CE - N° 434376
From GDPRhub
| CE - N° 434376 | |
|---|---|
 | |
| Court: | CE (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 35 GDPR |
| Decided: | 06.11.2019 |
| Published: | |
| Parties: | Le service intégré de l'accueil et de l'orientation (SIAO) Office français de l'immigration et de l'intégration (OFII) |
| National Case Number/Name: | N° 434376 |
| European Case Law Identifier: | ECLI:FR:CECHR:2019:434376.20191106 |
| Appeal from: | CNIL (France) |
| Appeal to: | |
| Original Language(s): | French |
| Original Source: | CONSEIL D'ETAT (in French) |
| Initial Contributor: | n/a |
The French Council of State (Conseil d' Etat) clarified the application of Article 35 GDPR (data protection impact assessments).
English Summary
Facts
Several NGOs brought a complaint before the Conseil d’Etat to stop a new form of cooperation between two national services (SIAO and OFII) in charge of asylum seekers and beneficiaries of international protection. This new form of cooperation leads to a new joint database and, thus, to a new processing operation of the applications for asylum by the SIAO and the OFII. This new database includes the personal data of the asylum seekers.
Dispute
The Conseil d’Etat had to assess when the Data Protection Impact Assessments (DPIA) according to Article 35 GDPR should be carried out in this case.
Holding
The Conseil d’Etat stated that the DPIA must be carried out prior to the processing operation, but it must also be updated after the actual launch of the processing operation to ensure that the risks to the rights and freedoms of the natural persons whose personal data are processed are always duly taken into account. If further found that carrying out the DPIA when initiating the processing operation was sufficient to comply with Article 35 GDPR.
Comment
Share your comment on the decision here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the original. Please refer to the French original for more details.
Council of State N° 434376 ECLI:EN:CECHR:2019:434376.20191106 Mentioned in the tables of the Lebon collection 2nd - 7th bedrooms combined Ms Stéphanie Vera, Rapporteur Mrs Sophie Roussel, public rapporteur SCP SPINOSI, SUREAU, Lawyers reading of Wednesday 6 November 2019 FRENCH REPUBLIC ON BEHALF OF THE FRENCH PEOPLE Full text Having regard to the following procedure: 1°/ Under n° 434376: By an application, a supplementary statement of claim and a statement in reply, registered on 9 and 19 September and 15 October 2019 at the Litigation Secretariat of the Council of State, the Fédération des Acteurs de la Solidarité, the Fédération Nationale des Samu sociaux, Emmaus France, Emmaus Solidarité, the Fondation Abbé B... pour le Logement des Défavorisés, the Salvation Army Foundation, Secours Catholique, Médecins du Monde, Les Petits Frères des Pauvres, Habitat et Insertion, the Association des Cités du Secours Catholique, the DALO association, the National Association of Social Service Assistants, the National Association le Refuge, the ARDHIS, the Aurore Association, the Association Avocats pour la défense des étrangers-e-s, the Centre d'Action Sociale Protestant dans la Région Parisienne, the Cimade, the Collectif Les Morts de la Rue, the association Dignité, Dom'Asile, the FASTI, the Fédération Droit au Logement, the Fédération Santé Habitat, the GISTI, Interlogement 93, the Ligue des Droits de l'Homme, the Fédération Addiction and the association ELENA ask the Conseil d'Etat : 1°) to annul Interministerial Instruction No. DGCS/SD1A/DGEF/2019/143 of 4 July 2019 relating to cooperation between the integrated reception and orientation services (SIAO) and the French Office for Immigration and Integration (OFII) for the care of asylum seekers and beneficiaries of international protection; 2°) to charge the State with the payment of a sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice. 2°/ Under n° 434377: By a petition and a reply memorandum registered on 9 September and 15 October 2019 at the Litigation Secretariat of the Council of State, the Fédération des Acteurs de la Solidarité, the Fédération Nationale des Samu sociaux, Emmaüs France, Emmaüs Solidarité, the Fondation Abbé B... pour le Logement des Défavorisés, the Salvation Army Foundation, Secours Catholique, Médecins du Monde, Les Petits Frères des Pauvres, Habitat et Insertion, the Association des Cités du Secours Catholique, the DALO association, the National Association of Social Service Assistants, the National Association le Refuge, the ARDHIS, the Aurore Association, the Association Avocats pour la défense des étrangers-e-s, the Centre d'Action Sociale Protestant dans la Région Parisienne, Cimade, the Collectif Les Morts de la Rue, the association Dignité, Dom'Asile, the FASTI, the Fédération Droit au Logement, the Fédération Santé Habitat, the GISTI, Interlogement 93, the Ligue des Droits de l'Homme, the Fédération Addiction and the association ELENA request the judge in summary proceedings of the Council of State, ruling on the basis of Article L. 521-1 of the Code of Administrative Justice: 1°) to suspend the execution of interministerial instruction n° DGCS/SD1A/DGEF/2019/143 of 4 July 2019 relating to cooperation between the integrated reception and orientation services (SIAO) and the French Office for Immigration and Integration (OFII) for the care of asylum seekers and beneficiaries of international protection ; 2°) to charge the State with the payment of a sum of 5,000 euros under Article L. 761-1 of the Code of Administrative