CE - 440376
From GDPRhub
| CE - 440376 | |
|---|---|
 | |
| Court: | CE (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 5(1)(c) GDPR Article 5(1) GDPR Article 6(1) GDPR Article 6(4) GDPR Article 9 GDPR Article 14(5)(b) GDPR Article 23(1) GDPR |
| Decided: | 30.12.2021 |
| Published: | 30.12.2021 |
| Parties: | |
| National Case Number/Name: | 440376 |
| European Case Law Identifier: | ECLI:FR:CECHR:2021:440376.20211230 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | French |
| Original Source: | Legifrance (in French) |
| Initial Contributor: | JulesO3 |
The Supreme Administrative Court of France (CE) green-lighted the implementation of a two years testing phase of DataJust, an AI-based technology collecting judicial data, including sensitive and personal one, in order to facilitate compensation assessments.
English Summary
Facts
DataJust is an AI-based technology aiming at evaluating compensation harmonisation in the judicial system as well as establishing indicative references for compensation. It thus collects several type of information on case-law regarding compensation between January 1st 2017 and 31st December 2019. Data collected and processed includes name of individuals, except the parties, identifying elements, information on damages, and personal information on professional and financial situation. Right to opposition does not apply as stated in Article 6 of the decree. In order to set up the system, the government adopted a decree on March 27 2020 laying out DataJust functioning.
Several complainants, including NGOs, challenged the legality of DataJust on several grounds including lawfulness of processing, unauthorized use of sensitive data, violation of the data minimisation principle as well as inadmissible restriction of data subjects' rights.
Holding
The CE approved DataJust decree on several grounds.
First, the decree explains explicitly the legitimate interest to process the data as required in Article 4 of the loi du 6 janvier 1978. Ends of the data processing are fully vindicated and legitimate as it is only on a short period of time (2 years), it has an all-encompassing approach (both amicably and judicial dispute resolutions are taken into account) and it facilitates access to case-law.
Complainants also put forward that DataJust was using data collected for other purposes which would be incompatible with Article 5(1)(b) GDPR and Article 6(4) GDPR. The CE dismissed that claimed by recalling that both DataJust and first data collection involve dispute settlement purposes.
Second, for what concerns the use of health data and other very sensitive data, the CE pointed out that the processing is based on Article 9(2)(g) GDPR and Article 6 of the loi du 6 janvier 1978 and that there was a substantial public interest in simplifying access to jurisprudence through an algorithm.
Third, complainants challenged the amount of data collected with regards to data minimisation principle (Article 5(1)(c) GDPR). The CE highlighted that training an AI system requires great amount of data. Moreover, data will be pseudonymised.
Finally, regarding restrictions of individual rights, the CE confirmed the proportionality of the measures. First, no consent is required as Article 6(1)(e) GDPR allows processing based on a task carried out in the public interest. Second, right to individual information can be side-lined if, as stated in Article 14(5)(b) GDPR, it represents a disproportionate effort, which would be the case. Especially since the ministry is providing publicly available information on the matter. Regarding the right to opposition, proportionate restrictions can be applied based on Article 23(1)(e) GDPR following a general public interest. The decree precises that it follows a general public interest of law accessibility. Restrictions to such rights does not require a law, a decree is sufficient according to the CE. Finally, right of access and modification can be exercised through the ministry of interior.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
FRENCH REPUBLIC IN THE NAME OF THE FRENCH PEOPLE Considering the following procedures: 1 ° Under number 440376, by a request registered on May 4, 2020 at the litigation secretariat of the Council of State, the company B ... Avocat Victimes et Préjudices and Mr. C ... B ... ask the Council of State: 1 °) cancel for excess of power decree n ° 2020-356 of March 27, 2020 creating an automated processing of personal data called "DataJust"; 2 °) to charge the State the sum of 3,000 euros under article L. 761-1 of the code of administrative justice. 2 ° Under number 440976, by a summary request and an additional memorandum, registered on June 2 and September 2, 2020 at the litigation secretariat of the Council of State, MP .. M ..., MI .. N ..., Mrs Z ... V ..., Mrs X ... G ... and Mrs L ... E ... ask the Council of State: 1 °) cancel for excess of power decree n ° 2020-356 of March 27, 2020 creating an automated processing of personal data called "DataJust"; 2 °) to charge the State the sum of 3,000 euros under article L. 761-1 of the code of administrative justice. .................................................. .................................. 