Key Benefits:
The National Computer and Information Commission Freedoms,
Having regard to Convention 108 of the Council of Europe for the protection of persons with regard to the automatic processing of personal data;
Having regard to Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 Relating to the protection of individuals with regard to the processing of personal data and the free movement of such data;
In view of the environmental code, in particular Articles L. 127-10 and R. 127-10;
Given the code of Spatial planning and spatial planning regulations;
Seen book of tax procedures, including articles L. 107 A and R. 107 A-1 to R. 107 A-7;
Seen Law n ° 78-17 of January 6, 1978 as amended relating to computers, files and freedoms, including articles 25-I (5 °) and 25-II;
Seen Law n ° 2009-967 of 3 August 2009 on the Environment Grenelle's work;
Seen under Act n ° 2010-788 dated July 12, 2010 National Commitment to the Environment;
Seen Order n ° 2005-1516 of 8 December 2005, in particular Articles 9 and 10 creating the " General security repository " ;
Seen Decree No. 2005-1309 of 20 October 2005 as amended for the purposes of the Act No. 78-17 On January 6, 1978 relating to computers, files and freedoms;
In view of deliberation n ° 2006-257 of 5 December 2006 with sole authorisation of treatment Of personal data implemented By local authorities or their groupings for urban planning or public service management of non-collective sanitation and may include a geographical information system (single authorisation decision AU-001);
After Having heard the report of Mr Dominique Richard, Commissioner, and the comments of Mrs Elisabeth Rolin, Commissioner of the Government,
Scope of this authorisation:
A geographic reference database is intended to map a territory, whether local or national, for the purpose of better governance of spatial planning. It shall contain the references, drawing and/or address of the parcel which indirectly identify the owner of the parcel. This data is therefore personal data.
A geographical information system (GIS) is designed to visually locate within a territory the human activities or categories of people involved in a particular geographical area. Management activity.
The statistical operation of a GIS is to represent the population density by sector in order, in particular, to optimize a decision.
This statistical operation cannot identify directly or Indirectly the persons concerned. The controller is responsible for the non-identifying character of this operation.
The applicable system:
The treatments implemented from the cadastre, geographic database or GIS data, as long as they are Have interconnections with a personal data file having a distinct purpose and which are of different public interest, constitute treatments subject to the authorisation scheme provided for in Article 25-I (5 °) of the Law " Informatique et Libertés ", except in the cases provided for in Articles 26 or 27.
In addition, where such treatment is likely to include data relating to urban and environmental offences, they are also subject to Article 25-I (3 °) of the Act of 6 January 1978, as amended. They must also, as such, be authorised by the committee. The same applies to the treatment of health-related data justified by the public interest (Articles 8-IV and 25-I [1 °] of the Act) Computing and Liberties ").
In accordance with Article 25-II of the Act of 6 January 1978, as amended, the Commission may authorise, by a single decision, the same purposes and for identical categories of data and
. Responsible for each treatment complying with this single decision addressed to the committee a commitment to comply with the characteristics of this authorisation.
The committee decides, under these conditions, that the structures and bodies Listed below which address a compliance commitment for their treatment Personal data complying with the conditions laid down in this single decision shall be authorised to implement such processing.
Processing Finalities.
For the management of public services identified by this release, a GIS is used to:
-represent on a map any geo-positionable information;
-project data from a business application onto a map. Several layers of information from several business applications can be superimposed on a GIS.
Each business application that has personal data must also be subject to formalities with the Commission prior to its interconnection with IMIS.
Only may be subject to a commitment of conformity by reference to this Single Authorisation of the treatments implemented by:
-the state;
-its deconcentrated services;
-its public institutions;
-local authorities;
-their groups;
-any organization, private or public, responsible for a public service mission, statutorily or Contractually, by a community or group cited above,
having as its object the use of geographic databases, in relation to the files corresponding to the following purposes.
Planning Management:
-the establishment of an inventory of the land of the community or of the state and the management of land acquisition or sales records of the community or group of communities, of the state or its deconcentrated services;
- The appraisal of applications for building permits and other formalities in the field of land law;
-the completion of studies on town planning, habitat, spatial planning, and in particular the PLU (local planning plan);
- The preparation or consultation of documents, plans and programmes defining Public policy on urban planning and the environment;
-monitoring findings of urban planning offences;
-information for those involved in road development, public domain management Land, urban planning or related to the environment;
-the issuing of information by municipalities to persons who have filed a request for duly substantiated information concerning a specific property, whether built or not ;
-the issuance by municipalities to the land owner of the survey Of its property (s);
-the consultation of the information on the outfitting and networks, excluding the personal data related to the management of the subscriptions.
Managing the collective sanitation service or not:
- The management of remediation facilities in the community or community group.
