MUNICIPALITIES and the GDPR

In France, the municipality is, at the institutional level, both a territorial community, namely a decentralized administrative authority benefiting from legal personality, and having its own affairs, distinct from the affairs of the State, and an administrative district, namely an administrative division without legal personality, territory of exercise of a decentralized service of the State administration or of one of its representatives.

As an administrative district, the municipality constitutes the basic organ of state power within the national territory. The mayor, in addition to his or her duties as executive of the community, exercises certain prerogatives within the competence of the State. In this capacity, he or she is responsible, in particular, for civil status, the revision and maintenance of electoral lists, the organization of elections, and the census.

Personal data that may be processed by municipalities concerning their residents may include:

• Identification data: Civil status, address, telephone number, email address, etc.
• Economic and financial data: banking data, income, assets, taxation, etc.
• Personal life data: family status, professional status, training, etc.
• Health data: through the activity of the CCAS in particular.
• Data relating to police investigations and court convictions.
• Data concerning municipal staff: identity, contact details, skills, etc.

Municipalities as local authorities must appoint a DPO, they must respect the principles of the Data Protection Act and the General Data Protection Regulation (GDPR) regarding the processing of personal data. In particular, they must ensure the security and confidentiality of data and inform the persons concerned of their rights.