LAW RELATING TO THE PROTECTION OF INDIVIDUALS WITH REGARD TO THE PROCESSING OF PERSONAL DATA
The Constitutional Council has been seized, under the conditions provided for in article 61, second paragraph, of the Constitution, of the law relating to the protection of individuals with regard to the processing of personal data and amending law no. ° 78-17 of January 6, 1978 relating to data processing, files and freedoms, July 20, 2004, by Mr. Jean Marc AYRAULT, Ms. Patricia ADAM, Sylvie ANDRIEUX BACQUET, MM. Jean Marie AUBRON, Jean-Paul BACQUET, Gérard BAPT, Claude BARTOLONE, Jacques BASCOU, Christian BATAILLE, Jean-Claude BATEUX, Éric BESSON, Jean Louis BIANCO, Jean-Pierre BLAZY, Serge BLISKO, Patrick BLOCHE, Jean Claude BOIS, Maxime BONO , Augustin BONREPAUX, Jean Michel BOUCHERON, Pierre BOURGUIGNON, Mrs Danielle BOUSQUET, MM. François BROTTES, Thierry CARCENAC, Christophe CARESCHE, Mrs Martine CARILLON COUVREUR, MM. Laurent CATHALA, Jean Paul CHANTEGUET, Alain CLAEYS, Gilles COCQUEMPOT, Pierre COHEN, Mrs. Claude DARCIAUX, Mr. Michel DASSEUX, Mrs. Martine DAVID, MM. Marcel DEHOUX, Bernard DEROSIER, Marc DOLEZ, François DOSÉ, René DOSIÈRE, Julien DRAY, Tony DREYFUS, Pierre DUCOUT, Jean Pierre DUFAU, Jean-Paul DUPRÉ, Yves DURAND, Henri EMMANUELLI, Claude ÉVIN, Laurent FABIUS, Jacques FLOCH, Pierre FORGUES , Michel FRANÇAIX, Jean GAUBERT, Mmes Nathalie GAUTIER, Catherine GÉNISSON, MM. Jean GLAVANY, Gaétan GORCE, Alain GOURIOU, Ms Elisabeth GUIGOU, Paulette GUINCHARD-KUNSTLER, Mr David HABIB, Ms Danièle HOFFMAN RISPAL, MM. François HOLLANDE, Jean Louis IDIART, Mrs Françoise IMBERT, MM. Serge JANQUIN, Armand JUNG, Jean-Pierre KUCHEIDA, Mme Conchita LACUEY, MM. Jérôme LAMBERT, François LAMY, Jack LANG, Jean LAUNAY, Jean-Yves LE BOUILLONNEC, Gilbert LE BRIS, Jean-Yves LE DÉAUT, Jean LE GARREC, Jean-Marie LE GUEN, Bruno LE ROUX, Mrs Marylise LEBRANCHU, MM. Michel LEFAIT, Patrick LEMASLE, Guy LENGAGNE, Mrs Annick LEPETIT, MM. Jean Claude LEROY, Michel LIEBGOTT, Mrs Martine LIGNIÈRES CASSOU, MM. François LONCLE, Bernard MADRELLE, Christophe MASSE, Didier MATHUS, Kléber MESQUIDA, Jean MICHEL, Didier MIGAUD, Mme Hélène MIGNON, MM. Arnaud MONTEBOURG, Henri NAYROU, Alain NÉRI, Mrs. Marie-Renée OGET, MM. Christian PAUL, Germinal PEIRO, Mmes Marie-Françoise PÉROL DUMONT, Geneviève PERRIN GAILLARD, MM. Jean-Jack QUEYRANNE, Paul QUILÈS, Alain RODET, Bernard ROMAN, René ROUQUET, Mmes Ségolène ROYAL, Odile SAUGUES, MM. Henri SICRE, Dominique STRAUSS KAHN, Pascal TERRASSE, Daniel VAILLANT, André VALLINI, Manuel VALLS, Michel VERGNIER, Alain VIDALIES,
and, the same day, by Mr. Claude ESTIER, Mrs. Michèle ANDRÉ, MM. Bernard ANGELS, Bertrand AUBAN, Robert BADINTER, Jean Pierre BEL, Ms. Maryse BERGÉ LAVIGNE, Mr. Jean BESSON, Ms. Marie-Christine BLANDIN, Mr. Didier BOULAUD, Ms. Yolande BOYER, Claire-Lise CAMPION, MM. Jean-Louis CARRÈRE, Bernard CAZEAU, Mrs Monique CERISIER-ben GUIGA, MM. Gilbert CHABROUX, Gérard COLLOMB, Raymond COURRIÈRE, Yves DAUGE, Marcel DEBARGE, Jean Pierre DEMERLIAT, Claude DOMEIZEL, Michel DREYFUS SCHMIDT, Bernard DUSSAUT, Bernard FRIMAT, Charles GAUTIER, Jean Pierre GODEFROY, Jean-Noël GUÉRINI, Mrs. Odette HERVIAUX, MM. André LABARRÈRE, Serge LAGAUCHE, Louis LE PENSEC, André LEJEUNE, Jacques MAHÉAS, Jean-Yves MANO, François MARC, Jean Pierre MASSERET, Pierre MAUROY, Louis MERMAZ, Gérard MIQUEL, Michel MOREIGNE, Jean-Claude PEYRONNET, Jean François PICHERAL, Bernard PIRAS, Jean Pierre PLANCADE, Mmes Danièle POURTAUD, Gisèle PRINTZ, MM. Daniel RAOUL, Daniel REINER, Roger RINCHET, Gérard ROUJAS, Claude SAUNIER, Michel SERGENT, René Pierre SIGNÉ, Jean Pierre SUEUR, Simon SUTOUR, Michel TESTON, Jean Marc TODESCHINI, Pierre-Yvon TRÉMEL, André VANTOMME, André VÉZINHET and Marcel VIDAL, senators;
THE CONSTITUTIONNAL COUNCIL,
Having regard to the Constitution;
Considering the ordinance n ° 58-1067 of November 7, 1958 modified on the organic law on the Constitutional Council;
Having regard to the Treaty establishing the European Community;
Having regard to the Treaty on European Union;
Having regard to Directive 95/46 / EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
Having regard to the penal code;
Having regard to the intellectual property code;
Having regard to the postal and electronic communications code;
Considering the law n ° 78-17 of January 6, 1978 relating to data processing, files and freedoms;
Considering the law n ° 2004-669 of July 9, 2004 relating to electronic communications and audiovisual communication services, in its article 8;
Having regard to the observations of the Government, recorded on July 23, 2004;
Having regard to the observations in reply presented by the deputies who made the first referral, recorded on 28 July 2004;