Land Use Management: Planning, development and mentoring of networks, energies, transport; organisation and management of local infrastructures, reception areas for Travellers. All activities which, in addition to geographical information, exploit personal data relating to:
-to the owners whose parcel is affected by the activity, by the introduction of new equipment, by the new A study or new service;
-the geographic location of network subscribers;
-or those affected by the managed activity,
, who require their agreement or information.
Building Management: Programmed operation to improve habitat (OPAH); control of unfit and unhealthy habitat; management of vacant housing; identification of urban sprawl and peri-urbanisation phenomena; characterization of agronomic quality Land: Identification of agricultural land to be protected as a priority for urbanisation, establishment of an observatory for land use; management, control and analysis of data necessary for the taxation of local tax payers subject to local tax On external advertising; study of the thermography of buildings.
Management of green spaces, agricultural spaces, natural spaces, ditches, watercourses, coastlines, protected sites: Any activities that require the collection of information on the owners of the parcels concerned, tenants, sharecroppers, farmers, occupiers or neighbours of the parcels concerned.
Control of health risks and treatment of the Pollution: all activities requiring the collection of information on the owners of the parcels concerned, tenants, sharecroppers, farmers, occupiers or neighbours of the parcels concerned
Establishment of an observatory of local taxation, use of the cadastral matrix by the communal or inter-communal commission of direct taxes for the valuation of built or unbuilt properties, management of vacant housing, management of Craft and trade.
Communication and tourism: publication on the website of the routes of hikes with their tourist facilities, remarkable sites, castles and accommodation with contact details of the operators or Owners.
Population Assistance: Management and prevention of risks, management of the home support and support service, school sectors, polling stations, concessions in cemeteries; the municipal safeguard plan (PCS), management of the missions of the service Fire and rescue department (SDIS) and all activities that require the collection of information on the geolocalised persons concerned.
Any other use of GIS is prohibited.
Registered personal data categories.
Only the information that follows can be processed, provided that they refer to the territory of the State, the community, the grouping of Communities or jurisdiction specific to the private or public body responsible, statutorily or contractually, for a public service mission:
(a) Information relating to the owner (s) and/or occupier (s) and/or (s) Operating: Quality, surname, given name, date and place of birth; social reason, legal form; property right and dismemberment; home address;
(b) Information on non-built properties: cadastral references; address; reference In the land book (in Alsace-Moselle); lots; nature and sub-nature of culture; area; cadastral income; nature of exemption, applied percentage; exempt income fraction; taxation return year; taxed income; history of the Parcel;
c) Information on constructed properties: Cadastral references; address; year of construction; category, assignment, nature of premises; cadastral income; nature of permanent exemptions; number, assignment and area of rooms; maintenance, situation and D' elevator; descriptive of temporary exemptions; bases of taxation; information relating to the tax or charge on the removal of household waste;
(d) Information on town planning files: Name, first name and address of the applicant; quality, surname, first name and address of the architect; quality, surname, first name and address of the notary; address, area and cadastral status of the land; coefficient of occupation of the land; area of the local plan Urban planning; administrative easements; nature of work; change of destination; detail of surfaces; amount of town planning taxes; notice of the mayor; administrative and criminal proceedings;
e) Information on matters relating to Statement of intent to dispose of: Name, first name and address of the owner and the applicant; address and area of the land; designation of the property, use and occupation, existence of real and personal rights, selling prices, notices of the domains;
f) Information relating to the Town planning offences: Name, first name and address of the offender and the complainant; identification of the ground, origin of the file, nature of the proceedings; object of the infringement found, amount of the daily periodic penalty imposed by the High Court, taxes put Collection, dates of proceedings;
g) Information on Road Permissions: Surname and first name of the beneficiary and object;
h) Information on the energy performance of public or private buildings;
i) Information relating to the management of individual collective sanitation facilities or not Collective: Address of the building, name, first name and address of the owner of the building, name and forename of the occupant of the building, year of construction, category, assignment and occupation of premises, surface, cadastral references and photographic illustration Parcels.
Data, if any, from the drinking water management or collective sanitation service will be used during the initial maintenance phase of the accountability file;
j) Information Necessary for the management of vacant, unsanitary or unworthy housing ;
k) Information needed to implement population alerts: Name and forename of the occupants of the dwelling, number of living children in the dwelling, date of birth, address, fixed telephone number, mobile number and/or professional number, e-mail address; quality of which the person Is entered in the file; characteristics of the dwelling; pet; ability to understand without assistance (yes/no); ability to move without help (yes/no); means of evacuation possible; possible transport modality; contact details The person to be prevented in an emergency; name and quality of the third party Having made the entry in the register;
(l) The information necessary to establish the charges for the removal of household refuse: Name and first name of the occupants of the dwelling, number and age of inhabitants per dwelling, volume of the ferry made available and number of releases;
m) Financial and tax information necessary for the establishment of a tax observatory Local or economic analysis of a territory;
n) The information necessary for the allocation and monitoring of grants, including the address of the tenant and its heritage situation.
