CE - N° 431350
From GDPRhub
The French Council of State (CE) ruled that the decree n°2019-412 of 6 May 2019 concerning the monitoring of persons in psychiatric care without consent and the processing known as the file of alerts for the prevention of radicalization of a terrorist nature does not fall within the GDPR scope.
| CE - N° 431350 | |
|---|---|
 | |
| Court: | CE (France) |
| Jurisdiction: | France |
| Relevant Law: | |
| Decided: | 27. 03. 2020 |
| Published: | n/a |
| Parties: | n/a |
| National Case number: | N° 431350 |
| European Case Law Identifier: | ECLI:FR:CECHR:2020:431350.20200327 |
| Appeal from: | CNIL (France) |
| Language: | French |
| Original Source: | Légifrance(in FR) |
English Summary
Facts
Holding
.
Comment
Share your comment on the decision here!
Further Resources
Share other blogs or news articles here!
See the CNIL summary and comment here.
English Machine Translation of the Decision
References Council of State N° 431350 ECLI:EN:CECHR:2020:431350.20200327 Mentioned in the tables of the Lebon collection 10th - 9th bedrooms combined Mrs Isabelle Lemesle, Rapporteur Mr Alexandre Lallet, public rapporteur reading of Friday 27 March 2020 FRENCH REPUBLIC ON BEHALF OF THE FRENCH PEOPLE Full text Having regard to the following procedures: 1° Under n°431350, by a request registered on June 5th, 2019 at the Litigation Secretariat of the Council of State, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA) asks the Council of State: 1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ; 2°) to charge the State the sum of 2,500 euros under Article L. 761-1 of the Code of Administrative Justice. 2° Under n°431530, by a petition and an additional brief, registered on 10 June and 10 September 2019, the Human Rights League (LDH) asks the Council of State : 1°) to annul for misuse of power decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ; 2°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice. .................................................................................... 3° Under No. 432306, by a petition and a reply brief registered on 5 July 2019 and 11 March 2020, the MGEN Action Sanitaire et Sociale (MGEN ASS) requests the Council of State : 1°) to annul for excess of power the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data relating to the monitoring of persons in psychiatric care without consent ; 2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice. .................................................................................... 4° Under No. 432329, by a petition and an additional brief, registered on 5 July and 28 February 2020 and 6 March 2020 at the Litigation Secretariat of the Council of State, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) asks the Council of State : 1°) to annul for excess of power Decree n°2018-383 of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent ; 2°) to annul for excess of power Decree n°2019-412 of 6 May 2019 modifying Decree n°2018-383 of 23 May 2018; 3°) in the alternative, to stay the proceedings pending the decision of the Court of Justice of the European Union on questions referred for a preliminary ruling; 4°) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice. .................................................................................... 5° Under No. 432378, by a petition registered on 8 July 2019 with the Litigation Secretariat of the Council of State, the National Council of the Medical Association (CNOM) requests the Council of State to : 1°) to annul for excess of power Decree n°2019-412 of 6 May 2019 amending Decree n°2018-383 of 23 May 2018 ; 2°) to charge the State the sum of 3,000 euros under Article L. 761-1 of the Code of Administrative Justice. .................................................................................... .................................................................................... In view of the other parts of the files ; Seen: - the European Convention for the Protection of Human Rights and Fundamental Freedoms; - the Charter of Fundamental Rights of the European Union; - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ; - the Public Health Code ; - the Internal Security Code ; - Law No. 78-17 of 6 January 1978; - the code of administrative justice; After hearing in public session: - the report of Mrs. Isabelle Lemesle, State Councillor; - the conclusions of Mr. Alexandre Lallet, Maître des requêtes; The floor having been given, before and after the conclusions, to CPS Spinosi, Sureau, lawyer of the League of Human Rights, to CPS Matuchansky, Poupot, Valdelievre, lawyer of the National Council of the Order of Physicians; Considering the following: 1. Under nos. 431350, 431530, 432306, 432329, 432378 and 435722, the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the association Avocats, droits et psychiatrie (ADP), the Conseil national de l'ordre des médecins (CNOM) and the Syndicat des psychiatres des hôpitaux (SPH) request the Conseil d'Etat to annul on grounds of excess of power the decree of 6 May 2019 amending the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent. Under No. 432329, the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) also asks the Conseil d'Etat to annul the decree of 23 May 2018 on the grounds of excess of power. It is appropriate to join these petitions for the same decision. On the conclusions directed against the decree of 23 May 2018: 2. Article R. 421-1 of the code of administrative justice provides that: "The court may only be seised by way of appeal against a decision, and this within two months from the notification or publication of the contested decision (...)". 