnic origins.
The Commission takes note that this data cannot Be registered in order to avoid the assignment in the same cell of inmates who may be in direct conflict and will not be able to be systematically informed.
On Recipients:
The recipients listed in Article 6 of the draft decree have access to the GIDE application in consultation.
In view of the sensitivity of the data recorded in this application, the Commission considers that access by these addressees The processing must be surrounded by strict guarantees, in particular in terms of authorisation, justification for access to data and, finally, in terms of traceability.
Access in consultation with some of these recipients has attracted the attention of The Commission.
The case of individual employees Designated and duly authorised of the decentralised services of the public service for the judicial protection of youth:
These officers have access to the prison service module for insertion and probation/service of judicial youth protection/electronic link book.
The Commission requests that only the judicial protection officers of the Youth who have direct contact with the minor or young person in detention, or with members of their families who are also detained, may consult the data provided in the CEL and only those relating to this Last.
The case of private personnel acting in delegated management :
Under Article 6 of the draft decree, the staff of private groups acting in the context of delegated management have access to all the data of the accounting modules, ATF and CEL.
The diversity of benefits that can be Covering all the delegated public management contracts concluded by the penitentiary administration and thus the number of persons concerned leads the Commission to consider that all providers cannot have access to the same data, All the more so because access in consultation is not traced.
On the other hand, It believes that access to a module should not be allowed to have access to all the data in this module.
The Commission takes note of the department's accuracy in this regard, indicating that the clearances of the Private groups provide access to specific functionalities according to their missions, under the responsibility of the head of establishment.
The Commission takes note that it is not foreseen in the ATF package as private groups Have access to the following data: Address before incarceration, telephone contact, stability in pre-incarceration accommodation, subject matter of conviction, record of legal history, type of background, but will have access to the following data: " The criminal category "," Administrative category "," The cellular geographical unit ".
With regard to their access to the CEL, the Committee notes that these staff have access in consultation to the requests of the prisoners. They may make representations as they deem necessary.
With regard to the consultation of detainees' requests, the Commission considers that these agents should be able to consult only those requests that concern them directly
The possibility for those agents to make observations, since the latter are made public by default, the Committee considers that the collection of those observations would be relevant and proportionate if it were carried out by the intermediary A licensed prison administration framework.
Access To data by authorized officials of national education:
The Commission notes that these officials have access to the ATF and the CEL. It takes note that only the national education officials who have left the CPU have access to all the data of the CEL.
It considers that other officials who do not have this entitlement should have access only to the Topic " Maintenance with the national education department " And the ATF module in the absence of any traceability of the consultations. However, it considers that they can issue observations directly in the CEL, without being able to consult the observations of other stakeholders.
Access to data by the members of the Single Multidisciplinary Commission (CPU)
Article 90 of the Code of Criminal, the CPU is presided over by the Head of Institution. It also includes the Director of the Prison and Probation Service, an official in the detention area of the prisoner whose situation is being examined, a representative of the labour department, a representative of the training service The
considers that these persons will not be able to be aware of the sensitive data contained in the CEL only to the extent that the CPU's agenda established by the Chief Establishment implies such a consultation.
It believes that the data In relation to the health of the prisoner should be examined only to the extent that the persons listed in the Href=" /viewCodeArticle.do?cidTexte=LEGITEXT000006071154&idArticle=LEGIARTI000006515350&dateTexte= &categorieLink = cid"> article D. 90 of the Code of Criminal Procedure, namely the psychologist in charge of the execution of the sentence, a representative Caregivers from the ambulatory care and consultation unit or the regional medical/psychological service designated by the connecting health facility.
Wishes that it is for these medical personnel to determine freely the data that may be communicated during the CPU, taking into account the presence of non-medical staff.
Article 7 of the draft order determines in a manner Extremely broad the persons who may be recipients of certain categories of data without access to the application.
The Commission considers that Article 7 of the draft decree should be completed in order to clarify that only staff Individually designated and specially empowered may be aware of these Information.
On interconnections:
The Commission notes that data from the GIDE application feeds APPI processing into the follow-up of persons subject to judicial enforcement action and The National Prisoners File.
It points out that no data contained in the CEL will be able to feed these treatments.
It acknowledges that no interconnection between the GIDE application and the treatments referred to " Electronic surveillance "," Mobile electronic surveillance "," Management of educational measures for the reception of minors from the judicial protection of youth " And " Particularly reported detainees " Is not implemented.
On retention times:
The Committee notes that the draft decree provides for a retention period of two years for all data recorded in GIDE as of the lifting of the nut of the data subject.
It takes note that at the end of two years Years, the data will be kept in an intermediate archive for an eight-year period, only accessible to the central services of the penitentiary administration for the management of the legal proceedings of the prisoners or their successors in title Right, and this data cannot be returned to the active base.
