Personal data – Management of the university’s internal reporting system
Paris Cité University processes personal data as part of the management of the university’s internal reporting system.
Purpose of data processing
Purposes
• Receipt, recording and analysis of internal requests and reports (harassment, discrimination, gender-based violence, psychosocial risks);
• Assessment of admissibility, investigation and follow-up of internal requests and reports;
• Recording of requests and the action taken;
• Statistics and activity reports.
Legal basis
The processing is necessary for compliance with a legal obligation (Article 6(1)(c) of the GDPR) to which the university is subject under Decree No. 2020-256 of 13 March 2020 concerning the reporting mechanism for acts of violence, discrimination, harassment and sexist behaviour in the civil service, and on the responsibility of public employers to take ‘the necessary measures to ensure the safety and protect the physical and mental health of workers’, as set out in the Labour Code; these obligations are referred to in Article L 811-1 of the General Civil Service Code.
Data processed
Categories of data processed
• Identity, status and contact details;
• Date and subject of the request or report;
• Information and documents provided;
• Information gathered as part of the review of the application or report;
• Action taken;
• Closure date;
• Activity statistics.
Source of data
• Individuals wishing to consult an EDI adviser or submit a report;
• Members, staff or third parties contacted as part of the review of the request or report.
Whether data collection is mandatory or optional, and the consequences of failing to provide data
The use of the internal adviser and reporting systems is optional.
The identification of the applicant (unless they wish to remain anonymous), a description of the subject of the request or report, and the provision of any information and documents likely to support it are necessary for the processing of the request or report and for informing the applicant.
Automated decision-making
The processing does not involve automated decision-making.
Data subjects
The data processing concerns:
• Internal and external beneficiaries of the scheme;
• Internal EDI contact persons and staff who may receive reports;
• Third parties concerned by the reports;
• University staff, and third parties where necessary, who assist in reviewing the requests and reports received or who are responsible for implementing appropriate measures.
Recipients of the data
Categories of recipients
Within the limits of their respective needs, the following are recipients of all or part of the data:
• The relevant case handler;
• Staff who may receive reports;
• University staff, and third parties where necessary, who assist in examining the requests and reports received or who are responsible for implementing appropriate measures;
• Where applicable, another competent administration or authority;
• The authors and persons named in a report;
• Where applicable, the competent courts.
Data transfers outside the EU
No data is transferred outside the European Union.
Data retention period
Data relating to the internal reporting system is retained for the calendar year in which the request or report is closed, plus five years.
In the event of a dispute arising from the report, the data is retained until the end of the administrative or judicial proceedings, taking into account the applicable limitation periods
Security
Security measures are implemented in accordance with the State Information Systems Security Policy (PSSI-E) and the Paris Cité University Information Systems User Charter.
Your rights regarding your personal data
You may access and obtain a copy of your personal data, and request that it be rectified or erased. You also have the right to restrict the processing of your data.
Exercising your rights
To exercise these rights or if you have any questions regarding the processing of your data, please contact the department responsible for data processing by email at signalement@u-paris.fr or by post at:
Université Paris Cité
Equality, Diversity and Inclusion (EDI) Officer
Reporting Scheme Coordinator
Directorate-General for Services
85 boulevard Saint-Germain
75006 PARIS
You will receive a response as soon as possible and, in any event, within one month of receipt of your request.
If you encounter any difficulties, you may also contact our Data Protection Officer (DPO) by email: dpo@u-paris.fr
Complaint to the CNIL
If, after contacting us, you feel that your data protection rights have not been respected, you may lodge a complaint with the CNIL.