CE - 439360

CE - 439360
Court:	CE (France)
Jurisdiction:	France
Relevant Law:	Article 5 GDPR Article 15 Directive (UE) 2016/680 Article 8 Charter of Fundamental Rights of the Europan Union Article 121 Directive (UE) 2016/680 Article 107 Loi Informatique et Libertés Article 110 Loi Informatique et Libertés Article 22 French Constitution of 1958 Article 31(II) Loi Informatique et Libertés Article 4 Loi Informatique et Libertés Article 6 Loi Informatique et Libertés Article 87 Loi Informatique et Libertés Article 88 Loi Informatique et Libertés Article 89 Loi Informatique et Libertés Article 98 Loi Informatique et Libertés Article L761-1 Code of administrative justice
Decided:	13.04.2021
Published:
Parties:	ADHEOS AIDES Association Mousse Familles-A Homosexualités et socialismes Internet Society France La Ligue des droits de l'homme La Quadrature du Net Stop Homophobie Syndicat de la magistrature Syndicat des avocats de France La Ligue Internationale Contre le Racisme et l'Antisémitisme
National Case Number/Name:	439360
European Case Law Identifier:	ECLI:FR:CECHR:2021:439360.20210413
Appeal from:
Appeal to:	Not appealed
Original Language(s):	French
Original Source:	Legifrance (in French)
Initial Contributor:	Roka

The French Highest Administrative Court invalidated part of a decree adopted by the Interior Ministry for infringing the GDPR, Convention 108 and Article 8 of the Charter of Fundamental Rights of the European Union. The decree authorised the collect and processing of special category data when necessary for judicial or administrative police activities, for preventive actions, investigatory or interventions.

English Summary

Facts

In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile note-taking application" (Décret n° 2020-151 du 20 février 2020 portant autorisation d'un traitement automatisé de données à caractère personnel dénommé «application mobile de prise de notes» (GendNotes)).

The app should be used on the occasion of preventive actions, investigations or interventions necessary for the exercise of judicial or administrative police missions. Among the data that can be collected is information relating to alleged racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sexual activities or orientation.

A group of human rights organisations filed a complaint with the French Constitutional Court.

Dispute

Is the "GendNotes" App of the French national police force (Gendarmerie nationale) unlawfully processing special category personal data?

Holding

The French Highest Administrative Court held that the decree infringed Article 4 of the Law of 6 January 1978, implementing GDPR in France, the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and Article 8 of the Charter of Fundamental Rights of the European Union, as it excessively infringed upon the right to respect for private life and the correlative right to protection of personal data, without providing appropriate safeguards for their protection in terms of the purpose of the processing and the nature of the data collected, as well as excessive data retention period, data sharing and data security.

The Court discussed whether the decree violated Article 4 GDPR, (a), (b), (c), and (e) and Article 9 GDPR.

According to the Court, the processing of data did not comply with the principle of purpose limitation, as data is collected for future investigations or proceedings. However, the Court did not find a violation on the collect of special category data, given the fact that the decree establishes that this data can only be processed in case of "absolute necessity".

Additionally, the Court noted that, even if the decree provides a limitation for the storage of the data, in practice this can be ignored, as the data may be used in different or further investigations, that would impede its erasure. However, they found that the decree was lawful in this regard, given that it clearly stated a retention period of 3 months to 1 year.

Taken the above-mentioned into account, the French Highest Administrative Court decided that the data processed by the French national police force can no longer be used "in other data processing, in particular by means of a pre-information system".

Therefore, the Court held:

1. In Article 1° of the decree, the words "in other data processing, in particular by means of a pre-information system," are cancelled out.
2. The State will pay €3000 to every claimant.
3. The rest of the application is rejected. The allowance to collect special category data is not overruled, as the Court argues that the decree only allows it when it is "absolutely necessary".
4. This decision will be notified to the claimants: the Ligue des droits de l'homme, the associations Homosexualités et socialismes and Internet Society France, the associations Mousse, Stop Homophobie, Adheos and Familles A, the association AIDES, the Syndicat de la magistrature, the Syndicat des avocats de France, the Conseil national des barreaux, the Quadrature du Net and the International League against Racism and Anti-Semitism, the Prime Minister and the Minister of the Interior.

