CE - 474251
From GDPRhub
| CE - 474251 | |
|---|---|
 | |
| Court: | CE (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 12 GDPR Article 13 GDPR Article 14 GDPR Article 21(1) GDPR Article 1 Décret n° 2023-255 du 6 avril 2023 |
| Decided: | 08.07.2024 |
| Published: | |
| Parties: | La Ligue des droits de l'Homme Le Conseil national des barreaux |
| National Case Number/Name: | 474251 |
| European Case Law Identifier: | ECLI:FR:CECHR:2024:474251.20240708 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | French |
| Original Source: | Conseil d'État (in French) |
| Initial Contributor: | wp |
The Supreme Administrative Court held that the decree governing the processing of data relating to the care of minors returning from areas with terrorist activity is in line with the data processing principles set out in Article 5 GDPR.
English Summary
Facts
Several applicants, including the The Human Rights League (la Ligue des droits de l'Homme) and the National Council of Bar Associations filed requests to The Supreme Administrative Court of France to annul the Decree of 6 April 2023. The applicants brought forward a number of charges against the Decree, including unclear purpose of the Decree, its interference with the principle of data minimisation, right to information, right to object and the security of data.
The Decree authorised the implementation of automated processing of personal data relating to the care of minors returning from areas of operation of terrorist groups. The processing covered the data of French minors, minors presumed to be French minors, as well as foreign minors present in French territory, who lived in or transited through the Iraqi-Syrian zone or any other area in which terrorist groups operate. The data included the data identifying minors, their current situation (family, judicial, administrative, medical and educational) and identification data of persons exercising the parental authority.
Holding
The court rejected all requests.
At the beginning the court ruled out the allegation of incompetence of the regulatory power by referring to the legal basis of the Decree (Article 34 of French Constitution). Then, it explained why data-principles charges against the Decree were unfounded.
First, regarding the purpose of the Decree, the court emphasised it was precisely indicated in Article 1 of Decree. The idea that stood behind the Decree was to better help minors coming from the areas exposed to terrorist groups operations. The processing of the data aimed at providing the minors with appropriate care and prevent them from getting involved in criminal activities as well as spreading radicalism. Hence, it was obvious that processing of data under the Decree served legitimate public interest and, as such, did not unlawfully interfere with the privacy of minors.
Second, the principle of data minimisation was not violated. The scope of data processed under the Decree covered the data necessary for the purpose of the Decree, namely providing the appropriate care. For this reason, the data of persons exercising the parental authority was also relevant, especially to better coordinate offered care.
Third, the security and confidentiality of the data was not diminished. The court explained that access to data by different authorities in order to fulfil their duties as such did not influence the security of data.
Fourth, the retention period set forth by the Decree was not contrary to the GDPR. Because of the purpose of data processing and the Decree itself, it was necessary to store the data as long as the minor comes of age.
Fifth, the Decree did not violate the right to information as suggested by the applicants. The court clarified that neither Article 12 GDPR nor Article 13 or Article 14 required the Decree to contain dedicated provisions on right to information. In its opinion on the Decree, the French DPA (CNIL) confirmed it was a duty of the data controller to properly ensure adherence with the right to information.
Sixth, the exemption from Article 21(1) GDPR provided for by the Decree did not violate the GDPR. Bearing in mind the purpose of the Decree, the exemption was created in accordance with Article 23 GDPR, as it served the public interest objective.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Full Text FRENCH REPUBLIC IN THE NAME OF THE FRENCH PEOPLE Considering the following procedures: 1° Under number 474251, by a summary request, a complementary brief and a new brief, registered on May 16, August 16, 2023 and March 21, 2024 at the litigation secretariat of the Council of State, the League of Human Rights Man, Mr D... G..., Mrs C... F..., Mr H... B... and Mrs I... B... ask the Council of State: 1°) to cancel for excess of power Decree No. 2023-255 of April 6, 2023 authorizing the creation of automated processing of personal data relating to the care of minors returning from areas of operations of terrorist groups (MRZOGT); 2°) to charge the State the sum of 4,000 euros under article L. 761-1 of the administrative justice code. 2° Under number 474841, by a summary request and a complementary brief, registered on June 6 and September 1, 2023 at the litigation secretariat of the Council of State, the National Bar Council requests the Council of State: 1°) to cancel for excess of power Decree No. 2023-255 of April 6, 2023 authorizing the creation of automated processing of personal data relating to the care of minors returning from areas of operations of terrorist groups (MRZOGT); 2°) to charge the State the sum of 6,000 euros under article L. 761-1 of the administrative justice code. .................................................. .................................. 