Local authorities: the legal obligations for sharing documents

Local authorities face a great many challenges in carrying out their work. Exchanging data between town halls, departments and other local bodies is one of the main ones. Bills were studied on the subject and a legal framework was eventually put in place. In this article we look at the legal obligations governing document exchanges inside and outside French local authorities.

The legal framework for exchanging documents

Local authorities produce a great many documents, physical and digital alike. Information note no. 2016/004 of 5 April 2016 on cloud computing reminds everyone concerned of the legal obligations around handling those documents. Signed by the director general for local authorities and the director in charge of the Archives de France, it sets out the legal framework applying to the management of local authority documents. In effect, the documents local authorities produce fall under the legal regime for public archives from the moment they are created.

The documents concerned are:

• paper files that have been digitised;
• office documents produced in word processing software;
• the contents of a database;
• emails sent or received by a local authority.

Under French law, all public archives are national treasures, on the grounds that they are documents of present or future historical interest. Local authorities' digital records are classified as national treasures as soon as they are created, which means exchanging or moving them is governed by fairly strict rules. No national treasure may leave French customs territory. In certain circumstances it can, but only temporarily and with authorisation from the Ministry of Culture.

Under article L. 111-7 of the French heritage code, a national treasure may only leave the country for "restoration, appraisal, participation in a cultural event or deposit in a public collection". That means any document with the character of a national treasure has to be handled on French national territory. The law therefore obliges local authorities to store their documents in France.

The constraints on local authorities hosting data

The circular of 5 April 2016 makes clear that any local authority using a foreign provider to host its documents is acting unlawfully. Hosting covers digital or digitised documents, which is where the cloud comes in: it lets town halls and other local authorities store computer data with outside providers.

The cloud provides hosting for digital documents and so lets public bodies and groupings manage internal and external exchanges better. To that end, the director general for local authorities and the director in charge of the Archives de France added to their information note with a Guide to cloud computing and data centres for local authorities. The circular also set out some good practice, and encourages local authorities to turn to departmental archive services in applying what the law provides for.

The reasoning is that those services have a scientific and technical oversight role over the public archives produced in each French department. The Directorate General for Local Authorities also stresses that before any data hosting project goes ahead, every organisation has to refer to the recommendations of the CNIL, France's data protection authority, on the subject. Equally, in applying the Secure Cloud label, the recommendations of ANSSI, the national cybersecurity agency, have to be taken into account.

The obligation to use a sovereign cloud for exchanging documents

The cloud lets local authorities store their documents. In itself, though, the cloud is not especially secure: it offers very few guarantees about where documents are located, since they are saved on virtual infrastructure that could sit anywhere. That is the main reason the law requires local authorities to use only a sovereign cloud. A cloud is described as sovereign when the data it holds is stored and processed entirely on French territory.

To be sure the digital documents saved and handled are secure, every local authority has to choose its host carefully. There are many providers in France offering sovereign cloud services. The best is the one whose level of security matches how sensitive the archives are. The Secure Cloud label is the reference.

That label has two levels of certification relating to IT security:

• the first is Secure Cloud, which requires measures such as physical access control to the data stored, software encryption, hosting in Europe and very strong authentication with encrypted passwords;
• the second is Secure Cloud +, which is stronger still. It requires multi-factor authentication, hardware encryption and infrastructure suited to cloud computing. At that level of certification, the data has to be hosted entirely in France.

A local authority choosing its host also has to require a legal guarantee proving the data will not be used, and the provider has to guarantee where the hosted files are located. That matters all the more because the General Data Protection Regulation obliges local authorities to protect the personal data they hold.

At NetExplorer, we make exchanging documents easier within local authorities, and between those authorities and outside partners. We store data 100% in France.

As an elected representative, you can customise our platform so it reflects your authority. It is an intuitive platform that is easy to get to grips with. Our document sharing solution lightens the daily load for elected members, advisers and officials.