ACT 78-17 of 6 January 1978
on Data Processing, Data Files and Individual Liberties (*)
(*) Translation approved by the French Ministry of Justice
No governmental or private decision involving an appraisal of human conduct
may be based solely on any automatic processing of data which describes the
profile or personnality of the person concerned.
However, charges may be made to cover the costs of certain formalities
mentioned in Sections 15, 16, 17 and 24 of this Act.
It shall consist of 17 members designated for five years or the duration of
their term in office:
The Commission shall determine its own rules
of procedure.
The Chairman shall have a casting vote.
If the Chairman or a member leaves the Commission before expiration of his
term of office, his successor shall serve the Commission only for the
unexpired part of such term.
The following may not be members of the Commission:
He may within ten days after a matter has been discussed, call for a further
meeting to reconsider it.
The Commission may delegate its powers under Sections 16, 17 and 21 (4),
(5) and (6) to the Chairman or Vice-Chairman Delegate.
The employees of the National Commission are appointed by the Chairman or
the Vice-Chairman Delegate.
Computers specialists called on to provide information to the Commission or
to testify before it shall be relieved insofar as need be from their duty of
confidentiality.
If the Commission's opinion is unfavorable, it may be disregarded only by a
decree issued on the favorable opinion of the Conseil d'Etat or, in the case
of a territorial authorithy, by a decision of its governing body approved by
decree issued on the favorable opinion of the Conseil d'Etat.
If the Commission fails to notify its opinion within two months, which time
may be extended for a like period once by the Chairman, such opinion shall
be deemed to be favorable.
Such declaration shall entail an undertaking that the processing is in
accordance with the law.
Upon receipt of the acknoledgement which the Commission shall issue
forthwith, the applicant may proceed with processing. he shall be relieved
of none of his liabilities or responsabilities.
For processing covered by such rules, only a simplified declaration of
conformity to one of these rules shall be filed with the Commission. Unless
otherwise decided by the Commission, the acknoledgement, the applicant may
proceed with the processing. He shall relieved of none of his liabilities or
responsabilities.
Some of the particulars listed above may be omitted from applications for
opinions relating to the automatic processing of personal data affecting
national security, defense or public safety.
The report shall describe, inter alia, the procedures and working methods of
the Commission and shall contain in an appendix any information about the
organization of the Commission and its departments which may facilitate
relations of the public with the Commission.
This right shall not apply to processing limitately, designated in the
regulation provided for in Section 15.
These provisions shall not apply to the collection of data requed for
purposes of criminal investigation.
Until implementation of the file of motor vehicle drivers provided by Act
70-539 of June 1970, insurance companies shall be authorized, under
Commission supervision, to process themsleves the data mentioned in Section
5 of that Act relative to the persons covered by the last paragraph of such
Section.
Churches and religious, philosophical, political or union organizations may
however keep records of their members or correspondents in computerized
form. They are not subject to supervision in that connection.
On public policy grounds, other exceptions may be made to such prohibition
on the Commission's proposal or favorable opinion, by decree made in the
Conseil d'Etat.
A copy shall be delivered to the holder of such a right of access on
application against payment of a fixed charge varying according to the
category of processing, the amount of which shall be fixed by Commission
ruling and approved by Order of the Minister of Economy and Finance.
However, on application to the Commission with notice to the person
requesting the data, the Commission may grant the person in charge of the
file:
Upon request of the person concerned, the department or organization
involved must issue a copy of the altered record without charge.
In the event of dispute, the onus of proof shall be on the department in
relation to which the right of access is exercised, unless it appears that
the disputed data were disclosed by or with the consent of the person
concerned.
When the holder oa right of access has a record ??tered, the charge paid
pursuant to Section 35 shall be refunded.
The applicant shall be advised that checks have been made.
The court may also order publication of the judgment in full or in part in
one or more newspapers, and public display thereof as it may determine, at
the guilty party's cost.
The court may also order publication of the judgment in full or in part in
one or more newspapers and public display thereof as it may determine, at
the guilty party's cost.