The Commission points out that each individual data Collected personnel must be adequate, relevant and not excessive in relation to the Purpose continued.
Mapping " Sensitive data " Within the meaning of Article 8 of the Act of 6 January 1978, data relating to delinquency (Article 9) and those with assessments on the social difficulties of persons (Article 25-I [7 °] of the Act) Computing and Liberties ") Remain subject to a specific authorisation.
Registered data may not, in the context of this single authorisation decision, be subject to further processing. They may not, therefore, be integrated into another file or be the subject of interconnection, approximation or any other form of connection with other treatments than those corresponding to the purposes listed in Article 1
Do not fall within the scope of this authorization to update the personal data contained in business applications, one or more processing managers via GIS mapping.
Information for people.
The data subjects are informed by the controller in accordance with Article 32 of the law " Informatique et Libertés ", in particular with regard to the possible geolocation of their addresses for each GIS-related processing. The information shall be posted on the website of the controller, by way of posting, by publication in the local press or on a communication medium specific to the controller.
Any publication on the Internet of this Geo-location is subject to a right of opposition from the data subject. This right is embodied in a publication scale guaranteeing the absence of direct or indirect identification of the persons concerned by the results.
Rights " IT and freedoms " As defined in Chapter V of Act No. 78-17 of 6 January 1978, as amended, apply to the service (s) designated by the State, the community, the group or the private or public body responsible for the mission of service Public. This information is on all media used by the controller to contact the persons concerned.
Communication The
of information from the cadastral matrix can only be carried out under the conditions laid down in Articles L. 107 A and R. 107 A-1 to R. 107 A-7 of the Book of Proceedings
The controller may issue or cause to be issued by the person that he/she delegates to that effect, to any person who requests it on a case-by-case basis, information from the cadastral
. The above mentioned articles, the date and place of birth of the owner, the Grounds for exemption from property taxes where these reasons give information on the method of financing the construction or the personal situation of the owner (economically weak person) cannot be Communicated to the public.
The public can access directly via the Internet a consultation interface to the information contained in a " Geographic, local or national database, reference " ("BGR").
The Commission points out that a reference geographical base available to the general public may not include " No personal information other than parcelling and the addresses of the parcels', in accordance with Article L. 127-10 of the Environment Code.
The obligation to publish plans for urban planning and land use Can be done on the internet.
Recipients of the information.
1 ° Within the limits of their respective powers and for the purpose of the abovementioned purposes, are the only ones authorised to directly access the director of a deconcentrated service The state, the mayor, the president of the community, The President of the public institution for inter-communal cooperation, the heads of private or public bodies responsible for a public service mission or their designated representatives, and the authorised agents of the services responsible for:
-the training of soil law files;
-urban planning, the environment and sustainable development;
-work and studies related to spatial planning (habitat, roads, etc.);
-collective or non-collective sanitation ;
-heritage management;
-building management;
-management of green spaces, agricultural spaces, natural spaces, ditches, watercourses, coastlines, protected sites ... ;
-control of health risks, pollution treatment and waste management;
-the economy and spatial planning;
-communication and tourism;
-population assistance.
These empowered agents must not Access only to data whose knowledge is essential for the exercise of their public service mission. To this end, different levels of clearance must be defined.
As a reminder, in the context of the safeguard and alert plans to the population, Article L. 121-6-1 of the Code of Social Action and Families provides that " Such nominative data may be consulted only by the agents responsible for the implementation of this collection and that of the alert and emergency plan referred to in Article L. 116-3. Article R. 121-7 of the same code states that " The mayor ensures the retention of the applicant's records and takes all necessary precautions to preserve the confidentiality and security of the information collected. Only persons named by the Mayor shall be entitled to register, process, retain and modify the data of the Nominal Register. Persons who are aware of the collection of the information, the constitution, the registration and updating of the register, as well as all those who have access to the data contained in this register, are bound by professional secrecy in The conditions set out in Articles 226-13, 226-14 and 226-31 of the Penal Code ".
In the case of a shared GIS, regional, Departmental or inter-municipal, communities or Community groups shall have access and access only to information concerning their territory and within their competence. The manager of the shared GIS guarantees the integrity of the data in each community.
