JORF n ° 0154 July 4, 2012 text no. 135 Deliberation No. 2012-140 may 2, 2012, opinion on a draft decree on the creation of a telecommunication service of administration referred to as «service dematerialized alternating» for the purpose of facilitating the conclusion and management of contracts in alternation (request for opinion No. 1549192) NOR: CNIX1227393X ELI: not available the national data processing and Liberties Commission Seized by the Ministry of labour, employment and health for an opinion on a draft decree on the establishment of a telecommunication service of the administration, referred to as 'service dematerialized alternation', for the purpose of facilitate the conclusion and management of contracts in alternation;
Having regard to the convention no 108 of the Council of Europe for the protection of individuals with regard to the treatment automated of personal data;
Having regard to directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of data personal and the free movement of such data;
Having regard to Act No. 2011-893 of July 28, 2011, for the development of the alternation and the securing of career paths and, in particular article 4 providing for the creation of a dematerialized alternation;
Having regard to Act No. 78-17 of 6 January 1978 amended relative to computers, files and freedoms, particularly article 27 - II (4 °);
Having regard to Decree No 2005 - 1309 of 20 October 2005 amended taken for the application of the Act No. 78-17 of 6 January 1978 modified relative to computers, files and freedoms;
Having regard to the draft decree of the Minister of labour, employment and health and the latter Minister responsible for learning and training authorizing automated processing of personal data relating to dematerialized alternating service put at the disposal of users;
Having regard to the folder and its supplements;
On the proposal of Mr. Emmanuel de Givry, Commissioner, and after having heard the comments of Ms. Elisabeth Rolin, Commissioner of the Government, emits the following opinion: on the basis of article 27 - II (4) of the Act of 6 January 1978 modified, the national data processing and Liberties Commission was seized for opinion by the Ministry of labour, employment and health of a draft decree on the establishment of a telecommunication service of the administration referred to as 'cloud service of alternation' for the purpose of facilitate the conclusion and management of contracts in alternation.
The purpose of the treatment: implementing the service dematerialized alternation has aims to provide a response to the difficulties encountered in the management of work-study and, specifically, excessive processing delays and a double entry of the personal data transmitted to this day in hardcopy by mail.
The draft decree considered by the commission plans to allow the implementation, by the Délégation Générale for employment and vocational training (DGEFP), of an online service called administration "service dematerialized alternation.
Article 1 of the draft decree provides that this teleservice is intended to put at the disposal of companies and individuals a set of services for: — facilitate the conclusion of contracts in alternation;
― improving the quality of service to users;
— facilitate the treatment and support of contracts by the agencies involved;
— facilitate the development of the processing of anonymous statistical data;
― establish coherence existing information networks;
— facilitate the processing of payments of aid for the alternation.
Specifically, the service dematerialized alternation must allow to issue information about the alternation and the rights and obligations, arising from simulate revenues, record claims dematerialised of persons wishing to enter into a contract in alternation, to follow the instruction of an application as well as the associated administrative decision and, finally, to ensuring links to dematerialised between the administration and its partners through interconnections of files.
With regard to these interconnections, the commission notes it is envisaged to interconnect files of the DGEFP with those of the Central Agency of the organismes de sécurité sociale (ACOSS) to calculate contributions and grants due to employers, on the one hand, as well as files of the DGEFP with those of the National Fund of pension insurance (CNAV), to record and post the periods worked by the alternating on the other hand.
The commission notes that it is also expected to interconnect files of the DGEFP with those of the General Association of institutions for retirement provision of executives (AGIRC) and the Association for complementary pension of employees (ARCCO), in order to save and validate the periods worked by the alternating.
These interconnections of files will allow, in addition, to go back to the alternating a full information on their pension rights, both for the general scheme for the supplementary scheme.
The commission notes that the aims of interconnected files, covered by several corporations managing public services, do not correspond to different public interests within the meaning of article 25-I (5 °) of the law of 6 January 1978 amended.
The commission considers that the purposes pursued by implementing called teleservice "service dematerialized alternation" are determined, explicit and legitimate.
