Key Benefits:
National Computer and Liberties Commission,
Entering the Minister of Justice of a request for an opinion on a draft decree of the Council of State establishing the processing of personal data relating to the national management of persons held in prisons, GENESIS;
Having regard to Convention 108 of the Council of Europe for the protection of persons with regard to the automatic processing of personal data;
Having regard to Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 Relating to the protection of natural persons with regard to the processing of data Personal character and the free flow of this data;
Given the Code of Criminal Procedure ;
Seen Law n ° 78-17 of January 6, 1978 as amended relating to computers, files and freedoms, in particular its Articles 26-II and 27-I (1 °);
Seen Law No. 2009-1436 of November 24, 2009 Prisons;
In the light of Decree No. 87-604 of 31 July 1987 on the empowerment of persons to whom certain functions may be entrusted in the Penitentiary institutions and completingarticle R. 79 of the Code of Criminal Procedure ;
Seen decree n ° 2005-1309 of 20 October 2005 modified for the application of Law n ° 78-17 of 6 January 1978 relating to computers, files and freedoms;
Seen decree n ° 2011-817 of 6 July 2011 creating a data processing Computerized management of the Held in custody (GIDE);
In view of the Decree n ° 2013-368 of 30 April 2013 on the internal rules of the prison system;
In the light of the 20 February 2003 amending the decree of 28 October 1996 on the creation of an automated national file for prisoners;
In view of the decree of 9 July 2008 establishing the organisation of the offices of the Directorate of the Prison Service ;
Seen délibération n ° 2011-021 of 20 January 2011 giving notice of a draft decree in the Council of State establishing the processing of personal data relating to the Management of the "ecruised persons" Computerized management of institutional inmates " (GIDE);
After hearing Mrs Claire DAVAL, Commissioner, in her report, and Mr Jean-Alexandre SILVY, Commissioner of the Government, in his observations,
Emet the following opinion:
The Commission has received a request from the Minister of Justice for an opinion on a draft Order in Council State establishing the processing of personal data relating to the national management of persons detained in prison (GENESIS).
This treatment must enable the management of the execution of the decisions made By the judicial authorities and relating to persons under nut. It contains, in particular, data under Article 8 of the law of 6 January 1978, as amended. Its implementation must therefore be authorised by decree in the Council of State taken after reasoned and published opinion of the committee, in accordance with the provisions of Article 26 (II) of the Law of 6 January 1978 as amended
Persons in the national directory for the identification of natural persons (NIR) will be collected, in particular for the purpose of managing the social situation of the prisoner, justifying the application of Article 27-I (1 °) of the same law
GENESIS is called upon to replace the Computer Management treatment of inmates in Establishment (GIDE), authorised by the decree of 6 July 2011 taken after reasoned and published opinion of the committee. The committee ruled on two occasions on the GIDE treatment and, in its deliberation of 2 January 2011 referred to above, made several reservations, notably concerning the electronic link book (CEL), the evaluation grids thus That the security and traceability measures.
In this regard, the Commission notes that the new GENESIS treatment will replace a tool that has become technically and functionally obsolete, and also take into account some of the Remarks by the CNIL and the Council of State.
Application includes four Major functional areas (registry, accounting, detention, individual monitoring) as well as technical areas. The prisoner's libretto allows the different actors to have a comprehensive view of the information specific to prisoners, accessible according to the profiles of clearances.
The draft decree provides for the modification of the decree of 6 July 2011 in order to Postpone the date of cancellation of GIDE as of 31 December 2017, in order to allow a gradual deployment of the GENESIS application.
As a preliminary point, the Committee notes that this treatment is for the management of persons detained in Penitentiary establishment, also in relation to the execution of decisions And the maintenance of public safety as well as the social reintegration of detained persons and the prevention of recidivism. It therefore considers that, if these objectives are such as to justify the diversity of the data collected and the high number and diversity of the recipients, legal and technical measures must necessarily be implemented for Ensure the protection of personal data recorded in the GENESIS processing.
