Key Benefits:
National Computer and Liberties Commission,
Seizure by the Ministry of Labour, Employment and Health of a Request for Advice Concerning a draft decree establishing a teleservice of the administration for the dematerialisation of the management of the single contract for insertion;
In view of the Council of Europe Convention No 108 for the Protection of persons with regard to the automatic processing of personal data;
In view of Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to treatment Personal data and the free movement of such data;
Given the Labour Code, and in particular its Item L. 5134-19-3 ;
Seen Law n ° 78-17 of January 6, 1978 as amended relating to computers, files and freedoms, including its article 27-II (4 °);
Seen decree n ° 2005-1309 of 20 October 2005 modified for the application of Law n ° 78-17 of 6 January 1978 changed for computing, files, and freedoms;
Vu The draft decree establishing a teleservice of the administration named " System of free access by employers " Having as its purpose the dematerialisation of the management of the single contract for insertion;
Having regard to the dossier and its additions;
On the proposal of Mr Emmanuel de Givry, Rapporteur, and after having heard the comments of Mrs Elisabeth Rolin, Government Commissioner,
Emet the following notice:
On the basis of Article 27-II (4 °) of the Act of 6 January 1978, as amended, the National Commission for Informatics and Freedoms was seized for an opinion by the Ministry of Labour, Employment and Health of a draft decree The creation, by the Service and Payment Agency (ASP), of a teleservice of the administration whose purpose is the dematerialization of the management of the single contract for insertion (CUI).
At the outset, at the reading of article L. 5134-19-3 of the Labour Code, the Commission observes that a CUI takes the form of an employment escort contract (CAE) when it is entered into with an employer in the non-market sector, on the one hand, or an initiative-employment contract (CIE) when it is entered into with an employer in the merchant sector, on the other
.
The draft order under consideration by the Commission provides for the provision of tele-service to users of the administration via an application created by the ASP, known as " System of free access by employers " (SYLaé).
Article 1 of the draft decree provides for the creation of the SYLae service for the purpose of managing, monitoring and following the individual CUI agreements, on the one hand, and calculating and paying the aid that is to be allocated to the The
, on the other hand, will be able to teledeclare the presence of employees benefiting from a CUI. In addition, they will use the SYLaé application to inform the ASP of the suspension or early termination of a CAE or ICE. Finally, employers may also seize or correct their bank details in order to collect from the administration the assistance to be paid to them.
The Commission notes that the objectives pursued by this teleservice are to Reduce processing times, increase the reliability of the data and allow for more efficient control of the CUI.
The Commission considers that the purpose of the SYLaed application is determined, explicit and legitimate.
On the Processed personal data:
The Committee notes that Article 1 of the draft decree lists the personal data collected and processed by the SYLaé application.
More specifically:
-identification data for employees benefiting from a CUI (name, first name, registration number of individual CUI conventions);
-data relating to professional life (start date of the contract, expected end date of the Contract, actual termination date of the contract, number of absences, reason for failure, month of suspension and reason for suspension of the contract);
-economic and financial data (salary of beneficiaries of a CUI, bank details of Employers);
The Commission also observes that the connection data Employers in the teleservice will also be collected (login, password, timestamp information).
The Commission considers the collection and processing of all these data to be legitimate, relevant and not excessive in the eyes of the For continued purposes.
On recipients:
Article 1 of the draft decree indicates the recipients of the personal data processed through the SYLae service.
More specifically, these are the only agents of the ASP authorized to verify the information
The Commission considers that these addressees have a legitimate interest in accessing the data of the remote service known as SYLaé.
On data retention periods:
Article 2 of the draft decree specifies that personal data are kept for the period during which the public accountant is responsible and, at the latest, for five years after the date of completion of the agreement
The Commission also notes, in the event of disputes relating to an individual CUI Convention, that the data necessary for the investigation of this type of dispute may be retained until a decision has been taken.
The Commission considers that these Retention shall not exceed those necessary for the purposes of the purposes pursued.
On the information of the persons concerned and the rights of access and rectification:
Article 4 of the draft decree states that the rights of access and rectification provided for in Articles 39 and 40 of the Law of 6 January 1978, as amended, will be exercised with the regional directorates of the ASP
That the request for an opinion presented by the Ministry of Labour, Employment and Health indicates that the information of the persons concerned will be provided by means of a statement on the forms as well as a statement on the website of the DGEFP.
The Commission considers that the measures provided for in the information of persons
On security measures:
The Committee notes that physical and logical protection measures have been taken to safeguard the security of processing and personal data. These measures are intended to prevent any misuse or misuse of the data or that unauthorized third parties have access to it.
It takes note that the SYLaé service will be subject, after its implementation, to a compliance check with the Requirements of the General Security Repository (RGS), as defined inOrder No. 2005-1516 of 8 December 2005 on electronic exchanges between users and Administrative authorities and administrative authorities.
The Commission also notes that the ASP has also initiated a process of compliance with the requirements of the RGS.
The Commission notes, however, that the safeguards entrusted to an external provider are not encrypted. Accordingly, it recommends that measures be taken to ensure the confidentiality of the data contained in these safeguards.
Apart from this last remark, the Commission considers that the security of the SYLaé teleservice does not call for
The President,
I. Falque-Pierrotin