Whoever imprudently or negligently discloses or allows disclosures of data
described in the preceding paragraph shall be fined 2,000 to 20,000 francs.
The first paragraph of Section 26 shall apply to same files, except public
files designated by official decision.
Any person providing his identity shall be entitled to question departments
or organizations keeping files mentioned in the first paragraph of this
Section to determine whether such files contain personal data concerning
him. The holder of a right of access shall be entitled to obtain access to
such data; he may require compliance with the first three paragraphs of
Section 36 of this Act relative to the right of correction. Section 37, 38,
39 and 40 shall also apply. A decree made in the Conseil d'Etat shall fix
the conditions of exercise of the right of access and correction; such
decree may provide for the collection of charges for issuing copies of the
data disclosed.
On recommendation of the National Commission for Data Processing and
Liberties, the Government may, by decree made in the Conseil d'Etat, decide
that the other provisions of this Act may, in whole or in part, be applied
to a file or categories of files which are non-automated or mechanized and
which, by themselves or used in combination with a computerized file,
threaten civil liberties.
Such decrees shall fix the time, when the provisions of this Act shall take
effect. Such time shall not exceed two years after the promulgation of this
Act.
The Commission may, however, by special ruling, apply Section 15 and fix the
time within which the regulation covering processing must be adopted.
Two years after the promulgation of this Act, all processing covered by
Section 15 shall comply with the requirements of such Section.
This Act shall be enforced as an Act of the State.
Paris, 6 January 1978.
The Minister of Interior,
The Deputy Minister of Economy and Finance,
The Minister of Education,
The Minister of Labor,
CHAPTER I
PRINCIPLES AND DEFINITIONS
SECTION 1.
Data processing shall be at the service of every citizen. It
shall develop in the context of international co-operation. It shall
infringe neither human identity, nor the rights of man, nor privacy, nor
individual or public liberties.
SECTION 2.
No judicial decision involving an appraisal of human conduct may
be based on any automatic processing of data which describes the profile or
personality of the person concerned.SECTION 3.
Any person shall be entitled to know and to dispute the data and
logic used in automatic processing the results of which are asserted against
him.
SECTION 4.
For the purposes of this Act personal data which permit, in any
form, directly or indirectly, the identification of the natural persons to
which they relate, irrespective of whether the processing is done by a
natural or legal person.
SECTION 5.
For the purposes of the Act the automatic processing of personal
data means any series of operations effected by automatic means, involving
the collection, recording, preparation, modification, storage and
destruction of personal data as well as any series of such operations
relating to the use of files or data bases, including interconnections or
comparisons, the consultation or communication of personal data.
CHAPTER II
THE NATIONAL DATA PROCESSING AND LIBERTIES COMMISSION
SECTION 6.
A National Processing and Liberties Commission shall be
established. It shall ensure observance of the provisions of this Act, inter
alia, by informing all persons concerned of their rights and duties,
co-operating with them and monitoring the application of data processing to
personal data. For this purpose the Commission shall have authority to make
regulations in the cases referred to in this Act.
SECTION 7.
The appropriations required by the national Commission for its
operations shall be included in the budget of the Ministry of Justice. The
provisions of the Audit Act of 10 August 1922 shall not apply to the
administration thereof. The Commission's accounts shall be audited by the
Cour des Comptes. SECTION 8.
The National Data Processing and Liberties Commission shall be an
independant governmental authority.
The Commission shall elect from its membership a Chairman and two
Vice-Chairmen, for five years.
The Commission shall determine in each case such grounds for
disqualifacation. Save for resignation, the term of office of a member may
only be terminated by a finding by the Commission that he is disqualified
under the rules which it has laid down.
SECTION 9.
A government representative appointed by the Prime Minister shall
sit on the Commission.SECTION 10.
The Commission shall have staff under the control of the
Chairman or, on delegation of authority, of a Vice-Chairman.SECTION 11.
The Commission may request the senior presiding judges of courts
of appeal or the chief judges of administrative courts to assign a judge of
their court, if necessary assisted by experts, to carry out investigations
and inspections under its supervision.
SECTION 12.
