French Public Health Code
In forceI. - Voting shall take place electronically.
To this end, an automated personal data processing system shall be set up under the responsibility of the Minister for Health.
This automated processing guarantees the separation, in separate files, of data relating to voters, on the one hand, and votes, on the other.
The rights of access and rectification provided for in articles 49 and 50 of law no. 78-17 of 6 January 1978 relating to information technology, files and freedoms, as well as the rights to erasure and limitation of data provided for in articles 51 and 53 of the same law, may be exercised with the Minister responsible for health. The right to object provided for in article 56 of the same law does not apply to this automated processing.
This automated processing allows voters to cast their vote electronically, while respecting the anonymity, confidentiality and secrecy of the vote.
In order to protect against any risk of failure, the electronic voting system is duplicated on two separate geographical platforms offering the same characteristics and the same guarantees.
II. - Prior to its implementation, or to any substantial modification of its design, the electronic voting system shall be subject to an independent assessment designed to verify compliance with the guarantees provided for in this sub-section by the entire system, both as installed before the ballot, and as used during the ballot and after the ballot.
The expert's report, containing the method and means used to verify a posteriori that the various software components to which the expert's report relates have not been modified, is made available to the Commission Nationale de l'Informatique et des Libertés and communicated to the Ministry of Health.
III. - An order of the Minister for Health specifies the characteristics of the processing provided for in I.
In particular, it sets out
1° The categories of personal data recorded in the processing ;
2° The procedures for the independent assessment provided for in II;
3° The guarantees surrounding the use of a technical service provider responsible for managing the automated processing, in compliance with the security obligations resulting from this sub-section, and the terms and conditions of its involvement;
4° The arrangements for voter identification and authentication and the arrangements for the recovery of the voter's authenticator;
5° The conditions for implementing the back-up system in the event of failure mentioned in the last paragraph of I.