Justice. .................................................................................... Having regard to the other parts of the files ; Seen: - the Constitution; - Order n° 58-1067 of 7 November 1958; - the European Convention for the Protection of Human Rights and Fundamental Freedoms; - the Charter of Fundamental Rights of the European Union; - Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 ; - the Code on the Entry and Residence of Foreigners and the Right of Asylum ; - the Code of Social Action and Families; - Law No. 78-17 of 6 January 1978; - Act No. 2018-778 of 10 September 2018; - the code of administrative justice; After hearing in public session: - the report of Mrs Stéphanie Vera, Maître des requêtes en service extraordinaire, - the observations of the representative of the Defender of Rights, - the conclusions of Mrs Sophie Roussel, public rapporteur, Before and after the conclusions, the floor was given to CPA Spinosi, Sureau, lawyer for the Federation of Solidarity Actors and others; Considering the following: 1. The law of 10 September 2018 for controlled immigration, effective asylum and successful integration introduced in Article L. 744-6 of the Code on the Entry and Residence of Foreigners and the Right of Asylum, a new paragraph, which became the sixth, relating to the assessment of the vulnerability of asylum seekers and the exchange of information between the French Office for Immigration and Integration (OFII) and the French Office for the Protection of Refugees and Stateless Persons (OFPRA), under the terms of which "The integrated reception and guidance service mentioned in article L. 345-2 of the Social Action and Families Code provides the French Office for Immigration and Integration with a monthly list of persons accommodated pursuant to article L. 345-2-2 of the same Code who have submitted an asylum application and a list of persons who have been granted refugee status or subsidiary protection". The Minister for Territorial Cohesion and Relations with Territorial Communities and the Minister for the Interior sent to the regional and departmental prefects an instruction dated 4 July 2019, which the applicant associations are seeking to have annulled, setting out the terms of cooperation between the integrated reception and guidance services (SIAO), which are responsible, under the authority of the State representative in each department, for providing guidance to persons in distress within the emergency accommodation system, and the OFII. 2. The two requests from the Fédération des Acteurs de la Solidarité and the other applicant associations seek, on the one hand, the annulment of this instruction and, on the other hand, the suspension of its execution. The two applications should be joined to give a single decision. Interventions: 3. The Association Chrétienne de Coordination d'Entraide et de Solidarité and the Union départementale d'Accueil et d'Urgence sociale justify, having regard to their statutory purpose, a sufficient interest in the annulment of the contested decision. Thus, their interventions in support of the application of the Fédération des acteurs de la solidarité are admissible. On the priority question of constitutionality: 4. Under the terms of the first paragraph of article 23-5 of the Order of 7 November 1958 establishing the Constitutional Council: "The plea that a legislative provision infringes the rights and freedoms guaranteed by the Constitution may be raised [...] in proceedings before the Council of State [...]". It follows from the provisions of the same article that the Constitutional Council is seized of this question of constitutionality on the threefold condition that the contested provision is applicable to the dispute or procedure, that it has not already been declared in conformity with the Constitution in the grounds and operative part of a decision of the Constitutional Council, unless circumstances change, and that the question is new or of a serious nature. 5. The applicant associations submit that the legislature has vitiated the sixth paragraph of Article L. 744-6 of the Code on the Entry and Residence of Foreigners and the Right of Asylum with a negative lack of jurisdiction affecting the right to respect for private life, the constitutional right of asylum and the principle of confidentiality of asylum applications. 6. In the first place, if these provisions are likely to infringe the principle of the right to respect for private life, their implementation leading to the creation of a personal data processing of the information thus collected, this processing is subject to the provisions of Regulation (EU) No 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and of the Law of 6 January 1978 on data processing, data files and individual liberties, and to the guarantees they provide. It is therefore the responsibility of the competent authorities, in compliance with these guarantees and under the supervision of the judge, to ensure that the collection, recording, conservation, consultation, communication, contestation and rectification of the data in this file are carried out in an appropriate manner and in proportion to the objective pursued. It follows from this that the applicant associations are not justified in maintaining that the provisions of the sixth paragraph of Article L. 744-6 of the Code on the Entry and Residence of Foreigners and the Right of Asylum are vitiated by a negative lack of jurisdiction which deprives the constitutional requirements relating to the right to respect for private life of legal guarantees. 