The members and employees of the Commission shall be bound by a
duty of secrecy regarding facts, documents or information with which tey may
have become acquainted in the course of their duties, as provided by Article
75 of the Criminal Code and, subject to the requirements for preparation of
the annual report referred to below, article 378 of the Criminal Code.
SECTION 13.
The members of the National Data Processing and Liberties
Commission shall take no orders from any authority in the performance of
their duties.CHAPTER III
FORMALITIES PRIOR TO COMMENCING AUTOMATIC DATA PROCESSING
SECTION 14.
The National Data Processing and Liberties Commission shall
ensure that public or private automatic processing of personal data is
carried out in accordance with this Act.
SECTION 15.
Aside from cases in which it must be authorized by law, the
automatic processing of personal data on behalf of the State, a public
establishment or territorial authorithy, or a private legal entity managing
a public service, shall be authorized by a regulation adopted after
obtaining the reasoned opinion of the National Data Processing and Liberties
CommissionSECTION 16.
The automatic processing of a personal data on behalf of parties
other than those who are subject to the provisions of Section 15 must, prior
to commencement of operations, be declared to the national data Processing
and Liberties Commission.SECTION 17.
For the most common types of public or private processing, which
manifestly do not infringe privacy or liberties, the Commission shall set
and publish simplified rules based on the characteristics set forth in
Section 19.SECTION 18.
Use of the national identification index of natural persons with
a view to processing of personal data may be authorized by order of the
Conseil d'Etat after advice from the Commission.
SECTION 19.
The application for an opinion on the declaration must specify:
Any change in the particulars listed above or discontinuance of processing
shall be reported to the Commission.SECTION 20.
The official decision authorizing processing under Section 15
above shall specify, inter alia:
Decrees made in the Conseil d'Etat may provide that the regulations relating
to certain processing affecting national security, defense and public safety
shall not be published.
SECTION 21.
For discharge of its supervisory, the Commission:
Ministers, public authorities, directors of public and private undertakings,
heads of groups and associations and more generally holders or users of
personal files may not oppose action by the Commission or its members for
any reason, and instead shall take any step needed to facilitate its work.
SECTION 22.
The Commission shall make a list of processing activities
available to the public, specifying in each case:
Rulings, opinions or recommendations of the Commission of use in the
application or interpretation of this Act shall be kept available for the
public as provided by decree.
SECTION 23.
The Commission shall submit a yearly report to the President of
the Republic and to parliament on the discharge of its duties. This report
shall be published.SECTION 24.
On the proposal of or as advised by the Commission, the
transmission between France and another country in any form of personal data
subjected to automatic processing covered by Section 16 above may call for
prior authorization or be regulated by decree made in the Conseil d'Etat, to
ensure compliance with the principles laid down in this Act.
CHAPTER IV
COLLECTION, RECORDING AND STORAGE OF PERSONAL DATA
SECTION 25.
Acquisition of data by any fraudulent, dishonest or illegal
means is prohibited.
SECTION 26.
Any natural person is entitled to object, for due cause, to the
processing of personal data concerning him.SECTION 27.
Persons from whom personal data are obtained must be informed:
When such data are obtained by questionnaires, these must mention the above
requirements.SECTION 28.
Unless otherwise provided by law, the data may not be stored in
personal form beyond the period stated in the application for opinion or in
the declaration, unless such storage is authorized by the Commission.
SECTION 29.
Any person processing personal data or ordering such processing
thereby shall undertake, vis-a-vis the persons concerned to see that all
necessary precautions are taken to protect the data and in particular to
prevent these from being distorted, damaged or disdosed to unauthorized
third part.
SECTION 30.
Unless otherwise provided by law, only the courts and public
authorities acting within the scope of their legal powers and, on favorable
opinion of the National Commission, legal persons managing a public service
may engage in the automatic processing or personal data relating to criminal
offenses, convictions or security measures.SECTION 31.
Without the party's express consent the recording or storage in
a computer memory of personal data which directly or indirectly reflect
racial origins or political, philosophical or religious opinions or union
membership shall be prohibited.SECTION 32.
Access to the voter list is given under identical conditions to
candidates and political parties under the control of campaign commissions.