3° Under number 474908, by a summary request and a complementary brief, registered on June 8 and September 11, 2023 at the litigation secretariat of the Council of State, Mr. A... E... asks the Council of State: 1°) to cancel for excess of power Decree No. 2023-255 of April 6, 2023 authorizing the creation of automated processing of personal data relating to the care of minors returning from areas of operations of terrorist groups (MRZOGT); 2°) to charge the State the sum of 3,000 euros under articles L. 761-1 of the administrative justice code and 37 of the law of July 10, 1991. .................................................. .................................. Considering the other documents in the files; Seen : - the Constitution ; - the European Convention for the Protection of Human Rights and Fundamental Freedoms; - the international convention on the rights of the child signed in New York on January 26, 1990; - the Charter of Fundamental Rights of the European Union; - Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016; - the internal security code; - Organic Law No. 2011-333 of March 29, 2011; - Law No. 78-17 of January 6, 1978; - the administrative justice code; After hearing in public session: - the report of Mrs Alexandra Poirson, auditor, - the conclusions of Mr. Laurent Domingo, public rapporteur; The floor having been given, after the conclusions, to the SCP Spinosi, lawyer of the Human Rights League and others, to the SCP Piwnica and Molinié, lawyer of the National Bar Council and to the SCP Ohl, Vexliard, lawyer of Mr. E...; Considering the following: 1. The decree of April 6, 2023 creates automated processing of data concerning French minors or presumed to be such, as well as foreign minors present on French territory, having actually stayed in the Iraqi-Syrian zone or any other zone of operations of terrorist groups. This processing includes information relating to the identification of these minors, their family situation, their method of return to France and their legal, administrative, medical and educational care. 2. By three requests, the Human Rights League and others, the National Bar Council and Mr. E... request the annulment of this decree for excess of power. It is necessary to join them to rule by a single decision. On the request presented by the National Bar Council: 3. The National Bar Council, a public utility establishment with legal personality established by article 15 of the law of December 31, 1990 relating to the reform of certain judicial and legal professions, has the main purpose of representing the profession of lawyer with public authorities. The contested decree does not have sufficiently direct and certain impacts on the conditions of exercise of the legal profession for the National Bar Council to justify an interest giving it the right to request its annulment for excess of power. On the interventions: 4. Any person who demonstrates a sufficient interest having regard to the nature and subject of the dispute is admissible to file an intervention, before the trial judge as well as before the judge of cassation. 5. Firstly, the French Lawyers' Union and the Magistrates' Union argue that their statutory purpose is to defend the professional rights and interests of the members of the professions they represent. On the one hand, if the Magistrates' Union takes advantage of the fact that the data processing authorized by the contested decree provides that the magistrates of the public prosecutor's office are among the accessors to the file and that the rights of defense of the parents of the minors concerned would be affected, the contested provisions are not likely to affect the employment and working conditions of the judicial magistrates whose collective interests it defends and do not in themselves infringe their rights and prerogatives. He therefore does not demonstrate an interest giving him standing to request the annulment of the provisions he is contesting. On the other hand, the French Lawyers' Union does not claim any harm to the collective interests of lawyers caused by the contested decree. These professional unions, whose purpose is governed by the provisions of Article L. 2131-1 of the Labor Code, cannot usefully rely on the general terms of their statutes relating, for the first, to the defense of rights and freedoms with constitutional value or guaranteed by international conventions and, for the second, with the objective of taking any action to defend the rights of defense and freedoms in the world. 6. It follows from the above that the intervention of the Magistrates' Union and that of the French Lawyers' Union are not admissible. 7. Secondly, for the reasons mentioned in point 3, the National Bar Council does not demonstrate an interest giving it standing to intervene in support of the request of the League for Human Rights and others. On the external legality of the contested decree: 8. Firstly, under the terms of article 34 of the Constitution: “The law establishes the rules concerning: / civil rights and the fundamental guarantees granted to citizens for the exercise of public freedoms”. Under the terms of article 31 of the law of January 6, 1978: "I.- Are authorized by order of the competent minister(s), taken after reasoned and published opinion of the National Commission for Information Technology and Liberties, the processing personal data implemented on behalf of the State and: / 1° Which concern State security, defense or public security (...) / II. on data mentioned in I of Article 6 are authorized by decree in the Council of State taken after reasoned and published opinion of the commission (...) ". The contested decree authorizes the implementation of processing of personal data on the basis of article 31 of the law of January 6, 1978. It has neither the purpose nor the effect of establishing rules concerning guarantees fundamental rights granted to citizens for the exercise of public freedoms falling within the competence of the legislator under article 34 of the Constitution. The argument based on the incompetence of the regulatory power can only be rejected. 9. Secondly, it does not appear from the documents placed in the file that the contested decree would include provisions which would differ both from the initial draft and from the text adopted by the interior section of the Council of State. Consequently, the argument based on ignorance of the rules governing the examination by the Council of State of draft decrees in the Council of State must be rejected. On the internal legality of the contested decree: With regard to the purposes of the processing: 10. Under the terms of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms: “1. Everyone has the right to respect for their private and family life, their home and their correspondence. / 2. There can only be interference by a public authority in the exercise of this right to the extent that this interference is provided for by law and that it constitutes a measure which, in a democratic society, is necessary for the national security, public safety, the economic well-being of the country, the defense of order and the prevention of criminal offenses, the protection of health or morals, or the protection of rights and freedoms of others.” Under the terms of Article 7 of the Charter of Fundamental Rights of the European Union: "Everyone has the right to respect for their private and family life, their home and their communications." Under the terms of article 8 of this same charter: "1. Everyone has the right to the protection of personal data concerning them. / 2. These data must be processed fairly, for specific purposes and on the basis of consent of the person concerned or by virtue of another legitimate basis provided for by law Every person has the right to access the data collected concerning them and to obtain their rectification / 3. Compliance with these rules is subject to. control of an independent authority. 