French Legislation on CRIS

1. French Legislation on CRIS Jacques Millet millet@dsi.cnrs.fr

2. Nominative process - a definition • A process may be directly nominative • that is, a process that makes use of a person’s identity ; • Or it may be indirectly nominative • where a person can be identified, even if its name is not clearly mentioned : through secondary • information such as administrative number or code, telephone number, electronic address, cross-checking of non nominative information… • All of the following processes should be declared before the CNIL • Electronic directories • Personal Web sites • Bibliographic Lists • Scientific electronic forums • … French legislation on CRIS

3. Privacy protection • Every individual whose personal information is subject to an automated procedure must be • precisely informed of both its purpose and finality ; • He has at all times the right of access and the right of rectification and, under certain • conditions, the right of withdrawal ; • He must be informed, if applicable, of all new dissemination modalities. French legislation on CRIS

4. Internet impact of French regulations on nominative date processing continued • Applicable recommandations by the Commission • The display of personal information must be done so as to discourage its capture • (no downloading facilities, avoidance of listed items, breakdown of the information in several • arborescences…) ; • Mention in clear that any published personal information is not delicated for electronic • capture in order to constitute or supply other databases (for commercial or advertizing • purposes, for instance) ; in fact, such data capture is strictly prohibited for all countries ; • Ongoing work with the Commission : new propositions promoted by the CNRS • Building a centralized national procedure of declaration, covering all processes common to all • administrative levels of the CNRS • & that could be generalized to other French research organizations. French legislation on CRIS

5. Other French legal indirect limitations in CRIS European dissemination • Compulsory usage of French language on the national territory • « In all designation, offer, presentation (…) of a good, product or service, (…) the use of French • language is obligatory. This clause applies to all writen, spoken or audio-visual publicity. » • (Law of Aug. 4, 1994, Art. 2 on the usage of French language.) French legislation on CRIS

6. Towards a transnational regulation • The French legal limitations in CRIS ’s national and international usage is inappropriate to the • internationalism of Internet ; • There is a need to create a genuine Internet regulation with an international span ; • Such regulation would table on the autoregulation implicitly observed by the community of its users • (strong legitimity of the Netetiquette), albeit supported by explicit Codes of good practices, an • International Regulation Agency of the Internet and national Observatories of the evolution of • information & communication technologies. (State council report, Jul. 2, 1998.) French legislation on CRIS

7. European Initiatives • «The Member States shall provide that the transfer to a third country of personal data which are • undergoing processing or are intended for processing after transfer may take place only if (…) • the third country in question ensures an adequate level of protection. » (Directive 95/46/EC of • the European Parliament & of the Council of 24 Oct. 1995 on the protection of individuals with regard to the processing of personal • data on the free movement of such data, Art. 25 § 1) • Applicable national legislation (that is : the country where the process took place) are meant • to be harmonized within European countries (before Nov. 1998, but not in third countries) ; • As for France : The European Directive is in total adequation with the French Commission’s • element of doctrine on the citizen’s right, without justification, to oppose himself against the • cession of personal data to third parties ; • Need to build an international convention on the basis of the European Directive ; • Need for an International Regulation Agency (not yet established). • Full text of the cited Directive • http://europa.eu.int/eur-lex/en/lif/dat/en_395L0046.htlm French legislation on CRIS