CE - 433555
| CE - 433555 | |
|---|---|
 | |
| Court: | CE (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 15 GDPR Article 23 GDPR |
| Decided: | 21.12.2020 |
| Published: | |
| Parties: | Ministère de l'Intérieur Mme A |
| National Case Number/Name: | 433555 |
| European Case Law Identifier: | ECLI:FR:CEFSP:2020:433555.20201221 |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | French |
| Original Source: | Legifrance (in French) |
| Initial Contributor: | Kest |
The French Supreme Administrative Court (Conseil d'Etat) held that the legal procedure applicable to the exercise of the right of access and the right to erasure of personal data processed for national security purposes is compliant with Article 15 and Article 23 GDPR.
English Summary
Facts
The applicant claimed to have personal data stored on the French National Schengen Information System (“N-SIS II database”). Under Regulation (EU) 2018/1862, the Schengen Information System is composed of, on one hand, a central system (“C-SIS”), and, on the other hand, national systems (“N-SIS”) that communicate with the central system. The system as a whole allows Member States to share alerts on persons, which include personal data, for several purposes in relation with police and judicial cooperation.
The applicant exercised his rights of access and erasure against the Ministry of the Interior (“Ministère de l’intérieur”), without success. She then petitioned the French DPA (“CNIL”), with the same outcome. In this context, she seeks the annulment of the Ministry’s decision before the French Administrative Supreme Court (“Conseil d’Etat”).
As it appeared during the proceedings, her demand was processed in accordance with the procedure applicable to personal data processed for national security purposes. The applicant demands that the Court reviews the lawfulness of this procedure and the decision of the Ministry.
Dispute
Is French procedural law applicable to the exercise of the right of access and the right to erasure of personal data processed for national safety purposes compliant with Article 15 and 23 GDPR?
Holding
The Court found that the applicant’s petition had been lawfully processed and must be rejected.
According to Article L773-1 to 773-8 of the Administrative Justice Code (“Code de la Justice administrative”), a specific panel of judges reviews the application. The defendant has limited access to the file.
If the alleged data do not exist or are lawfully processed, the application is rejected without further indication.
However, if the processing is found unlawful, the applicant is informed of this outcome, and the decision specifies the reason. The Court mentions the legal reasons laid down by Article L773-8 of the Administrative justice Code: personal data are incorrect, incomplete, ambiguous or out of date or their collection, processing, transmission or storage are prohibited.
The Court finds this process compliant with Article 15 GDPR, on the right of access, and Article 23 GDPR on restrictions to the rights of data subject by legislative measures. Subsequently, it finds that the Ministry of Interior has acted pursuant to this procedure and thus lawfully.
Regarding the rights exercised by the data subject, the Court rejects the application on the basis of its own review of the file.
Comment
The Court only indicates the outcome of its review of the compliance with Article 15 and 23 GDPR. The reasonning itself is not displayed. Furthemore, the opinion of the Rapporteur public, a common and highly valuable source of information, has not been published yet.
The Adminsitrative Supreme Court issued a similar decision on the same day: CE, 21 december 2020, n° 433554, M. B v. Ministry of Interior
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
FRENCH REPUBLIC IN NAME OF THE FRENCH PEOPLE Considering the following procedure: By a request, registered on August 13, 2019 at the litigation secretariat, Mrs. B ... A ... asks the Council of State: 1 °) annul the decision of 25 March 2019 by which the Minister of the Interior refused her access to data likely to concern her appearing in the Schengen Information System (N-SIS II), as a State security would be concerned; 2) to order the Minister of the Interior to erase the data concerning him which appears illegally in this file; 3) to charge the State with the payment to SCP Thouin-Palat and Boucard, its lawyer, of a sum of 2,800 euros under Articles L. 761-1 of the Administrative Justice Code and 37 of the law of July 10, 1991. Having regard to the other documents in the file; Seen: - Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; - the code of internal security; - Law n ° 78-17 of January 6, 1978; - Law n ° 91-647 of July 10, 1991; - Decree n ° 2005-1309 of October 20, 2005; - Decree No. 2019-536 of May 29, 2019; - the code of administrative justice; After having summoned to a closed session, on the one hand, Mrs. A ... and the SCP Thouin-Palat and Boucard, his lawyer, and, on the other hand, the Minister of the Interior and the National Commission data processing and freedoms, which were given the opportunity to speak before the conclusions; And after hearing during the session: - the report by Mr. Philippe Josse, State Councilor, - and, without the presence of the parties, the conclusions of Mr. Guillaume Odinet, public rapporteur; Considering the following: 1. Under the provisions of articles 70-18 et seq. Of the law of January 6, 1978 relating to data processing, files and freedoms, resulting from law n ° 2018-693 of June 20, 2018, applicable to the procedure involved and now included in Articles 104 et seq. of the same law, in the wording resulting from Ordinance No. 2018-1125 of 12 December 2018, when the processing of personal data is carried out for the purposes of prevention and the detection, investigation and prosecution of criminal offenses or the execution of criminal sanctions, including protection against threats to public security or the prevention of such threats, the data subject has the right to obtain from the controller confirmation that personal data concerning him or her are or are not processed and, when they are, the right to access these data as well as certain information, to request rectification, complement, the eff acement of this data or limit its processing. The data controller may however delay or limit the communication of this data, or refuse access to it, under the conditions provided for in article 70-21 of the law, applicable to the procedure in question and now included in article 107 of the same law. 2. Pursuant to article 31 of the law of January 6, 1978, the processing of personal data carried out on behalf of the State and involving State security, defense or public security is authorized by order of the competent minister (s), taken after a reasoned opinion from the National Commission for Information Technology and Freedoms (CNIL), published with the order authorizing the processing. Those of these treatments which relate to the data mentioned in I of article 6 of the same law must be authorized by decree in Council of State taken after a reasoned opinion of the Commission, published with this decree. A Council of State decree may exempt from publication the regulatory act authorizing the implementation of these treatments; the meaning of the opinion issued by the CNIL is then published with this decree. 