Comment

Share your comments here!

Further Resources

• Official Press release by the French constitutional court (in FR): Le Conseil d’État annule la possibilité de transférer les données de l’application GendNotes vers d’autres fichiers
• Le Monde (in FR): Le Conseil d’Etat retoque en partie GendNotes, une application de collecte de données destinée à la gendarmerie

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

FRENCH REPUBLIC

IN THE NAME OF THE FRENCH PEOPLE

Having regard to the following proceedings:

1° Under number 439360, by a summary application and a supplementary memorandum, registered on 6 March and 8 June 2020 at the Secretariat of the Litigation Division of the Council of State, the association "La Ligue des droits de l'homme" asks the Council of State:

1°) to annul for excess of power the decree n° 2020-151 of 20 February 2020 authorising an automated processing of personal data called "Mobile note-taking application" (GendNotes) ;

2°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice.

2° Under number 440978, by a request and a reply brief, registered on 2 June 2020 and 9 March 2021 at the Secretariat of the Litigation Division of the Council of State, the associations Homosexualités et Socialismes and Internet Society France asked the Council of State

1°) to annul for excess of power the decree n° 2020-151 of 20 February 2020 authorising an automated processing of personal data called "Mobile note-taking application" (GendNotes) ;

2°) to charge the State with the sum of 3,000 euros to be paid to each of the associations under Article L. 761-1 of the Administrative Justice Code.

....................................................................................

3° Under number 441151, by a request and a reply registered on 12 June 2020 and 23 March 2021 at the Secretariat of the Litigation Division of the Council of State, the associations Mousse, Stop Homophobia, ADHEOS and Familles-A... are asking the Council of State

1°) to annul for excess of power the decree n° 2020-151 of 20 February 2020 authorising an automated processing of personal data called "Mobile note-taking application" (GendNotes);

2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.

....................................................................................

4° Under number 442307, by a request registered on 30 July 2020 at the Secretariat of the Litigation Division of the Council of State, the association AIDES, the Syndicat de la magistrature and the Syndicat des avocats de France request the Council of State

1°) to annul Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data called "Mobile note-taking application" (GendNotes) on the grounds of excess of power;

2°) to charge the State the sum of 4,000 euros under Article L. 761-1 of the Code of Administrative Justice.

....................................................................................

He maintained that the contested decree infringed Article 4 of the Law of 6 January 1978, Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and Article 8 of the Charter of Fundamental Rights of the European Union in that it excessively infringed the right to respect for private life and the correlative right to protection of personal data, without providing appropriate safeguards for their protection in terms of the purpose of the processing and the nature of the data collected, but also in terms of the length of time the data are kept, the control of the recipients of the data collected and security.

....................................................................................

6° Under number 442363, by a summary application, a supplementary statement and a statement in reply registered on 2 August and 3 November 2020 and 26 March 2021 with the Secretariat of the Litigation Division of the Council of State, the association "La Quadrature du Net" asks the Council of State:

1°) to annul for excess of power the decree n° 2020-151 of 20 February 2020 authorising an automated processing of personal data called "Mobile note-taking application" (GendNotes);

2°) to enjoin the Minister of the Interior to proceed with the deletion of the data collected since the entry into force of this decree, under a penalty of 1,024 euros per day of delay;

3°) to charge the State the sum of 4,096 euros under Article L. 761-1 of the Administrative Justice Code.

....................................................................................

7° Under number 443239, by a request registered on 24 August 2020 at the Secretariat of the Litigation Division of the Council of State, the association "La Ligue Internationale Contre le Racisme et l'Antisémitisme" asks the Council of State:

1°) primarily, to annul on the grounds of excess of power decree no. 2020-151 of 20 February 2020 authorising automated processing of personal data called "Mobile note-taking application" (GendNotes);

2°) in the alternative, to annul the last paragraph of Article 2 of this decree authorising the collection of sensitive data;

3°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice.

