Key Benefits:
National Commission on Informatics and Liberties,
Seizure by the Ministry of Labour, Employment, Training And the social dialogue of a request for an opinion on a draft decree on the implementation of the processing of personal data, IENC " Having as its purpose the management of applications for approval of conventional breaks of an indefinite employment contract;
In view of Council of Europe Convention 108 for the protection of persons with regard to treatment Computerised personal data;
In view of Directive 95146 /EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to the processing of personal data and free Circulation of this data;
Seen job code, including its articles L. 1237-11 to L. 1237-16 and R. 1237-3;
Seen Law n ° 78-17 of January 6, 1978 as amended relating to computers, files and freedoms, in particular Articles 27-11 (4 °), 28 and 29;
Seen decree n ° 2005-1309 of 20 October 2005 modified for The application of Law n ° 78-17 of 6 January 1978 relating to computers, files and freedoms;
In view of the draft decree establishing a teleservice and Automated processing of nominative data relating to the management of applications for approval of contractual breaks of an indefinite employment contract;
After hearing Mr Emmanuel de GIVRY, Commissioner, in his report and Mr. Jean-Alexandre SILVY, Government Commissioner, in his Observations,
Emet the following opinion:
On the basis of Article 27-11 (4 °) of the Act of 6 January 1978, as amended, the National Commission for Informatics and Freedoms was seized for opinion by the Ministry of Labour, Employment and The health of a draft decree establishing a tele-service called " TeleRC " Concerning the management of applications for approval of contractual breaks in an open-ended contract of employment (CDI).
As a preliminary point, it should be recalled that the Href=" /viewCodeArticle.do?cidTexte=LEGITEXT000006072050&idArticle=LEGIARTI000019068089&dateTexte=29990101 &categorieLink = cid"> provisions of Articles L. 1237-11 to L. 1237-16 of the Labour Code the employer and the employee may agree on a common Agreement on the conditions for the breach of the contract of employment which binds them. This conventional breach of the contract of employment follows a specific procedure: maintenance (s) between the two parties, approval of the agreement by the administration, etc.
The teleservice " TeleRC " Allows employers and employees to make online the claim for certification of conventional rupture.
On The purposes of processing
The draft decree provides for the creation of an automated processing of personal data with the purposes of:
-the making available to users (employers and employees) of a teleservice, to be known as: " TeleRC ", offering assistance for the seizure of the CERFA Form 14598 of an application for approval of a conventional breach of an indefinite employment contract;
-access to a management application allowing the agents of the Department services for processing applications, either by entering data or by automatic retrieval of preseason data from the public portal, upon receipt of the paper form in territorial unit (UT);
-development Statistical studies on anonymized data from data In a decision-making tool.
The Commission takes note that the assisted seizure provides a guarantee of quality of file filling and a prompt processing of applications for approval of conventional breaks by Administration.
The Commission considers the purposes of the application " TeleRC " Are determined, explicit and legitimate.
On the nature of the data processed
The Commission notes that Article 2 of the draft decree lists personal data collected and processed through two channels:
Since The public portal:
-employer data (SIRET number, social reason, institution address, convention signing name, telephone number, email, URSSAF number);
-employee data (civility, name, first name, date of Birth, correspondence address, telephone number, e-mail, qualification, employment, collective agreement);
-data relating to the calculation of the allowance (employee seniority, last known paid month, amount of monthly wages of the Last twelve months, exceptional bonuses of the last twelve months, Amount of average remuneration, gross amount in figures and letters of the specific allowance proposed);
-maintenance data (date, surname, first name and quality of employees' and employer's assistants);
-relative data The breach agreement (amount of severance pay, date of signature of the parties, termination date of the withdrawal period, envisaged termination date, other clauses of the agreement).
From the management application:
The receipt of paper forms in territorial units allows agents to create a folder from their business intranet or retrieve the preseason information from the public portal. The processed data is:
-the data from the CERFA form and populated in the public portal;
-data repatriated from the internal SIENE directory of the department (APE code, establishment strength, inspection section code);
-number of breaks Conventional in the enterprise over a period of fifteen months, information on each conventional break (territorial unit of assignment, file number created, SIRET number of the institution, name or name of the institution, date Receipt of the form in territorial unit, decision taken, date Of the decision, surname and first name of the employee);
-nature of the decision (inadmissibility, implicit approval, express approval, refusal, transfer to the competent territorial unit).
These data are relevant to the Intended purpose, in accordance with the provisions of Article 6 (3) of the law of 6 January 1978 as amended.
On the duration of data retention
Data shall be kept two years from the date on which the data are stored. The administration has made its decision on the application for registration, since then Management application. The data remains accessible 60 days on the public portal side for managers in UT, whether or not they are retrieved from the management application side.
User-created folders are accessible for three days on the Public portal; beyond the user's access. At the end of this period, the user must generate the pre-filled paper form to be sent to the administration. Once the file is processed by the administration, the user can generate a certificate from the public portal. It shall have a period of six months from the end of the period of inquiry. At the end of this time, the folder is no longer accessible.
These retention periods are relevant to the purpose of the processing.
On Data Recipients
Recipients of the data The data are, because of their respective responsibilities and for the purposes of the missions entrusted to them:
-the agents of the Labour Inspectorate;
-the officers of the Directorate-General for Labour at the Ministry of Labour who are responsible for monitoring the implementation of this processing and the management of applications for approval;
-the Department statistics officers responsible for the work.
The list of these recipients does not require comments from the committee.
On People Information
Users are informed, in accordance with Section 32 of the Act of January 6, 1978, as amended, of their rights of access, rectification And opposition on the public portal www.teleRC.travail.gouv.fr, under the heading " Legal notices ". This information is also mentioned on the form CERFA.
Employees' advisors in the regional directorates of enterprises, competition, consumption, labour and employment (DIRECT) are informed by Mail of the establishment of an automated processing of data capable of including their identity if they intervene in a conventional breach procedure by attending an employee and may oppose the inclusion in that employee 's Processing.
These individuals' information requirements appear sufficient for the Committee.
On rights of access, rectification and opposition of persons
The rights of access, rectification and opposition of persons are exercised with the Ministry of Labour, Employment and Training Work and social dialogue, Directorate-General for Labour, Labour Relations Office (SR 2), or with the appropriate Instructor Service.
These procedures for the exercise of the rights of persons appear Sufficient for the panel.
Data security and data security Action traceability
The Commission takes note that physical and logical protection measures are taken to safeguard the security of the processing of personal data. These measures are intended to prevent any unauthorized or fraudulent use of the data or to prevent unauthorized third parties from accessing it.
It takes note that access to the server is protected by login and password. Users distributed by profiles only have access to the functions and data allowed by the profile assigned to them (manager, observer, administrator). Also, firewalls protect the system from malicious intrusions. Movement traceability is available and can be used to detect and verify abnormal movements. Access to software is reserved for authorised personnel.
The Commission considers that these security measures are satisfactory in the light of the provisions of Article 34 of the Law of 6 January 1978 as amended.
For the Chair:
The Associate Vice-President,
E. Givry
