UNITED NATIONS ECONOMIC COMMISSION FOR EUROPE

CONFERENCE OF EUROPEAN STATISTICIANS

Workshop on Ethics in Modern Statistical Organisations

26-28 March 2024, Geneva, Switzerland

26 February 2024

French official statistician and ethics: from law to practice Mylène CHALEIX (INSEE, France) - e-mail : [email protected]

Olivier LEFEBVRE (INSEE, France) - e-mail :[email protected]

Abstract

Created in 1946, INSEE's missions are to develop and disseminate official statistics to inform economic and social debate in the service of democracy. The 1951 Statistical Act on statistical confidentiality, coordination and obligation is the cornerstone of its mandate and embodies the values of French statistical service. In particular, from the outset it has struck a balance between the conditions under which data is collected and the ways in which it is protected.

However, in addition to being enshrined in law or in initial training programmes, ethics must also be part of everyone's day-to-day practices. In this respect, the organisation adopted for French official statistics is to give statisticians end-to-end responsibility for their process, which includes the production of the final result, but also respect for the values of official statistics. From the design stage to the dissemination of data and studies, the statistician will meet people on numerous occasions who will (re)question the measures taken to contribute to this:

 the advisability of launching a statistical operation, access to data (existing data or setting up a survey),

 compliance with European statistical best practices,

 GDPR declarations for individual data,

 conditions of access for researchers to the data produced,

 treatment of statistical confidentiality in dissemination,

 as well as the IT axis (project management, certification, securing access and workstations).

These different stages provide collective insurance that the ethics of public statisticians are taken into account as closely as possible to the work, while at the same time giving meaning to these issues. Combined with a policy of staff mobility between the various statistical services, they strengthen the ownership by everyone and the cross-fertilisation of approaches, bringing greater security to the whole.

1

Ethics and practice, the practice of ethics, the example of INSEE

The practice of ethics at INSEE and in the French official statistical service is the result of a balance between ideals and realities, between procedures and their adaptation to circumstances, between theory and practice. Like a bicycle, this balance is only viable if it is accompanied by movement, in other words if it is practised on a daily basis and if its components are continuously adapted.

All official statisticians can therefore rely on a legal framework that gives them a sense of responsibility and protection, as well as on a body of professional values and best practices that are regularly questioned and confirmed in real-life situations. Procedures govern their implementation, while remaining adaptable enough to take into account exceptional circumstances. The way INSEE is organised allows for regular exchanges between colleagues, enabling them to find answers to their questions, and to to find the right balance for each of these values.

* Simple question of balance

The legal and organisational framework at INSEE, a vehicle for the values of official statistics

The French National Institute for Statistics and Economic Studies - INSEE - was created by the Finance Act of 27 April 1946, taking over a public statistics activity that had been carried out continuously since 1833. Under the French Statistics Act of 1951, its mission is to collect, analyse and disseminate information about the French economy and society throughout the country. It coordinates the French official statistical service.

In comparison with most other national statistical institutes, INSEE has two important specific features: it carries out economic and social studies based on the data it produces, as well as short-term economic forecasts; it manages inter-administrative registers of people and economic entities on behalf of all stakeholders. A third distinctive feature of INSEE is the way in which its staff are trained: most of the staff recruited undergo initial training in economics and statistics at specialised schools. These schools train both INSEE civil servants and future statisticians for the private sector.

A national and European legal environment that is evolving to adapt to the context and challenges, without losing sight of the fundamentals (providing a framework for data collection, guaranteeing its relevance and data protection). The challenge: guaranteeing a balance between data collection, use and protection

INSEE operates within a national legal framework that is both relatively old, and therefore firmly rooted in custom and practice, and evolving to take into account changes in context or needs. The founding legislation for this statistical activity dates back to 1951. Initially focused on surveys, it defines the rules of the game in terms of: first data collection (including the obligation to answer), second opportunity (in relation to the need to shed light on a given phenomenon but also the absence of other sources) and third the protection of the data collected (statistical confidentiality). It has gradually been enriched to enshrine professional independence in law and to take into account new data collection methods (use of administrative data and, more recently, data held by private bodies), while at the same time implementing the rules to assess the appropriateness of such data collection and the protection of the data collected.

