ACT 78-17 of 6 January 1978
on Data Processing, Data Files and Individual Liberties (*)
The National Assembly and the Senate have adopted,
The President of the Republic promulgates the following Act;
(*) Translation approved by the French Ministry of Justice
PRINCIPLES AND DEFINITIONS
PRINCIPLES AND DEFINITIONS
Data processing shall be at the service of every citizen. It shall develop in the context of international co-operation. It shall infringe neither human identity, nor the rights of man, nor privacy, nor individual or public liberties.
No judicial decision involving an appraisal of human conduct may be based on any automatic processing of data which describes the profile or personality of the person concerned.
No governmental or private decision involving an appraisal of human conduct may be based solely on any automatic processing of data which describes the profile or personnality of the person concerned.
Any person shall be entitled to know and to dispute the data and logic used in automatic processing the results of which are asserted against him.
For the purposes of this Act personal data which permit, in any form, directly or indirectly, the identification of the natural persons to which they relate, irrespective of whether the processing is done by a natural or legal person.
For the purposes of the Act the automatic processing of personal data means any series of operations effected by automatic means, involving the collection, recording, preparation, modification, storage and destruction of personal data as well as any series of such operations relating to the use of files or data bases, including interconnections or comparisons, the consultation or communication of personal data.
THE NATIONAL DATA PROCESSING AND LIBERTIES COMMISSION
A National Processing and Liberties Commission shall be established. It shall ensure observance of the provisions of this Act, inter alia, by informing all persons concerned of their rights and duties, co-operating with them and monitoring the application of data processing to personal data. For this purpose the Commission shall have authority to make regulations in the cases referred to in this Act.
The appropriations required by the national Commission for its operations shall be included in the budget of the Ministry of Justice. The provisions of the Audit Act of 10 August 1922 shall not apply to the administration thereof. The Commission's accounts shall be audited by the Cour des Comptes.
However, charges may be made to cover the costs of certain formalities mentioned in Sections 15, 16, 17 and 24 of this Act.
The National Data Processing and Liberties Commission shall be an independant governmental authority.
It shall consist of 17 members designated for five years or the duration of their term in office:
The Commission shall elect from its membership a Chairman and two Vice-Chairmen, for five years.
The Commission shall determine its own rules of procedure.
The Chairman shall have a casting vote.
If the Chairman or a member leaves the Commission before expiration of his term of office, his successor shall serve the Commission only for the unexpired part of such term.
The following may not be members of the Commission:
The Commission shall determine in each case such grounds for disqualifacation. Save for resignation, the term of office of a member may only be terminated by a finding by the Commission that he is disqualified under the rules which it has laid down.
A government representative appointed by the Prime Minister shall sit on the Commission.
He may within ten days after a matter has been discussed, call for a further meeting to reconsider it.
The Commission shall have staff under the control of the Chairman or, on delegation of authority, of a Vice-Chairman.
The Commission may delegate its powers under Sections 16, 17 and 21 (4), (5) and (6) to the Chairman or Vice-Chairman Delegate.
The employees of the National Commission are appointed by the Chairman or the Vice-Chairman Delegate.
The Commission may request the senior presiding judges of courts of appeal or the chief judges of administrative courts to assign a judge of their court, if necessary assisted by experts, to carry out investigations and inspections under its supervision.
The members and employees of the Commission shall be bound by a duty of secrecy regarding facts, documents or information with which tey may have become acquainted in the course of their duties, as provided by Article 75 of the Criminal Code and, subject to the requirements for preparation of the annual report referred to below, article 378 of the Criminal Code.
The members of the National Data Processing and Liberties Commission shall take no orders from any authority in the performance of their duties.
Computers specialists called on to provide information to the Commission or to testify before it shall be relieved insofar as need be from their duty of confidentiality.
FORMALITIES PRIOR TO COMMENCING AUTOMATIC DATA PROCESSING
The National Data Processing and Liberties Commission shall ensure that public or private automatic processing of personal data is carried out in accordance with this Act.
Aside from cases in which it must be authorized by law, the automatic processing of personal data on behalf of the State, a public establishment or territorial authorithy, or a private legal entity managing a public service, shall be authorized by a regulation adopted after obtaining the reasoned opinion of the National Data Processing and Liberties Commission
If the Commission's opinion is unfavorable, it may be disregarded only by a decree issued on the favorable opinion of the Conseil d'Etat or, in the case of a territorial authorithy, by a decision of its governing body approved by decree issued on the favorable opinion of the Conseil d'Etat.
If the Commission fails to notify its opinion within two months, which time may be extended for a like period once by the Chairman, such opinion shall be deemed to be favorable.
The automatic processing of a personal data on behalf of parties other than those who are subject to the provisions of Section 15 must, prior to commencement of operations, be declared to the national data Processing and Liberties Commission.
Such declaration shall entail an undertaking that the processing is in accordance with the law.