In addition, it is clear that this dossier, in addition to the new features it contains, allows for the regularisation of existing practices but which Did not appear in the decree of 6 July 2011.
For the purposes of the Processing
It is assigned multiple purposes to the GENESIS processing:
" -the execution by the prison registry of judicial decisions ordering imprisonment and the management of the formalities of the nut;
-the care of detained persons whose purpose is the implementation of the detention route, The prevention of risk behaviour, the holding of the single multidisciplinary committee of the prison establishment and the management of requests, observations, hearings, appointments, visits and mail of persons Detained;
-the management of the nominative account of detained persons;
-management of the workforce, disciplinary procedures, searches, isolation of instructions and detention regimes;
-the management of the individualization of the punishment and the reintegration of persons under the control of justice in The framework of the missions for the prevention and control of recidivism by the officers of the Prison and Probation Service and the Youth Judicial Protection Service;
-the implementation of reintegration activities in the Socio-cultural and sports fields, work, education and training Professional;
-the determination of the place of duty of the persons detained. "
Just as the GIDE treatment, GENESIS will also enable the management of disputes between the prison administration and the persons placed under the control of
a general rule, the purposes assigned to the GENESIS processing are similar to those assigned to GIDE. However, the Committee notes certain developments.
In the first instance, the draft decree initially submitted to the committee was silent on the possible purpose of the prison information, which the penitentiary administration assures to the Local, regional (department of security and detention) and central (prison information office, says' EMS3 ").
In fact, the staff of the Directorate of the Security Staff (EMS) of the Directorate of Penitentiary Administration (DAP), and in particular the office mentioned above, directly access the data recorded in GENESIS, Or. Office, pursuant to the said Order of 9 July 2008, is " Responsible for the collection and analysis of all information relevant to the security of prison facilities and services. It arranges for the collection of this information from the deconcentrated services and proceeds to operate them for operational purposes. It shall liaise with the central services of the police and the gendarmerie ".
The Committee observes that access to this data will enable the prison administration, and in particular at this office, to collect information enabling the Prevention of acts that could affect the public safety and security of penal institutions and services, but also to ensure the supervision of persons detained, groups or organisations and phenomena Threat precursors. It therefore took note of the commitment of the Ministry of Justice to amend the draft decree in order to expressly mention this purpose.
Second, the management missions by the prison services officers And probation (PJJ) and probation (PJJ) are written more broadly than in the decree of 6 July 2011 mentioned above. The Commission considers that this new wording will make it possible to take better account of the actual missions of PSIs and PJJ, refocused on the prevention of recidivism.
Third, the new purpose of " Determination of the place of duty of detained persons " Corresponds in substance to the purpose assigned to the National Prisoners File (FND), which GENESIS will eventually replace. The Committee wishes to be kept informed of this development.
In addition, it is envisaged that GENESIS will be subject to the exploitation of the information collected for statistical research
. The
considers that the purposes assigned to GENESIS are determined, explicit and legitimate.
On the nature of the Processed data
As a preliminary matter, the Commission notes that the Draft decree shows in a clearer way than in the decree of 6 July 2011 the persons whose data may be collected (persons detained, magistrates, lawyers, detained persons, persons to be prevented in case of
takes note that the GENESIS processing operation may contain sensitive data within the meaning of Article 8 of the law of 6 January 1978, as amended. This data will in no way be systematically informed, but only if it is necessary for the purposes pursued, in particular in order to avoid affecting prisoners who are in direct conflict in the same cell. In this respect, it notes that no predetermined list of geographical or ethnic origins, which are the subject of free entry, will be implemented.
In general, the data collected are close to those already provided for by the Decree of 6 July 2011 mentioned above. They relate to the person detained, to his multidisciplinary care, to the risks of suicide (both for the major and minor persons), to the danger and vulnerability of the person, to the decisions of the chief Establishment, detention of the detained person and the management of his personal account.
New data are nevertheless provided for in the draft decree in relation to the decree of 6 July 2011. These are either simple clarifications with respect to the decree or data enabling new legislative or regulatory provisions to be taken into account (the place of house arrest or the indication, by yes or no, of Registering with FIJAIS-V for example). As a general rule, the Commission considers that this data does not pose any particular difficulty.