The processing of personal data is carried out in compliance with the 1978 Data Protection Act, which has also evolved to adapt to the General Data Protection Regulation (RGPD) and to new opportunities for the secure

2

*

linking of personal data. The National Commission for Information Technology and Civil Liberties (CNIL) is responsible for informing and monitoring its application.

The organisation of official statistics in France is based on 3 pillars. The 1951 Statistical Act on the obligation, coordination and confidentiality of statistics, revised in particular by the law on the modernisation of the economy of 4 August 2008, created various bodies which play an essential role in the operation and regulation of official statistical activities:

 the official statistical service (SSP), comprising INSEE and 16 ministerial statistical offices (SSM), which carry out statistical operations in their areas of competence;

 the National Council for Statistical Information (CNIS), a consultative body for producers and users of official statistics, responsible for monitoring statistical work; its remit is similar to that of ESAC for European statistics, although it is organised differently,

 the Official Statistics Authority (ASP), which is specifically responsible for ensuring the professional independence of official statisticians. It is the French equivalent of the ESGAB.

INSEE is responsible for coordinating the methods, resources and statistical work of the SSP and for unifying statistical classifications. The way in which the SSP carries out its activities is supervised by the Official Statistics Authority. The reference framework is defined in particular by the European Statistics Code of Practice (CoP). Also created by the 1951 Statistical Act, the Official Statistics Label Committee and the Litigation Committee for Compulsory Statistical Surveys deal respectively with surveys on quality and compliance with the obligation to answer. The Label Committee also intervenes, at the request of the ASP, on the conformity of statistics produced by bodies other than those of the SSP (with levels of conformity depending on the levels of labelling requested).

A strong commitment to sharing data while respecting statistical confidentiality

Unlike a number of NSIs, INSEE has not been entrusted with the task of 'data stewardship' at national level, nor does it claim to do. It does, however, carry out cross-cutting missions in terms of data administration and sharing, for very specific audiences, types of data and domains. The first mission is to share statistical data within the official statistical service (with, in particular, the introduction of a non-meaningful individual identifier internal to official statistics), or with researchers, under conditions defined by a specific body called the Statistical Confidentiality Committee. The second is to manage a set of classifications, including geographical ones, and common concepts designed to make it easier to share these data. A third mission, which could be described as 'statistical stewardship', consists in making the data it produces widely available in open data format. Finally, through its management of inter-administrative registers, INSEE carries out an "ID

3

INSEE

STAKEHOLDERS

● Users (directs, indirects)

● Government/public or private decision-makers ●

● Intermediaries (information relays, reusers ...) ●

● Suppliers (respondents, administrative or private data)

Official Statistical authority ● Ensures the professional indepedance,

ethics for the SSP ● Controls (auditions NSI, ONAs)

National council for statistical information

● Consultation ● Opportunity

SSM Labor

SSM Health and Solidarity

SSM Education SSM Higher Education, Research

SSM Culture

SSM Internal Security SSM Defence

SSM Immigration

SSM Local government

SSM Civil service

SSM External trade

SSM Agriculture

SSM Sustainable development

SSM Justice

SSM Youth affairs and Sports

SSM Public finance

SSM = ministerial statistical services

Official Statistical system

Official Statistics Label Committee ● Compliance

stewardship" mission designed to facilitate the semantic interoperability of administrative files by means of unique and shared identifiers.

The practice of ethics on a day-to-day basis at INSEE is the result of several factors

A body of good practice and essential values The challenge: guaranteeing quality, responsiveness and practicality

This legal and institutional framework completes an other one, based on professional values and good practice. In some respects, the former has translated the latter into law, by "making these values enforceable", when necessary (in case of new questions, new opportunities, new challenges). In some others respects, it can be said that these are coherent formalizations, and that the principles and values allow each statistician to "preserve meaning". One example is the European Statistics Code of Practice, whose 16 principles guide a number of our projects, like the core values adopted by UNECE. This corpus is projected into the daily lives of statisticians through illustrations, behaviours and shared points of attention. The aim is to maintain a high level of quality, in line with our core values, while remaining responsive to real-life situations and all their unexpected aspects.

