Truth beyond the Rhine is not error in below

On 30 March, Deutsche Bahn President Hartmut Mehdorn, had to release orders from the German railway, accused of spying employees e-mails. A few days later, "State of health" sheets of confidential data on employees of Lidl have been found in a German distributor bin. This information would have obtained in a fraudulent manner by the employer. The case resulted in the dismissal of the head of the group in Germany, Frank - Michael Mros. Truth beyond the Rhine is not error in below...

The issue of data protection personal employees, customers and partners is everywhere. Thus, on July 3, 2008, centre car of a Leclerc of Yvelines hypermarket has been endorsed by the National Commission for computing and liberties (CNIL) for violating the rules relating to the client files. Persistence despite several updates in remains of the CNIL of phrases such as "lawyer, master-singer husband" or "not to intervene on the vehicle, client of bad faith" earned him a fine of 30,000 euros. "Beyond the monetary penalties, businesses fear especially the coverage of such cases", says Mr. Florence Chafiol-Chaumont, lawyer associate August & Debouzy.

Graduated response system

Index of interest brought by the companies in question: this law firm, which has organized a briefing on "the rules, pitfalls to avoid in the protection of personal data in the business" has been overwhelmed by requests.

Only very large companies, who can appoint a correspondent CNIL, perfectly mastered the rules. The others are unclear. "They can rely on the advice of the CNIL, which is very open to dialogue and a real work of pedagogy and accompanying firms," notes Florence Chafiol-Chaumont. The commission has adopted a system of graduated response: punishment is almost always preceded by multiple updates remains and/or warnings. We really need that breaches are repeated or that they affect in the most sensitive points (collection of personal data leaving the health-related information, sexual orientation, race, membership of political, trade union or philosophical client or employee) that the company is sanctioned. The CNIL has delivered the year past 101 notices, but only 5 9 financial sanctions and warnings.

However, the companies seem not really aware of the risks that they face. Because they consider that a control, it is as serious an accident: it only happens to others! This is not completely wrong: flooded in the administrative management of the 57,000 prior statements (compulsory prior to the creation of a file or the processing of personal data), the CNIL has little means of its ambitions. And can hardly control as 100 to 150 companies per year, focusing his research on sensitive sectors (commerce, security, telecommunications, the Bank and insurance...). Business leaders are all the more tempted to play the ostriches that they poorly mastered the rules for the protection of personal data. "Who knows that it is prohibited to maintain the CVS of candidates for hiring more than two years" asks Florence Chafiol-Chaumont.

European standard en view

It is better to leave the head in the sand: the law computer and freedoms of 1978 was amended in August 2004 to integrate the information technology emerged in the meantime and, above all, to give real power to control and sanction to the CNIL. A new cure could intervene: in 2008, the CNIL entrusted a working group to consider the revision of this Act; This year, a Senatorial mission is devoted to "electronic tracing" and the protection of privacy Finally, all European CNIL are developing a future European standard relative to the protection and the free movement of data.