It nevertheless wishes to return to certain categories of data which had already referred to its attention in its previous deliberation
Firstly, the Committee notes that the different types of grids (assessment of the suicidal potential, the assessment of dangerousness and vulnerability) used in GENESIS are identical to those developed for GIDE. These grids are completed on arrival in custody in the form of " Yes/no /NSP " And can be updated at any time. The data of these grids recorded in GIDE will be automatically included in GENESIS.
With regard to certain categories of the evaluation grid of suicidal potential, the Commission can only reiterate the reservations expressed in its Deliberation of 20 January 2011 on the wording of the headings " Apparently delirious "," Appears to be in psychological shock, " Seems depressed "," Seems anxious-sad-aggressive ".
It notes that, as in GIDE, these grids will be supplemented by the instructions and alerts (CS), which will determine the regime, the terms and conditions of the stay in custody, but will allow Also to meet the public safety requirement by preventing the risk of aggression or escape.
In addition, it will be possible, in GENESIS, to make observations in areas of open field of the application, just like that Was the case in GIDE. The Commission is aware that these observations may be necessary for the work of prison staff and that they ensure the permanent link between the monitoring agents themselves and their hierarchy in order to determine the Behavior to adopt in front of a new event. However, these observations will be made available to most recipients, with the exception of the members of the Committee on Enforcement (CAP), the judges of the courts and certain judges of the central administration (Directorate Criminal cases and graces and the service of European and international affairs).
Consequently, if the committee does not question the usefulness of these observations, it points out that the data processed must be relevant, Adequate and not excessive in relation to the intended purpose and Strict control must therefore be ensured by the Ministry of Justice.
On the duration of data retention
The Committee notes that the draft decree is more detailed than Article 7 of the decree of 6 July 2011. However, the terms and conditions of conservation laid down in the draft decree are identical to those implemented in GIDE.
Data will be retained for two years from the date of the removal of the nut. At the end of this period, the data will be kept for eight years in inactive basis, the access of which will be reserved for the authorised staff of the DAP and the Inter-regional Prison Services Directorates (DISP), in particular for the Litigation and the security staff.
As in GIDE, for parolees with a follow-up period of more than twenty-four months, the data are kept on an active basis one month after the end date of the Follow-up.
Finally, and in accordance with the dispute management objective set out in The draft decree, any litigation involving the responsibility of the penitentiary administration has the effect of suspending the retention periods, until the expiry of the remedies, including information and Personal data about the co-inmates who shared the cell in the month of the cause of the dispute.
The Commission estimates, as it did in 2011, that visitor data, In the event of an incident, to persons who have been examined and who have been the subject of Order of non-location, as well as data corresponding to a specific moment in the detention of the detained person (including observations and assessment grids), should be paid in the inactive basis upon the definitive lifting of the The person's nut. Such data would still be accessible, but to small staff, in particular for the management of the legal proceedings of the detainees or their successors in title or for the purposes of police
. The Commission considers that the retention periods provided for in the draft decree are in conformity with the provisions of Article 6 (5 °) of the Act of 6 January 1978 as amended.
On addressees of the data
The draft decree Lists the recipients of the data recorded in the processing, distinguishing the Staff who have direct access to the data of the staff to whom this information may be communicated. While these addressees may appear numerous and diverse, it should be noted that, for the most part, they appear in the decree of 6 July 2011, on the one hand, and correspond to the different actors in prison or in the process of bringing the The
considers, however, that the number and the diversity of the recipients of the treatment require the implementation of appropriate measures to guarantee restricted access only to the Data strictly necessary for the performance of their missions.
The Commission notes that the decree provides that staff access the data " Strictly necessary for the exercise of their duties (...), because of their duties or for the purposes of the service ". In the same way, the draft decree provides that recipients may receive data " Within the scope of their duties, within the limits of the need to know ".
