Key Benefits:
The National Commission on Informatics and Liberties,
Seizure by the Minister of Labour, Employment, Vocational Training and Social Dialogue of a request for an opinion on a draft decree in the Council of State Relating to the implementation of the processing of personal data concerning a survey on psychosocial risks at work, " Psychosocial Risks 2016 " ("RPS 2016"),
Given the Council of Europe Convention No 108 for the protection of persons with regard to the automatic processing of personal data;
In view of Directive 95 /46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of natural persons with regard to the processing of personal data and the free movement of such data;
In the light of Act No. 51-711 of 7 June 1951 Amended on the obligation, coordination and secrecy of Statistics;
In view of the amended Act No. 78-17 of January 6, 1978 relating to computers, files and freedoms, in particular its Article 27-I (1 °);
Seen decree n ° 2005-1309 of 20 October 2005 modified for the application of Law n ° 78-17 of 6 January 1978 relating to computers, files, and Freedoms;
After hearing Mr Alexandre LINDEN, Commissioner, in his report and Mr Jean-Alexandre SILVY, Commissioner of the Government, in its observations,
Emet the following opinion:
Direction de l' animation de la recherche, des études et des statistics (DARES) du ministère du travail (DARES) of the Ministry of Labour seized the National Commission on Informatics and Liberties (CNIL) of a Draft decree in the Council of State (hereinafter " The project ") Relating to the implementation of an automated processing of personal data relating to a device for investigation of psychosocial risks at work, referred to as " Psychosocial Risks 2016 " Or " 2016 ".
The draft submitted to the Committee for opinion is taken pursuant to Article 27-I (1 °) of the law of 6 January 1978 amended which submits to a decree in the Council of State, taken after reasoned and published opinion of the CNIL, the treatment of Personal data implemented on behalf of the State which relate to data from which the NIR is included.
Presentation of the device:
The investigative device " Psychosocial Risks 2016 " Objectives:
-to measure exposure to psychosocial risks at work;
-to measure the duration, repeatability and timing of psychosocial risk factors;
-to measure changes in working conditions ;
-to explore the relationship between work and health.
It will consist of two phases of surveys:
-the first phase, known as " Individuals "will consist of a face-to-face survey of 27 000 individuals aged 15 years or older from October 2015 to June 2016;
-the second phase, known as" Employers " will consist of a survey carried out by mail or via the Internet to employers designated by the persons interviewed previously.
The processing will be carried out by the Directorate of Research Animation, of the Department of Labour Studies and Statistics (DARES).
The Component Target " Individuals " Consists of all persons who are self-employed or employed, public or private, stable or temporary, aged 15 years or over. The RPS 2016 survey will interview all survey respondents " Working Conditions 2013 ", conducted by the DARES, notwithstanding their professional situation (active, unemployed, retired). A complementary sample of "incoming" Will be taken from the 2014 census file to preserve the representativeness of the respondents.
The target of the component " Employers " Consists of employers designated by the persons previously interviewed and a complementary random sample of establishments of all sizes in order to be representative of all establishments in France
Of the investigation " Individuals ", the individual survey data will be matched with data from the National Interstate Information System of Health Insurance (SNIIRAM), including the National Workers' Health Insurance Fund Employees (CNAMTS) is responsible for the care of the subjects of the investigation. This linkage requires the use of the National Physical Person Identification (NIR) registration number of respondents and, where applicable, their right openers.
Prior to referral to the The draft investigation was examined by the National Statistical Information Council (CNIS), which issued a favourable opinion on 11 December 2013. On 9 January 2015, the committee of the CNIS label awarded the general interest and statistical quality label to the SDN survey for the years 2015 and 2016, with a mandatory character.
On the purpose of processing:
Under the terms of the Article 1 of the draft, it is intended to authorise " The implementation by the Directorate of Animation and Research, Studies and Statistics (DARES) of the Ministry of Labour, Employment, Vocational Training and Social Dialogue of an automated processing of character data Staff on a national survey on psychosocial risks at work, known as "Psychosocial Risks 2016 or" RPS 2016.
The purpose of this treatment is to measure exposure to psychosocial risks at work, duration, Repetitive and chronicity of psychosocial risk factors, the evolution of Working conditions and exploring the relationship between work and health. The information on the expenditure of care undertaken is intended to enable the assessment of the medical cost attributable to psychosocial risks and poor working conditions. '.
The Commission considers that, in the interest of public health, This investigation, the creation of such processing and the purposes thus pursued shall be determined and legitimate.
