Departments (as local authorities) and the GDPR

In France, the department is both:

• An administrative district, territory of competence of State services;
• The area of jurisdiction of a department as a territorial authority; a territorial authority properly speaking, namely a legal entity under public law other than the State, invested with a mission of general interest concerning the department, understood as a territory.

The departmental administrative district is administered by a prefect who heads various state services.

The departmental authority, for its part, has, for the exercise of the powers assigned to it, a deliberative body, the departmental council, and an executive body, the president of the departmental council, who prepares and executes the deliberations of the departmental council. He is assisted for this purpose by vice-presidents and an office on the political level and by departmental services for the implementation of decisions.

Personal data that may be processed by departments concerning their citizens may include:

• Identification data: Civil status, address, telephone number, email address, etc.
• Economic and financial data: banking data, income, assets, taxation, etc.
• Personal life data: family status, professional status, training, etc.
• Health data: particularly through the activity of managing social benefits.
• Data relating to police investigations and court convictions.
• Data concerning municipal staff: identity, contact details, skills, etc.

Departments as local authorities must appoint a DPO, they must respect the principles of the Data Protection Act and the General Data Protection Regulation (GDPR) regarding the processing of personal data. In particular, they must ensure the security and confidentiality of data and inform the persons concerned of their rights.