National Institute of Demographic Studies (INED) – Violation Found (France, 2023)

The National Institute of Demographic Studies (INED) (the controller) – intended to implement a “Families and Employers longitudinal survey project” (FamEmp), which would involve the processing of sensitive personal data of data subjects. The data controller founded the legal basis for the processing on public interest under Article 6(1)(e) GDPR. The survey was aimed at making available to the scientific community statistical survey data relating to the balance between professional, family and personal life to analyse the impact of these interrelations on life courses and factors of risks according to professional and family characteristics. The data controller requested an opinion from the the French DPA (CNIL) on 22 May 2023 regarding the FamEmp survey, as on the basis of Article 44(6) of [https://www.wipo.int/wipolex/en/text/514585 French law no. 78-17 of 6 January 1978] and Article 36 GDPR, any data controller has to obtain a published opinion of the DPA when seeking to process sensitive personal data for public research purposes. In support of this request, the data controller carried out an impact assessment relating to the envisaged processing. The CNIL issued its opinion as follows. On the legal basis for data processing, the DPA acknowledged that the survey involved the processing of sensitive data relating to the health, sexuality and religion of the data subjects and held that such processing for the FamEmp is legitimate and the processing permissible in law in the public interest. Secondly, the data controller stated that the survey results would be transmitted to third parties in pseudonymised form, to which the DPA replied that the data must be anonymised before being disseminated and not pseudonymised. It also reminded the controller that the disseminated data must be equally adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Thirdly, on the storage and retention period, the data controller stated that the personal data would be archived ten years after the last access request by a researcher. In this regard, the DPA referenced Article 89 GDPR, which mandates the implementation of appropriate safeguards for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. The DPA also reminded of the importance of having a defined retention period for pseudonymised data, and it objected to the controller’s intention to retain personal data after they are transferred to the Archives of France. For the security of personal data, the DPA recommended automatic or manual monitoring of any data transfer outside the controller to systematically verify the anonymity of the data at all times and ensure compliance with security requirements at all stages of processing. The DPA also held that security measures, must be operational during the implementation of the processing, in line with Article 5(1)(f) GDPR and Article 32 GDPR. Additionally, regarding the access to personal data and recipients of personal data, the DPA advised the controller to restrict as much as possible the number of third parties authorised to access personally identifiable information of the data subjects. It reminded that access to personal data by a person in a country outside the EU must be carried out in accordance with the principles of personal data transfer outside the EU mandated in Chapter V GDPR. Furthermore, on the data subject’s right to be informed, the controller outlined that before contacting a data subject, an announcement letter, as well as an email or SMS, should be sent to all selected individuals. The DPA also suggested that all of the information related to the processing as provided for in Article 13 GDPR should be delivered again to the data subject verbally or at the start of the web questionnaire, including the terms and conditions that guide the data subject’s exercise of their rights. Regarding processing the personal data of third parties who cannot be informed, the DPA validated the data controller’s reliance on Article 14(5)(b) GDPR, which exempts third parties from having the right to be informed. Lastly, on the exercise of data subject rights, the controller stated that data subjects could object to data processing via an email address indicated in the information notices. On which the DPA emphasised that the mechanism for objection should be easy and accessible to anyone, including those who lack access to or knowledge of computer tools.