Upon receipt of the acknoledgement which the Commission shall issue forthwith, the applicant may proceed with processing. he shall be relieved of none of his liabilities or responsabilities.
For the most common types of public or private processing, which manifestly do not infringe privacy or liberties, the Commission shall set and publish simplified rules based on the characteristics set forth in Section 19.
For processing covered by such rules, only a simplified declaration of conformity to one of these rules shall be filed with the Commission. Unless otherwise decided by the Commission, the acknoledgement, the applicant may proceed with the processing. He shall relieved of none of his liabilities or responsabilities.
Use of the national identification index of natural persons with a view to processing of personal data may be authorized by order of the Conseil d'Etat after advice from the Commission.
The application for an opinion on the declaration must specify:
Any change in the particulars listed above or discontinuance of processing shall be reported to the Commission.
Some of the particulars listed above may be omitted from applications for opinions relating to the automatic processing of personal data affecting national security, defense or public safety.
The official decision authorizing processing under Section 15 above shall specify, inter alia:
Decrees made in the Conseil d'Etat may provide that the regulations relating to certain processing affecting national security, defense and public safety shall not be published.
For discharge of its supervisory, the Commission:
Ministers, public authorities, directors of public and private undertakings, heads of groups and associations and more generally holders or users of personal files may not oppose action by the Commission or its members for any reason, and instead shall take any step needed to facilitate its work.
The Commission shall make a list of processing activities available to the public, specifying in each case:
Rulings, opinions or recommendations of the Commission of use in the application or interpretation of this Act shall be kept available for the public as provided by decree.
The Commission shall submit a yearly report to the President of the Republic and to parliament on the discharge of its duties. This report shall be published.
The report shall describe, inter alia, the procedures and working methods of the Commission and shall contain in an appendix any information about the organization of the Commission and its departments which may facilitate relations of the public with the Commission.
On the proposal of or as advised by the Commission, the transmission between France and another country in any form of personal data subjected to automatic processing covered by Section 16 above may call for prior authorization or be regulated by decree made in the Conseil d'Etat, to ensure compliance with the principles laid down in this Act.
COLLECTION, RECORDING AND STORAGE OF PERSONAL DATA
Acquisition of data by any fraudulent, dishonest or illegal means is prohibited.
Any natural person is entitled to object, for due cause, to the processing of personal data concerning him.
This right shall not apply to processing limitately, designated in the regulation provided for in Section 15.
Persons from whom personal data are obtained must be informed:
When such data are obtained by questionnaires, these must mention the above requirements.
These provisions shall not apply to the collection of data requed for purposes of criminal investigation.
Unless otherwise provided by law, the data may not be stored in personal form beyond the period stated in the application for opinion or in the declaration, unless such storage is authorized by the Commission.
Any person processing personal data or ordering such processing thereby shall undertake, vis-a-vis the persons concerned to see that all necessary precautions are taken to protect the data and in particular to prevent these from being distorted, damaged or disdosed to unauthorized third part.
Unless otherwise provided by law, only the courts and public authorities acting within the scope of their legal powers and, on favorable opinion of the National Commission, legal persons managing a public service may engage in the automatic processing or personal data relating to criminal offenses, convictions or security measures.
Until implementation of the file of motor vehicle drivers provided by Act 70-539 of June 1970, insurance companies shall be authorized, under Commission supervision, to process themsleves the data mentioned in Section 5 of that Act relative to the persons covered by the last paragraph of such Section.
Without the party's express consent the recording or storage in a computer memory of personal data which directly or indirectly reflect racial origins or political, philosophical or religious opinions or union membership shall be prohibited.
Churches and religious, philosophical, political or union organizations may however keep records of their members or correspondents in computerized form. They are not subject to supervision in that connection.
On public policy grounds, other exceptions may be made to such prohibition on the Commission's proposal or favorable opinion, by decree made in the Conseil d'Etat.
Access to the voter list is given under identical conditions to candidates and political parties under the control of campaign commissions.
Sections 23, 30 and 31 shall not apply to personal data processed by press or broadcasting organizations under the laws governing them, if application of those sections would have the effect of restricting freedom of expression.
EXERCISE OF RIGHT OF ACCESS
Any person proving his identity shall be entitled to question the departments or organizations using automatic processing, a list of which shall be available to the public under Section 22 above, to determine whether such processing involves personal data concerning him, and if they do, to obtain access thereto.
The holder of such a right of access shall be entitled to obtain access to information concerning him. The information supplied to him shall be in clear language and shall conform to the contents of the records.
A copy shall be delivered to the holder of such a right of access on application against payment of a fixed charge varying according to the category of processing, the amount of which shall be fixed by Commission ruling and approved by Order of the Minister of Economy and Finance.
However, on application to the Commission with notice to the person requesting the data, the Commission may grant the person in charge of the file:
When there is reason to feat the concealment or disappearance of data mentioned in the first paragraph of this section, and even before commencement of legal proceedings, application may be made to the competent court to order ny appropriate measures for preventing such concealment or disappearance.