3. The Decree of 23 May 2018 was published in the Official Journal of the French Republic on 24 May 2018. Since the application by the association Avocats, droits et psychiatrie (Lawyers, rights and psychiatry) seeking its annulment on grounds of misuse of powers was not registered with the Litigation Secretariat of the Council of State until 5 July 2019, it was submitted late and is therefore inadmissible. On the conclusions directed against the decree of 6 May 2019: 4. Article 1 of the decree of 6 May 2019 adds to the processing of personal data relating to the follow-up of persons in psychiatric care without consent, known as HOPSYWEB, implemented by the regional health agencies, the main purpose of which is the administrative follow-up of persons undergoing psychiatric care without consent, another purpose allowing the State representative to be informed of the admission of persons to psychiatric care without consent, which is necessary for the purposes of preventing radicalisation of a terrorist nature, under the conditions laid down in Book II of Part III of the Public Health Code and Article 706-135 of the Code of Criminal Procedure. For that purpose alone, Article 2 provides that the surnames, forenames and dates of birth collected in HOPSYWEB processing operations are linked to the same identification data recorded in the automated processing of personal data known as the Terrorist Radicalisation Prevention Alert File (FSPRT). When this linkage reveals a match between the data being compared, the State representative in the department where the admission to psychiatric care without consent takes place and, where appropriate, the officials under his authority whom he designates for this purpose are informed. With regard to the admissibility of applications : 5. On the one hand, pursuant to article L. 4121-2 of the Public Health Code, the main purpose of the National Council of the Medical Association is to "ensure the maintenance of the principles of morality, probity, competence and devotion essential to the practice of medicine and the observance by all its members of their professional duties, as well as the rules laid down in the code of ethics" and "ensure the defence of the honour and independence of the medical profession". Article L. 4122-1 of the same code stipulates that: "The national council of the order fulfils at national level the mission defined in article L. 4121-2. In particular, it ensures that all members of the Order comply with the professional duties and rules laid down by the code of ethics (...). It assesses, in conjunction with approved patients' associations (...), compliance with the principle of non-discrimination in access to prevention or care (...) by members of the order. It is responsible for assessing the extent and nature of practices of refusal of care by the means it deems appropriate. It studies questions or projects submitted to it by the minister responsible for health / The National Council authorises its president to take legal action / It may, before all courts, exercise all the rights reserved to the civil party in respect of acts that are directly or indirectly prejudicial to the collective interest of the profession of midwife, doctor or dental surgeon (...)". Consequently, in the present proceedings, the Conseil national de l'ordre des médecins does not show that it has an interest which entitles it to seek annulment of the contested decree. 6. Moreover, the main statutory purpose of the Syndicat des psychiatres des hôpitaux, an association governed by the Law of 1 July 1901, is 'to take in hand the general interests of its members' and 'to work for the transformation and continuous improvement of the conditions in which public psychiatry is practised with a view to the development of the public mental health service'. Consequently, in the present proceedings, he does not show that he has an interest which entitles him to seek annulment of the contested decree. As regards the intervention of UNAFAM : 7. The National Union of Families and Friends of Sick and/or Mentally Handicapped Persons has a sufficient interest to justify its admissibility to intervene in support of the conclusions presented by the association CRPA under No. 431350. As regards the legality of the contested decree : 8. First, it is apparent from the copy of the minutes of the Social Section of the Council of State, produced on the file by the General Secretariat of the Government, that the published text does not contain any provision which differs both from the Government's initial draft and from the text adopted by the Social Section. It follows that no ignorance of the rules governing the examination by the Council of State of draft decrees can be accepted. 9. Secondly, Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the version applicable on the date of the contested decree, provides that: "(...) the Council of State shall examine the draft decrees in the light of the provisions of Article 2 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties. Any operation or set of operations relating to such data, whatever the process used, and in particular the collection, recording, organisation, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, alignment or interconnection, as well as blocking, erasure or destruction, constitutes processing of personal data". A linkage of two existing processing operations which consists in reconciling data stored in one and the other with a view to their use for the purpose pursued by one of them or for a specific purpose constitutes in itself a processing operation within the meaning of these provisions. The legal framework applicable to such processing depends on the purpose thus pursued. 