On the personal data processed: article 2 of the draft decree specifies the data personal treated. It is more precisely: with regard to employers: ― identification data (name, surname, address, telephone, fax and e-mail address);
data relating to working life ― (name, number of SIRET, code APE or NAF code, sector of activity, main activity, workforce, social enterprise plan, applicable collective agreement);
As regards the beneficiaries of contracts of apprenticeship and professionalization: ― of identification data (name, surname, address, phone, sex, nationality, date and place of birth, number of inscription on the list of job-seekers, number of the entry of persons to the national Repertory of identification of physical persons);
data relating to personal life ― (where applicable: name, surname, address and quality guardian or legal representative);
data relating to working life ―: ― entitled of the job held, date start and end of contract, duration weekly work, duration of the trial period, level and coefficient of qualification in the collective identity of the signatories of the contract, filing date and registration of the contract, date of decision of the instructor body, date of archiving of the contract information on entitlement to payment of the aid or licensing decisions;
— name and address of the Fund retirement and the approved joint collecting body (OPCA);
popular class last ―, entitled to the highest degree, current training level, prior to the entry into contract, level of degree prepared, diploma or prepared title and specialty;
― If applicable: recognition of the qualification of disabled worker, authorisation to work on dangerous machinery or exposure to specific risks;
― duration of training of teaching evaluation or, name and address of the training centre, name qualification and professional experience of the master of learning or guardian);
― data relating to the economic and financial situation (bank details, monthly wage employment, monthly salary during the period of the contract, amount of potential benefits in kind);
Regarding the treatment of the registration number of the persons to the national identification of natural persons (NIR) directory, the commission takes note that this data will be used only to secure electronic exchanges and reconciliation of data carried out between the DGEFP, on the one hand, and social security and retirement agencies concerned (ACOSS, CNAV, AGIRC, ARCCO), on the other hand.
A reading of article 4 of the draft decree, the commission notes indeed that the NIR cannot be used as a first step, for transmit electron flow information relating to contracts in alternation to organizations authorized to deal the NIR for purposes of identification of the persons in a social security and retirement mission and , in a second step, to secure the procedure of approximation of the qualified data received from these organizations.
The commission notes that the other recipients of the service dematerialized alternating data, referred to in article 5 of the draft decree are not recipients of the NIR of the alternating.
The commission considers that the collection and processing of the data referred to in article 2 of the draft decree are legitimate, relevant and not excessive in relation to the continuing purposes.
Recipient: article 5 of the draft decree specifies the recipients eligible to receive communication of data processed through the 'dematerialised alternating service '.
Specifically, these data will be available, each for what concerns: ― to the managing bodies of the branches of the general system of social security;
― to the Chambers;
― to approved bots joint bodies (OPCA);
― to training bodies;
― to apprenticeship training centres;
― the regional directions of business, competition, consumption, labour and employment (DIRECCTE) and their territorial units;
― at the General delegation for employment and vocational training;
― in the direction of the animation of the research, studies and statistics (DARES).
The commission considers that these recipients have a legitimate interest to access data called teleservice 'service dematerialized alternation.
On data retention times: article 6 of the draft decree specifies that the personal data are kept on the site dematerialized alternating during the time necessary for the full investigation of the case, within the limit of ten years from the end of the contract.
The commission notes that this article also specifies that the data are kept by the DARES "in anonymous mode or mode individualized the time required for the constitution of panels for surveys in respect of its missions of evaluation of policies of employment and vocational training"
Finally, the commission notes that article 3 of the draft decree specifies that accounts created online, after sending a message of warning to the account holder, are revoked one year after the end of the contract concerned if no connection in authenticated mode is not performed on the portal of the alternation.
The commission considers that these retention periods do not exceed those that are necessary for the fulfilment of the aims pursued.
On the information of the persons concerned and the rights of access and rectification: article 7 of the draft decree mentions that the rights of access and rectification, provided for by articles 39 and 40 of the Act of 6 January 1978 modified, are the Ministry of labour, employment and health (7, square Max Hymans, 75741 Paris Cedex 15) postal mail or e-mail.
Further, the commission notes that the application for notice by the Ministry of labour, employment and health indicates that the persons concerned will be informed by a mention on the website of the Ministry.
The commission considers that the measures provided for in respect of information of persons are satisfactory.
On security measures: the commission observes that the user authentication is ensured using alphanumeric passwords. It recalls, in this title, that passwords should be regularly renewed, at least eight characters and include at least one letter, one number and a special character.
The commission notes, moreover, that profiles enabling defining functions or types of information accessible to a user have been defined.
It also notes that a consultation operations, creation, update logging feature day and deletion has been defined.
The commission notes finally that the data exchanges between the different actors are made through secure channels and, in particular, the transmitted data is encrypted. It also took note that social security numbers are subject to a basic encryption.
These security measures appear satisfactory to the commission.
The President: the delegate Vice-Chairman, e. de Givry