On staff directly accessing the data
In this regard, the Department of Justice has provided several measures: On the one hand, the modalities for the empowerment of non-ministry-owned staff who can directly access the data recorded in GENESIS are foreseen by the Order No. 87-604 dated July 31, 1987.
the other hand, the department has put in place 16 " Business profiles, according to a single national repository, as well as " Under profiles " Allowing access to personal information only to the data recorded in the inmate's booklet and that are strictly necessary for the performance of their missions.
Finally, the department has put in place a " Agent card ", that is, secure and individual physical support. Strong personal certificate authentication, enabled by a PIN code that only the bearer knows, greatly reduces the risk of identity theft.
The Commission notes that new personnel directly accessing the data Have been added: Judicial authorities and registry officers, members of the Committee on Enforcement (CAP), the staff responsible for the management of personal accounts, the staff of the private groups in charge of the management of activities, the Director of Criminal Affairs and Graces (DACG) and the Head of European and International Affairs.
The missions of most of these categories of staff have not evolved since the decree of 6 July 2011 and none Specific justification has not been provided on this point by the department. The Committee therefore concludes that it is a matter of regularizing the access of these staff to treatment and notes that this tends to increase considerably the number of staff who have access to the data recorded in GENESIS. It nevertheless takes note that the access of the DACG is in the context of the purpose of " Determination of the place of duty of the detained persons ", assigned to the ETF, which will eventually be replaced by GENESIS. Furthermore, it notes that the Ministry is considering, in view of the changes in the missions entrusted to the European and international affairs departments, that the head of this service should be deleted.
In addition, as regards access to Data provided by the authorised staff of the Directorate of Penitentiary Administration (DAP) and the Interregional Prison Services Directorates (DISP), members of the Single Multidisciplinary Committee (CPU) and members of the Committee Of the application of penalties (CAP), the Commission considers that the The draft order should further clarify the framework for such access, particularly for DAP and DISP staff.
In addition, the Commission notes that surveillance staff will have access to more data than is the case. Currently planned in GIDE. It takes note of the Ministry's justification that these officers are in charge of detention and that it is therefore legitimate for them to have access to data relating to detention and activities, insofar as they Create travel that staff must be able to monitor.
Similarly, national education officers have access to the same data in GENESIS as in GIDE, with an exception: they will now be able to access requests, which include: All the themes relating to detention. The Commission takes note that the Head of National Education (RLE) is nevertheless only a recipient of requests concerning his field of competence.
Finally, the access of SPIP and PJJ officers is extended, in line with developments
As regards access by private group staff, to whom the current functioning of a penitentiary institution may be delegated, or the management of activities proposed to persons detained in In a variety of fields, they are only recipients of data , depending on their area of expertise. In addition, their observations are validated by an administrative framework. The Commission considers this device to be satisfactory.
Of the staff to whom the information can be communicated
Most of the recipients in the draft order are similar to those provided for in The decree of 6 July 2011 and are addressed to the same categories of data. These addressees therefore do not refer to any additional comments from the Commission.
It is nevertheless intended that new recipients will have disclosed certain data recorded in GENESIS. They are lawyers, for the contradictory procedures, the assessors, the information relating to the disciplinary proceedings, the officers of the Pôle emploi (as well as local missions for young adults less than twenty-six years old), in The framework for the return to employment of the persons held, of the Banque de France, for the maintenance of the libretto and bank accounts of the detained person and the payment of the claims, of the connecting hospitals, as part of the distribution of Drugs and training organizations.
These new recipients In general, do not call for any particular comment from the committee. Indeed, it is a matter of taking into account certain lessons drawn from the use of GIDE, the provisions of the decrees implementing the penitentiary law or, finally, certain omissions in the decree of 6 July 2011
As a framework for the purpose of the penitentiary intelligence of the data was to be exchanged with specialised information services, the Commission considers that such staff should appear as recipients.
On People information
The right to information for people Inmates will be provided by way of posting as well as officers, authorized personnel, detained persons and prison visitors.
Information for judges will be posted within the courts, while, for the purposes of Persons to be prevented in the event of an incident, the information provided during the contact by SPIP with the relatives of the detained persons.