Guides, procedures, audits and action plans to help with implementation The challenge: to remain solid and not lose our sense of purpose

Beyond these principles and values, official statisticians rely on three pillars. The first concerns shared methods for their actions, to ensure that they are correctly implemented. The second involves procedures for day-to-day operations and also action plans to improve or implement investments. The third involves audits designed to provide an external view of our practices. These audits allow to assess the effectiveness (are they achieving the desired goal?) and the efficiency (with the adequate allocation of resources?). The challenge is for all statisticians to have concrete, shared benchmarks for the implementation of their work, without being locked into total formatted processes, and to be able to evaluate and develop them.

An organisation that gives responsibility to the project designers and to each of the players involved, and enables them to look at each phase of the process from different angles. The challenge: integrating diverse contributions without diluting responsibilities

INSEE has adopted a work organisation that gives full responsibility to the designer of a statistical operation (from data collection to analysis and the provision of initial results). This organisation provides the technical skills and the outside expertise needed to successfully complete the operation, and to continuously improve it especially in case of a recurrent operation. The manager in charge of the process surrounds him/herself first with experts in the field to target the collection of information according to the stakeholders’ expectations.

4

After, he/she works with experts in methodology or survey design1, as well as with architects and IT developers for high-performance and secure implementation of the collection and processing. He/she relies on interviewers, then controllers, for these collection and processing operations... Checkpoints (opportunity opinions, statistical compliance opinions, IT security approvals) allow outside parties to express their views, so as to improve the system or, if not, to express their opposition to its implementation.

A practice that enables us to adapt to external shocks or particular contexts (passionate subjects, sensitive issues, public scrutiny) without sacrificing our values. The challenge: knowing how to relax the rule when necessary without losing its spirit, or knowing how to go further than the proposed framework.

The procedures are clear, just restrictive enough to guarantee their efficiency (by preventing everyone from re- inventing them) and to ensure the necessary transparency, while retaining the possibility of adapting them to the circumstances. For example, during the Covid crisis, official statistics were able to carry out a survey on companies and published the results less than 30 days after the request was made. Accelerated procedures to examine the appropriateness and conformity of statistics, combined with a flexible and secure IT system, enabled a crucial question to be answered quickly (how did businesses adapt to the initial containment?) without sacrificing the quality or security of data collection and processing.

A shared mindset based on the values of quality, confidentiality and independence The challenge: a common compass for day-to-day use

For all of this to work optimally, it is essential that everyone shares a vision of the aims of the statistical operations to which they contribute, but also of the values that underpin its implementation, and of their own role in carrying them out. The values are part of the teaching received in the schools, and then they are continuously infused through exchanges between colleagues, additional training, internal communication and managerial practices. One of the challenges is to link everyday actions and routine or exceptional work to these values, so as to embody them. The level of formalisation of the values has so far remained minimalist, but it may be necessary in the future to expand them to meet the growing expectations of users and facilitate communication on these values.

In practice, this is illustrated by the classic procedure for an official statistics survey

Any official statistics survey project must be the subject of an opinion from the CNIS, which checks the general interest and usefulness of the statistical operations presented in the work programmes. This opinion, issued by the president of the thematic commission responsible for the survey, ensures that it meets a public interest need

1questioning, questioning protocol, whether or not to use multi-mode, sampling

5

(principle of relevance) and that it does not duplicate other sources already available - statistical or administrative survey, management file, etc. (principle of minimising the burden on respondents).

In order to be carried out within the framework of the 1951 Statistical Act, any statistical survey project presented by a public statistics producing service must obtain a label of general interest and statistical quality.

After receiving an opinion, the person in charge of the survey (within the producing service) prepares a file (which, since 2024, includes the main headings of the SIMS (Single Integrated Metadata Structure) standard for user-oriented quality reports, supplemented by methodological appendices). Next, the Official Statistics Label Committee gives its opinion which then ensures that survey meets statistical quality criteria. These criteria concern the consultation with users, the collecting and sampling methods2, the relevance of the questioning and the adaptation of the dissemination to the stated objectives. The file also includes the results of questionnaire testing. It also ensures that the survey does not place an excessive burden on respondents, that consultation has taken place with the stakeholders and that the wishes expressed by the CNIS during the debate on the appropriateness have been taken into account.