7. Secondly, while the provisions in question do not relate to the content of asylum applications, the complaint that the alleged negative incompetence in itself infringes the right to asylum and the principle of confidentiality of asylum applications can only be dismissed. 8. It follows from the above that the question of the conformity of the contested provisions with the rights and freedoms guaranteed by the Constitution is not a serious one. There is therefore no need to refer it to the Constitutional Council. On the conclusions for annulment : 9. The contested investigation asks prefects, in order to enable asylum seekers and beneficiaries of international protection, accommodated in the 'generalist' accommodation system, to be directed as soon as possible to accommodation systems dedicated to them and to be cared for by benefiting from services adapted to their administrative and social situation, to organise cooperation at departmental level between the OFII services and the SIAOs. To this end, the instruction provides in particular that each SIAO must transmit to the corresponding OFII territorial management, on the 10th of each month, via an extraction from its information system called SI-SIAO, a processing operation created by the Directorate General for Social Cohesion and authorised by Decision No. 2011-224 of the National Commission for Information Technology and Civil Liberties (CNIL) dated 21 July 2011, the identity of asylum seekers and beneficiaries of international protection, specifying their administrative status, the address of their accommodation and the date of their entry into it. The procedures for this extraction are set out in two technical notices drawn up in July 2019. The disputed instruction specifies that the information transmitted to the OFII must then be discussed at monthly meetings involving the two services. As regards the plea alleging the incompetence of the authors of the instruction : 10. By the contested instruction, the Minister for Territorial Cohesion and Relations with Territorial Communities and the Minister for the Interior have, within the framework of the power to organise the services placed under their authority, in particular defined the characteristics of data processing, taking the form of the transmission of information from the SIAOs to the OFII provided for in Article L. 744-6 of the Code on the Entry and Residence of Foreigners and the Right of Asylum, as well as the guarantees surrounding it. While the provisions of the eighth paragraph of this Article provide that a decree in Council of State shall set out the terms of application, this reference to a decree in Council of State, prior to the Law of 10 September 2018, whose main purpose is to implement the assessment of the vulnerability of asylum seekers and the procedures for exchanging information between the OFII and OFPRA did not intend to call into question the power of the competent ministers in their capacity as heads of department to define or complete the processing of personal data in compliance with the provisions of Regulation (EU) 2016/679 and the provisions of the Law of 6 January 1978, subject to the provisions of the latter regarding the processing of certain data. The plea alleging the incompetence of the authors of the investigation must therefore be dismissed. With regard to the pleas alleging ignorance of the right to protection of personal data : 11. According to Article 5 of Regulation (EU) 2016/679, "1. Personal data must be: / a) processed in a lawful, fair and transparent manner with regard to the data subject (...); / b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; (...); / c) adequate, relevant and limited to what is necessary for the purposes for which they are processed (...); / d) accurate and, where necessary, kept up to date (...).(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed; (...) / (f) processed in such a way as to ensure adequate security of personal data (...); 2. The controller shall be responsible for compliance with paragraph 1 and shall be able to demonstrate such compliance (accountability)". 12. Article 6 of the Regulation provides that: "1. Processing shall be lawful only if and insofar as at least one of the following conditions is met: (a) the data subject has consented to the processing of his or her personal data for one or more specific purposes; (...); / (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (...)". 13. First, Article 35 of Regulation (EU) 2016/679 provides that the controller shall carry out a data protection impact assessment where the processing is likely to present a high risk to the rights and freedoms of natural persons. While this analysis is the responsibility of the controller, it is in principle carried out prior to the implementation of the processing operation and the analysis must be updated after the actual start of the processing operation in order to ensure that the risks to the rights and freedoms of natural persons related to the processing of their personal data are adequately addressed at all times. Thus, while the performance of an impact analysis of the processing of personal data, the absence of which may give rise to sanctions by the CNIL pursuant to Article 20 of the Act of 6 January 1978, is linked to the implementation of such processing, the sole circumstance, invoked by the applicant associations, that it was not performed before the signature of the instruction is not such as to taint it with illegality. The plea alleging that the contested investigation infringed Article 35 of Regulation (EU) must therefore in any event be dismissed. 