Key Benefits:
National Computer and Liberties Commission,
Seizure by the Ministry of Labour, Employment and Health of a Request for Advice Relating to a draft decree on the establishment of a teleservice of the administration, referred to as " Dematerialised service of rotation ", with the aim of facilitating the conclusion and management of alternate contracts;
In view of the Council of Europe Convention No 108 for the protection of persons with regard to the automatic processing of Personal data;
In view of Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to the processing of personal data and the free movement of such data Data;
Seen Law n ° 2011-893 of 28 July 2011 for the development of alternation and securitization of career paths and, in particular Article 4 providing for the creation of a The dematerialised service of the alternation;
In view of the Law n ° 78-17 of 6 January 1978 as amended relating to computers, files and freedoms, in particular Article 27-II (4 °);
Seen decree n ° 2005-1309 of 20 October 2005 modified for the application of Law n ° 78-17 of 6 January 1978 modified , files and freedoms;
In view of the draft decree of the Minister of Labour, Employment and Health and the Minister to the latter responsible for apprenticeship and vocational training Authorizing automated data processing to Personal character relating to the dematerialised service of the alternation made available to users;
Having regard to the file and its additions;
On the proposal of Mr Emmanuel de Givry, Commissioner, and after hearing the observations of Mrs Elisabeth Rolin, Government Commissioner,
Emet the following opinion:
On the basis of Article 27-II (4 °) of the Act of 6 January 1978, as amended, the National Commission for Informatics and Freedoms was seized for an opinion by the Ministry of Labour, Employment and Health of a draft decree Creation of a teleservice of the administration, called " Dematerialized service of alternation " With the purpose of facilitating the conclusion and management of contracts on an alternating basis.
On the purpose of processing:
Implementation of the " Dematerialized service of alternation " Aims, inter alia, to provide an answer to the difficulties encountered in the management of alternating training and, in particular, the lengthy processing times and the double entry of the personal data transmitted to the This day in paper form by post.
The draft decree examined by the committee provides for the implementation by the general delegation to employment and vocational training (DGEFP) of a teleservice from the administration Called " Dematerialised service of alternation ".
Article 1 of the draft decree provides that this telesservice is intended to make available to businesses and individuals a set of services intended to:
-facilitate the conclusion of alternate contracts;
-improve the quality of service to users;
-facilitate the processing and management of contracts by the organizations involved;
-facilitate the development of Anonymous statistical data processing;
-consistency of existing information networks;
-facilitate the processing of alternate aid payments.
More specifically, the " Dematerialized service of alternation " Be able to provide information about the alternation and the rights and obligations arising from it, to simulate income, to record the dematerialised applications of persons wishing to enter into a contract on an alternating basis, to follow The processing of an application as well as the associated administrative decision and, finally, to ensure dematerialized links between the administration and its partners through file interconnections
Interconnections, the Commission observes that it is envisaged to interconnect files From the DGEFP with those of the Agence centrale des organismes de sécurité sociale (ACOSS) to calculate contributions and aid due to employers, on the one hand, and the files of the DGEFP with those of the national old-age insurance fund (CNAV), to record and validate alternate periods, on the other.
The Commission notes that it is also planned to interconnect files from the DGEFP with those of the General Association of Pension Institutions Executives (AGIRC) and the Association for the Supplementary Retirement System of the Employees (ARCCO), in order to record and validate the periods worked of the alternants.
These file interconnections will allow, in addition, to trace back to the alternants a complete information on their pension rights, for both The
observes that the purposes of the inter-connected files, which are the responsibility of several legal entities managing a public service, do not correspond to different public interests in the Meaning of Article 25-I (5 °) of the Act of January 6, 1978, as amended
The Committee considers that the purposes pursued by the implementation of the teleservice referred to as " Dematerialized service of alternation " Are determined, explicit and legitimate.