The The Committee notes that the draft decree does not provide for a specific retention period for data recorded in the CEL. It considers that the question of the preservation of the history of the observations contained therein is of the utmost importance in view of the sensitivity of this information.
In this regard, the prison authorities argue that the CEL may permit, in Cases of possible disputes, to be able to seek the observations made by the officers in order to prove that the staff of the prison administration has fulfilled its tasks.
The Commission considers that this data Should, at a minimum, be placed in the archive as soon as the nut is removed Of the data subject, in order to be accessible only by a limited staff.
As regards the data relating to visitors, if the Ministry indicated that the data were no longer available as soon as the final nut was removed, The Commission considers that this data should be placed in the intermediate archive as soon as the person's nut is removed from the person in contact with the visitors concerned.
With regard to the retention of data relating to persons who are Review and have been subject to a non-suit, if the department has Stated that it was necessary to be able to keep the data relating to detention in view of the increase in the number of cases, the Committee considered that these data should also be kept in an archive as soon as the definitive lifting of the The person concerned.
The committee has received a supplement to the draft decree on 18 January 2011 inserting a new paragraph in Article 8 which provides for a specific retention period for the prisoners being monitored By the security staff.
The Commission takes note that this period of Retention is set to 10 on an active basis. It also takes note of the parolees whose follow-up period is longer than 24 months, that the data are kept on an active basis one month after the end date of the follow-up to enable the application judge to be seized Penalties in case of a violation by the convicted person of the obligations to which he is bound, in accordanceArticle 712-20 of the Code of Criminal procedure.
On the Rights of Persons:
The Commission takes note that the right of access is exercised directly except for data relating to the dates of transfers, judicial translations and extractions, special requirements of judicial or penal origin Establishing the prisoner's detention regime, designation of the premises of the institution, description of the movements of detainees, designation of persons who decide on the assignment of detainees. With regard to the latter information, the right of access is indirect.
In this regard, the Committee points out that the inaccuracy of certain data under the indirect right of access may lead to difficulties in interpretation, such as " Special requirements of judicial or prison origin for the detention of the detainee " And " Description of the movements of prisoners ".
It notes that the right of information is posted by posting.
Regarding the CEL module:
The Commission considers that it should be subject to specific information terms with the Held, in particular with respect to observations. In this regard, the department indicated that it could consider individual information from the inmate during the first interview. The charter of use attached to the record by the department specifies it. In view of the sensitivity of the treatment, the Commission considers that this charter should be circulated via a circular letter to the institutions concerned as suggested by the Ministry.
Security:
The national application GIDE :
The GIDE application is a locally deployed application in all prisons. Each GIDE application deployed in an institution feeds the national GIDE database (BNG) through the virtual private network of the Department of Justice (OPI).
The BNG collects all updates on all the GIDE databases Various penitentiary centres. It is only a technical application, implemented at the computer level in order to ensure the national consolidation of the local GIDE data in order to then feed the infocentre prisons. The BNG is not accessible to users. The accesses that are made to the BNG relate only to the feed of the penitentiary infocentre and the information that is returned to the users, via the infocentre, are anonymized.
The commission notes that the clearances are Extremely limited to access this national base.
Local applications GIDE:
The Commission notes that the physical security of the servers hosting the application and the machines for accessing them is guaranteed by the fact that these facilities are in a penitentiary.
In terms of logical security, Network equipment is planned to protect servers from unauthorized access.
The Commission notes that only 24 out of 11 300 posts were on an operating system that is no longer commercialized, and that these 24 posts would be in Compliance in the first half of 2011.
It notes that data consultation Within the various functionalities at the local level is under empowerment. In the current state, subject to their field of competence, the members of the CPU and the management staff are entitled to access all the functionalities of the CEL. Non-executive staff are entitled to access functionalities " Comments "," Queries " And " Mail ". The department indicated that an individualized change in the allocation of clearances, and not automatically as a result of membership in a category, was scheduled to take place in September or October 2010. However, this new version is not yet deployed.
Users are authenticated by ID/password, including robustness and. Management is considered satisfactory. Connections and disconnections are logged for a period of ten months.
Regarding traceability:
The Commission considers, in view of the sensitivity of the data collected in GIDE and the number of recipients concerned, that Important safeguards should be implemented.
It believes that there should be serious safeguards in terms of traceability, the latter being limited to access to modification and deletion only. The simple consultations are excluded.
Query Input Borne:
Prisoners have the option of registering their requests with terminal aisles. These terminals are physically secured to prevent any use of these terminals for other purposes. The registration of requests by these devices is intended to ensure their traceability.
The Commission considers that these terminals should be placed in places allowing access to the confidentiality of the requests of the Inmates.
It takes note that the authentication of inmates is done from a barcode card and the seizure of a password.
Transfer of an inmate:
The Commission notes that, when transferring an inmate, the transfer of data is carried out by the virtual private network of justice through an encrypted archive.


The President,

A. Türk


Downloading the document in RTF (weight < 1MB) Excerpt from the authenticated Official Electronic Journal (format: pdf, weight: 0.24 MB)