14. Secondly, it is apparent from the contested investigation that it states that the communication of the data collected to the OFII must serve the following purposes: 'to direct asylum seekers to the facilities dedicated to them, in particular the accommodation facilities mentioned in Article L.' (Article L.1). 744-3 of the CESEDA, in order to adapt the monitoring and care methods for this public; / - to enable beneficiaries of international protection to benefit from the systems dedicated to them (Republican integration contract, temporary accommodation centres, citizen accommodation, HOPE-type integration systems, etc.); / - to enable them to benefit from the systems dedicated to them (Republican integration contract, temporary accommodation centres, citizen accommodation, HOPE-type integration systems, etc.). ) / - to improve the fluidity of emergency accommodation under ordinary law, which can only be mobilised for these groups in the name of unconditional reception in the event of distress; / - to prevent the additional daily amount of the ADA from being paid to asylum seekers while they benefit from accommodation in the generalist system". Thus, the instruction clearly and in sufficient detail sets out the purposes for which the SIAO will transmit the list of asylum seekers and beneficiaries of international protection to the OFII, a list which it is specified may not be communicated for other purposes. Consequently, this information may only be transmitted by the SIAO to the OFII and may only be discussed between these two services, which alone are authorised to examine it during the monthly meetings provided for in the instruction, in order to meet the purposes restrictively listed in the instruction. 15. Thirdly, as the processing is necessary for the public interest mission, in particular to ensure that asylum seekers and beneficiaries of international protection can benefit from the mechanisms dedicated to them, it falls under the provisions of e) of Article 6 of Regulation (EU) 2016/679 cited above, as the consent of the interested parties for the transmission of data collected by the SIAO to the OFII is not required by the provisions of this article. However, the interested parties must, in accordance with the terms of the instruction, be informed of the existence of this transmission and its purposes at the time of data collection. Furthermore, in the absence of any modification by law or by the instruction of the modalities of data collection by the OFII, the persons questioned may freely refuse to answer the questions asked and must be informed of the absence of consequences of a failure to answer. 16. Fourth, if the applicant associations maintain that some of the data collected are not relevant to the purposes for which they are processed, it appears, first, that the data are not relevant to the purposes for which they are processed, that information relating to the address of the accommodation centre is necessary for the OFII not only to effectively implement the referral of the persons concerned to dedicated accommodation but also to determine whether the accommodation is temporary or not and to draw the consequences on the allocation of the additional amount of the asylum seeker's allowance which is not paid to the applicant who has not demonstrated a need for accommodation or who has access to accommodation or housing free of charge for whatever reason. On the other hand, it follows from the instruction that the transmission of the AGDREF number, the identification number allocated to each foreign national who has undertaken administrative procedures for the right of residence, and data relating to the nationality of the persons concerned, which will only be effective once the procedures required by Regulation (EU) 2016/679 have been completed, will make it possible for the first of these data to ensure, in view of the high risks of homonymy, reliable identification of the persons mentioned in the sixth paragraph of Article L. 744-6 mentioned above and, for the second, to guide them in the dedicated system under the best possible conditions, both in terms of interpretation and prevention of intercommunity conflicts. Consequently, the information to be communicated to the OFII, and which exclusively concerns asylum seekers and beneficiaries of international protection, is sufficiently precise but also necessary to meet the purposes for which it is processed. 17. Fifth, contrary to what the applicant associations maintain, the contested investigation does not implement the planned interconnection between the SI-SIAO and DNA-NG systems, which is the OFII's data processing system and which, according to the very terms of the investigation, will require an amendment to Decree No 2017-665 of 27 April 2017. Furthermore, it does not provide for any interconnection between the SI-SIAO and AGDREF 2 processing systems. As a result, the argument that the instruction, by providing for such interconnections, would not sufficiently ensure data security and confidentiality is in fact lacking and can only be dismissed. Furthermore, the instruction and its technical notices provide for a secure procedure for the transmission of data which will only be accessible for each department to the agents of the corresponding OFII territorial management and to agents working at the OFII headquarters, necessarily within the limits of their attributions and the need to know in view of the purposes for which the data is collected. Consequently, the instruction does not, by itself and in any event, disregard the rules of security and confidentiality. 