“In this ruling, the French Supreme Court states that the mere updating of a computer program processing personal data does not entail an obligation for the data controller to notify the data processing a second time”.
Under article 22 of the French personal data Act, automatic processing of personal data must be notified to the French personal data authority CNIL. Article 22 indeed provides that automatic processing of personal data must be notified to the CNIL except when the processing requires the prior authorisation of the CNIL because it falls under the provisions of articles 25 (political, philosophical data, medical, sexual life data; genetic data; offences; exclusion from a right; use of social security numbers), 26 (State security and criminal offences processing) and 27 (public processing of social security numbers – State biometrics).
In the present case, a youth educator had been dismissed for refusing to enter data concerning minors under protective measures into a software that had been updated. The employee considered that he was not obliged to accept allegedly unlawful orders given by the employer.
The Court of Appeal of Aix-en-Provence found that the dismissal of the employee was not justified, because when the computer program EVA 3 was upgraded in January 2007 to EVA 4, personal data, which had been originally notified to the CNIL, had to be re-entered into the system by the educators, which meant that the processing had to be notified a second time to the CNIL beforehand.
The Cour de Cassation, the French Supreme Court, in a judgement of 23 April 2013, annulled the judgement of the Court of Appeal, stating that “only a substantial change in the information that has been previously declared has to be notified to the CNIL”. The Court added that the mere updating of a computer program processing personal data does not entail an obligation for the data controller to notify the data processing a second time.
The Supreme Court therefore annulled the judgement of the Court of Appeal of Aix-en-Provence as it had not verified whether the change of the computer program was a simple update or a change necessitating a new notification to the CNIL.
BS
________________________
To make sure you do not miss out on regular updates from the Kluwer Copyright Blog, please subscribe here.
