Those who process personal data concerning other people must comply with to the following principles:
1 - The principle of legitimacy
The processing of personal data is allowed only if there is a legitimate reason to justify it. Anyone who wants to process data concerning you must ask for your consent beforehand. Besides, data processing is also permitted if it is essential in order to fulfil a contract, a task in the public interest or a legal obligation, or to protect your own life. Finally, the processing can be legitimate if there is a justified interest, provided the processing of your data has only a minimal effect on your privacy.
This first criterion is used to determine whether the processing is legal. It answers the question of when your data can be requested and used. The next principles describe the rules that must be observed when processing your data.
They answer the question of how your data can be processed.
2 - The principle of purpose
The use of your personal data (including images and sounds) must be rigorously confined to a purpose which has been explicitly determined beforehand.
The collection, recording and use of your personal data are strictly limited to what is necessary to achieve the aims specifically declared in advance by the authority, agency, company, association, professional or self-employed worker involved.
These users cannot disclose the data to other organisations or people, unless it is needed to accomplish the same aims.
Following an accident at work, your employer tries to find out about your state of health from your GP. Thinking she is doing the right thing in reassuring him, the doctor’s assistant provides information on the doctor’s diagnosis.
In doing so, she is transgressing the purpose for which the medical practice holds this information, i.e. in order to provide health care.
3 - The principles of necessity and proportionalit
The principle of proportionality ensures that the processing of your personal data is limited to cases where there is a direct connection with the initial purpose of the processing. The information must not only be useful, but also necessary to whoever is processing your data. The data being processed must not be excessive in relation to the aim pursued.
When booking a table at a restaurant by telephone, the manager of the establishment asks you to supply your credit card number.
This information should be regarded as excessive in relation to the aim being pursued, which is only to arrange available tables.
4 - The principle of the accuracy of data
As inaccurate or incomplete information can harm the person to whom it relates, every effort must be made to ensure the data being processed is correct and up-to-date. If this is not the case, the personal data must be rectified or erased.
The law also protects you against any negative decision automatically taken about you by a computer, without you being able to put forward your personal point of view.
You are applying to your bank for a personal loan to buy some furniture. After submitting your application via the Internet, you immediately receive a negative reply from your bank which refuses to grant you the requested loan. It transpires that no bank adviser has been involved, but that your application has been assessed using a software which evaluated your request upon pre-established ratios and statistics.
In this event, you have the right to insist on your application being re-examined on the basis of an interview with your bank adviser who should listen to your argumentation. During this interview, you might point out, for example, that your financial situation has recently improved thanks to an inheritance. It could even be possible that the figures used where incorrect or that there was a mix-up with a dept-ridden person of the same name.
5 - The principle of fairness
Your personal data must be collected, recorded, used and communicated fairly, and with your knowledge. Also, your data must be erased or rendered anonymous as quickly as possible. Subsequent use of your personal data for purposes other than those stipulated from the outset is prohibited as a rule.
Your supermarket offers you a loyalty card to give you special discounts on your shopping or an end-of-year rebate. As you subsequently pass through the checkout, the contents of your basket are recorded and used to build a consumer profile, which will be monitored on a regular basis.
If this is done without your knowledge, and if you weren’t informed about it when signing up, the principle of fairness has been violated.
6 - The principle of security and confidentiality
Your personal data must be processed in a confidential manner and stored in safe forms and places.
In the event of non-compliance with this principle, the person who processes your data assumes personal responsibility. This includes the individual behaviour of employees, and contracts entered into with subcontractors (suppliers for instance) as well as the choice of technical equipment (in terms of computer security).
You want to change your mobile phone network. However, having looked at your application, the sales consultant of the company you have just chosen refuses to accept you as a new client. This person, who used to work as a sales agent for your previous GSM operator, refers to a dispute over a bill which you had with the first company.
By allowing its sales agents to obtain information from its accounts department, your previous GSM operator failed to ensure that personal information on its clients could be accessed by those employees really needing it for their work.
So, was the staff property warned against the temptations of misusing client-related data? How was the sales agent able to bring a client file from his old employer to his new employer? Was the file stolen?
Whatever the case, the security measures and internal organisation of the company were inadequate in terms of maintaining the confidentiality of personal data. The management which failed in its legal obligations, as well as the unscrupulous employee are to blame for this.
7 - The principle of transparency
The law guarantees that you can obtain the information you need about the processing operations performed on your personal data and gives you the opportunity to exercise personal control. Anyone who wants to process your personal data must notify you when the data is collected or in the event of your data being communicated to third parties.
You have the right to request details of the personal information on record and about its use, you also have the right to demand that any data not processed in accordance with the law be deleted. The registration of databases with the CNPD contributes to transparency.
The public register of the processing of personal data will be accessible via its website.
Seeing that you have been in a state of exhaustion for a long time, your GP suggests having your blood analysed to determine the causes of your fatigue. The blood sample is taken by an external laboratory, which sends the results of this analysis to your doctor. It turns out that an HIV test has been done without your knowledge.
This constitutes a breach of the principles of transparency and loyalty.
8 - Particularly sensitive information is subject to even more stringent protection
The processing of personal information which reveals your opinions and beliefs, or which relates to your state of health or your sex preferences, including your genetic data, is prohibited, apart from a few exceptions which are enumerated in a restrictive way in the law.
Data being processed in accordance to these exceptions must in principle be notified to the CNPD. Processing of genetic data must even be explicitly authorized by the CNPD.
At a job interview, the company’s Human Resources Manager to whom you are presenting yourself asks you what you think about financing retirement and the respective views of the political parties on this subject. He also makes it known to you that he keeps a list of employees who are members of trade unions.
Gathering this kind of information (sensitive data) is normally prohibited by the law.
9 - Surveillance (via audio, video, data) of identifiable people is strictly limited by law
An authorisation from the CNPD is in principle required before using technical means for monitoring people, particularly by video camera, electronic tracing, etc. Personal data gathered in this way can only be processed under certain very specific circumstances enumerated by the law. This includes surveillance on public premises, in public transportation, in shopping centres and also at your workplace. In the latter case, surveillance cannot be undertaken unless the staff representatives, joint committee or the Inspection du travail et des mines and yourself, have been previously informed.
Your telephone conversations are recorded by the company you work for, without you having been told beforehand.
This is contrary to the principle of transparency. Furthermore, the employer requires authorisation from the CNPD, which is responsible for verifying the legitimacy and proportionality of such a practice.
10 - Use of your personal data for advertising or marketing purposes requires your permission
You may object to the use of your personal data for commercial purposes at any time. Direct marketing using modern means of communication (SMS, e-mail, etc) is in principle prohibited if you haven’t given your consent.
Being assailed with junk mail, you can require the business stores and commercial companies to stop sending this mail.
It turns out that the company sending the personalised mailings is sponsor to your sports club from whom it received your address as well as the database of all the club members. The club should not have communicated its file of recordings concerning its members as the information contained is only meant to be used to manage the club and organise its activities.
This unlawful misuse of the purpose for which the personal data was given is a breach of data protection law as well as an offence that is subject to punishment.