At the design stage, the survey manager can call on experts from various cross-functional units:  for the design of their questionnaire (Statistical Methods Unit) and specialists in the field (internal or

external to the SSP) ;  for sampling (Statistical Methods Unit);  on the organisation of its survey (Survey Project Management Units);  on the definition of dissemination products (Dissemination and Regional Action Directorate) and the

treatment of confidentiality (Statistical Methods Unit)…

Illustration with TEO: Trajectories and Origins survey (2008 - 2019 editions)

The Trajectories and Origins survey (Trajectoires et Origines - TeO) attempts to measure the impact of origins on access to the main resources that define one’s place in society: housing, education, language skills, employment, public services and social benefits, health, social and family relations, nationality, citizenship, etc. ). It looks at the relationship between origins and other categories of distinction in French society (gender, class, age, neighbourhood, etc.) in order to analyse the processes of integration, discrimination and identity- building within French society as a whole. The second edition of the survey (TeO2), was carried out in 2019- 2020, updated the results of the first survey (TeO1) on these different themes ten years later.

Following strong public demand for information on immigrants and their descendants, and their integration (lack of information in administrative data or in the census), INSEE and INED - the French Institute for Demographic Studies, a public research body) have joined forces to offer an original survey on trajectories and origins. The special feature of the survey is that it deals with issues classified as sensitive under the Data Protection Act. These include in particular issues relating to racial or ethnic origins, religion, health or civic life (trade union or political opinions).

For the first edition, a multidisciplinary working group (statisticians, demographers and researchers) was set up to design the questionnaire between 2006-2007 (with a focus group and field test), the associations concerned were consulted, and the CNIS held discussions on the sensitivity of the data (in May and October 2007) in addition to the usual opportunity and compliance stages. The opinion of the CNIL was also sought out.

Driven once again by public demand, a new edition was included in the survey programme. During the preparation of TeO2 (2016-2019), the same stages were repeated (design group, opinion of opportunity; compliance, opinion requested from the CNIL and registration with the GDPR and their recommendations were included in the protocol. The recommendations were on the experimental nature of the survey on the 3rd

2 sampling plan, data adjustment method, treatment of non-responses to guarantee the reliability of the results, etc.

6

generation or the possibility of not responding on sensitive topics.

In addition to surveys, the data-producing services also ask the CNIS to access administrative data (1951 Statistical Act - Article 7bis) or private data (1951 Statistical Act - Article 3bis) and to obtain an opinion. The question of proportionality, which is not addressed through the prism of the response burden, requires particular attention. In France, this attention is ensured by the Data Protection Act, which states that "data collected for a given purpose must remain adequate, relevant and not excessive, and that the list of data must be limited to what is strictly necessary to meet the stated purpose". With the development of statistical identifiers and the forthcoming introduction of dedicated applications, consideration is being given to the introduction of a linking procedure in order to control the objectives and, once again, limit the information linked to that which is necessary.

Other safeguards for data confidentiality and security

DPIA: a procedure to protect personal data

The General Data Protection Regulation (GDPR), transposed in 2018 into French law by the changes made to the Data Protection Act, imposes obligations on all data providers. These obligations essentially revolve around two main principles: a principle of transparency and a principle of controlling and limiting the risks of process’impact on the privacy of data subjects. The principle of transparency requires data subjects to be informed, in particular of the purpose of the processing operation, the data used, how to exercise their rights, and how to respond to their requests, as well as having acess to the documentation on the processing operations (see letter of notification for respondents and information on insee.fr). The data provider must also ensure that the processing carried out complies with the principles of necessity, minimisation and proportionality with regard to the data processed.

The French version of the GDPR requires all processing of personal data to be recorded in a register kept by the service responsible for the processing, as well as realising an impact assessment on the consequences for individuals in the event of a proven risk. The register of processing operations describes the purposes and objectives of each personal data processing operation, the categories of data used, the categories of data subjects, the parties involved (producers, recipients, processors) and the storage periods. The register is used to compile data processing description sheets, which are published online at insee.fr or communicated directly to respondents.

