Key Benefits:
National Commission on Informatics and Liberties,
Entering the Minister of the Economy and The finances of a request for an opinion on a draft decree in the Council of State establishing a personal data processing operation known as LRPDJ,
In view of the Council of Europe Convention No 108 for the Protection of Persons to The automatic processing of personal data;
In view of Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to the processing of character data Personnel and the free flow of these data;
Seen Criminal Procedure Code, including its article 28-1;
Due to Law No. 78-17 of 6 January 1978 as amended relating to computer, files and freedoms, in particular Article 26-II;
Seen Decree No. 2005-1309 of 20 October 2005 amended For application of Law n ° 78-17 of January 6, 1978 relating to computers, files and freedoms;
Given the decree N ° 2011-110 of 27 January 2011 amended authorizing the creation of an automated processing of personal data known as the National Police Procedure Writing Software (LRPPN);
Seen decree n ° 2011-111 of 27 January 2011 authorising the implementation by the Ministry of the Interior (Directorate-General of the National Gendarmerie) of an automated processing of personal data assistance in the drafting of procedures (LRPGN);
Vu The Order of 5 December 2002 establishing a service with national jurisdiction known as the national judicial customs service;
After hearing Mr. Jean-Marie COTTERET, Commissioner, in his report, and Mr. Jean-Alexandre SILVY, Commissioner of the Government, in his observations,
Emet the following opinion:
The Committee was referred by the Minister for Economic Affairs and Finance of a draft decree to the Council of State for the creation of an automated processing of personal data known as LRPDJ (software for writing the procedures of the Judicial customs).
This treatment must allow the officers of the National Judicial Customs Service (SNDJ), established by the decree of 5 December 2002, to draw up the minutes of the judicial proceedings which they are entitled to carry out on the Basis of article 28-1 of the Code of Criminal Procedure. This is a similar treatment to the drafting software of the procedures currently used by the national police and gendarmerie (LRPPN and LRPGN), authorised by the decrees of January 27, 2011 mentioned above. As well as the latter, the LRPDJ treatment will subsequently feed directly into other treatments that make up the criminal chain, including the treatment of criminal history (YAT), the conditions of which are expected to be implemented articles R. 40-23 to R. 40-34 of the Code of Criminal Procedure.
This treatment has as its object prevention, research, The identification and prosecution of criminal offences. In so far as it is also likely to involve sensitive data within the meaning of Article 8 of the law of 6 January 1978 amended, the LRPDJ treatment must be authorised by decree in the Council of State after reasoned and published opinion In accordance with the provisions of Article 26 of the same Act.
For the purposes of processing:
Under the terms of Article 1 of the draft decree, the purpose of the LRPDJ treatment is to enable the agents of the SNDJ " Ensure the clarity and consistency of the drafting of the judicial procedures that they have the competence to implement ". This office purpose, similar to that pursued by the aforementioned treatments LRPPN and LRPGN, is determined, explicit and legitimate, in accordance with the provisions of Article 6 (2 °) of the Act of 6 January 1978 as amended
In relation to judicial proceedings are affected by this treatment, unlike the LRPPN and LRPGN treatments which also concern the administrative procedures which police and national gendarmerie officers have competence for Implement. Acts relating to administrative procedures carried out by customs officers on the basis of the Customs Code are indeed recorded in a processing operation. Separate, named Garance and authorised by order of 21 May 2013 taken after the opinion of the committee dated 28 March 2013, and no technical link exists between these two treatments.
Nevertheless, the Committee notes that the LRPDJ treatment continues A second power purpose for other data processing Relating to judicial proceedings, in particular the TAJ and the Cassiopeia application implemented by the Ministry of Justice. This second purpose, also pursued by the drafting software of the procedures of the police and the national gendarmerie, is also expressly mentioned in the decrees establishing these treatments
The Committee considers that the provisions of the first paragraph of Article 1 of the draft decree, which relate to the purposes of the treatment, should be amended to mention this second purpose of feeding. Similarly, the interconnections or relation provided with the treatments in question should be specifically mentioned in the draft decree, as is the relationship between the LRPGN application and the JUDEX treatment provided for in article 4 of decree n ° 2011-111 of January 27, 2011.
For more specifically the automatic feed of the TAJ by The LRPDJ application for all procedures performed by agents The SNDJ, the committee recalls that its implementation requires the modification of the provisions of Article R. 40-24 of the Criminal procedure. These are now subject to registration in the TAJ of the data collected in the framework of procedures established by customs officers entitled to carry out judicial police missions on the condition that a police service or a Gendarmerie unit be called upon to ensure its continuation or common conduct. The Committee recalls that the modification of these provisions as well as the precise technical conditions of this food will have to be submitted to it for an opinion.