18. In the sixth place, it emerges from the technical notice relating to data extraction methods that the SIAO will not be able to keep the files downloaded monthly for more than three months from the date of their transmission to the OFII. Consequently, since the instruction specifies the purposes for which the data is collected by the SIAOs, the information which must be transmitted in order to respond to them and their recipients, the applicant associations are not entitled to maintain that the contested instruction is unlawful for lack of having supervised the management of the file by the OFII, which is responsible for ensuring that the retention period for the files transmitted does not exceed that necessary in the light of the purposes for which they are processed. 19. It follows from all of the above that the means derived from the disregard of the right to the protection of personal data and the right to privacy are unfounded. With regard to the plea alleging disregard for the provisions of the Code of Social Action and Families relating to emergency accommodation : 20. Under article L. 345-2-2 of the Code of Social Action and Families, "A... homeless persons in situations of medical, psychological or social distress have access at all times to emergency accommodation (...)". Article L. 345-2-3 of the same Code stipulates that: "A... a person accommodated in an emergency accommodation facility must be able to benefit from personalized support and remain there, if he or she so desires, until guidance is offered to him or her. This orientation is made towards a stable accommodation or care structure, or towards an accommodation, adapted to his situation". It follows from these provisions that the asylum seeker or beneficiary of protection must be able to stay in emergency accommodation until orientation is offered. Thus, the instruction cannot and does not intend to prohibit access to emergency accommodation for asylum seekers or beneficiaries of international protection or to exclude them from it. Consequently, the argument that the investigation infringes the above-mentioned provisions is unfounded. As regards the plea alleging infringement of the right to respect for the home: 21. The applicant associations challenge the provisions of the instruction maintaining the intervention in emergency accommodation of teams made up of prefecture and OFII agents, as provided for in the circular of 12 December 2017 relating to the examination of administrative situations in emergency accommodation. However, these agents are exclusively responsible for collecting, from the people accommodated who agree to talk to them, the information that these people wish to communicate to them and that no power of constraint is conferred on the agents called upon to go to the accommodation facilities, either with regard to the people accommodated or to the managers of the accommodation facilities. In particular, the instruction shall not constitute a title to enter private premises without the consent of the persons concerned. In those circumstances, the applicant associations are not entitled to maintain that the authors of the contested investigation disregarded the right to respect for private life, in particular the inviolability of the home, guaranteed by Article 2 of the Declaration of the Rights of Man and of the Citizen and by Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms. 22. It follows from the foregoing that the applicant associations are not entitled to seek annulment on the ground of misuse of powers of the interministerial instruction of 4 July 2019. The form of order sought at the end of the suspension : 23. Since their claims for annulment are thus adjudicated upon, the claims submitted by the applicant associations for suspension of the execution of the contested investigation have become devoid of purpose. There is therefore no need to adjudicate on them. The forms of order sought under Article L. 761-1 of the Code of Administrative Justice : 24. It follows from the foregoing that the conclusions submitted by the applicant associations on the basis of Article L. 761-1 of the Code of Administrative Justice can only be rejected. D E C I D E : -------------- Article 1: The interventions of the Christian Association for the Coordination of Mutual Aid and Solidarity and of the Departmental Union of Reception and Social Emergency are admitted. Article 2: There is no need to refer to the Constitutional Council the priority question of constitutionality raised by the Fédération des Acteurs de la Solidarité and others. Article 3: The request of the Federation of Solidarity Actors and Others, registered under No. 434376, is rejected. Article 4: There is no need to rule on the application of the Federation of Solidarity Actors and Others registered under No. 434377. Article 5: This decision shall be notified to the Fédération des Acteurs de la Solidarité, first named, for all applicants, to the Minister for Territorial Cohesion and Relations with Local Authorities, the Minister for Solidarity and Health and the Minister of the Interior. Copies will be sent to the Constitutional Council, the Prime Minister, the Human Rights Defender and the French Office of Immigration and Integration.