The Data Protection Impact Assessment (DPIA) is a tool that can be used to design a processing operation that complies with the GDPR and respects privacy. It concerns the processing of personal data that is likely to give rise to a high risk for the rights and freedoms of data subjects.

To carry out a DPIA, it is necessary to:

1. define and describe the context of the processing operation(s) in question;

2. analyse the measures guaranteeing compliance with the fundamental principles of proportionality and necessity of the processing operation, and protection of the rights of the data subjects;

3. assess the privacy risks associated with data security and ensure that they are adequately addressed; formally validate the DPIA in the light of the above elements, or decide to revise the previous stages.

The data protection impact assessment includes a more detailed description of the processing operation than that contained in the register of processing operations. It also deals with the factors that will enable the sensitivity of the processing to be assessed, in particular with regard to its scale (the entire population or a

7

Source : CNIL

sample?), the variables processed (in particular with regard to their sensitivity within the meaning of the GDPR) and the nature of the processing itself (does it involve cross-referencing several files?). In particular, it includes an analysis of the risks in terms of data security or breach of privacy, together with remedial measures. This document is drawn up by a specialised unit at INSEE, in conjunction with the designer of the processing operation, who thus benefits from essential expertise in analysing these issues.

... and another procedure for data integrity and security

Securing data at every stage of the process is also a concern for public statisticians, and one that is growing with the rise in cyberattack. At INSEE, information systems are subject to security certification, involving experts from the Information Systems Directorate and external experts. Once again, the process will be scrutinised, but this time from the point of view of IT security: availability, integrity, confidentiality and traceability. As far as surveys are concerned, since the data collection tools are pooled within a survey network, the certification of a survey is based on what has been done for the network.

But being able to think outside the box when necessary

How can we ensure that a sensitive project is acceptable? The challenge: legitimacy beyond the ability to do things

In 2021, INSEE has launched an ambitious project called RÉSIL, which aims to build a statistical register of individuals and housing based on the linkage of various administrative data. In this project, INSEE is convinced that the legal and ethical issues are just as important as the technical challenges and require special attention, with the support of outside experts. In addition to the technical and legal capacity to make RÉSIL work, we also needed to acquire legitimacy, through a "social mandate". An ambitious process of consultation with civil society was therefore carried out on this project, in parallel with the statistical engineering work. In particular, it relied on a working group from outside official statistics, which operated very intensively for 6 months, from May to October 2022. This was an extra-ordinary approach, going beyond the usual consultation processes, but adapted to the very specific challenges of this project.

The group was not opposed to the principle of RÉSIL, as an exclusively statistical register fed by various sources and allowing record linkages, but had confidence in the institution from a technical and ethical point of view to build and operate it in accordance with the principles of good practices.

However, the group considered that given the nature of RÉSIL and the current context regarding the use of personal data, marked both by greater circulation of this data and increased vigilance over its use, it is necessary to set and make visible the rules of the game, to rely on outside views so that various national authorities or agencies can guarantee them and set the limits. They also felt that it was essential to continue the transparency and consultation efforts undertaken by INSEE over the long term.

This experience of consultation was very challenging, but very useful for INSEE, as it enabled us to identify certain concerns that might emerge about such a system, certain challenges in terms of communication and consultation on RÉSIL and the use of external data which in turn helped us to improve the design of our project.

Sensitive data The challenge: proportionate data collection

Knowing not to go too far for reasons linked to social acceptability: in the example of TeO, the exceptions provided for in the regulations on sensitive data (on racial or ethnic origins in particular) allowed INSEE to collect information on skin colour with a consensus reached on self-perception which included a free response without predefined categories. However, the principle of collecting this information was debated and, noting that social acceptance of this type of questioning was not guaranteed, INSEE and INED decided to abandon it.

8

Another example with RÉSIL is that some of the administrative sources envisaged were not retained following discussions in the consultation group, which warned of the risks (proportionality and acceptability). In this respect, benefiting from an outside perspective is essential in assessing the principle of proportionality.

And communicating our values

As part of RÉSIL, in addition to the transparency and collaboration with stakeholders practised during the consultation group, it was decided to communicate more widely on the values underlying the construction of the directories, also by highlighting professional independence, confidentiality, relevance and impartiality.

