#2015-254Law on the Creation of FranceConnect Tele-Service for Personal Data Processing
AI-generated summary for informational purposes only. Not legal advice. See the original source for the authoritative text.
The law establishes a framework for the FranceConnect tele-service, which facilitates electronic identification and authentication for citizens interacting with public administration services in France. It is designed to streamline administrative processes by enabling users to connect to multiple electronic services through a single authentication mechanism while ensuring the security and privacy of personal data. The law outlines the types of personal data that can be collected, their purposes, and sets guidelines for data handling, user rights, and the security measures necessary to protect users' information.
AI-generated summary. May contain errors. Refer to official sources for legal decisions.
Key Changes
- Establishes a unique authentication framework for accessing public administration services.
- Specifies the types of personal data collected for identification and tracking.
- Introduces measures to ensure user consent and rights regarding data sharing.
Obligations
What this law requires
Obtain ministerial authorization by decree (arrêté ministériel) after receiving motivated and published opinion from CNIL before implementing the FranceConnect personal data processing system
Collect and process only the mandatory pivotal identity data (nom, prénom(s), genre, date et lieu de naissance) plus any additional optional data specifically required by the service provider
Certify the pivotal identity against the RNIPP (Répertoire national d'identification des personnes physiques) before generating the federation key, while ensuring identity providers cannot directly access the RNIPP
Generate a unique technical alias for each user that is regenerated at each connection and known only to FranceConnect
Ensure that personal data processed is limited strictly to what is necessary for accomplishing administrative procedures and that general information accessible to all internet users shall not be subordinated to user authentication