Communities & Document Sharing 4 Things You Should Know

Like private companies, local authorities use, create, share and store a large number of data and documents.

Privacy and data protection is not a new topic, but this year it is more relevant than ever with the entry into force of the European data protection regulation (RGPD) on May 25 last year and the opening of public data of local authorities which takes effect from October 2018.

Following the numerous data piracy scandals that have broken out all over the world and the growing concern of citizens about the use of their data, the French government has put in place measures to regulate the storage and processing of data and documents of local authorities.

Sharing documents: what you need to know

Here are 4 things that local authorities absolutely need to know about sharing documents and data protection.

1. A sovereign cloud, or nothing

As specified above, local authorities are therefore required to use a sovereign cloud. Indeed, the April 2016 circular states that “the use of a non-sovereign cloud, which, by definition, does not guarantee that all data is stored on French territory, is therefore illegal for any institution producing public archives, including local authorities, their groups and their public institutions.”

Local authorities must therefore carefully choose a service provider that meets government requirements and ensure that their data is well processed and stored in France.

Wimi and Wimi Armoured are online file sharing tools, highly secure that host your data in France.

2. The clauses to be provided

Among the best practices cited in the government information note, it should be noted that “if a local authority wishes to subscribe to a cloud offer, it will thus be able to focus only on a sovereign cloud offer, taking care of provide clauses related to the location, security, confidentiality, confidentiality, traceability, traceability, auditability, reversibility, portability and elimination of data in the system. If the chosen offering is a public cloud offering, it will also ensure that the logical separation of data from that of other customers is guaranteed.”

3. The appointment of a data protection officer

Since May 25, 2018, local authorities have been required to appoint a data protection officer. The missions of this agent are as follows:

• inform and advise community agents on the processing and protection of data;
• set up an Information Technology & Freedom culture within the community;
• carry out audits in order to check compliance with the regulation and national law on data protection;
• cooperate and be in contact with the CNIL;
• advise the community on carrying out a data protection impact assessment and verify its execution.

In order to exercise his role effectively, the data protection officer must have a sufficient level of expertise and resources, have specialized knowledge of data protection law and practices and benefit from the resources and training necessary to carry out his missions successfully. (Source: CNIL)

4. Penalties

If you notice a violation of personal information, you must notify it to the CNIL within 72 hours following the violation. After this period, the community may be sanctioned by a Public warning or by a administrative fine of up to 20 million euros.

As an indication, the amount of the fine for a private company can be between 2% and 4% of its annual worldwide turnover, depending on the category of the offense.

The problem with data storage

Today, communities are using software more and more or to platforms that allow them to store all their documents and data in a single space, easily accessible (via the Internet) to agents and users alike. This is what we call cloud computing (or cloud computing in French).

The problem is that this data is stored in huge datacenters that are, very often, physically installed abroad, and therefore outside French territory. As a reminder, all documents of local authorities (paper documents scanned or created by word processing software, databases or emails) fall under the public archives regime as soon as they are created and are considered as “national treasures” that cannot “leave French customs territory” (source: The Gazette of Municipalities).

In an information note dated April 2016, the Government recalls that it is imperative that data be processed and hosted in a sovereign cloud, that is to say “which is located within the limits of the national territory, by an entity governed by French law and in application of French laws and standards.”

The different types of data

The data managed by local authorities are classified into three main families:

• data that is internal and necessary for the functioning of the community;
• data concerning jobs and services;
• information about their users.

On a daily basis, local authorities use and process a considerable amount of data ranging from civil registration data, to information on the incomes of citizens, including information given by the municipal police, social assistance files, video surveillance, cadastral files, etc. And this quantity of information is only increasing with the development of e-administration, which makes it possible to modernize and accelerate public action.

‍

To conclude

Today, local authorities must follow the evolution of the digital society. Data sharing and protection are now important topics and it is imperative to comply with the new regulations that govern them.