....................................................................................

Having regard to the other documents in the files;

Having regard to :

- the Constitution, in particular its Preamble;

- the European Convention for the Protection of Human Rights and Fundamental Freedoms;

- Convention No. 108 of 28 January 1981 of the Council of Europe for the protection of individuals with regard to automatic processing of personal data;

- the International Convention on the Rights of the Child

- the Treaty on European Union;

- the Charter of Fundamental Rights of the European Union;

- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016;

- Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016;

- Organic law n° 2011-833 of 29 March 2011;

- Law no. 78-17 of 6 January 1978;

- the Code of Administrative Justice and Decree no. 2020-1406 of 18 November 2020;

After hearing in public session :

- the report by Ms Myriam Benlolo-Carabot, maître des requêtes en service extraordinaire,

- the conclusions of Mr Alexandre Lallet, public rapporteur;

SCP Spinosi, lawyer for the Ligue des droits de l'homme, SCP Sevaux, Mathonnet, lawyer for the association Aides, the Syndicat de la magistrature and the Syndicat des avocats de France, and SCP Boré, Salve de Bruneton, Mégret, lawyer for the Conseil national des barreaux, were given the floor after the conclusions;

Considering the following:

1. The applications by the Ligue des droits de l'homme, the associations Homosexualités et socialismes and Internet Society France, the associations Mousse, Stop Homophobie, Adheos and Familles A... , the association AIDES, the Syndicat de la magistrature and the Syndicat des avocats de France, the Conseil national des barreaux, the Quadrature du Net and the Ligue internationale contre le racisme et l'antisémitisme are directed against the same decree of 20 February 2020 authorising the automated processing of personal data called "Mobile note-taking application" (GendNotes) They should be joined in order to give a ruling in the same decision.

2. The contested decree authorises the Minister of the Interior to implement an automated processing of personal data called "Mobile Note-taking Application" (GendNotes), the purpose of which, under the terms of its Article 1, is to "1, 1° To facilitate the collection and storage, with a view to their use in other data processing, in particular by means of a pre-intelligence system, of information collected by members of the national gendarmerie during preventive actions, investigations or interventions necessary for the exercise of judicial and administrative police missions; / 2° To facilitate the transmission of reports to the judicial authorities. According to Article 2 of the contested decree: "Personal data and information (...) relating to ) relating to: 1° All elements relating to persons, places or objects which are collected in the context of interventions by members of the national gendarmerie or in the performance of their duties; / 2° All elements of the procedure which are transmitted to magistrates during police custody or during the processing of certain offences relating to the traffic police. / (...) The collection and processing of personal data of the kind mentioned in Article 6(I) of the aforementioned Act of 6 January 1978 relating to alleged racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sex life or sexual orientation is only possible where absolutely necessary for the sole purpose and in strict compliance with the conditions defined in this decree, within the limits of the requirements of the mission under which they are collected.

On the external legality of the contested decree :

3. Firstly, Article 89 of the Law of 6 January 1978 provides: "(...) II.- If the processing relates to data mentioned in Article 6 I, it is provided for by a legislative or regulatory provision adopted under the conditions set out in Article 31 II". Under the terms of II of Article 31 of the same law: "Those processing operations that concern the data mentioned in I of Article 6 are authorised by decree in the Council of State issued after a reasoned and published opinion from the Commission. This opinion shall be published together with the decree authorising the processing. It follows from these provisions that the competence of the regulatory authority to authorise the processing described in point 2 by decree in the Council of State is provided for by the Law of 6 January 1978. The plea that the Prime Minister lacked competence to adopt the contested decree can therefore only be rejected.

