Key Benefits:
National Computer and Liberties Commission,
Seizure by the Ministry of National Education of a request for an opinion on a draft decree Authorising the creation of a personal data processing operation aimed at the management of the additional public service regime;
Given the Council of Europe Convention No 108 for the protection of Persons with regard to the automatic processing of personal data;
Having regard to Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to data processing at Personal character and the free movement of such data;
In view of the Law n ° 78-17 of 6 January 1978 as amended relating to computers, files and freedoms, Article 27-I (1 °);
Law No. 83-634 of 17 July 1983 Amended bearing the rights and obligations of civil servants together with the Act No. 84-16 of 11 January 1984, the statutory provisions relating to the function State public;
Due to Act No. 2003-775 of 21 August 2003 on pension reform, in particular Article 76;
Seen decree n ° 2004-569 of 18 June 2004 relating to the additional retirement of the civil service, in particular its Article 1;
Given the decree n ° 2005-1309 of 20 October 2005 changed for The application of Law n ° 78-17 of 6 January 1978 relating to computers, files and freedoms;
Having regard to the Order of 26 November 2004 applying the Href=" /viewTexte.do?cidTexte=JORFTEXT000000803653 &categorieLink = cid"> decree n ° 2004-569 ;
After hearing Mr Eric Peres, Commissioner, in his report and Elisabeth Rolin, Commissioner of the Government, in her observations, Emet the opinion Next:
The National Information and Freedom Commission has been entered by the Department of National Education (MEN) of a request for an opinion on a draft decree " The creation of an automated processing of personal data referred to as " SIRAD relating to the management, by the Ministry of National Education, Youth and associative life, of the additional scheme of the public service referred to in TheArticle 1 of Decree n ° 2004-569 of 18 June 2004 concerning the additional retirement of the civil service, taken for the purposes of section 76 of the Pension Reform Act 2003 775 dated August 21, 2003 ".
On the information system for the Management of the regularizations of Public Service pension contributions (FDR):
The proposed Order in Council creates an information system for the management of Public Service Supplementary Retirement Assessment (FDR) regularizations.
The FDR will be made available to employers In order to process the data relating to the regularisation of the additional pension contributions of the incumbent agents reporting on the budget of the State.
will automatically be registered in the FDR Pay data categories available in the pay files provided by the The following regional public finance directorates:
-the remuneration paid by the main employers (rectorats, academic inspections, administrative action and modernisation);
-the remuneration paid by the chief employer of the agent on a catch file In respect of compensation different from the main remuneration package;
-remuneration paid by a separate employer from the main employer (outside the agent's academy);
-the remuneration paid under Participation in a competition board or correction of copies (SIEC).
By contrast, the ancillary remuneration of these agents (such as ancillary remuneration paid by GRETA-adult training organisation for national education, local authorities, or other administrations) Units and their desConcentrated services) will have to be manually entered into the FDR, in order to be consolidated with those that are automatically integrated with them.
As such, SIRAD will allow each primary employer, on the one hand, to Notify the secondary employers of agents of the amounts of the Regularisations of contributions (civil pension liabilities of the State paid by the agent and by the State) to be paid to the additional public service pension institution (ERAFP) and, on the other hand, to generate a personalised document Destination of agents in order to recover the wage share " Advanced " To the ERAFP.
On the applicable legal system:
The processing of data relating to national education officers in the FDR includes the registration number of persons in the national directory of identification of persons Physical (NR) which is the identifier of insured persons of the general pension scheme (art. R. 115-1 of the CSS).
Pursuant to Article 27-I (1 °) of the Act of January 6, 1978, as amended, " Are authorised by decree in the Council of State, taken after reasoned opinion and published by the National Committee on Informatics and Liberties " Processing of personal data implemented on behalf of a legal person under public law " For data including the person registration number in the national directory for the identification of natural persons ".