10. It is apparent from the documents in the file that the purpose of the processing created by the contested decree, which partially links the HOPSYWEB processing and the FSPRT processing, is the prevention of radicalisation of a terrorist nature. It follows that, in the same way as the FSPRT processing, it comes under the sole provisions applicable to processing relating to State security and defence, now grouped together in Title IV of the Law of 6 January 1978 on data processing, data files and liberties, and under the provisions common to all processing now appearing in Title I. It therefore does not fall within the scope of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RGPD), nor of Title II of the Law of 6 January 1978 on processing operations falling within the scope of the protection provided for by this Regulation, which is now applicable. The pleas in law alleging infringement of the provisions of that regulation, in particular the plea alleging the inadequacy of the impact assessment, can therefore be dismissed as ineffective, without the need to stay the proceedings until the Court of Justice of the European Union has ruled on the interpretation to be adopted of Articles 9, 12, 13, 14, 16 and 17 of Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016. 11. Thirdly, Article 6 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, as applicable on the date of the contested decree, provides that: 'Processing may only involve personal data which satisfy the following conditions: (...) 2° They are collected for specified, explicit and legitimate purposes and are not further processed in a way incompatible with those purposes (...) / 3° They are adequate, relevant and not excessive in relation to the purposes for which they are collected and their further processing (...)". It appears from the documents in the file that the purpose of linking the HOPSYWEB and FSPRT treatments is to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Since only the data strictly necessary for the identification of the persons enrolled in these two treatments are linked, only the State representative in the department of the place of admission to psychiatric care without consent and, where applicable, the agents under his authority designated for this purpose are informed of the correspondence revealed by this linking, whereas it appears in particular from the information report on public services dealing with radicalization, registered at the Presidency of the National Assembly on 27 June 2019, that 12% of the persons registered in the FSPRT are said to suffer from psychiatric disorders, the plea alleging that the processing created by the contested decree does not comply with the requirements that the data processed must be adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment, in the performance of their duties, of the purpose pursued must be excluded. 12. Fourthly, while paragraph I of Article 8 of the Law of 6 January 1978 on Data Processing, Data Files and Individual Liberties, in the wording applicable at the date of the contested decree, prohibits the processing of personal data revealing data concerning health, paragraph IV of the same article derogates from that prohibition in respect of 'processing, whether automated or not, justified by the public interest and authorised under the conditions laid down in II of Article 26'. Since, on the one hand, the purpose of the processing created by the contested decree is to prevent radicalisation of a terrorist nature and is thus in the public interest and, on the other, it was authorised by a decree of the Council of State, after a reasoned and published opinion of the Commission nationale de l'informatique et des libertés, adopted on the basis of Article 26(II) of the Law of 6 January 1978, the plea alleging infringement of the prohibition on the processing of health data must be dismissed. 13. Fifth, if it is submitted that it was issued by an incompetent authority on the ground that its provisions infringe medical confidentiality, the sole purpose of the contested decree is to organise, by linking the HOPSYWEB and FSPRT treatments, the information of the State representative in the department of the place of admission to psychiatric care without consent - who is already aware of that admission even when the decision has been taken by the director of the receiving establishment pursuant to Article L. 3212-5 of the Public Health Code - on the registration of the person concerned in the FSPRT. It follows that they do not affect the confidentiality guaranteed by the provisions of Article L. 1110-4 of the Public Health Code. Although the applicants also challenge the procedure for removing doubts as to the identity of the persons concerned, the details of that procedure, which relate to the implementation of the contested processing, do not affect the legality of the contested decree. 14. Sixth, the contested provisions, which have neither the object nor the effect of opposing persons under psychiatric care to their psychiatric history, do not infringe the provisions of Article L. 3211-5 of the Public Health Code, according to the terms of which: "A person undergoing, on account of mental disorders, psychiatric care, whether or not in the form of full hospitalisation, retains, at the end of that care, all his rights and duties as a citizen, subject to the provisions relating to measures for the protection of adults laid down in sections 1 to 4 of Chapter II of Title XI of Book I of the Civil Code, without his psychiatric history being able to be invoked against him". 