Key Benefits:
La National Commission on Informatics and Liberties,
Seizure by the Ministry of Labour, Employment, Training And the social dialogue of a request for an opinion on a draft decree establishing a teleservice of electronic administration;
In view of the Council of Europe Convention No. 103 for the protection of persons Automatic processing of personal data;
In view of Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and The free movement of this data;
Given the Labour Code, including its articles L. 5122-1 et seq;
Seen Law No. 78-17 of January 6 1978 as amended relating to computers, files and freedoms, in particular Article 27-II (4 °);
In view of Law n ° 2013-504 of 14 January 2013 on securing employment, in particular Article 18 thereof;
Seen decree n ° 2005-1309 of 20 October 2005 modified for the application of Law n ° 78-17 of 8 January 1978 relating to computers, files and freedoms;
On the Proposal by Mr Emmanuel de GIVRY, Commissioner, and after hearing Mr Jean-Alexandre SILVY, Commissioner of the Government, in his observations,
Emet the following opinion:
On the basis of Article 27-II (4 °) of the amended Act of 8 January 1978, the National Commission for Informatics and Freedom was seized for opinion by the Ministry of Labour, Employment, Vocational Training and Dialogue Of a draft decree establishing, since the Service and Payment Agency, of a teleservice of electronic administration is intended to dematerialize and simplify the procedure for the application for partial activity and the payment of compensation Corresponding.
On the purpose of processing
The implementation of the teleserservice referred to above is intended to enable undertakings to carry out in a dematerialised manner their applications for authorisation of investment in positions, of partial activity of The
takes note that the objectives pursued by this teleservice are, in particular, to simplify the administrative procedures, to reduce the time limits for Processing, increasing the reliability of the data and facilitating
Article 1 of the draft decree examined by the committee specifies that the Service and Payment Agency is authorised to create a personal data processing operation with the purpose of:
" 1 ° The management, control and follow-up of prior applications for the authorization of partial employment of employees and claims for compensation;
2 ° The calculation and payment of the partial activity allowance paid to Institution;
3 ° Development of anonymized statistical and financial data. "
The Commission considers these purposes to be determined, explicit and legitimate.
On the nature of the data processed:
The project (the decree examined by the committee refers to the categories of data collected and processed by the Service and Payment Agency, namely:
1 ° In case of payment of the allocation of the partial activity to the institution :
-the user name and first name;
-the person's registration number in the national directory for identifying natural persons;
-the socio-professional category;
2 ° In case of direct payment to employees of Partial activity allowance:
-use name, birth name, first name, civility, date of birth, commune of birth, INSEE code of the municipality of birth,
-the person's registration number in the national identification directory of the Physical persons;
-address, postal code, and city of residence;
-bank details.
For use: The registration number of persons in the national directory for the identification of natural persons, the Commission takes note that this data will be used to ascertain the identity of the applicants for compensation and compliance with the conditions The
considers that the collection and processing of the data referred to above is relevant, adequate and not excessive in relation to the purposes pursued.
The Committee nevertheless notes the collection Of a category of data not mentioned in the draft order, to Knowledge of login credentials. It therefore appears to him that the draft decree should be completed in this capacity.
On the duration of data retention
The draft decree specifies that the personal data processed by the Service Agency And payment shall not be kept beyond the time required for:
-manage, monitor, and track pre-job placement authorization requests and claims;
-calculate and pay for partial activity allocations;
-establish data Anonymized statistics and financials.
The Commission takes note that the data will be kept by the Service and Payment Agency for five years.
The draft order specifies, moreover, that the data Necessary for the management of an application dispute The
considers that these retention periods do not exceed those necessary for the fulfilment of the purposes of the decision.
However, it believes that the draft order should be completed to include the retention period for login credentials, i.e. one year.
On Data Recipients
Draft Order in Council Specifies that the data for this treatment, except the registration number of the Persons in the national directory of identification of natural persons and for the only requirements relating to their respective powers, shall be communicated to the authorised agents:
-general delegation, employment and vocational training;
-the unemployment insurance manager organization;
-the labour ministry's deconcentrated services.
The draft order Shall also specify that the statistical offices of the Ministry responsible for employment designated and empowered by their responsible authority shall be addressed to the data of this treatment, with the exception of family names, marital names and Numbers of people in the national directory Identification of natural persons, solely for the purpose of compiling anonymized financial statistical data.
The Commission considers that these recipients have a legitimate interest in knowing the data available to them Communicated.
On the information of persons
The Committee notes that the request for an opinion presented by the Ministry of Labour, Employment, Vocational Training and Social Dialogue states that: Concerned by this treatment shall be informed, in accordance with Article 32 The law of 6 January 1978 amended, by legal notices on form, a statement on the website of the Ministry, as well as by the general conditions of use of the teleservice.
The Commission considers that the measures provided for in the Information of persons is satisfactory.
On the rights of access, rectification and opposition of persons:
The draft decree provides that the rights of access and rectification, provided for in Articles 39 and 40 of the Act of 6 January 1978, as amended, shall be exercised directly with the Agency for Services and Payment by mail or by mail
The Commission notes that the draft order does not expressly exclude the application of the right of opposition for legitimate reasons.
The provisions of the draft decree on rights of access, rectification and opposition for Legitimate reason does not require observation from. The Commission.
On Data Security and Action Traceability
The Panel observes that user authentication is ensured by using an alphanumeric password. It recalls, as such, that passwords must be regularly renewed, contain at least eight characters and include at least one letter, a numeral and a special character. The Commission also points out that the administrators' passwords must be at least ten characters.
The Commission points out that the transmission of identifiers and passwords by e-mail is not such as to Ensure confidentiality. It therefore recommends that the passwords communicated in this way must be changed by the users on the occasion of their first connection to the service.
The Commission takes note of the enabling profiles defining The functions or types of information available to a user have been defined as part of this processing.
It reports that a logging functionality for the lookup, create, update, and delete operations has been
The Commission finally observes that data exchanges Are carried out using secure channels, in particular, that the data transmitted is encrypted.
The Associate Vice-President,
E. Of Givry