On the purpose of processing:
SIRAD processing serves two purposes (article 1, paragraph 2, of the draft decree):
-enable the principal employer, within the meaning of Article 16 of the Order of 26 November 2004 implementing the Decree n ° 2004-569 of 18 June 2004 relating to the Additional public service pension, to ensure the collection and consolidation of individual compensation elements of any nature not taken into account in the civilian and military pension calculation base;
- Allow employers " ", within the meaningparagraph 2 of Article 11 (I) of Decree No. 2004-569 of 18 June 2004 concerning retirement Additional public service, to calculate and report pension contributions due to the establishment of the additional public service pension (ERAFP).
The Commission considers that these purposes meet the requirements of section 76 of Law n ° 2003-775 of 21 August 2003 reforming pensions as well as those of article 1 of Order in Council n ° 2004-569 of June 18, 2004 relating to the additional retirement of the Public
. Generating a custom document to the agents of The public service concerned in order to recover the wage share " Advanced " ERAFP is not mentioned in the draft decree.
As a result, the Commission points out that only the purposes mentioned in the draft decree can be processed in the FDR.
On the nature of the data Processed:
The data processed in the FDR are related to the identification of individuals (s. 2-I of the draft decree), to their professional life (art. 2-II of the draft decree) and their economic and financial situation (art. 2-III of the draft order).
The Commission notes that the treatment of " PCS code " (INSEE nomenclature of the socio-professional category) is not strictly necessary for the fulfilment of the task of managing the additional pension scheme provided for in Article 1 of the draft decree but that it has the sole purpose of To compile statistics a posteriori by the ERAFP.
In these circumstances, the Commission considers that the collection of this data should remain optional.
On the duration of data retention:
The Commission requests that Article 4 of the draft decree be clarified, in particular in order to make it clear that the data will be kept:
-for a period of five years from their active registration (all authorized agents can then access the SIRAD);
-until the retirement of the agent in intermediate archiving (i.e. Limiting access to the FDR to a limited number of agents, specially empowered to respond to requests for information from agents whose rights are managed in the SIRAD).
On recipients of the data:
Section 3 of the proposed Order does not make clear distinctions between the agents who are authorized to access the FDR and third-party agents, recipients of the data processed in the FDR.
The Commission recommends that Section 3 of the proposed Order is amended to clearly identify:
-on the one hand, individually empowered officers of the main employers, using the FDR, in charge of the human resources of the central and decentralised services of the MEN (rectorats, academic inspections, SAAM and SIEC);
-other The recipients, via the main employer, of the data contained in the FDR, namely the specifically authorised agents of secondary employers responsible for human resources for the purposes of calculating and reporting contributions due to I ' ERAFP does not access the FDR; the authorized officers of the ERAFP for the purposes The supply of the additional pension account of each employee; the officers whose data are processed in the FDR and to recover the wage share " Advanced "
On the information of persons:
In accordance with Article 32 of the law of 6 January 1978 amended, the agents concerned shall be individually informed of the registration of personal data concerning them in The SIRAD by reference to the officer's salary bulletin.
On the rights of access, rectification and opposition of persons:
In accordance with Articles 39 and 40 of the Act of 6 January 1978, as amended, the exercise of the right of access and Rectification shall be carried out " With the staff management services of the central and decentralised departments of the Ministry responsible for education " (Article 5 of the draft decree).
In accordance with the amended Article 38 (3) of the Act of 6 January 1978, the right of opposition will not apply to this treatment (Article 6 of the draft decree)
Does not call an observation.
On data security and action traceability:
The implementation of processing relies on multiple VPN networks (VPN). The application also implements data transport encryption processes (SSL protocol).
The Commission considers that these processes ensure confidentiality of data.
As regards the management policy of the Passwords, the Commission recalls that it recommends the use of minimum eight-character passwords, containing lowercase letters, capital letters, numbers and special characters.
It therefore recommends that each academy should Consistent with these requirements.
Finally, the Commission proposes to the MEN Identify in a more transparent way the purpose of the draft decree, which is to create the SIRAD treatment, in particular by deleting the reference: Referred to inArticle 1 of Decree No. 2004-569 of 18 June 2004 concerning the additional retirement of the civil service, taken for The application ofArticle 76 of Law No. 2003-775 of 21 August 2003 on the reform of pensions.
The President,
I. Falque-Pierrotin
