Key Benefits:
The National Computer and Liberties Commission,
In view of Council of Europe Convention 108 for the protection of persons with regard to the automatic processing of personal data;
In view of Regulation (EU) No 165/2014 of 4 February 2014 on tachographs in transport Regulation (EEC) No 3821-85 of the Council of 20 December 1985 amended concerning the control apparatus in the field of road transport and amending Regulation (EC) No 561/2006 of the European Parliament and of the Council concerning The harmonisation of certain provisions of social legislation in the Field of road transport;
In view of Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to the processing of personal data and the free movement of This data;
In view of the amended Act No. 78-17 of January 6, 1978 relating to computers, files and freedoms, in particular Article 24;
Seen decree n ° 2005-1309 of 20 October 2005 modified for the application of Law n ° 78-17 of 6 January 1978 relating to computers, files and freedoms;
After hearing Mr. Eric PERES, Commissioner, in his report, and Mr. Jean-Alexandre SILVY, Commissioner of the Government, in his observations,
Form the following observations:
Regulation (EU) No 165/2014 of 4 February 2014 on tachographs in road transport requires the installation and use of tachographs on vehicles used for passenger transport of more than nine persons and Goods vehicles of more than 3.5 tonnes. These control apparatus are used to record the data relating to the use of vehicles of drivers of passenger and freight vehicles.
This Regulation repealed Regulation (EEC) No 3821/85 of 20 December 1985 Amended concerning the control apparatus in the field of road transport, which nevertheless continues to apply on a transitional basis until Regulation (EU) No 165/2014 becomes applicable, namely March 2, 2016.
Installation Required control equipment installed in vehicles of the Road transport involves the implementation of personal data processing.
In accordance with Article 24-11 of the law of 6 January 1978 amended, the Committee is empowered to define, for the most common categories of Processing of personal data, those which are exempt from reporting.
Taking into account the purposes, categories of persons concerned, the personal data processed, the length of time they are kept, and the duration of their retention Addressees of the processing of personal data resulting from these The Commission considers that they may be subject to such a declaration exemption, subject to strict compliance with the following provisions.
Salary Finalities.
Personal data processing must be for the sole purpose of controlling the use of passenger and freight vehicles In accordance with the regulations in force, including legislation Social in the field of road transport.
Nature of personal data processed.
Only can be processed Personal data provided for by the regulations in force, and in particular by Article 4 of Regulation (EU) No 165/2014 of 4 February 2014.
These data are, in the main proceedings, relating to:
-the distance travelled and speed of the vehicle;
-the measurement of time;
-for vehicles equipped with a tachograph connected to a positioning service based on a satellite navigation system (tachograph Intelligent), the locations of the vehicle registered at the beginning and end of the daily working period, and all three hours of accumulated driving time, under the conditions laid down in Article 8 of Regulation (EU) No 165/20414 ;
-driver identity;
-driver activity;
-data Relating to the control, calibration and repair of the device;
-events and failures.
As a transitional period, until the application of Regulation (EU) No 165/2014 of 4 February 2014, only the Data listed by the Annexes to Regulation (EEC) No 3821/85 of 20 December 1985 as amended.
Data holders.
For The exercise of the abovementioned purposes, can only have access to the data Persons provided for by the regulations in force, and in particular by Regulation (EU) No 165/2014 of 4 February 2014.
These addressees are, in the main proceedings:
-the approved installers and repairers;
-the trusted control agents;
-the employers;
-drivers.
These recipients can have access to the only data they need to know about Needs of their missions.
Duration of data retention
In accordance with current regulations and in particular Article 33 of Regulation (EU) No 165/2014 of 4 February 2014, the employer must Retain data (record sheets and printed data) for at least one year after use.
The employer may, however, archive the data for the duration of the legal requirement in order to be able to Disputes over the number of hours worked by the employee.
Security.
The controller takes all precautions Useful to preserve the security and confidentiality of Data processed, in particular to prevent them from being distorted, damaged or unauthorized third parties can become aware of it.
In particular, the controller must ensure that only identified recipients will be Ability to access all the information contained in the tachograph. These guarantees must cover both physical access to information and also remote access to information. Finally, security measures must ensure data integrity to protect the system from any changes to the information in the tachograph.
Information and human rights.
In accordance with Article 32 of the law of 6 January 1978 amended, the persons concerned are informed of the purposes of the processing, of the recipients of the Data and procedures for the exercise of their rights of access, rectification and Deletion.
With particular regard to smart tachographs, Article 9 of Regulation (EU) No 165/2014 of 4 February 2014 requires the employer to inform drivers of the possibility of communication of data to the Control authorities, for the purpose of remote detection of any manipulation or misuse of tachographs.
This information may, in particular, be issued in the driver's contract of employment by handing over to the driver of Appropriate communication or a reference displayed in the vehicle's habitable area,
addition, the driver must be able to exercise his right of access directly to his or her employer. In accordance with the regulations in force, and in particular Article 33 of Regulation (EU) No 165/2014 of 4 February 2014, the driver must be able to obtain a copy of the data downloaded from the driver card and the printed versions Of this copy.
Effects of the reporting exemption.
Treatments that meet the conditions set out in items 1 to 6 may Be implemented without delay and without prior notification to the CNIL.
The exemption from prior notification to the CNIL does not exempt the person in charge of such treatments from any of his other obligations laid down in the texts applicable to the protection of personal data. In particular, the Committee recalls that it reserves the right to monitor compliance with the provisions of this deliberation.
This release will be published in the Official Journal of the French Republic.
The President,
I. Falque-Pierrotin