Having regard to the observations in reply presented by the senators who made the second referral, recorded on July 28, 2004;
The rapporteur having been heard;
1. Considering that the authors of the two referrals refer to the Constitutional Council the law relating to the protection of individuals with regard to the processing of personal data and amending law n ° 78-17 of 6 January 1978 relating to IT, files and freedoms; that they denounce its unintelligibility and question articles 8, 9, 21, 22 and 26 of the law of January 6, 1978 as they result from articles 2 to 4 of the referred law;
– ON THE CONSTITUTIONAL STANDARDS APPLICABLE TO THE DEFERRED LAW:
2. Considering, in the first place, that under article 2 of the Declaration of the Rights of Man and of the Citizen of 1789: “The aim of any political association is the conservation of the natural and inalienable rights of man. These rights are liberty, property, security and resistance to oppression ”; that the freedom proclaimed by this article implies respect for private life;
3. Considering, in the second place, that it is at any time open to the legislator, acting in the field of his competence, to modify previous texts or to repeal them by substituting, if necessary, with others. provisions, as long as, in doing so, it does not deprive legal guarantees of constitutional requirements;
4. Considering, in the third place, that it is for the legislator, by virtue of article 34 of the Constitution, to lay down the rules concerning the fundamental guarantees granted to citizens for the exercise of public freedoms; that it is up to him to ensure the reconciliation between respect for private life and other constitutional requirements linked in particular to the safeguard of public order;
– ON THE NEW ARTICLE 8 OF THE LAW OF 6 JANUARY 1978:
5. Considering that article 8 of the law of January 6, 1978, in the wording given to it by article 2 of the referred law, provides in its I: “It is prohibited to collect or process personal data which reveal, directly or indirectly, the racial or ethnic origins, political, philosophical or religious opinions or trade union membership of persons, or which relate to their health or sexual life ”; that 5 ° of II of the same article 8 provides that, to the extent that the purpose of the processing so requires, this prohibition does not apply to “processing necessary for the establishment, exercise or defense of a right to justice ”;
6. Considering that the authors of the referrals maintain that this last provision infringes respect for private life;
7. Considering that under article 88-1 of the Constitution: “The Republic participates in the European Communities and the European Union, made up of States which have chosen freely, by virtue of the treaties which established them, to jointly exercise some of their skills ”; that thus, the transposition into internal law of a Community directive results from a constitutional requirement which could not be obstructed except by reason of an express contrary provision of the Constitution; that in the absence of such a provision, it is only for the Community courts, seized if necessary for a preliminary ruling,
8. Considering that the provisions criticized are limited to drawing the necessary consequences from the unconditional and precise provisions of e) of 2 of Article 8 of Directive 95/46 / EC of 24 October 1995 referred to above, on which it does not belong to the Constitutional Council to rule; that as a following, the grievance drawn infringement respect for private life can not be usefully presented before him;
– ON NEW ARTICLE 9 OF THE LAW OF 6 JANUARY 1978:
9. Considering that article 9 of the law of January 6, 1978, in the wording given to it by article 2 of the referred law, provides: “The processing of personal data relating to offenses, convictions and security measures can only be set up by: … – 3 ° Legal persons who are victims of offenses or acting on behalf of said victims for the strict needs of the prevention and fight against fraud as well as compensation for damage suffered, under the conditions provided for by law; – 4 ° The legal persons mentioned in Articles L. 321-1 and L. 331-1 of the Intellectual Property Code, acting under the rights they manage or on behalf of victims of infringements of the rights provided for in books I, II and III of the same code for the purposes of
10. Considering that, according to the authors of the referrals, these provisions infringe respect for private life and are vitiated by negative incompetence;
. Regarding the 3 °:
11. Considering that point 3 of article 9 of the law of January 6, 1978, in the wording given to it by article 2 of the referred law, would allow a legal person of private law, mandated by several other legal persons considering that they have been victims or are likely to be victims of acts punishable by criminal penalties, to gather a large amount of personal information relating to offenses, convictions and security measures; that due to the extent of the processing of personal data thus implemented and the nature of the information processed, point 3 of the new article 9 of the law of 6 January 1978 could affect, by its consequences, the right to respect for private life and the fundamental guarantees granted to citizens for exercise of public freedoms; whereas the provision criticized must therefore include appropriate and specific guarantees meeting the requirements of Article 34 of the Constitution;
12. Considering that, as regards the object and the conditions of the mandate in question, the contested provision does not provide these details; whereas it is ambiguous as to the offenses to which the term “fraud” applies; that it leaves unspecified the question of knowing to what extent the data processed could be shared or transferred, or even if there could be included persons on whom the simple fear weighs that they are capable of committing an offense; that it does not say anything on the limits likely to be assigned to the conservation of the mentions relating to the convictions; that with regard to article 34 of the Constitution, all these details cannot be provided by the authorizations issued by the National Commission of IT and freedoms; that in the present case and having regard to the matter concerned, the legislator could not be satisfied either, as provided for in the provision criticized, clarified by the parliamentary debates, to lay down a rule of principle and to dismiss them in full. modalities of application to future laws; that, consequently, the 3 ° of the new article 9 of the law of January 6, 1978 is tainted with negative incompetence;
. Regarding the 4 °:
13. Considering that the contested provision gives the possibility to collecting and managing societies of copyright and neighboring rights, mentioned in Article L. 321 1 of the Intellectual Property Code, as well as to defense organizations professional, mentioned in Article L. 331 1 of the same code, to carry out processing operations relating to data relating to offenses, convictions or security measures; that it tends to fight against the new counterfeiting practices which are developing on the Internet; that it thus responds to the general interest objective which is attached to the protection of intellectual property and cultural creation; that the data thus collected cannot, by virtue of article L. 34-1 of the Postal and Electronic Communications Code, acquire a nominative character only in the context of legal proceedings and by reconciliation with information whose retention period is limited to one year; that the creation of the treatments in question is subordinated to the authorization of the National Commission of data processing and freedoms in application of 3 ° of I of the new article 25 of the law of January 6, 1978; that, taking into account all of these guarantees and having regard to the objective pursued, the contested provision is such as to ensure, between respect for private life and other rights and freedoms, a reconciliation which is not clearly unbalanced; legal proceedings and by reconciliation with information whose retention period is limited to one year; that the creation of the treatments in question is subordinated to the authorization of the National Commission of data processing and freedoms in application of 3 ° of I of the new article 25 of the law of January 6, 1978; that, taking into account all of these guarantees and having regard to the objective pursued, the contested provision is such as to ensure, between respect for private life and other rights and freedoms, a reconciliation which is not clearly unbalanced; legal proceedings and by reconciliation with information whose retention period is limited to one year; that the creation of the treatments in question is subordinated to the authorization of the National Commission of data processing and freedoms in application of 3 ° of I of the new article 25 of the law of January 6, 1978; that, taking into account all of these guarantees and having regard to the objective pursued, the contested provision is such as to ensure, between respect for private life and other rights and freedoms, a reconciliation which is not clearly unbalanced; data processing and freedoms in application of 3 ° of I of the new article 25 of the law of January 6, 1978; that, taking into account all of these guarantees and having regard to the objective pursued, the contested provision is such as to ensure, between respect for private life and other rights and freedoms, a reconciliation which is not clearly unbalanced; data processing and freedoms in application of 3 ° of I of the new article 25 of the law of January 6, 1978; that, taking into account all of these guarantees and having regard to the objective pursued, the contested provision is such as to ensure, between respect for private life and other rights and freedoms, a reconciliation which is not clearly unbalanced;