4. Secondly, it is clear from the documents placed on file by the Minister for the Interior, in particular the copy of the minutes of the Council of State's Interior Section, that the decree of 20 February 2020 authorising the automated processing of personal data known as the "Mobile Note-taking Application" (GendNotes) does not contain any provision that differs from both the Government's initial draft and the text adopted by the Interior Section. Consequently, the applicants are not entitled to argue that the rules governing the examination of draft decrees by the Council of State were disregarded.

5. Thirdly, it is clear from the documents in the file that the contested decree and deliberation No. 2019-123 of the Commission nationale de l'informatique et des libertés dated 3 October 2019 were published in the Journal officiel on 22 February 2020. Consequently, the plea based on the absence of publication of the opinion of this commission, provided for by the provisions of II of Article 31 of the Law of 6 January 1978 cited in point 3, is, in any event, lacking in fact.

6. Fourthly, Article 22 of the Constitution states: "The acts of the Prime Minister shall be countersigned, where appropriate, by the ministers responsible for their execution. "In the case of a regulatory act, the ministers responsible for its execution are those who are competent to sign or countersign the regulatory or individual measures that the execution of this act necessarily involves. Since the contested decree does not call for any regulatory or individual execution measures on the part of the Minister of Justice and the Minister of the Armed Forces, the plea based on the lack of countersignature by these two ministers can only be rejected.

On the internal legality of the contested decree :

7. The processing called "Mobile Note-taking Application" (GendNotes) authorised by the contested decree is implemented in the context of interventions and investigations carried out by members of the national gendarmerie, in particular for the purposes of prevention and detection of criminal offences, investigations and prosecutions in this area or the execution of criminal sanctions, including protection against threats to public safety. As such, it falls under the provisions of Title III of the Act of 6 January 1978 on Data Processing, Data Files and Individual Liberties, adopted to transpose the Directive of 27 April 2016 on the protection of individuals with regard to the processing of personal data for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and not under Title II of the same Act relating to processing operations covered by the regime provided for by the Regulation of 27 April 2016 known as the General Data Protection Regulation ("GDPR"). It is also covered by the provisions common to all processing of personal data contained in Title I of the same law, such as those of Article 4, under the terms of which: "Personal data must be: / 1° Processed in a fair and lawful manner (...); 2° Collected for specific, explicit and legitimate purposes, and not be further processed in a manner incompatible with these purposes. (...) / 3° Adequate, relevant and, with regard to the purposes for which they are collected, limited to what is necessary or, for processing under Titles III and IV, not excessive (...); / 5° Kept in a form which permits identification of the data subjects for no longer than is necessary for the purposes for which they are processed. It follows from these provisions that interference with the exercise of the right to privacy by a public authority in the collection, storage and processing of personal data can only be lawfully authorised if it serves legitimate purposes and if the selection, collection and processing of the data are carried out in an adequate and proportionate manner with regard to those purposes.

As regards the purposes of the processing :

8. Under the terms of Article 1, the contested decree authorises the creation of automated processing of personal data for the purpose of, on the one hand, facilitating the collection and storage, "with a view to their subsequent use in other data processing", in particular by means of a pre-intelligence system, of information collected by members of the national gendarmerie in the course of preventive actions, investigations or interventions, and, on the other hand, facilitating the transmission of reports to the judicial authorities. While it is clear from the information in the file during the investigation that the data collected would be used in other processing operations, in particular to automatically feed the "Logiciel de Rédaction des Procédures de la Gendarmerie Nationale" (software for drafting procedures for the national gendarmerie) and to link it with several other files via the "Messagerie tactique" application, the decree does not contain any indication as to the use of the data, The decree does not contain any indication as to the nature and purpose of the processing operations concerned, nor as to the conditions for using the data collected by the "Mobile note-taking application" (GendNotes) in these other processing operations. It follows that the purpose consisting of 'further use in other processing operations', in particular by means of a pre-intelligence system, of the data collected does not satisfy the requirement of a 'specific, explicit and legitimate' purpose set out in Article 4(2) of the Act of 6 January 1978 cited in point 7. The applicants are therefore entitled to maintain that the contested decree must be annulled in so far as it assigns such a purpose to the processing which it authorises, without it being necessary to rule on the other pleas in law in the applications relating to the legality of the decree on this point.