On processed personal data:
Article 2 of the draft decree specifies the personal data processed. More specifically:
As regards employers:
-identification data (name, first name, address, telephone, fax and e-mail address);
-data relating to professional life (name, SIRET number, code APE and/or NAF code, business line, main activity, workforce, company social system, applicable collective agreement);
As regards the beneficiaries of apprenticeship and professionalisation contracts:
-identification data (surname, first name, address, telephone, sex, nationality, date and place of birth, registration number on the list of jobseekers, registration number of persons in the national directory of identification of persons Natural persons);
-personal life data (if applicable: name, first name, address and quality of guardian or legal representative);
-data relating to professional life:
-job title occupied, contract start and end date, weekly hours of work, duration of trial period, level and coefficient of qualification in collective agreement, identity of contract signatories, filing date And registration of the contract, date of the decision of the investigating body, date of archiving of the contract, information on the opening of rights to the payment of aid or award decisions;
-name and address of the pension fund And the Joint Authorized Collector (OPCA);
-last class Attended, entitled the highest degree, current level of training, situation prior to contract entry, degree of degree prepared, diploma or degree prepared and specialty;
-if applicable: Recognition of the qualification of disabled worker, authorization to work on dangerous machines or exposure to specific risks;
-duration of teaching or evaluation training, name and address of the centre Training, first name and professional experience of the master of learning or tutor);
-data relating to the economic and financial situation (bank details, monthly salary for hire, monthly salary During the period of the contract, the amount of potential benefits in kind);
As regards the processing of the registration number of persons in the national directory for the identification of natural persons (NIR), the Committee takes note that this data will only be used to secure electronic exchanges and Reconciliations of data between the DGEFP, on the one hand, and the relevant social security and pension agencies (ACOSS, CNAV, AGIRC, ARCCO), of the other part.
reading Article 4 of the draft decree, the Committee notes that The NIR can only be used first to transmit By electronic flow of information relating to contracts alternating between organisations authorised to process the NIR for the purpose of identifying persons in the context of a social security and retirement mission and, secondly, To secure the procedure for matching qualified data received from these organizations.
The Commission takes note that the other recipients of the " The dematerialised service of the alternation " mentioned in Article 5 of the draft decree will not be addressed to the alternate NIR.
The Commission considers that the collection and processing of the data referred to in Article 2 of the draft decree Are legitimate, relevant and not excessive in relation to the purposes pursued.
On addressees:
Article 5 of the draft decree specifies the recipients authorised to receive communication of the data processed through the " Dematerialized service of alternation ".
More specifically, these data will be accessible, each for the purposes of:
-to organizations managing branches of the general social security system;
-to the consular rooms;
-to the Certified Collectors' Organizations (OPCA);
-to the training organizations;
-to the centres of Apprenticeship training;
-Regional Business, Competition, Consumer, Labour and Employment Directorates (DIRECCTE) and their territorial units;
-to the General Employment and Training Delegation Professional;
-directing the animation of research, studies and Statistics (DARES).
The Commission considers that these addressees have a legitimate interest in accessing the data of the tele-service called " Dematerialised service of alternation ".
On data retention periods:
Article 6 of the draft decree specifies that personal data are kept on the dematerialised site of the alternation during the period Necessary for the complete investigation of the file, within ten years of the end of the contract.
The Commission notes that this article also states that the data are kept by the DARES " In anonymous or individualised mode the time required for the establishment of the panels of investigations carried out in respect of its tasks for the evaluation of employment and vocational training policies.
Article 3 of the draft decree specifies that accounts created online, after sending a warning message to the account holder, are revoked one year after the end of the contract concerned if no authenticated mode connection is made on the Alternation portal
The Commission considers these retention periods Do not exceed those necessary for the purposes pursued.
On the information of the persons concerned and the rights of access and rectification:
Article 7 of the draft decree states that the rights of access and rectification provided for in Articles 39 and 40 of the Law of 6 January 1978, as amended, shall be exercised by the Ministry of Labour, Employment and Health by mail (7, Square Max-Hymans, 75741 Paris Cedex 15) or by e-mail.
The Committee notes, moreover, that the request for an opinion presented by the Ministry of Labour, Employment and Health indicates that the information of the persons concerned will be Provided by a reference on the ministry's website.
The Commission Considers that the measures provided for the information of persons are satisfactory.
On security measures:
The Commission notes that user authentication is ensured by means of alphanumeric passwords. It recalls, as such, that passwords must be regularly renewed, contain at least eight characters and include at least one letter, a number and a special character.
The Commission takes note, moreover, that Clearance profiles that define the functions or types of information accessible to a user have been defined.
It also reports that a logging functionality for lookup operations, creation, updating, and Delete has been defined.
The Commission finally notes that data exchanges Between the different actors are achieved by means of secure channels and, in particular, that the data transmitted are encrypted. It also takes note that the social security numbers are encrypted on base.
These security measures appear satisfactory to the Commission.
For the Chair:
Associate Vice-President,
E. Givry