3. Article L. 841-2 of the Internal Security Code provides that the Council of State is competent to hear, under the conditions provided for in Chapter III bis of Title VII of Book VII of the Code of Administrative Justice, requests concerning the implementation of the right of access to personal data and of interest to the security of the State or the defense which are contained in the processing carried out on behalf of the State, the list of which is fixed by decree in Board of state. By virtue of article R. 841-2 of the same code, the file called N-SIS II provided for by point 1 of article R. 231-3 of the internal security code is included in the number of these treatments, for the only data concerning the security of the State mentioned in 3 ° of article R. 231-8 of this code; 4. Article L. 773-8 of the administrative justice code provides that, when it deals with requests relating to the implementation of article 41, now article 118 of the law of January 6, 1978: "the formation of the judgment is based on the elements contained, if any, in the treatment without revealing them or revealing whether or not the applicant is included in the treatment. However, when it finds that the treatment or the part of the treatment which is the subject of the dispute includes personal data concerning him which is inaccurate, incomplete, equivocal or out of date, or whose collection, use, communication or conservation is prohibited, it informs the applicant, without mentioning any element protected by the secrecy of national defense. It can order that these data be, according to the cases, rectified, updated or erased. Seized of conclusions in this direction, it can compensate the applicant ". Article R. 773-20 of the same code specifies that: "The defendant indicates to the Council of State, when filing his briefs and documents, the passages of his productions and, where applicable, of those of the Commission national control of intelligence techniques, which are protected by national defense secrecy. / The briefs and attachments produced by the defendant and, where applicable, by the National Commission for the control of intelligence techniques are communicated to the applicant , with the exception of passages from briefs and documents which either contain information protected by national defense secrecy, or confirm or deny the implementation of an intelligence technique with regard to the applicant, or disclose elements contained in the data processing, either reveal that the requester appears or does not appear in the processing. / When an intervention is formed, the president of the specialized training orders, if necessary , that the brief be communicated to the parties, and to the National Commission for the Control of Intelligence Techniques, under the same conditions and subject to the same reservations as those mentioned in the previous paragraph ". 5. It appears from the documents in the file that Mrs. A ... seized the Minister of the Interior, in application of articles 70-19 and 70-20 of the law of January 6, 1978, then applicable and now included in articles 105 and 106 of the law of January 6, 1978, a request for access to data likely to concern it appearing in the N-SIS II file and of interest to State security. By decision of March 25, 2019, the Minister of the Interior refused to provide him with the requested data. Mrs A ... asks the annulment of this refusal, to order the Minister to proceed with the erasure of the data in question and to charge the State for the payment of a sum of 2,800 euros for Articles L. 761-1 of the Administrative Justice Code and 37 of the Law of July 10, 1991. 6. The Minister of the Interior communicated to the Council of State, under the conditions provided for in Article R. 773-20 of the Code of Administrative Justice, the information relating to the situation of the person concerned. 7. It belongs to the specialized training, created by article L. 773-2 of the code of administrative justice, seized of conclusions directed against the refusal to communicate the data relating to a person who claims to be mentioned in a file appearing in the Article R. 841-2 of the Internal Security Code, to verify, in view of the information communicated to him outside the adversarial procedure, whether or not the applicant appears in the contested file. If so, it is for him to assess whether the data appearing therein are relevant with regard to the purposes pursued by this file, adequate and proportionate. To do this, it may automatically raise any means as provided for in Article L. 773-5 of the Code of Administrative Justice. When it appears either that the applicant is not mentioned in the contested file or that the personal data concerning him which appear therein are not vitiated by any illegality, the formation of judgment rejects the conclusions of the applicant without further clarification. In the event that information relating to the applicant appears in the contested file and appears to be tainted with illegality, either because the personal data concerning him are inaccurate, incomplete, equivocal or out of date or because their collection, use, communication or consultation is prohibited, it informs the applicant without mentioning any element protected by national defense secrecy. This circumstance, if applicable automatically raised by the judge under the conditions provided for in Article R. 773-21 of the Administrative Justice Code, necessarily implies that the authority managing the file restores legality by erasing or rectifying, to the extent necessary, illegal data. In such a case, the implied decision refusing to proceed with such erasure or rectification must be annulled. 8. The specialized training examined the information provided by the Minister, in view of the observations of the CNIL. This examination was carried out according to the methods described in the previous point, which do not disregard the provisions of Articles 15 and 23 of the aforementioned Regulation of the European Parliament and of the Council of 27 April 2016, contrary to what is supported, and did not revealed no illegality. It follows from there that the conclusions of Mrs. A ..., who can not usefully take advantage of that the decision which it attacks would be insufficiently motivated, must be rejected, including its conclusions for the purposes of injunction and application of article L. 761-1 of the code of administrative justice. DECIDES: -------------- Article 1: The request of Mrs. A ... is rejected. Article 2: This decision will be notified to Mrs. B ... A ... and to the Minister of the Interior. A copy will be sent to the National Commission for Informatics and Liberties. ECLI: FR: CEFSP: 2020: 433555.20201221