2 ° Within the limits of their respective powers and for the exercise of their tasks in the context of the abovementioned purposes, they are the sole recipients of the Information necessary for the performance of their missions, without access to the application, the following persons:
-the agents of the various external organisations consulted as part of the building permit appraisal;
-the decentralised services officers of the ministries responsible for agriculture, spatial planning, energy, The environment, sustainable development, transport, housing and tourism;
-the officers of the public finance directorate;
-the agents of the local community, since it has transferred the competence of the treatment to the A grouping, or any managing body responsible for processing;
- The prosecutor of the Republic who is territorially competent for information relating to urban and environmental offences.
3 ° Reuse of information of a GIS containing personal data is governed by the Href=" /viewTexteArticle.do?cidTexte=JORFTEXT000000339241&idArticle=LEGIARTI000006528244&dateTexte= &categorieLink = cid"> section 13 of Law n ° 78-753 of 17 July 1978 " Cada law " (anonymization or consent of persons) and subject to prior formalities with the National Commission on Informatics and Freedoms.
Retention period.
Every geographic database is updated regularly, and at least every year.
Except as otherwise provided by legislation or regulations, only the previous year's version can be Be kept on base.
The person responsible for the Geographical information system (GIS) can implement, for statistical purposes, cohort monitoring and historical analysis of the evolution of territories, over a longer period, a basis " Infocentre " Specific, consisting of aggregated data, and does not allow the direct or indirect identification of persons. This infocentre will be enriched each year by importing GIS data and applications interlinked to it.
As indicated in Article 9 of this release, the cadastral matrix and, in particular, its archiving is the responsibility of the Exemption from declaration n ° 16.
The Commission points out that the different purposes, interlinked or internal to the MIS and declared to the CNIL, must, in particular, specify the duration of the data storage.
If the Other information is not recorded in business applications They may be stored in the GIS for a duration that does not exceed the duration required for the purposes for which they are collected.
Beyond that period, the controller must provide for archiving of the Information on a separate media.
Use of a Provider.
The completion of the studies referred to in Article 1 may be entrusted by the controller to a third party service provider.
Relevant data for performing a benefit Subcontracted can be accessed by the provider On special clearance or be transmitted to it by the controller in encrypted form, and under the conditions laid down by an agreement in accordance with the General Security Repository (RGS) ( decree n ° 2010-112 of February 2, 2010 taken for the application of Articles 9, 10 and 12 of Order No. 2005-1516 of December 8, 2005, relating to the Security of information exchanged electronically).
The agreement signed with the provider shall, in particular, define the operations authorised from the personal data to which it has access or which is transmitted to it thus The undertakings made to ensure their security and confidentiality, and in particular to emphasize the prohibition on the use of the data for purposes other than those covered by the Convention.
The service provider must Destroying or returning all manual files or Computer containing the information transmitted to it and has been enriched, upon completion of its contract.
Measures of Security.
Adequate measures must be implemented and monitored to reduce the risks of illegitimate access, unwanted modification and the disappearance of the information processed. Processes must be put in place to enable the persons concerned to exercise their rights. The objective is to prevent any misuse or fraudulent use of this information, in particular by unauthorized third parties, and to preserve the integrity of the data. As such, the security measures put in place to allow the consultation on a website open to the general public must prohibit the downloading of maps displaying personal data from the GIS.
People Authorised, referred to in Article 5 (1), shall have direct and permanent access to processing data. This access is controlled by means of an individual identifier and password in accordance with the recommendations of the CNIL and the general security repository, or by any other means of authentication at least equivalent.
When data Are exchanged en masse on physical media, their confidentiality must imperatively be protected by encryption mechanisms conforming to the general security repository. Such exchanges shall be subject to the formalities prescribed by law " Informatique et Libertés ".
When access to treatment is carried out through an unsecured network, the personal data transmitted must be encrypted when they are transported, in order to guarantee confidentiality. When this encryption is provided by an electronic certificate, it must be generated and handled according to the terms defined in the general security repository.
Finally, all access to personal data must be traced in A connection log, which must be kept for six months and regularly scanned, to detect any attempt to access data that is illegitimate.
Exclusions from the single authorisation field.
The treatments implemented by the communities, their groups and any organisation in charge of a public service mission limited to the consultation of the cadastral matrix and the edition of cadastral surveys, without possibility Enrichment and reprocessing of data, including the use of CD-ROMs " Visu-DGFiP ", do not fall within the scope of this authorisation decision (cf. Simplified Standard 44 as amended in exemption from declaration).
Any other processing of personal data implemented from geographical data, whether or not including a GIS, does not correspond in any way to this decision, In particular with regard to its purposes, recipients, or categories of data processed, must be the subject of a separate application for authorisation.
Relliberation n ° 2006-257 of 5 December 2006 with a single authorisation for processing personal data with a GIS Work by local communities or their Shall be repealed and replaced by this deliberation.
This deliberation shall be published in the Official Journal of the French Republic.
Dated March 29, 2012.
The President,
I. Falque-Pierrotin