3 ° Under number 442327, by a request and a memorandum, registered on July 31, 2020 and April 15, 2021 at the litigation secretariat of the Council of State, Ms. W ... A ..., Mr. AA ... U ... and Mrs Y ... O ... ask the Council of State: 1 °) cancel for excess of power decree n ° 2020-356 of March 27, 2020 creating an automated processing of personal data called "DataJust"; 2) to charge the State the sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice. .................................................. .................................. 4 ° Under number 442361, by a summary request, an additional memorandum and a reply memorandum, registered on August 2 and November 2, 2020 and on December 13, 2021 at the litigation secretariat of the Council of State, the association La Quadrature du Net asks the Council of State: 1 °) cancel for excess of power decree n ° 2020-356 of March 27, 2020 creating an automated processing of personal data called "DataJust"; 2) to order the Keeper of the Seals, Minister of Justice, to delete the data collected since the entry into force of the contested decree, under penalty of 1,024 euros per day of delay; 3) to charge the State the sum of 4,096 euros under Article L. 761-1 of the Code of Administrative Justice. .................................................. .................................. 5 ° Under number 442935, by a request registered on August 18, 2020 at the litigation secretariat of the Council of State, the APF France handicap association, the National Federation of Victims of Attacks and Collective Accidents and the National Union associations of families of cranial trauma and cerebral injuries ask the Council of State: 1 °) cancel for excess of power decree n ° 2020-356 of March 27, 2020 creating an automated processing of personal data called "DataJust"; 2) to charge the State the sum of 1,500 euros to be paid to each of the requesting associations under article L. 761-1 of the code of administrative justice. .................................................. .................................. Having regard to the other documents in the files; Seen : - the Constitution ; - the European Convention for the Protection of Human Rights and Fundamental Freedoms; - the Charter of Fundamental Rights of the European Union; - Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016; - Law n ° 78-17 of January 6, 1978; - the code of administrative justice; After hearing in public session: - the report by Mr Bruno Delsol, State Councilor, - the conclusions of Mr. Arnaud Skzryerbak, public rapporteur; The floor having been given, after the conclusions, to the SCP Rocheteau, Uzan-Sarano, lawyer of the company B ... Lawyer Victims and Prejudices and of MB .. and to the SCP Foussard, Froger, lawyer of MM .., of MN .., of Mrs. V…, of Mrs. G… and of Mrs. E…; Considering the following: 1. The requests of the company B ... Avocat Victimes et Préjudices and MB ..., of MM ... and others, of Mrs. A ... and others, of the association La Quadrature du Net and of the APF association France handicap and others are directed against the same decree of March 27, 2020 creating an automated processing of personal data called "DataJust". They should be joined to rule by the same decision. 2. The contested decree authorizes the Keeper of the Seals, Minister of Justice, to implement, for a period of two years, a treatment whose purpose, under the terms of its article 1, is "the development of an algorithm to be used to: / 1 ° Carrying out retrospective and prospective evaluations of public policies in terms of civil or administrative liability; / 2 ° Drawing up an indicative benchmark for compensation for bodily injury; / 3 ° Informing the parties and assistance in evaluating the amount of compensation to which victims can claim in order to promote an amicable settlement of disputes; / 4 ° Information or documentation of judges called upon to rule on claims for compensation of bodily injury. ". Its article 2 provides that the data "are extracted from court decisions rendered on appeal between January 1, 2017 and December 31, 2019 by administrative courts and civil formations of judicial courts in the sole litigation relating to compensation for bodily injury ". The same article fixes the list of the categories of data concerned and specifies that they can include those mentioned in article 6 of the law of January 6, 1978. The decree provides that the right of information and the right of opposition of the persons whose data is collected will not apply. On the interventions: 3. Mr. J ... and others on the one hand, the National Union of approved associations of users of the health system on the other hand, justify a sufficient interest in the annulment of the attacked decree. Their interventions are therefore admissible. On the external legality of the contested decree: 4. In the first place, under the terms of article 34 of the Constitution: "The law fixes the rules concerning: the civic rights and the fundamental guarantees granted to the citizens for the exercise of the public freedoms". The law of January 6, 1978 relating to computers, files and freedoms governs the processing of personal data, in particular within the framework of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, known as the general regulation on data protection known as "RGPD". The creation and implementation of such processing are subject to compliance with all the applicable guarantees provided for by this law, in particular the principles, listed in Article 4, of lawfulness, as specified in its article 5, of loyalty, limitation of purposes, minimization of data, accuracy, limitation of storage, integrity and confidentiality. 