11. Interference in the exercise of the right of any person to respect for their private life constituted by the collection, storage and processing, by a public authority, of nominative personal information, can only be legally authorized if it serves legitimate purposes and that the choice, collection and processing of data are carried out in an adequate and proportionate manner with regard to these purposes. 12. Firstly, no conventional stipulation, no legislative or regulatory provision nor any principle prevents the authorization of the recording, in data processing, of data relating to minors, provided that, in accordance with the general requirements applicable to the processing of personal data, interference in the exercise of the right of any person to respect for their private life complies with the requirements set out in point 11. 13. In accordance with Article 1 of the contested decree, the authorized processing is intended to "enable better coordination of the competent services in matters of administrative, judicial, medical and socio-educational care of minors returning from areas of operations of terrorist groups, with a view to ensuring their protection and preventing their involvement in a process of delinquency or radicalization. 14. It appears from the documents in the file that the data processing thus created is implemented within the framework of the monitoring, by the services of the State and local authorities, of minors who have lived in areas of operations of terrorist groups or having transited there, returning to the national territory, in accordance with the Prime Minister's instruction of March 23, 2017 relating to the care of minors returning from the Iraqi-Syrian zone, which involves the systematic intervention of the children's judge as part of educational assistance measures, and aims to ensure adequate care for these minors and to prevent their possible involvement in a process of delinquency or radicalization. Instituted in the interest of the minors concerned and in the interest of public order, this processing meets legitimate general interest purposes. Taking into account the guarantees it provides, the processing in dispute does not cause a disproportionate and discriminatory attack on the private life of the minors concerned. It follows that the argument that it would harm the best interests of the child and constitute an illegal interference in their private life must, in view of the objective pursued by the processing, be rejected. 15. Secondly, the situation of minors returning from areas of action of terrorist groups differs, with regard to the object of the decree and its purposes, from that of other minors found on French territory. Consequently, the argument that the contested decree would be contrary to the principle of equality in that it would treat the minors concerned differently must be rejected. Regarding the data collected: Regarding the principle of data minimization: 16. By virtue of the so-called “data minimization” principle mentioned in paragraph 1 (c) of Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR), the data to be personal nature collected must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. The Human Rights League maintains that this principle would be disregarded in that the data collected for minors would not be justified and in that data relating to the parents of the minors concerned would be collected. 17. It appears, on the one hand, from the documents in the file that the data collected for minors relate to the identification of the minor, their family situation, their care arrangements, whether it concerns care judicial, administrative, medical or educational charge. Such data is necessary for the coordination of the monitoring of these minors and limited to the purpose of the processing. On the other hand, if the contested decree also provides for the recording, in the processing, of data relating to the parents, and, where applicable, to other persons exercising parental authority over the minors concerned, it appears from the documents in the file that the collection of this information, which is limited to the identification of the persons concerned and, for the parents, to their possible legal assistance, is necessary and adapted with regard to the purposes of the processing, which aims to enable better coordination of the competent services for the administrative, judicial, medical and socio-educational care of these minors. Consequently, the argument based on ignorance of the principle of data minimization must be rejected. Regarding data security and confidentiality in the context of access and communication: 18. On the one hand, the persons mentioned in Article 5 of the contested decree are only authorized to access or obtain communication of all or part of the data of the disputed processing "within the limits of the need to know". This notion, which is also common in acts creating the processing of personal data, requires that the data in question be necessary for the exercise of the powers assigned to the author of the request. Contrary to what is claimed, the circumstance that representatives of several administrations are among the accessors and recipients of the processing, which corresponds, moreover, to the very purpose of the processing which is to allow the sharing of information for monitoring multidisciplinary of minors, is not likely to establish that the data processed would be subject to an insufficient level of security and confidentiality. Consequently, the argument that the decree would not sufficiently ensure the security and confidentiality of data or, in any event, that it would be tainted with negative incompetence by failing to define the conditions sufficiently precisely exercise of access to processing data, can only be excluded. 