On the nature of the data processed:
Personal data Registered in the processing are mentioned in the annex to the draft decree. They concern the natural persons involved, the victims, the witnesses and complainants, the legal persons involved or victims, as well as the facts of the investigation, the places, the date of the offence and the information relating to it. Objects, including those that are indirectly nominative.
The draft order contains the categories of personal data recorded in the LRPPN and LRPGN treatments, with the notable exception of the photograph of the persons concerned, Which, as a whole, do not require any particular observation from The committee.
Additional data are nevertheless collected concerning the persons involved, namely the references of identity documents, titles and means of transport, as well as the registration plate number, the Bank account and telephone numbers and data relating to the heritage situation (loans, real estate, moveable assets).
The Committee takes note of the justifications provided by the Ministry of Economy and Finance The collection of this information, which is intended to provide a Assistance in the investigation or decision of the judicial authority. It recalls, however, that Article 6 (3 °) of the Act of 6 January 1978, as amended, requires that only relevant, adequate and non-excessive data must be recorded in the LRPDJ treatment for each judicial procedure and in all cases
second paragraph of Article 1 of the draft decree provides for the registration of personal data falling within the scope of Article 1 of the draft decree. Article 8 of the Act of 6 January 1978, as amended, " To the extent that such data is necessary for the purposes of the purposes "
The Commission takes note that this data is not accessible by an index or other automated search system and that no thesaurus, in particular the thesaurus relating to the state of the persons, shows such data Data. These sensitive data are also not transmitted to other data processing data relating to judicial proceedings.
The Commission nevertheless considers that these provisions should be amended, on the model of Article R. 40-24 of the Criminal Procedure Code, to specify that this data can be processed in the Only where such information is the result of the nature or circumstances of the The offence or relate to specific, objective and permanent physical signs, as elements for the reporting of persons, where such elements are necessary for the search and identification of offenders
On the duration of data retention:
Article 3 of the draft decree provides that the data collected shall be kept in the LRPDJ processing until the end of the procedure and its Transmission to the competent judicial authority. The Panel finds that this shelf life, identical to that provided for the LRPGN treatment and well below that provided for the LRPPN application, is consistent with the provisions of section 6 (5 °) of the Act of January 6, 1978.
It points out that a mechanism for automatic clearing of information must be provided to ensure that personal data are not stored beyond that duration.
On recipients of the data:
The Commission takes note that only the SNDJs, individually appointed and specially authorised by the magistrate delegated to the judicial missions of customs or, where appropriate, by the Director General of Customs and Direct Rights May access, because of their duties and within the limits of the need to know, all or part of the data recorded in the PPDJ treatment. It also takes note that the magistrates, because of their powers and within the limits of the need to know, can receive such data.
The Ministry has also indicated that international cooperation bodies In respect of the judicial police and the police services of aliens may be made to the case, on a case-by-case basis and under the conditions set out in sections 695-9-31 to 695-9-49 of the code In criminal proceedings and in the regulations implementing it, of the data contained in the PPDJ treatment. The Committee therefore considers that Article 4 of the draft decree should be clarified on this point.
On the rights of the persons concerned:
In accordance with the provisions of Article 32 of the Act of 6 January 1978, as amended, the law Information of the data subjects does not apply to the LRPDJ treatment. The Commission nevertheless takes note that victims are informed of the registration of their personal data in this processing, as expressly provided for in the second paragraph of Article 6 of the draft decree
That the right of opposition provided for in Article 38 of the same Law does not apply to this treatment and that the rights of access and rectification shall be exercised with the Commission in accordance with the provisions of Articles 41 and 42 of the Law of 6 January 1978 amended.
On Treatment Secures:
Enabling profiles to access the LRPDJ processing have been defined and user authentication is based on the use of a smart card (CADO, Customs card) and an associated password (Alphanumeric PIN). The Commission points out that passwords must be sufficiently complex and that they should have a minimum length of eight characters and contain at least one number, a lower case and a special character.
One Logging functionality for lookup operations, creating, updating, and deleting is implemented. Article 5 of the draft decree provides that the data are kept in processing for three years.
As regards the exchange of data between LRPDJ and other applications, the Committee notes that all modalities The need to ensure the confidentiality of transmissions, in particular in connection with the interconnections with the TAJ and Cassiopeia treatments.
Subject to the above Observations, the safety measures described by the controller Are in conformity with the security requirement laid down in Article 34 of the Law of 6 January 1978 as amended. The Panel notes, however, that this obligation requires the updating of security measures with respect to the regular reassessment of risks.
The Associate Vice-President,
E. Of Givry