Downstream: more opportunities to ask questions

Once the data has been collected and processed, there are other opportunities for the statistician to question the relevance of the results and the associated documentation. For some surveys in particular, an analysis working group has been set up, bringing together researchers specialising in the field as well as official statisticians. This working group provides both an outside view of the data and exchanges on the initial results, or on the content and documentation associated with the files disseminated (FPR - Production and Research Files, see below). This working group is generally made up of people who are already members of the consultation working group set up when the survey was designed or redesigned.

New challenges arise when disseminating results: taking into account statistical confidentiality when disseminating data The challenge: striking a balance between open data and data protection

To do this, the survey manager can call on the experts in the Geographical Methods and Reference Frameworks Unit to ensure the statistical confidentiality of the tables produced, which is particularly important for business surveys. For the dissemination of localised data in particular, they can also call on the skills of the experts in the Dissemination Unit.

The 1951 Statistical Act on the obligation, coordination and confidentiality of statistics set up a Statistical Confidentiality Committee to ensure compliance with statistical confidentiality rules. This committee issue an opinion on requests to disclose data covered by statistical confidentiality for the purposes of official statistics or scientific or historical researches. The data concerned may have been collected as a statistical survey or transmitted by administrations or private operators to the official statistical service in order to compile statistics The applicant submits a file explaining the purpose of the study and justifying the list of data required. And after a favourable opinion, access is generally granted at the CASD (secure access centre), which allows the applicant to work on the data and extract results that respect statistical confidentiality.

A simplified procedure has been put in place for researchers with production and research files (files less rich than those available at the CASD to limit the risks of re-identification).

The importance of a shared culture among INSEE staff

INSEE staff undergo a high-level initial training course specialising in statistics and economics at one of the two schools of the Groupe des écoles nationales d'économie et statistique (GENES) or at the INSEE Training Center in Libourne (CEFIL). A continuous training programme ensures that staff develop their skills throughout their career. Training is not the only means of ensuring that the ethical values of official statistics are embraced. The mobility policy enables INSEE staff to regularly broaden their field of expertise, either by moving into different professions within the same field, or by moving between different fields of activity. In this way, they can start their career in a position of methodological expertise before taking responsibility for a survey, or vice versa. They are also encouraged to work in the ministerial statistical offices and to help disseminate good ethical practice throughout the official statistical service.

9

Conclusion

The environment in which we carry out our work is constantly changing. It offers new opportunities in the way we access and process data; it places us in a competitive situation with data producers who are now able to produce their own analyses or assessments; it confronts us with new needs for data or analyses to understand demographic, economic or social phenomena, it requires also quicker answers.

In the face of competition, the demands for relevance and quality are essential, as are strict compliance with data protection and transparency in data processing; they must be accompanied by a 'know-how' that enhances the value of the data itself. We need to learn to communicate our values better.

New opportunities give us new responsibilities: we must make the best use of them, while respecting the framework of necessity and proportionality and ensuring transparency about their use. This is a guarantee of the trust that citizens and users of our data place in us.

Being responsive and adaptable without abandoning our values or the quality of our output, implies a number of requirements: technicality, expertise, quality of tools for collecting, processing and making data available, the existence of tried and tested processes, but also a shared vision of the purposes of our work, enabling us to optimise its implementation, in a secure manner, depending on the circumstances and in line with ours values. It's a question of knowing how to make "tailor-made" products, making optimum use of the "machine tools", without the process becoming an assembly line.

Tailor-made vs Taylor-made...