19. On the other hand, if the applicants maintain that the decree should have provided for a prior procedure making it possible to assess requests for access in order to verify the necessity of communicating the data transmitted, as well as their limitation, but also a measure of security relating to the sharing of confidential information between participants in departmental monitoring units for the prevention of radicalization and support for families in restricted training (CPRAF-R), with regard to the provisions of article 57 of the law of January 6, 1978, these provisions, which relate to the obligations of the controller in the operation of the latter, cannot be usefully invoked in support of conclusions directed against the act by which the processing is authorized. The same applies to the argument based on the absence of effective prior control of access to data by a court or an independent administrative authority, in the case of processing which does not relate to traffic data or location data. Regarding the shelf life: 20. Under the so-called “limitation of retention” principle mentioned in paragraph 1 e) of Article 5 of the GDPR, the personal data collected must be kept for a period not exceeding that necessary for the purposes of the GDPR. purposes for which they are processed. If the applicants maintain that the retention of data until the date on which minors reach majority, regardless of their individual trajectory, disregards this requirement, it appears from the documents in the file that this duration is consistent with the legitimate purpose which constitutes the coordination of their care until they reach the age of majority. The circumstance that the duration of logging, that is to say the duration during which the traceability of accesses and actions on the processing is kept, is where applicable less than the duration of conservation of the processing data is devoid of impact on the legality of the contested decree. Regarding the right to information and the right to object: 21. On the one hand, paragraph 1 of Article 12 of the GDPR provides that: "The data controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 as well as to carry out any communication under Articles 15 to 22 and Article 34 with regard to the processing of the data subject in a concise, transparent, understandable and easily accessible manner, in clear and simple terms, in particular for any information intended specifically for a child ( ...) ". Article 14 of this same regulation specifies the information that must be provided to the persons concerned. These provisions do not require that the methods of implementing the information of the persons concerned be provided for by the decree establishing the processing. Moreover, it appears from the documents in the file, in particular from the deliberation of the National Commission for Information Technology and Liberties No. 2022-108 of November 3, 2022 giving an opinion on the draft decree under attack, that this right to information of the persons concerned by the disputed processing will be guaranteed by the data controller, through media adapted to the recipients of this information. 22. On the other hand, article 21 of the GDPR, to which article 56 of the law of January 6, 1978 refers, provides that the right of opposition does not apply when the processing meets a legal obligation or, under the conditions provided for in Article 23 of the same regulation, when the application of these provisions has been ruled out by an express provision of the act establishing the processing. Paragraph 1 of Article 23 of the GDPR authorizes national authorities to limit the scope of the right to object "when such limitation respects the essence of fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society to guarantee: (...) i) the protection of the person concerned or of the rights and freedoms of others". It follows from these provisions that the decree authorizing the implementation of processing of personal data or specifying the terms of processing created by law may include an express provision excluding the exercise of the right of opposition therefore that this exclusion is necessary and, having regard in particular to the nature of the data, the purposes pursued and the guarantees provided, proportionate to achieve important objectives of public interest. Having regard to the public interest objective of the protection of minors pursued by the processing and the need, for this purpose, to have exhaustive information, the plea based on the fact that the restriction placed on the right of opposition by Article 6 of the contested decree would not be justified must be rejected. 23. It follows from all of the above that the League for Human Rights and others and Mr. E... are not justified in requesting the annulment for abuse of power of the decree they are attacking. Therefore, their conclusions must be rejected, including those presented under article L. 761-1 of the administrative justice code. DECIDED : -------------- Article 1: Interventions by the French Lawyers' Union, the Magistrates' Union and the National Bar Council are not permitted. Article 2: The requests of the Human Rights League and others, of the National Bar Council and of Mr. E... are rejected. Article 3: This decision will be notified to the Human Rights League, the first applicant named under number 474251, to the National Bar Council, to Mr. A... E..., to the French Lawyers' Union, to Judicial Union, to the Prime Minister and the Minister of the Interior and Overseas Territories. Deliberated at the end of the session of June 19, 2024 at which sat: Mr. Jacques-Henri Stahl, deputy president of the litigation section, presiding; Mr. Bertrand Dacosta, Ms. Anne Egerszegi, presidents of chambers; Mr Olivier Yeznikian, Mr Nicolas Polge, Mr Vincent Daumas, Ms Rozen Noguellou, Ms Isabelle Lemesle, State Councilors and Ms Alexandra Poirson, auditor-rapporteur. Returned July 8, 2024. President : Signed: Mr. Jacques-Henri Stahl The rapporteur: Signed: Mrs Alexandra Poirson The Secretary : Signed: Mr. Hervé Herber ECLI:FR:CECHR:2024:474251.20240708