5. The contested decree is limited to authorizing the collection of data necessary for the development of an algorithm in matters of compensation for bodily injury without derogating from the law of January 6, 1978. It has neither the purpose nor the effect of lay down rules relating to the fundamental guarantees granted to citizens for the exercise of public freedoms. The plea alleging the incompetence of the Prime Minister to adopt the contested decree, including in that it excludes the exercise of the rights of information and opposition of the persons whose personal data is collected, and even that initially the government had prepared a draft legislative article establishing a compensation benchmark, which can therefore only be discarded. 6. Secondly, it appears from the documents entered into the file by the Minister of Justice that the contested decree does not contain any provision which would differ both from the Government's initial draft and from the text adopted by the Council of State. Consequently, the applicants are not, in any event, justified in maintaining that the rules governing the examination by the Council of State of the draft decrees were disregarded. 7. Thirdly, the applicants rely on the irregularity of the opinion of the National Commission for Informatics and Freedoms (CNIL). However, on the one hand, the mere fact that this opinion contains only the signature of its chairperson is not sufficient to establish that it was not delivered in plenary session since no provision or principle imposes other signatures nor does it provide for mandatory information to accompany the notice. It follows that when the opinion takes the form of a "deliberation" and mentions that it was delivered by the Commission, it cannot be regarded, in the absence of evidence to the contrary, as emanating from the sole president of the commission. On the other hand, it emerges from the documents in the file that the contested decree and deliberation n ° 2020-002 of January 9, 2020 bearing the CNIL's opinion were published in the Official Journal of March 29, 2020. Contrary to what the applicants maintain, the fact that the CNIL's opinion was published after the signing of the contested decree is, in any event, of no effect on the legality of the latter. It follows that the plea alleging irregularity in the CNIL's opinion must be rejected. 8. Fifth, the plea raised by the association La Quadrature du Net and alleging that all the legally required opinions have not been obtained is not accompanied by sufficient details to assess its merits. . 9. Lastly, article 22 of the Constitution provides that "The acts of the Prime Minister are countersigned, if necessary, by the ministers responsible for their execution.". In the case of a regulatory act, the ministers responsible for its execution are those who have the power to sign or countersign the regulatory or individual measures that the execution of this act necessarily involves. The contested decree does not call for any regulatory or individual implementing measure on the part of the Minister for Solidarity and Health, the Minister for Higher Education, Research and Innovation, or the Minister for interior, the plea based on the lack of countersignature of these ministers can only be dismissed. On the internal legality of the contested decree: 10. Under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms: "1. Everyone has the right to respect for his private and family life, his home and his correspondence. / 2. There can be interference by a public authority in the exercise of this right only insofar as such interference is provided for by law and constitutes a measure which, in a democratic society, is necessary for the national security, public safety, the economic well-being of the country, the defense of order and the prevention of criminal offenses, the protection of health or morals, or the protection of rights and freedoms of others ". Under the terms of Article 8 of the Charter of Fundamental Rights of the European Union: "1. Everyone has the right to the protection of personal data concerning them. / 2. These data must be processed fairly, for the purposes of determined and on the basis of the consent of the person concerned or by virtue of another legitimate ground provided for by law. Everyone has the right to access the data collected concerning him and to obtain its rectification. (... ) ". The processing in dispute falls under the regulation of April 27, 2016, known as the general data protection regulation. It is subject to article 4 I of the law of January 6, 1978 which requires that "Personal data must be: / 1 ° Processed fairly and lawfully (...); 2 ° Collected for specific purposes , explicit and legitimate, and not to be processed subsequently in a manner incompatible with these purposes. (...) / 3 ° Adequate, relevant and with regard to the purposes for which they are collected, limited to what is necessary or, for processing covered by Titles III and IV, not excessive (...); / 5 ° Kept in a form allowing the