9. On the other hand, the other purposes of the "Mobile note-taking application" (GendNotes) processing, consisting, on the one hand, of facilitating the collection and storage, for the purposes of carrying out the missions entrusted to them by the laws and regulations, of information collected by members of the national gendarmerie in the course of preventive, investigative or intervention actions and, on the other hand, of facilitating the collection and storage of information on the use of the data collected by members of the gendarmerie, and, secondly, to facilitate the transmission of reports to the judicial authorities, which are specific, explicit and legitimate, do not infringe the provisions of Article 4 of the law of 6 January 1978. It is therefore necessary to examine the other pleas raised in support of the applications in the light of these two purposes of the processing authorised by the contested decree.

As regards the data likely to be recorded :

10. Under Article 5 of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981: "Personal data undergoing automatic processing shall be : (...) c) adequate, relevant and not excessive in relation to the purposes for which they are recorded", as recalled in Article 4 of the law of 6 January 1978 cited in point 7. Under the terms of Article 6 of the same law: "I. - It is prohibited to collect or process personal data which reveal, directly or indirectly, the racial or ethnic origins, political, philosophical or religious opinions or trade union membership of individuals, or which relate to their health or sex life. (...) / IV. - Similarly, the prohibition provided for in I shall not apply to processing, whether automated or not, justified by the public interest and either authorised under the conditions provided for in I of Article 25 or II of Article 26, or declared under the conditions provided for in V of Article 22. Article 88 of the same law, applicable to the processing at issue, specifies that: "The processing of data mentioned in Article 6(I) is possible only in the event of absolute necessity, subject to appropriate safeguards for the rights and freedoms of the person concerned, and either if it is authorised by a legislative or regulatory provision, or if it is intended to protect the vital interests of a natural person, or if it concerns data which have clearly been made public by the person concerned.

11. As stated in point 2, Article 2 of the contested decree authorises the recording of personal data and information relating, on the one hand, to all elements relating to persons, places or objects which are collected in the context of interventions by members of the national gendarmerie or in the performance of their duties and, on the other hand, to all procedural elements which are transmitted to magistrates during police custody or during the processing of certain offences relating to the traffic police. The decree also authorises the collection and processing of sensitive data covered by Article 6(I) of the Act of 6 January 1978, relating to alleged racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sex life or sexual orientation, under the conditions it specifies.

12. In the first place, under the very terms of Article 2 of the contested decree, the recording of personal data in the 'Mobile note-taking application' (GendNotes) is authorised, in accordance with the requirements of Article 87 of the Law of 6 January 1978, only insofar as such data are necessary, appropriate and proportionate with regard to the aims pursued, as recalled in point 9. If it is not expressly provided for to specify whether the person whose data is collected, on the occasion of preventive actions, investigations or interventions necessary for the exercise of judicial and administrative police missions carried out by members of the national gendarmerie, is a defendant or only a victim or third party, nor to qualify the seriousness of the facts recorded and the more or less objective nature of the data recorded, it is common ground that these data must necessarily be directly related to the reason, which must be mentioned and may be the subject of details in the free comments zone, for the recording of this person in the processing. Consequently, the pleas alleging infringement of Articles 4 and 98 of the Act of 6 January 1978, which aim to guarantee the right to respect for private life and the protection of personal data, must be rejected.

13. Secondly, with regard to sensitive personal data covered by Article 6(I) of the Act of 6 January 1978, it is expressly stated that such data may only be recorded if absolutely necessary, this condition being assessed solely in the light of the requirements of the operation during which they are collected, in particular for the purposes of understanding a fact or the subsequent classification of an offence. Furthermore, this sensitive data can only be entered in the free commentary zones provided for in V of the annex to the decree and it is forbidden to select a particular category of person on the basis of this information alone. Under these conditions, despite the freedom of wording given to members of the national gendarmerie to enter this data in these free commentary zones, the authorisation to record sensitive personal data in these zones presents appropriate guarantees within the meaning of Article 88 of the Act of 6 January 1978 and does not, in itself, ignore the requirements laid down by the Act, by itself, the requirements laid down by this law with regard to the right to privacy, the right to protection of personal data and the freedom of thought, conscience and religion guaranteed by the Constitution, the European Convention for the Protection of Human Rights and Fundamental Freedoms and the Charter of Fundamental Rights of the European Union.