SECTION 33.
Sections 23, 30 and 31 shall not apply to personal data
processed by press or broadcasting organizations under the laws governing
them, if application of those sections would have the effect of restricting
freedom of expression.
CHAPTER V
EXERCISE OF RIGHT OF ACCESS
SECTION 34.
Any person proving his identity shall be entitled to question
the departments or organizations using automatic processing, a list of which
shall be available to the public under Section 22 above, to determine
whether such processing involves personal data concerning him, and if they
do, to obtain access thereto.
SECTION 35.
The holder of such a right of access shall be entitled to obtain
access to information concerning him. The information supplied to him shall
be in clear language and shall conform to the contents of the records.
When there is reason to feat the concealment or disappearance of data
mentioned in the first paragraph of this section, and even before
commencement of legal proceedings, application may be made to the competent
court to order ny appropriate measures for preventing such concealment or
disappearance.
SECTION 36.
The holder of a right of access may require the correction,
addition, clarification, updating or erasure of data concerning him which
are inaccurate, incomplete, ambiguous, outdated or o which the acquisition,
use, disclosure or storage is prohibited.SECTION 37.
A personal file must be supplemented or corrected even ex proprio
motu when the organization keeping it becomes aware of the inaccuracy or
incompleteness of a personal item of data in such a file.
SECTION 38.
If an item of data has been sent to a third party, its
correction or deletion must be notified to such party unless the Commission
waives such a proceeding.
SECTION 39.
The regard to processing activities affecting national security,
defense or public safety, the application shall be made to the Commission,
which shall nominate one of its members who is or has been a member of the
Conseil d'Etat, Cour de Cassation or Cour des Comptes, to conduct any
appropriate investigations and order the necessary alterations. Such member
may be assisted by a member of the Commission's staff.SECTION 40.
When exercise of a right of access applies to medical data,
these may be disclosed to the person concerned only through a doctor
designated by him for this purpose.
CHAPTER VI
PENAL PROVISIONS
SECTION 41.
Whoever engages in the automatic processing of personal data, or
has such data so processed without publication of the official decisions
provided for in Section 15 or without filing the declarations as provided in
Section 16 shall be imprisoned for six months to three years, or fined 2,000
to 200,000 francs, or both.
SECTION 42.
Whoever records or causes to be recorded, stores or causes to be
stored personal data contrary to Sections 25, 26 and 28-31 shall be
imprisoned for one to five years, fined 20,000 to 2,000,000 francs, or both.
SECTION 43.
Any person who, in connection with recording, filing,
transmittal or any other form of processing, obtains personal data,
disclosure of whichwould impair reputation or standing or invade privacy,
and who knowingly and without the authorization of the person concerned
discloses such data to any party not authorized to receive them under this
or any other Act, shall be imprisoned for two to six months, fined 2,000 to
20,000 francs, or both
SECTION 44.
Whoever, being in possession of personal data in connection with
recording, filing, transmittal or other processing, uses the same for a
purpose other than that specified in the regulations as provided under
Section 15, or in the declarations made pursuant to Section 16 and 17, or in
a statutory provision, shall be imprisoned for one to five years, and fined
20,000 to 2,000,000 francs.
CHAPTER VII
MISCELLANEOUS
SECTION 45.
The provisions of Sections 25, 27, 29, 30, 31, 32 and 33
relative to the acquisition, recording and storage of personal data shall
apply to non-automated or mechanized files other than those involving strict
exercise of the right of privacy.
SECTION 46.
Decrees made in the Conseil d'Etat shall specify arrangements
for giving effect to this Act. They shall be enacted within six months of
promulgation hereof.SECTION 47.
This Act shall apply in Mayotte and the overseas territories.
SECTION 48.
As a transitional measure, processing covered by Section 15
above and already effective shall only be subject to a declaration to the
National Commission for Data Processing and Liberties as provided in
Sections 16 and 17.
The Prime Minister,
RAYMOND BARRE
CHRISTIAN BONNET
ROBERT BOULIN
RENE HABY
CHRISTIAN BEULLAC