PRIVACY AND PROCESSING OF PERSONAL DATA - …

1 PRIVACY AND PROCESSING OF PERSONAL DATASUMMARYWhat is data protection?6 _The 10 commandmentsof PERSONAL data protection10 _Your rightsas a citizen18 _How and when can you enforce your rights?22 _The role of Commission nationale pour la protection des donn esto arbitrate26 _Data protection glossary28 _6_ WHAT IS data PROTECTION?In the information society, there are numerousorganisations and institutions collecting moreand more information about individuals. We all disclose PERSONAL information, voluntarilyor not, to a multitude of organisations, for exam-ple, to:_local or government authorities (permits,licences, grants);_tax authorities (tax return);_doctors and pharmacies (consultations andprescriptions);_health insurance funds (claims);_banks (loan applications and credit card statements);_supermarkets (loyalty cards and lotteries);_mobile phone operators, post and telecommu-nication services (telephone communications);_sports clubs, cultural and leisure organisa-tions (membership cards).

2 _or simply when browsing the Internet, or evenspending the afternoon shopping because ofthe recordings of surveillance this way, the circulation of our PERSONAL datais growing and spreading to more and to modern computing techniques, this datacan now be exploited more easily and in a varietyof ways, either by the State and its authorities, bycompanies and professionals, or by clubs building of PERSONAL profiles which revealour life style and consumer habits is becominga common practice (surveys, customer cards,Internet, etc).Whether data is collected or recorded, consultedor disclosed to third parties, there are real andconstant risks for the identifiable person, result-ing from this accumulation and exploitation ofpersonal , loss of control over your PERSONAL dataand unwarranted intrusion into your private life arenot inevitable, far from it.

3 The law of 2nd August2002which transposes a European Directiverelating to data protection1affords you certainrights. The law aims at protecting the PRIVACY ofindividuals (and so even the interest of corporatebodies) with regard to the PROCESSING of theirpersonal data by third authorities, companies, professionals, asso-ciations and other organisations who collect,record, use and disclose PERSONAL data cannotdo so without restrictions. They must notify theidentifiable person ( data subject ) and informthem of the purpose of what the law calls theprocessing of PERSONAL data . This processingmust be limited to what is necessary and pro-portionate to the aims stipulated at the must therefore always be used in accor-dance with strict rules, under the supervision of the Commission nationale de protection desdonn es2.

4 To ensure transparency, any filing system must previously be either declared orauthorised (depending on the type of data andprocessing).The legislation on the protection of PERSONAL datadoes not only apply to computer files, but cov-ers every kind of medium (paper files, audio andvideo recordings).1(Directive 95/46/EC dated 24 October 1995) IS data PROTECTION?The protection of PRIVACY is a fundamental right,just like the inviolability of the home, the confi-dentiality of correspondence and freedoms ofopinion and expression. The same principles apply in all 25 MemberStates of the European Union and beyond(Switzerland, Norway, Liechtenstein, Iceland,etc).

5 10_ THE 10 COMMANDMENTS OF PERSONAL data PROTECTIONT hose who process PERSONAL data con-cerning other people must comply withto the following PRINCIPLE OF LEGITIMACYThe PROCESSING of PERSONAL data is allowed onlyif there is a legitimate reason to justify it. Anyonewho wants to process data concerning you mustask for your consent beforehand. data process-ing is also permitted if it is essential in order tofulfil a contract, a task in the public interest or alegal obligation, or to protect your life. Finally,the PROCESSING can be legitimate if there is a jus-tified interest, provided the PROCESSING of yourdata has only a minimal effect on your first criterion is used to determine whetherthe PROCESSING is legal.

6 It answers the questionof whenyour data can be requested and next principles describe the rules that mustbe observed when PROCESSING your data . Theyanswer the question of howyour data can PRINCIPLE OF PURPOSEThe use of your PERSONAL data (including imagesand sounds) must be rigorously confined to apurpose which has been explicitly collection, recording and use of your per-sonal data are strictly limited to what is neces-sary to achieve the aims specifically declared inadvance by the authority, agency, company,association, professional or self-employed users cannot disclose the data to otherorganisations or people, unless it is needed toaccomplish the same an accident at work, your employertries to find out about your state of health fromyour GP.

7 Thinking she is doing the right thing inreassuring him, the doctor s assistant providesinformation on the doctor s doing so, she is transgressing the pur-pose for which the medical practice holdsthis information, in order to providehealth PRINCIPLES OF NECESSITY AND PROPORTIONALITYThe principle of proportionality ensures that theprocessing of your PERSONAL data is limited tocases where there is a direct connection with theinitial purpose of the PROCESSING . The informa-tion must not only be useful, but also necessaryto whoever is PROCESSING your data . The databeing processed must not be excessive in rela-tion to the aim booking a table at a restaurant by tele-phone, the manager of the establishment asksyou to supply your credit card information should be regarded asexcessive in relation to the aim being pur-sued, which is only to arrange 10 COMMANDMENTSOF PERSONAL data PRINCIPLE OF THE ACCURACY OF DATAAs inaccurate or incomplete information canharm the person to whom it relates, every effortmust be made to ensure the data beingprocessed is correct and up-to-date.

8 If this is notthe case, the PERSONAL data must be rectified law also protects you against any negativedecision automatically taken about you by acomputer, without you being able to put forwardyour PERSONAL point of are applying to your bank for a personalloan to buy some furniture. After submittingyour application via the Internet, you immedi-ately receive a negative reply from your bankwhich refuses to grant you the requested transpires that no bank adviser has beeninvolved, but that your application has beenassessed using a software which evaluatedyour request upon pre-established ratios this event, you have the right to insiston your application being re-examined onthe basis of an interview with your bankadviser who should listen to your this interview, you might point out,for example, that your financial situationhas recently improved thanks to an inher-itance.

9 It could even be possible that thefigures used were incorrect or that therewas a mix-up with a debt-ridden person ofthe same PRINCIPLE OF FAIRNESSYour PERSONAL data must be collected, recorded,used and communicated fairly, and with , your data must be erased or renderedanonymous as quickly as possible. Subsequentuse of your PERSONAL data for purposes otherthan those stipulated from the outset, is prohib-ited as a supermarket offers you a loyalty card togive you special discounts on your shopping oran end-of-year rebate. As you subsequentlypass through the checkout, the contents ofyour basket are recorded and used to build aconsumer profile, which will be monitored on aregular this is done without your knowledge,and if you weren t informed about it whensigning up, the principle of fairness hasbeen PRINCIPLE OF SECURITY AND CONFIDENTIALITYYour PERSONAL data must be processed in a con-fidential manner and stored in safe forms the event of non-compliance with this principle,the person who processes your data assumespersonal responsibility.

10 This includes the indi-vidual behaviour of employees, and contractsentered into with subcontractors (suppliers forinstance) as well as the choice of technicalequipment (in terms of computer security).You want to change your mobile phone net-work. However, having looked at your applica-tion, the sales consultant of the company youhave just chosen refuses to accept you as a new client. This person, who used to workas a sales agent for your previous GSM opera-tor, refers to a dispute over a bill which you hadwith the first allowing its sales agents to obtaininformation from its accounts department,your previous GSM operator failed toensure that PERSONAL information on itsclients could only be accessed by thoseemployees really needing it for their work.