1. French Legislation on CRIS Jacques Millet millet@dsi.cnrs.fr

2. EuroCRIS - Vienna, October 1998 2 Centre national de la recherche scientifique (France) - Jacques MILLET National Data Processing and Liberties Commission The establishing and use of information systems are subject to the current French laws related to data processing involving personal data (Act 78-17 of Jan. 6,1978). « Data processing shall be at the service of every citizen. It shall develop in the context of international co-operation. It shall infringe neither human identity, nor the rights of man nor privacy, nor individual or public liberties. » All data processing regarding personal information (or scientific information that include nominative data) must be declared before the National Data Processing & Liberties Commission (CNIL Commission nationale Informatique et Libertés). Web server of the Commission : www.cnil.fr (in french). French legislation on CRIS

3. EuroCRIS - Vienna, October 1998 3 Centre national de la recherche scientifique (France) - Jacques MILLET Nominative process - a definition A process may be directly nominative – that is, a process that makes use of a person’s identity ; Or it may be indirectly nominative – where a person can be identified, even if its name is not clearly mentioned : through secondary information such as administrative number or code, telephone number, electronic address, cross-checking of non nominative information… All of the following processes should be declared before the CNIL – Electronic directories – Personal Web sites – Bibliographic Lists – Scientific electronic forums – … French legislation on CRIS

4. EuroCRIS - Vienna, October 1998 4 Centre national de la recherche scientifique (France) - Jacques MILLET Privacy protection Every individual whose personal information is subject to an automated procedure must be precisely informed of both its purpose and finality ; He has at all times the right of access and the right of rectification and, under certain conditions, the right of withdrawal ; He must be informed, if applicable, of all new dissemination modalities. French legislation on CRIS

5. EuroCRIS - Vienna, October 1998 5 Centre national de la recherche scientifique (France) - Jacques MILLET Internet impact of French regulations on nominative date processing continued Applicable recommandations by the Commission – The display of personal information must be done so as to discourage its capture (no downloading facilities, avoidance of listed items, breakdown of the information in several arborescences…) ; – Mention in clear that any published personal information is not delicated for electronic capture in order to constitute or supply other databases (for commercial or advertizing purposes, for instance) ; in fact, such data capture is strictly prohibited for all countries ; Ongoing work with the Commission : new propositions promoted by the CNRS – Building a centralized national procedure of declaration, covering all processes common to all administrative levels of the CNRS – & that could be generalized to other French research organizations. French legislation on CRIS

6. EuroCRIS - Vienna, October 1998 6 Centre national de la recherche scientifique (France) - Jacques MILLET Other French legal indirect limitations in CRIS European dissemination Compulsory usage of French language on the national territory « In all designation, offer, presentation (…) of a good, product or service, (…) the use of French language is obligatory. This clause applies to all writen, spoken or audio-visual publicity. » (Law of Aug. 4, 1994, Art. 2 on the usage of French language.) French legislation on CRIS

7. EuroCRIS - Vienna, October 1998 7 Centre national de la recherche scientifique (France) - Jacques MILLET Towards a transnational regulation The French legal limitations in CRIS ’s national and international usage is inappropriate to the internationalism of Internet ; There is a need to create a genuine Internet regulation with an international span ; Such regulation would table on the autoregulation implicitly observed by the community of its users (strong legitimity of the Netetiquette), albeit supported by explicit Codes of good practices, an International Regulation Agency of the Internet and national Observatories of the evolution of information & communication technologies. (State council report, Jul. 2, 1998.) French legislation on CRIS

8. EuroCRIS - Vienna, October 1998 8 Centre national de la recherche scientifique (France) - Jacques MILLET European Initiatives «The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if (…) the third country in question ensures an adequate level of protection. » (Directive 95/46/EC of the European Parliament & of the Council of 24 Oct. 1995 on the protection of individuals with regard to the processing of personal data on the free movement of such data, Art. 25 § 1) Applicable national legislation (that is : the country where the process took place) are meant to be harmonized within European countries (before Nov. 1998, but not in third countries) ; As for France : The European Directive is in total adequation with the French Commission’s element of doctrine on the citizen’s right, without justification, to oppose himself against the cession of personal data to third parties ; Need to build an international convention on the basis of the European Directive ; Need for an International Regulation Agency (not yet established). Full text of the cited Directive http://europa.eu.int/eur-lex/en/lif/dat/en_395L0046.htlm French legislation on CRIS