. With regard to the whole of Article 9:
14. Considering that the new article 9 of the law of January 6, 1978, as it results from the declaration of unconstitutionality pronounced by virtue of the above, cannot be interpreted as depriving of effectiveness the right to exercise a legal recourse available to any natural or legal person with regard to offenses of which they have been the victim; that, subject to this reservation, it is not contrary to the Constitution;
– ON THE NEW ARTICLE 21 OF THE LAW OF 6 JANUARY 1978:
15. Considering that by virtue of the last paragraph of article 21 of the law of January 6, 1978, in its wording resulting from article 3 of the referred law, the persons questioned within the framework of the verifications made by the National Commission data processing and freedoms are required to provide the information requested by it for the exercise of its missions “except in cases where they are bound by professional secrecy”;
16. Considering that, according to the applicants, this reference to professional secrecy constitutes “a step backwards with regard to the guarantees provided to the constitutional requirements applicable in the matter”; that they argue that “in the law of 1978, it was not possible to oppose such secrecy to CNIL agents” and that “such a restriction manifestly unbalances the regime for the protection of privacy and the individual freedom of persons whose personal data has been processed ”;
17. Considering that, in the silence of the provisions of the law of January 6, 1978 prior to the referred law, the persons questioned by the National Commission for Informatics and Freedoms were already subject to professional secrecy; that, consequently, the complaint is lacking in fact;
18. Considering, moreover, that the unjustified invocation of professional secrecy could constitute an obstacle punishable by the penalties provided for by the new article 51 of the law of 6 January 1978;
– ON THE NEW ARTICLE 22 OF THE LAW OF 6 JANUARY 1978:
19. Considering that under the terms of the first paragraph of III of article 22 of the law of January 6, 1978, in the wording resulting from article 4 of the referred law: “The processing operations for which the person in charge has appointed a correspondent to the protection of personal data responsible for ensuring, in an independent manner, compliance with the obligations provided for in this law are exempted from the formalities provided for in Articles 23 and 24, except when a transfer of personal data to destination of a State which is not a member of the European Community is envisaged ”;
20. Considering that, according to the applicants, “this correspondent does not benefit, to the letter, from the indispensable guarantees of independence”; that they consider, therefore, that “by providing, under an always desirable simplification, a lessening of the control mechanisms, the legislator deprived of legal guarantee the right to private life and to individual liberty”;
21. Considering, in the first place, that the fact of appointing a correspondent for the protection of personal data has no other effect than to exempt the processing operations from the formalities of declaration to the National Commission for Informatics and freedoms; that this circumstance does not subtract them from the other obligations resulting from the referred law, the non respect of which remains liable to the sanctions that it provides; whereas this simplification of the procedure is not possible when transfers of data to a State which is not a member of the European Community are envisaged; that in addition, it does not concern processing subject to authorization;