The Commission considers that these terms of information are in conformity with the requirements of Article 32 of the The law of January 6, 1978 as amended.
As it had done for GIDE, the Nevertheless, the Committee considers that the Observations " Which are required to be included in GENESIS should be the subject of specific information to the detained person. This information could, in particular, be included in the prisoner's libretto, given to the person upon admission to the penal institution in accordance with the Href=" /viewTexteArticle.do?cidTexte=JORFTEXT000021312171&idArticle=JORFARTI000021312253 &categorieLink = cid"> section 23 of the above-mentioned Act of November 24, 2009.
On rights of access, rectification and opposition of persons
The procedures for exercising the rights of access and rectification are identical to those laid down in the decree of 6 July 2011.
Thus, the right of access is exercised in a direct way, except for the planned dates of transfers and extractions, the requirements of judicial or penitentiary origin relating to the care and detention of the detained person, The designation of the premises of the establishment and the description of the movements of the detained persons.
If the application of the provisions of Articles 41 and 42 of the Act of 6 January 1978 amended to those data does not pose any problems of principle, the Nevertheless, the Committee reiterates its reservations in its deliberation On 20 January 2011, concerning the imprecision of certain data under the indirect right of access, such as " Description of the movements of detained persons " And " Requirements of judicial or penal origin relating to the care and detention of the detained person ". In this latter category, for example, comments written in the free fields provided for in the GENESIS application.
In this respect, the Commission also draws the attention of the Ministry to the current practice of The prison administration, which consists of never communicating the observations to the data subject, which seems to be contrary to the principle of divisibility of the relevant data. It therefore recalls that the information which the communication does not call into question the purposes assigned to processing or public safety must be communicated to the person exercising the right of access
Does not apply to the proposed processing, which does not require comment from the Commission.
On Data Security and Action Traceability
In general, the Commission notes that: Measures implemented by the Ministry of Justice make it possible to bring a high
As a result, unlike GIDE, it has a centralized architecture that allows real-time data to be updated and a consistent security of the data. The accommodation measures presented are such as to ensure high availability of data.
Moreover, the Committee notes that, in accordance with what it had requested in its deliberation of 20 January 2011, traceability measures Have been improved. Indeed, and contrary to GIDE, the future Article R. 57-9-26 of the Code of Criminal Procedure as provided for in the draft decree provides that all actions (consultation, seizure, deletion) on the information system will be traced, the traces Is kept for three years.
Strong authentication (card with certificate issued by ANTS) is planned for all users.
GENESIS processing will be related to other processing, depending on Ministry of Justice (justice system, enforcement of sentences, Probation and insertion, national file of detainees, GIDE/CEL, the LDAP directory), the Ministry of Health, via an interdepartmental exchange server, or the Banque de France. The Committee notes that these data transmissions to various addressees all present security measures to ensure the confidentiality of the data exchanged (either through the use of the departmental network RPVJ, or by Using secure protocols such as HTTPS or SFTP).
In addition, GENESIS will have a " Require ", a tool for viewing data in an intelligible manner for operational purposes. The Commission takes note that only internal staff members of the prison administration will be able to use this tool and that certain data are excluded from the applicant (NIR, as well as all data from the inviting fields). User to a free entry). Finally, the applicant allows for the traceability of the identity of the applicant as well as the objects required for a period of three years.
The Commission notes that there is no scheduled remote maintenance; in addition, the safeguard policy is Satisfactory in the light of Article 34 of the law of 6 January 1978, as amended.
The Committee nevertheless draws the attention of the Ministry of Justice to the need to strictly supervise the providers of maintenance and Exploitation and specifies that a re-evaluation of risks as a result of the passage on the RIE (network
Subject to previous observations, the security measures described by the controller are in conformity with the security requirement laid down in Article 34 of the Law of 6 January 1978.
The Commission points out, however, that this obligation requires that security measures be updated with respect to the regular reassessment of risks.
The President,
I. Falque-Pierrotin