On the modalities of the organisation of the investigative body " RPS 2016 " :
Article 2 of the project states that:
-first collection of information by survey will be carried out from October 2015 to June 2016 with a representative sample of 27 000 individuals aged 15 years or older;
-one second Collection of information will take place at establishments employing at least one employee. These establishments are, for the most part, those in which the employees interviewed for the first collection are employed. Public employers are included in the scope of the investigation;
-subsequent supplementary surveys may be implemented with the persons investigated and agreed upon during the initial investigation;
-individuals who have Participated in the initial survey will be included in an address tracking device in order to be able to re-examine them as part of the survey on working conditions expected in 2019.
The Commission takes note of what the project specifies That prior formalities must be carried out with the CNIL
On the nature of the data processed:
Article 3 of the project lists the data collected directly from the persons under investigation.
These data relate to: :
1." The usage name and the given name (s);
2. Sex, date and place of birth;
3. The National Physical Person Identification (NIR) registration number, under the conditions set out in section 4; and
4. Where applicable, the birth name, given name, date and place of birth and the NIR of their right opening, under the conditions specified in Article 4;
5. Mailing address;
6. The current family situation, the family and vocational course: occupation and place of birth of the parents, family or major health events during childhood, diplomas, first job held;
7. Current occupational activity, contact information for the employer, the last occupation of persons who are furthest away from employment;
8. Organisation of work: rhythms, autonomy, changes;
9. Organisation of working time: time, predictability, accommodation;
10. Physical constraints, preventive measures and accidents at work;
11. Relationships with others at work and feeling about the atmosphere, discrimination, hostile behaviour;
12. The state of health as perceived by the persons investigated. "
Outres these data, the treatment also includes data on the care consumption of persons investigated. These data, from the SNIIRAM, are communicated by the CNAMTS to the DARES.
The referral file further specifies that the reconciliation of the survey data with the medical care consumption of the respondents, such as the SNIIRAM, Assume either direct collection of the NIR or indirect collection through the personal information (birth name, first name, sex, date and place of birth) allowing the NIR to be searched in the national identification directory of the Natural persons (RNIPP).
The Commission notes that the project does not mention The existence of this indirect collection of the NIR and requests that it be completed on this point.
These data do not require observation by the committee, since they are relevant, adequate and not excessive in relation to the purposes For which they are collected, in accordance with the provisions of Article 6 (3 °) of the law of 6 January 1978, as amended.
On the duration of data retention:
Article 8 of the draft provides for a retention period of five years:
-data identifying the subjects of the survey and, if applicable, their entitlement (i.e. their name, first name, date and place of birth, NIR) to allow matching with SNIIRAM data;
- Contact information (name, first name, postal address of the subjects of the survey) in order to enable the completion of supplementary investigations and the re-examination of persons in the framework of the survey on working conditions scheduled for 2019.
The Commission takes note that this data will be deleted when the
For the two purposes pursued, this five-year shelf-life does not require comment from the Commission.
On the recipients of the data:
Sections 6 and 7 of the project provide for: That DARES and the Archives of France are addressed:
- " Individual data files on the consumption of care resulting from the operations described in Article 5, allowing no direct identification of the persons with whom the survey was carried out;
-individual data from the data Of the investigation described in Article 3, which does not permit direct identification of persons. "
The Commission takes note of the fact that the names, first names, sex, date and place of birth, NIR and mailing address of the persons will not be transmitted to the DARES or the Archives of France.
The Commission notes that the data indirectly Identity will be transmitted to the Archives of France under the conditions laid down by the Heritage Code and that they are Communicable under the conditions laid down By Order in Council N ° 2009-318 of 20 March 2009, taken pursuant to Act No. 51-711 of 7 June 1951 as amended on the obligation, coordination and secrecy of Statistics.
On this point, the draft does not call for a specific observation of the Commission when it is a question of bodies legally entitled to request the communication of data processed in accordance with the provisions of Article 3-II of the Act of January 6, 1978, as amended.
On the Information of Individuals:
Article 4 of the project provides for specific information on the subjects of the survey on the conditions of use and conservation of their NIR, prior to the collection of these data by the investigators
Anticipates that the subjects of the investigation will be informed of the completion of the investigation by sending a letter-notice accompanied by an information leaflet and that a letter of revival in case of non-response will be addressed to them. The Commission takes note of this.
Article 9 of the draft recalls that persons will be informed of the mandatory nature of the collections in the letters addressed to them, while specifying that the questionnaires provide for the possibility of Do not answer one or more questions. In particular, if a person refuses to communicate their NIR, Article 9 of the project specifies that no match will be made with the SNIIRAM data.