identification of the data subjects for a period not exceeding that necessary for the purposes for which they are processed ". It follows from all of these texts that the interference with the exercise of the right of every person to respect for his private life constituted by the collection, storage and processing, by a public authority, of personal data, can only be legally authorized if it meets legitimate purposes and that the choice, collection and processing of data are carried out in an adequate and proportionate manner with regard to these purposes. With regard to the purposes of the processing: 11. Firstly, the formulation, by article 1 of the contested decree, of the purposes tending to "carry out retrospective and prospective evaluations of public policies in matters of civil or administrative liability" as well as to the creation of a compensation benchmark is sufficiently precise. The plea alleging that it disregards the aforementioned article 4 of the law of 6 January 1978 on the grounds that it is neither "determined" nor "explicit" must therefore be rejected. 12. In the second place, the applicants dispute the purposes of this processing on the grounds that the algorithm that it aims to develop would be both contrary to the principles of individualization and full compensation for damage, unnecessary to due to the existence of other tools with the same purpose, and biased for the processing failure to take into account amicable indemnities as well as the evolution of the law. However, it emerges from the documents in the file that the processing authorized by the contested decree is aimed at the development of an algorithm intended for the development of an indicative benchmark for compensation for bodily injury intended to be used to assess these damages within the framework of both amicable and judicial settlement of disputes. It thus tends to ensure easier access to case law on compensation for bodily injury in order to guarantee the accessibility and predictability of the law. In addition and at this stage, this processing, the duration of which is reduced to two years, is limited to the development phase of an artificial intelligence tool, has only an experimental character and is not intended, at this stage, to be made available to magistrates or parties. It follows that the plea alleging that the purposes pursued by the processing are not legitimate must be rejected. 13. Finally, under b) of 1 of article 5 of the GDPR, data whose collection and processing had already been planned for other purposes must not be subsequently processed in a manner incompatible with these. Point 4 of Article 6 specifies in this regard that "the controller (...) takes into account, inter alia: a) the possible existence of a link between the purposes for which the personal data are been collected and the purposes of the further processing envisaged; b) the context in which the personal data were collected, in particular as regards the relationship between the data subjects and the controller; c) the nature of the data of a personal nature, in particular if the processing relates to special categories of personal data, pursuant to Article 9, or if personal data relating to criminal convictions and offenses are processed, pursuant to Article 10; d) the possible consequences of the envisaged further processing for the data subjects; e) the existence of appropriate safeguards, which may include encryption or pseudonymi station ". 14. In the present case, if the contested decree provides that the data are extracted from court decisions transmitted by the Court of Cassation and the Council of State among the decisions that they were authorized to collect for the needs of their activity jurisdictional, the purposes provided for by the contested decree are linked to the purposes pursued by the initial collection when the settlement of disputes is involved in both cases. The decree also provides that the data relating to the parties are pseudonymized. Finally, the planned treatment which is not the subject of deployment is not likely to have an impact on the personal compensation of the latter. It follows that the new processing is in any event not incompatible with the initial purposes within the meaning of the provisions recalled in the previous point. With regard to the data collected: As for the principles of data minimization and accuracy: 15. The applicants cannot usefully maintain that the scope of the data collected is insufficient to allow the implementation of an operational instrument, nor that the decree is, as a result, vitiated by a manifest error of assessment. 16. The fact that the decisions annulled in cassation are not excluded from those which will be collected is not sufficient to undermine the principle of accuracy of the data collected. Moreover, since the processing of a large number of decisions is necessary for the reliability of the algorithm, the contested decree does not infringe the principle of data minimization. As for health data: 17. Article 9 of the RGPD and article 6 of the law of January 6, 1978 prohibit the processing of so-called sensitive data, including health data, except, in particular, under the terms of g) of paragraph 2 of the Article 9 of the GDPR, when it is necessary for reasons of important public interest on the basis of a right proportionate to the objective of public interest pursued. 