With regard to access to the processing operation :

14. Article 4 of the contested decree gives access to all or part of the information recorded in the processing, by virtue of their duties and within the limits of the need to know, on the one hand, to the member of the national gendarmerie who wrote the note and, unless he objects, to other members of the national gendarmerie assigned to his unit and, on the other hand, to the members of the national gendarmerie individually designated by the person who wrote the note assigned to another unit. Furthermore, Article 4 of the contested decree provides that the judicial authorities, within the framework and within the limits of the needs of the exercise of their powers, are recipients of the data and information recorded in this processing and that certain administrative authorities listed exhaustively may also be recipients of all or part of the data collected in the processing "by reason of their powers and within the strict limits where the exercise of their powers makes this necessary, provided that the framework in which this information was collected makes this communication possible, and within the strict limits of the need to know". The prefect and sub-prefect with territorial jurisdiction, the High Commissioner of the Republic in New Caledonia and French Polynesia and the mayor of the commune concerned may therefore be recipients of data recorded in the processing. Article 6 of the contested decree also provides that the author, date, time and reason for the operation, as well as the recipients of the communication, if any, must be recorded, and this information must be kept for a period of six years. In these circumstances, having regard to the purposes set out in point 9, the contested decree was able to include the administrative authorities it refers to among the recipients of the processing, strictly limiting the scope of the data concerned to only those they need to know in order to exercise their powers. Consequently, the plea alleging the illegality of Article 4 of the contested decree must be rejected.

As regards the period for which the data are kept :

15. Article 3 of the contested decree provides for a data retention period of three months from the date of recording, which may be extended to a maximum of one year. If the applicants maintain that the use of those data in other processing operations would lead to their retention for longer periods, it follows from what was said in point 8 that such use would in any event be unlawful in the absence of determination of the processing operations likely to use the data collected in the 'Mobile note-taking application' (GendNotes). With regard only to the purposes of the processing operation set out in point 9, the retention period provided for in Article 3 of the contested decree does not exceed the period necessary to meet them.

As regards the right to object :

16. Article 107 of the Act of 6 January 1978, taken for the transposition of Article 15 of the Directive of 27 April 2016, provides: 'I. The rights of the natural person concerned may be restricted in the manner provided for in II of this article if and as long as such restriction constitutes a necessary and proportionate measure in a democratic society, taking into account the fundamental rights and legitimate interests of the person in order to: / 1° To avoid hindering investigations, enquiries or administrative or judicial proceedings; / 2° To avoid hindering the prevention or detection of criminal offences, the investigation or prosecution of such offences or the execution of criminal penalties; / 3° To protect public security; / 4° To protect national security; / 5° To protect the rights and freedoms of others. / These restrictions are provided for in the act establishing the processing operation. On the other hand, in accordance with Article 110 of the same law: "Any individual has the right to object, on legitimate grounds, to personal data concerning him being processed. / The provisions of the first paragraph do not apply when the processing is in response to a legal obligation or when the application of these provisions has been excluded by an express provision of the act establishing the processing.

17. Article 5 of the contested decree provides that the right of opposition provided for in Article 110 of the Law of 6 January 1978 does not apply to the processing of 'Mobile Note-taking Application' (GendNotes), in accordance with the second paragraph of that article. It also provides, in accordance with Article 107 of the same law, that "in order to avoid hindering investigations, research or administrative or judicial proceedings or to avoid harming the prevention or detection of criminal offences, investigations or prosecutions in this area or the execution of criminal sanctions, or undermining public safety or national security", restrictions may be placed on the rights of information, access and rectification of data, under the supervision of the National Commission for Information Technology and Liberties, with which the data subject may exercise his rights. Having regard to the purposes of the processing operation 'Mobile note-taking application' (GendNotes) referred to in paragraph 9, in particular the transmission of information to the judicial authorities, the applicants are not entitled to maintain that such restrictions would unduly infringe the right to respect for private life and the protection of personal data.

