After having communicated the data processing that can be implemented by the local authorities within the framework of the distribution of masks, the CNIL raised, during its plenary session of April 30th, the question of the backing of these operations to the data contained in the housing tax file. In the current context, it considers that use of this data, and in particular for sending masks, can legally be implemented.

The attention of the CNIL has been attracted by the fact that many local authorities have considered themselves, in the light of the texts in force governing the use of the housing dossier, operationally unable to take the necessary action to ensure the proper distribution of masks to its citizens.

In the 30th April plenary reunion, the CNIL admitted the possibility for the local authorities of using housing tax information for institutional communication concerning the distribution of masks, as well as the delivery in different houses.

This specific use must be from a file extraction. This new file, created for mask delivery, must be in compliance with GDPR and, particularly, must be broken at the end of operations. Data subjects must be informed of this process using e-mail or letters on the community website.

Between CNIL guarantee, there is:

– the process restriction only for listed above purposes and for data which are strictly required for their implementation.
For this reason, in addition to data related to liable identity, also is used their address, their family composition (for establishing the masks numbers), the date of birth and the resident, because the problem may be related to have a certain age or live in a particular community.
– the supervision of sub-contracted operations, in the event of the use of a service provider for the enveloping of masks.
In fact, in both the book of tax procedure (article n. 135 B-3) and in the GDPR (article 28) the data processing, by a service provider, in local taxes benefits must be disciplined by an agreement which defines object, security measures (integrity, responsibility and disponibility), the lack of a misuse and in the end the destruction of data at the end of the contract.

Personal data processing on housing taxes by a sub-contractor must be regulated by a specific contract.

The local authority also has to inform firstly the local general financial direction for the sub-contract proposed.

SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DELLA FRANCIA – CNIL