18. It appears from the documents in the file that, having regard to its object relating to the development of an algorithm intended to facilitate access to case law, the processing authorized by the contested decree meets a need justified by reasons of interest. important audience. In addition, under the terms of article 2 of the contested decree, the names and surnames of the natural persons parties to the proceedings which were the subject of the court decisions rendered on appeal between January 1, 2017 and December 31, 2019 from which the data necessary for the development of the algorithm are extracted, must be concealed before their transmission to the general secretariat of the ministry of justice. Given this pseudonymization of the data collected relating to the parties to court decisions subject to processing, the collection of health data on the bodily injuries suffered, which moreover is not likely to have an impact on the persons concerned, including the damage has already been compensated, cannot be regarded as disproportionate with regard to the objective of public interest pursued. As for other data: 19. On the one hand, if the applicants criticize the adequacy and relevance of the collection of data relating to health expenditure, the financial situation of the victims and those responsible, the fees of doctors and experts as well as offenses and criminal convictions to which civil and administrative judgments may refer, these elements, which are the subject, as has been said, of pseudonymisation when they concern the parties to the proceedings, are necessary for the assessment compensation for bodily injury. 20. On the other hand, if the identity data of natural persons mentioned in court decisions, other than the parties, are also collected, article 2 of the contested decree provides that "It is prohibited to select in the processing a particular category of people based on these data alone. "These data will therefore not be processed and it appears from the documents in the file that their collection meets technical constraints. Like other personal data, they will be erased after two years at the latest by virtue of article 4 of the contested decree and, in accordance with article 3, they will only be accessible to a limited number of agents. precisely designated, by reason of their powers and within the limits of the need to know. 21. Finally, since court decisions are subject to pseudonymization of the personal data of the parties to the proceedings, the collection of their number is only intended to respond to requests from the persons whose data was collected. tending to the exercise of their right of access, rectification or limitation. 22. It follows from the foregoing that the choice, collection and processing of the data recorded in the processing authorized by the contested decree are carried out in an appropriate, necessary and proportionate manner with regard to the purposes pursued by the processing and do not infringe in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms. With regard to the restrictions on the rights of the persons whose data is processed: As for consent: 23. According to point 1 of article 6 of the GDPR, the processing of data without the consent of the person may be authorized when, in particular, the processing is necessary for the performance of a task of public interest or falling within the scope of the exercise of public authority. According to the last paragraph of point 3 of the same article, the law applied must meet an objective of public interest and be proportionate to the legitimate objective pursued. 24. Since the processing authorized by the contested decree has as its object, in order to facilitate access to case law, the development of an algorithm intended for the development of an indicative benchmark for compensation for bodily injury. that can be used to assess these damages in the context of both amicable and judicial settlement of disputes, it is necessary for the performance of a public interest mission within the meaning of Article 6 of the GDPR. In addition, as stated above, the data relating to the parties will be pseudonymized. The plea alleging the illegality of the lack of consent of the persons whose data is collected must therefore be rejected. As for the right to information: 25. It follows from the provisions of point b) of point 5 of article 14 of the GDPR that the obligation to inform the person concerned by the collection of data does not apply in particular when and to the extent that the provision of such data information proves impossible or would require disproportionate effort. In this case, the controller must make the information publicly available. 26. In view of the large number of court decisions to be processed, it cannot be argued that the individual information of each person concerned would not require disproportionate efforts. Thus, the plea alleging that the exclusion of the right to information would be excessive or infringe Article 8 of the Charter of Fundamental Rights of the European Union must be rejected. While the provisions cited in the previous point place on the controller the obligation to make the information publicly available, they do not require that the act creating the processing recalls this obligation or that it determines the modalities of its implementation. As for the right of opposition: 27. Article 23 of the GDPR provides that national law may impose limitations on the right of opposition recognized by its article 21 when such a limitation respects the essence of fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society to guarantee, in particular, important objectives of general public interest. 