The holder of a right of access may require the correction, addition, clarification, updating or erasure of data concerning him which are inaccurate, incomplete, ambiguous, outdated or o which the acquisition, use, disclosure or storage is prohibited.
Upon request of the person concerned, the department or organization involved must issue a copy of the altered record without charge.
In the event of dispute, the onus of proof shall be on the department in relation to which the right of access is exercised, unless it appears that the disputed data were disclosed by or with the consent of the person concerned.
When the holder oa right of access has a record ??tered, the charge paid pursuant to Section 35 shall be refunded.
A personal file must be supplemented or corrected even ex proprio motu when the organization keeping it becomes aware of the inaccuracy or incompleteness of a personal item of data in such a file.
If an item of data has been sent to a third party, its correction or deletion must be notified to such party unless the Commission waives such a proceeding.
The regard to processing activities affecting national security, defense or public safety, the application shall be made to the Commission, which shall nominate one of its members who is or has been a member of the Conseil d'Etat, Cour de Cassation or Cour des Comptes, to conduct any appropriate investigations and order the necessary alterations. Such member may be assisted by a member of the Commission's staff.
The applicant shall be advised that checks have been made.
When exercise of a right of access applies to medical data, these may be disclosed to the person concerned only through a doctor designated by him for this purpose.
Whoever engages in the automatic processing of personal data, or has such data so processed without publication of the official decisions provided for in Section 15 or without filing the declarations as provided in Section 16 shall be imprisoned for six months to three years, or fined 2,000 to 200,000 francs, or both.
The court may also order publication of the judgment in full or in part in one or more newspapers, and public display thereof as it may determine, at the guilty party's cost.
Whoever records or causes to be recorded, stores or causes to be stored personal data contrary to Sections 25, 26 and 28-31 shall be imprisoned for one to five years, fined 20,000 to 2,000,000 francs, or both.
The court may also order publication of the judgment in full or in part in one or more newspapers and public display thereof as it may determine, at the guilty party's cost.
Any person who, in connection with recording, filing, transmittal or any other form of processing, obtains personal data, disclosure of whichwould impair reputation or standing or invade privacy, and who knowingly and without the authorization of the person concerned discloses such data to any party not authorized to receive them under this or any other Act, shall be imprisoned for two to six months, fined 2,000 to 20,000 francs, or both
Whoever imprudently or negligently discloses or allows disclosures of data described in the preceding paragraph shall be fined 2,000 to 20,000 francs.
Whoever, being in possession of personal data in connection with recording, filing, transmittal or other processing, uses the same for a purpose other than that specified in the regulations as provided under Section 15, or in the declarations made pursuant to Section 16 and 17, or in a statutory provision, shall be imprisoned for one to five years, and fined 20,000 to 2,000,000 francs.
The provisions of Sections 25, 27, 29, 30, 31, 32 and 33 relative to the acquisition, recording and storage of personal data shall apply to non-automated or mechanized files other than those involving strict exercise of the right of privacy.
The first paragraph of Section 26 shall apply to same files, except public files designated by official decision.
Any person providing his identity shall be entitled to question departments or organizations keeping files mentioned in the first paragraph of this Section to determine whether such files contain personal data concerning him. The holder of a right of access shall be entitled to obtain access to such data; he may require compliance with the first three paragraphs of Section 36 of this Act relative to the right of correction. Section 37, 38, 39 and 40 shall also apply. A decree made in the Conseil d'Etat shall fix the conditions of exercise of the right of access and correction; such decree may provide for the collection of charges for issuing copies of the data disclosed.
On recommendation of the National Commission for Data Processing and Liberties, the Government may, by decree made in the Conseil d'Etat, decide that the other provisions of this Act may, in whole or in part, be applied to a file or categories of files which are non-automated or mechanized and which, by themselves or used in combination with a computerized file, threaten civil liberties.
Decrees made in the Conseil d'Etat shall specify arrangements for giving effect to this Act. They shall be enacted within six months of promulgation hereof.
Such decrees shall fix the time, when the provisions of this Act shall take effect. Such time shall not exceed two years after the promulgation of this Act.
This Act shall apply in Mayotte and the overseas territories.
As a transitional measure, processing covered by Section 15 above and already effective shall only be subject to a declaration to the National Commission for Data Processing and Liberties as provided in Sections 16 and 17.
The Commission may, however, by special ruling, apply Section 15 and fix the time within which the regulation covering processing must be adopted.
Two years after the promulgation of this Act, all processing covered by Section 15 shall comply with the requirements of such Section.
This Act shall be enforced as an Act of the State.
Paris, 6 January 1978.
The Prime Minister,
The Minister of Interior,
The Deputy Minister of Economy and Finance,
The Minister of Education,
The Minister of Labor,