22. Considering, secondly, that the correspondent, whose identity is notified to the National Commission for Informatics and Freedoms and brought to the attention of the employee representative bodies, must benefit, by virtue of the law, “ the qualifications required to perform its duties ”; that he keeps the list of treatments available to any person making the request; that he cannot be the object of any sanction on behalf of his employer because of the responsibilities which are entrusted to him in the exercise of his mission; that it can seize the National Commission of the data processing and freedoms, if necessary, of the difficulties which it meets;
23. Considering that, taking into account all the precautions thus taken, in particular with regard to the qualification, role and independence of the correspondent, the exemption from declaration resulting from his appointment does not deprive any legal guarantees of any requirement constitutional;
– ON NEW ARTICLE 26 OF THE LAW OF 6 JANUARY 1978:
24. Considering that under I of article 26 of the law of January 6, 1978, in its wording resulting from article 4 of the referred law: “Are authorized by decree of the competent minister or ministers, taken after advice motivated and published by the National Commission for Informatics and Freedoms, the processing of personal data carried out on behalf of the State and: – 1 ° Which concerns State security, defense or public security ; – 2 ° Or which have as their object the prevention, investigation, observation or prosecution of criminal offenses, or the execution of criminal convictions or security measures. – The opinion of the commission is published with the order authorizing the processing ”;
25. Considering that, according to the applicants, these provisions mark “one of the most obvious setbacks made by this law as regards the level of legal guarantees constitutionally required since today such treatment requires a favorable opinion from the CNIL”; that they consider that this development creates, “with regard to Article 2 of the Declaration of 1789 and individual liberty”, a “constitutionally prejudicial situation”;
26. Considering that the I of article 26 of the law of January 6, 1978 relates to the creation of only processing operations relevant to the protection of public order and not including sensitive data within the meaning of I of its article 8; that it is limited to substituting for an assent from the Council of State in the event of an unfavorable opinion from the National Commission for Informatics and Freedoms a ministerial decree taken after a reasoned and published opinion of the Commission; that the legislator provided that the opinion of the Commission would be published concomitantly with the order authorizing the treatment;
27. Considering, in these conditions, that the provisions criticized, which do not deprive the right to respect for private life of legal guarantees, are not contrary to any principle or to any rule of constitutional value;
– ON THE OBJECTIVE OF CONSTITUTIONAL VALUE OF INTELLIGIBILITY AND ACCESSIBILITY OF THE LAW:
28. Considering that, according to the applicants, “the whole of the text suffers from an opacity which … can only appear contradictory with the objective of intelligibility and clarity of the law”;
29. Considering that it is incumbent on the legislature to exercise fully the competence conferred on it by the Constitution and, in particular, its article 34; that in this regard, the objective of constitutional value of intelligibility and accessibility of the law, which derives from Articles 4, 5, 6 and 16 of the Declaration of 1789, requires it to adopt sufficiently precise provisions and unequivocal formulas;
30. Whereas, if the referred law overhauls the legislation relating to the protection of personal data, it is with a view to adapting this legislation to the development of technical data and practices, as well as to draw the consequences of a community directive; that it defines precisely the new procedural and substantive rules applicable;
31. Considering that there is no reason for the Constitutional Council to raise ex officio any question of conformity with the Constitution,
Article 1 .- Is declared contrary to the Constitution the 3 ° of article 9 of the aforementioned law of January 6, 1978, in its wording resulting from article 2 of the referred law.
Article 2 .- The new articles 8, 21, 22 and 26 of the law of January 6, 1978, as well as, subject to the reservation set out in recital 14, the remainder of its article 9, are not contrary to the Constitution.
Article 3 .- This decision will be published in the Official Journal of the French Republic.
Deliberated by the Constitutional Council in its meeting of July 29, 2004, where sat: Mr. Pierre MAZEAUD, President, MM. Jean Claude COLLIARD, Olivier DUTHEILLET de LAMOTHE, Mrs Jacqueline de GUILLENCHMIDT, MM. Pierre JOXE and Jean-Louis PEZANT, Mrs. Dominique SCHNAPPER, Mr. Pierre STEINMETZ and Mrs. Simone VEIL.