15. 15. Seventhly, article 29 of the Act of 6 January 1978, in the wording applicable at the date of the contested decree, provides that: 'Acts authorising the creation of a treatment pursuant to articles 26 and 27 shall specify : / 1° The name and purpose of the processing operation; / 2° The department to which the right of access defined in Chapter VII is exercised; / 3° The categories of personal data recorded; / 4° The recipients or categories of recipients entitled to receive communication of such data; / 5° Where appropriate, the exemptions from the obligation to provide information provided for in Article 32 V". Article 32 of the same law, in its wording applicable on the date of the contested decree, requires the data controller or its representative to inform the person from whom personal data concerning him/her are collected of the essential characteristics of the data processing and of his/her rights of opposition, access and rectification. It does not follow from these provisions that the act setting up a personal data processing operation must mention the methods of informing the persons from whom the data are collected. It follows that the plea alleging that the contested decree is unlawful because it does not provide for the persons whose data are processed to be informed of the link between the HOPSYWEB and FSPRT processing operations can only be dismissed. 16. Eighthly, article 34 of the law of January 6, 1978 relating to data processing and liberties, in its wording applicable at the date of the contested decree, provides that: "The data controller is required to take all useful precautions, with regard to the nature of the data and the risks presented by the processing, to preserve the security of the data and, in particular, to prevent them from being distorted, damaged, or that unauthorized third parties have access to them (...)". Although the applicants submit that the obligations incumbent on data controllers under those provisions are infringed by the linking of the HOPSYWEB and FSPRT processing operations, that plea, relating to the practical conditions for the effective implementation of that linking, does not affect the lawfulness of the contested decree. It follows that it can only be dismissed as inoperative. 17. Ninth, the Conseil d'Etat, ruling in the proceedings, having annulled on the ground of misuse of powers, by a decision of 4 October 2019, only Article 1(a) of 5° and 6° of the decree of 23 May 2018 authorising the processing of personal data relating to the monitoring of persons in psychiatric care without consent, in so far as they do not make national consultation of the data collected in each department by the central services of the Ministry of Health for statistical purposes conditional, nor the statistical exploitation of the data collected at departmental level for the preparation of the annual activity report of the departmental psychiatric care commissions to the pseudonymisation of the data used, the plea alleging that the contested decree should be annulled as a consequence of the annulment of the decree of 23 May 2018 can only be dismissed. 18. 18. Tenth, having regard to the purpose of the contested decree, which is to create a new treatment, the pleas of illegality which would result from the fact that it does not supplement the decree of 23 May 2018, first, in order to specify which persons are authorised to consult the data of the HOPSYWEB treatments and, second, in order to lay down special provisions relating to the measures of psychiatric care without consent declared unlawful must in any event be dismissed. The plea alleging infringement of Articles L. 6111-1 et seq. of the Public Health Code and Article L. 4001-1 of that code, which define the missions of health institutions and those of health professionals, is also ineffective against the contested decree, which has neither the object nor the effect of altering those missions. 19. 19. Eleventh and lastly, the plea alleging infringement of Article 8 of the Charter of Fundamental Rights of the European Union is, in any event, not accompanied by the particulars which would make it possible to assess its merits. 20. It follows from all of the foregoing that the applicants are not entitled to seek annulment of either the Decree of 23 May 2018 or the Decree of 6 May 2019 or of the implicit decision of the Prime Minister refusing to withdraw the latter. 21. 21. The provisions of Article L. 761-1 of the Code of Administrative Justice prevent a sum of money from being charged to the State, which is not the losing party in these proceedings. D E C I D E : -------------- Article 1: The intervention of UNAFAM is admitted. Article 2: The requests of the Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM), the association Avocats, Droits et Psychiatrie and the Syndicat des psychiatres des hôpitaux are rejected. Article 3: This decision shall be notified to the association Cercle de réflexion et de proposition d'actions sur la psychiatrie (CRPA), the Ligue des droits de l'homme (LDH), the MGEN action sanitaire et sociale (MGEN ASS), the Conseil national de l'ordre des médecins (CNOM) and the association Avocats, droits et psychiatrie, the Syndicat des psychiatres des hôpitaux, the Union nationale de familles et amis de personnes malades et/ou handicapées psychiques (UNAFAM), and the Minister of Solidarity and Health. Copies will be sent to the Prime Minister, the Minister of the Interior and the National Commission for Information Technology and Freedoms.