The Commission considers that the aforementioned letter-notice is used to respond to all Obligations under the provisions of Section 32 of the Act of January 6, 1978, as amended.
However, it notes that the persons interviewed as part of the component " Individuals " Are not explicitly informed that their responses will be used to contact their employers for the implementation of the component " Employers " Of the RPS 2016 survey. She notes that the letter sent to employers indicates that they are contacted following the questioning of at least one of their employees, without revealing their identity.
In accordance with the principle of loyalty provided for in Article 6 of the Act On 6 January 1978, as amended, the Commission considers that employees should also be fully informed of the terms of the investigation, in particular the fact that their employers will then be
. Letters-notices must be harmonised on the basis of the party " Individuals " Or " Employers ", in accordance with the opinion of the Committee of the CNIS label issued on 9 January 2015.
On rights of access, rectification and opposition of persons:
The Committee notes that, due to the mandatory nature of the SDN survey Article 9 of the draft excludes the application of the right of opposition provided for in Article 38 of the law of January 6, 1978, as amended.
Article 9 of the draft specifies that the rights of access and rectification of persons concerning the component " Persons " shall apply to the branch of the Institut national de la statistique et des études économiques (INSEE) or the regional or interregional directorates of the INSEE.
Article 9 of the draft also specifies that rights Access and rectification of persons concerning the component " Employers, "will work with the" Provider under the responsibility of DARES " And that the service with which the persons may exercise their rights will be identified in the notice addressed to them.
Article 29 (2 °) of the Act of January 6, 1978, as amended, requires that the act authorizing the creation of the treatment Specifies " The service to which the right of access is exercised. "
As a result, the Commission requests that the project be completed in order to clarify the service to which the persons concerned by the component" Employers " May exercise their rights.
Subject to the foregoing observations, the Commission considers that the manner of information and exercise of the rights of persons is such as to ensure the effective exercise of their rights
Data and traceability of actions:
Article 5 of the project provides that " The reconciliation of the information collected by investigation with the data of the National Intersystem Information System of the abovementioned health insurance is preceded by an encryption of the NIR to guarantee the confidentiality of the data during the Transfers ".
If NIR encryption ensures confidentiality when it is transferred, reconciliations with the SNIIRAM data will be carried out after the duplicate NIR hashing and the identity elements of the insured. The Committee notes that Article 5 of the draft also specifies these elements. However, it points out that the SNIIRAM data must not be matched to either the FOIN1 identifier or the NIRs of the survey subjects, and that the FOIN2 identifier should not be transmitted outside the SNIIRAM.
Section 10 of the project specifies That DARES, in its capacity as controller, " Ensures the security of data transfers and implements a policy for the management of data access clearances ".
However, the conditions for the retention of data and the terms of access are not indicated, the The Commission requests that this section be completed in order to clarify that the data will be retained by each of the stakeholders under conditions that ensure, in particular, their confidentiality and integrity
That a study of the risks to the privacy of individuals be conducted and Day on a regular basis.
As regards the specific measures implemented, described in the file, the staff of DARES and INSEE authenticates with a password consisting of eight characters and comprising three types of characters
Within the Group of National Schools of Economics and Statistics (GENES), persons entitled to access data have a specific case ("SD-Box"), chassis provided by the GENES allowing access to a storage space dedicated to the investigative device " RPS 2016 ", on the servers of the remote secure access data center (CASD). Authentication is achieved through the use of a biometric device.
The terms and conditions of access to data by the authorized staff of the CNAMTS are not specified. The Commission points out that these authorised personnel must be authenticated before any access to the data.
Data access is traced and these traces are stamped.
Data transfers are secured either through the use of Secure protocols, either by encrypting data prior to registration on the physical media used for transmission, or by a combination of secure protocols and data encryption. The encryption algorithm used is an asymmetric algorithm.
As regards the private keys used to decrypt the data, the Commission points out that they must be kept secret by the recipients of the data.
Within DARES, retained data are indirectly identifying data. They are stored on a secure server with limited physical and logical access.
The data removal procedures for data processing stakeholders are not specified in the folder.
The commission requests The terms and conditions for the final disposal of the data, once transmitted to the DARES, or at the end of the retention period, be provided for and implemented.
Other points of the project do not call, in the state and in the eyes of the Act of January 6, 1978, as amended, other observations of the Commission.
The President,
I. Falque-Pierrotin