As regards data relating to minors :

18. If the applicants invoke the provisions of Article 16 of the International Convention on the Rights of the Child, which provides: "No child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation. 2. The child shall have the right to the protection of the law against such interference or attacks", neither that Convention nor any other text or principle precludes the authorisation of the recording, in an automated processing system, of data relating to minors, provided that, in accordance with the requirements set out in paragraph 7, the interference with the exercise of the right to respect for private life of every person serves legitimate purposes and that the selection, collection and processing of the data are carried out in a manner which is appropriate and proportionate to those purposes. Consequently, the argument that minors should be provided with specific protection of their personal data can only be rejected.

As regards the inadequate security of the data collected :

19. Article 121 of the Law of 6 January 1978 provides: "The data controller is required to take all necessary precautions, in view of the nature of the data and the risks presented by the processing, to preserve the security of the data and, in particular, to prevent them from being distorted, damaged or accessed by unauthorised third parties. These provisions, which require the controller of a processing operation to guarantee the security of the data and to ensure that the processing operation is used in accordance with the rules laid down by the act authorising its creation, have no bearing on the legality of the act authorising the processing operation. Consequently, the plea alleging insufficient security of the data and information collected in the "Mobile note-taking application" (GendNotes) can only be rejected.

20. It follows from all the above that the Ligue des droits de l'homme, the associations Homosexualités et socialismes and Internet Society France, the associations Mousse, Stop Homophobie, Adheos and Familles A... the association AIDES, the Syndicat de la magistrature and the Syndicat des avocats de France, the Conseil national des barreaux, the Quadrature du Net and the Ligue internationale contre le racisme et l'antisémitisme are only entitled to request the annulment on the grounds of misuse of power of the terms "with a view to their use in other processing, in particular by means of a pre-intelligence system," contained in Article 1° of the decree of 20 February 2020 authorising automated processing of personal data called "Mobile note-taking application" (GendNotes). The remainder of the claims for annulment of the applications must be rejected, as well as the claims submitted by Quadrature du Net for an injunction.

21. In the circumstances of the case, the State should be liable for the sum of EUR 3,000 to be paid to each of the applicants under Article L. 761-1 of the Administrative Justice Code.

DECIDES:

--------------

Article 1: In Article 1° of Decree No. 2020-151 of 20 February 2020, the words "with a view to their use in other processing operations, in particular through a pre-intelligence system," are cancelled.

Article 2: The State shall pay the Ligue des droits de l'homme the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice, the sum of 3,000 euros to the associations Homosexualités et socialismes and Internet Society France, the sum of 3,000 euros to the associations Mousse, Stop Homophobie, Adheos and Familles A. ..., the sum of 3,000 euros to the association AIDES, the Syndicat de la magistrature and the Syndicat des avocats de France, the sum of 3,000 euros to the Conseil national des barreaux, the sum of 3,000 euros to the Quadrature du Net and the sum of 3,000 euros to the International League against Racism and Antisemitism.

Article 3: The remainder of the applications is rejected.

Article 4: This decision will be notified to the Ligue des droits de l'homme, the associations Homosexualités et socialismes and Internet Society France, the associations Mousse, Stop Homophobie, Adheos and Familles A..., the association AIDES, the Syndicat de la magistrature, the Syndicat des avocats de France, the Conseil national des barreaux, the Quadrature du Net and the International League against Racism and Anti-Semitism, to the Prime Minister and to the Minister of the Interior.

A copy will be sent to the Minister of Justice, the National Commission on Information Technology and Civil Liberties and the Human Rights Ombudsman.