28. In the first place, contrary to what the applicants maintain, the abovementioned provisions do not require the intervention of a law to authorize the exclusion of the right to oppose the data being processed. In the present case, its application was ruled out by an express provision of the act establishing the processing in accordance with what is provided for in article 56 of the law of 6 January 1978. 29. Secondly, the derogation from the right to object is justified by the need to have a compensation database that is as representative and complete as possible to meet the purposes which, as was stated in point 12, are legitimate. As for the rights of access, rectification and limitation: 30. Article 6 of the contested decree provides that the rights of access, rectification and limitation are exercised with the Minister of Justice under the conditions provided for respectively in Articles 15, 16 and 18 of the GDPR. If the applicants claim that, failing to have been informed of the collection of their data, the data subjects will not be able to exercise these rights, this means must be rejected as soon as the controller is required, as well as 'it was recalled in point 25, to provide the necessary public information on data collection. With regard to the recipients and the security of the data collected: 31. Article 3 of the contested decree provides: "Only have access, by reason of their powers and within the limit of the need to know, to personal data and information recorded in the present processing: / 1 ° The agents of the Ministry of Justice assigned to the service in charge of IT developments of the General Secretariat of the Ministry of Justice, individually appointed by the Secretary General; / 2 ° The agents of the Office of the Law of Obligations individually appointed by the Director of Civil Affairs and the Seal ". Thus, the persons having access to the data collected are exhaustively listed. The decree also prohibits these agents from using them for purposes other than those provided for. In addition, and as has already been said, they will only receive pseudonymized data concerning the parties to the proceedings. Consequently, the applicants cannot maintain that agents have too wide access to their data, nor that medical confidentiality is disregarded. 32. The conditions for compliance with data security rules fall under the obligations of the data controller and cannot therefore be usefully invoked against the act of authorization. 33. It follows from all of the foregoing, without there being any need to rule on the plea of inadmissibility raised by the Minister of Justice in application 440976, that the applicants are not justified in requesting annulment. of the decree they are attacking. Consequently, the conclusions at the end of injunction presented by the association La Quadrature du Net can only be rejected, as well as those presented by the applicants under article L. 761-1 of the code of administrative justice and those presented in the same way by the National Union of approved associations of users of the health system, which moreover is not a party in the present proceedings. D E C I D E: -------------- Article 1: The intervention of Mr. J ... and others and the intervention of the National Union of approved associations of users of the health system are admitted. Article 2: The requests of the company B ... Lawyer Victims and Prejudices and other, of MM ... and others, of Mrs. A ... and others, of the association APF France Handicap and others and of the association La Quadrature du Net are rejected. Article 3: The conclusions presented by the National Union of approved associations of users of the health system under article L 761-1 of the code of administrative justice are rejected. Article 4: This decision will be notified to the company B ... Avocat Victimes et Préjudices, to MP ... M ..., to Mrs W ... A ... born D ... and to the APF association France Handicap, each first named for all the applicants, to the association La Quadrature du Net, to the Prime Minister, to the Keeper of the Seals, Minister of Justice, to Mr. AB ... J. .., first named for all the interveners who came to support the request of the company B ... Victims and Prejudices Lawyer, and to the National Union of approved associations of users of the health system. Deliberated at the end of the meeting of December 17, 2021 where sat: Mr. Rémy Schwartz, deputy chairman of the litigation section, chairman; Mr. Q ... K ..., Mr. Frédéric Aladjidi, presidents of chambers; Mrs S ... F ..., Mr T ... H ..., Mrs Anne Egerszegi, State Councilors and Mr Bruno Delsol, State Councilor-rapporteur. Delivered on December 30, 2021 President : Signed: M. Rémy Schwartz The rapporteur : Signed: M. Bruno Delsol The Secretary : Signed: Mme R ... AC ... ECLI: FR: CECHR: 2021: 440376.20211230
