Key Benefits:
National Computer and Liberties Commission,
Seizure by the Minister of a request for an opinion on a project Of an order concerning the establishment of a teleservice of the administration, referred to as " Results of the driving licence ",
Having regard to Convention 108 of the Council of Europe for the protection of persons with regard to the automatic processing of personal data;
Having regard to Directive 95 /46/EC of the European Parliament and of the Council Of 24 October 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data;
Seen law n ° 78-17 of January 6, 1978 related to computers, Files and freedoms, including article 27-II (4 °);
Due to route code ;
Seen decree n ° 2005-1309 of 20 October 2005 modified for the application of Law n ° 78-17 of 6 January 1978 relating to computers, files and freedoms;
In view of the April 20 Order 2012 laying down the conditions for the establishment, grant and validity of the driving licence;
In view of the decree of 26 April 2013 on the notification of the results of driving licence examinations;
In view of the draft decree of the Minister of The inside;
Given the record and its additions;
After hearing Mr. Eric PERES, Commissioner, in his report and Mr. Jean-Alexandre SILVY, Commissioner of the Government, in his observations,
Emet the following opinion:
On the basis of Article 27-II (4 °) of the Act of 6 January 1978, as amended, the National Commission for Informatics and Freedoms was seized for the opinion of the Minister of the Interior of a draft decree establishing a teleservice of Administration, named " Results of driving licence " :
For purposes:
Article 1 of the draft decree specifies the purposes of the processing and states that this teleservice " [...] is intended to enable applicants for driving licences who wish to have access to their driving licence examination results online, as well as to the certificate which temporarily authorizes the driving of the vehicle of the category for ".
The Commission notes with satisfaction that the use of this tele-service is presented as a simple option available to" Candidates for a driver's licence ".
Candidates who do not wish or do not have the opportunity to access the teleservice" Results of driving licence " Have the opportunity either to obtain their certificate of examination of a driving licence from their driving school or, on the day of the examination, to apply to the inspector for the driver's licence to establish and mail a certificate Examination of driving licences "
The Commission considers that the purposes pursued by the implementation of the teleservice referred to as " Results of driving licence " Are determined, explicit and legitimate.
On the nature of the data processed:
Article 2 of the draft decree specifies the personal data processed. Specifically:
-vital statistics data: Name, first name;
-the driver's licence application file number (NEPH);
-the license category;
-marks obtained for driving licence examination tests;
-any codified references to restrictions or Limitation of validity.
Regarding the data relating to the civil status, the Commission takes note of the fact that, at its request, Article 2 of the draft decree has been supplemented by a reference to the date of birth, this data being required for Connect to remote service " Results of driving licence ".
With respect to" Codified references to restrictions or limitations of validity ', the Commission takes note that this is the particulars laid down in Annex 1 to the decree of 20 April 2012 laying down the conditions for the establishment, grant and validity of the
In so doing, the Committee observes that Article 2 of the draft decree permits the processing of health data, where such treatment is required by Annex 1 of the decree of 20 April 2012 laying down the conditions of establishment, of Issuing, and validity of the driver's licence.
Given what it does Are sensitive data within the meaning of Article 8 of the law of 6 January 1978, as amended, the Committee calls for vigilance and recalls that the confidentiality of this data must be reinforced by additional security
. The Committee considers that the collection and processing of the data referred to in Article 2 of the draft decree is legitimate, relevant and not excessive in relation to the purposes pursued.
On the duration of data retention:
Article 3 The draft decree states that " The duration of the retention of personal data and information recorded in Article 2 shall not exceed four months from the date of successful completion of the examination of driving
." Retention does not exceed that required for the purposes pursued.
On the recipients of the data:
Article 4 of the draft decree specifies the recipients authorised to receive the data processed Through the teleservice " Driver's license results ".
More specifically, this data will be accessible:
-aux" Agents of the decentralised services of the State in charge of the examination of driving licences', ' Because of their duties and within the limits of the need to know " ;
-to the applicant for the examination of the driving licence, as regards the data concerning him directly;
-to the operator of the establishment or association approved under Articles L. 213-1 and L. 213-7, in relation to the data of candidates for The examination of the driver's licence attached to it.
The Commission considers that these addressees have a legitimate interest in accessing the data of the teleservice called " Results of the driving licence ".
On the information of persons:
The Commission takes note that the information of the persons concerned will be provided by a reference to the page" Legal notices " Of the dedicated website.
On rights of access, rectification and opposition of persons:
Article 5 of the draft decree states that the rights of access and rectification provided for in Articles 39 and 40 of the Law of 6 January 1978, as amended, shall be exercised with the delegation to safety and road
. Further observes that Article 6 of the draft decree expressly dismisses the application of the right of opposition for legitimate reasons provided for in Article 38 of the law of 6 January 1978 as amended.
On the security of data and the tractability of shares :
The Commission takes note of the teleservice " Results of driving licence " Complies with the general security repository, in accordance with the Decree n ° 2010-112.
The Commission considers that the measures taken to secure trade between the Server containing the results of the license and the remote service web server are satisfactory.
Finally, the Commission points out that the implementation of the teleservice " Results of driving licence " Must be made in accordance with article 32-II of the law of January 6, 1978, as amended and that in particular:
-no cookie not necessary for the service must be deposited on the user's computer, without the prior consent of this Last;
-must be indicated to users how to oppose the filing of cookies while continuing to benefit from the service; and
-the information notices must be complete and detail the purposes associated with the different Cookies deposited.
The President,
I. Falque-Pierrotin