10

Legislative framework

Loi n°51-711 du 7 juin 1951 sur l’obligation, la coordination et le secret statistique (Statistical Act)

Décrets n°2009-250 du 3 mars 2009 modifié et n°2009-318 du 20 mars 2009 pour les missions de l’ASP, le Cnis et les comités du label de la statistique publique, du secret statistique et du contentieux des enquêtes statistiques obligatoires (ASP and CNIS Decrees)

Loi n°78-17 du 16 janvier 1978 relative à l’informatique, les fichiers et aux libertés (Data protection Act)

Règlement (UE) n° 223/2009 révisé du Parlement européen et du Conseil du 11 mars 2009 relatif à la statistique européenne (European Statistical Act)

T he French official statistical system on the website insee.fr (english version)

Bibliographies

 Anxionnaz I. et Maurel F., The National Council for Statistical Information: The quality of Official Statistics also depends on consultation, in Courrier des statistiques n° 6 (july 2021)

 Roth N. et Christine M., The Label Committee: A Governing Body Ensuring the Quality of Official Statistics, in Courrier des statistiques n° 5 (december 2020)

 Bureau D., Ensuring Independent Quality Statistics:The French Official Statistics Authority Ten Years After, in Courrier des statistiques n° 5 (december 2020)

 Redor P., Confidentialité des données statistiques : un enjeu majeur pour le service statistique public, in Courrier des statistiques n° 9 (juin 2023) – in French only

 Tavernier J.-L., Un système statistique intégré à l’administration centrale, in Courrier des statistiques n° 1 (décembre 2018) – in French only

 Isnard M., Qu’entend-on par statistique(s) publique(s) ? , in Courrier des statistiques n° 1 (décembre 2018) – in French only

 Lefebvre O. Towards a "social mandate" for the French project of a statistical directory of individuals and dwellings by France - Unece juin (2023)

11

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 27/03/24

French official statistician and ethics

Ethics and practice, the practice of ethics

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 2

1 - ETHICS AND PRACTICE A- LEGAL AND ORGANISATIONAL FRAMEWORKS B- PROCEDURES C- CULTURE

2 - THE PRACTICE OF ETHICS 3 - THE FUTURE

3

INTRODUCTION

Procedures and tools

Shared culture

Legal/organisation frameworks

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 4

LEGAL AND ORGANISATION FRAMEWORKS1-A

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 5

MISSIONS OF INSEE

LIKE EVERY NSI

 Production of statistics (surveys, use of administrative data, use of private data)

 Dissemination of statistics

 Coordination of national statistics system (NSI + ONA)

MORE SPECIFIC MISSIONS

 Short term analysis and economic forecast (national level)

 Economic and social studies (national and local level)

 Managing registers for administrative purposes (shared identification)

 Register for identification of persons (no address, share of Id strictily limited)

 Business register

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 6

3 PILLARS – FRENCH STATISTICAL SYSTEM

INSEE +

16 ministerial statistical offices

STAKEHOLDERS

● Users (directs, indirects)

● Government/public or private decision-makers ●

● Intermediaries (information relays, reusers ...) ●

● Suppliers (respondents, administrative or private data)

Official Statistical authority ● Ensures the professional indepedance,

ethics for the SSP ● Controls (auditions NSI, ONAs)

National council for statistical information

● Consultation ● Opportunity

Official Statistics Label Committee ● Compliance

Statistical confidentiality Committee ● Confidentiality ● Researchers accesses

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 7

OFFICIAL STATISTICS GOVERNANCE

3 FRENCH LAWS



 1951 Act on the obligation, coordination and secrecy of statistics (modified many times, especially 84, 2002, 2016)  « French Statiscal Law »



 Insure Data collection of survey and administrative data and private data since 2016  Creation of CNIS  Statistical coordination  Regulate mandatory data collection

 1978 Act relating to data processing, files and freedoms compliant with GDPR (modified in 2019)

 2016 Act for a Digital Republic : open data for database, documents, source code, access on private data (51 law's update), non significant identifier for record linkage

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 8

COMMON REFERENCE

European Statistics Code of Practice Necessity, proportionnality principles

« data collected for a given purpose must remain adequate, relevant and not excessive, and that

the list of data must be limited to what is strictly necessary to meet the stated purpose »

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 9

PROCEDURES AND TOOLS1-B

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 10

PROCEDURES (1/2)

DESIGN/BUILD PHASES – Opportunity, relevance, response burden

 with the Cnis’ opinions

– Compliance with the CoP, sound methodology of the project

 with the help of the Statistical Methods unit (sampling frames, good practices to design survey...)

 Label Committee

– Data confidentiality and security

data protection impact assessment (compliance with GDPR) with the Legal Affairs and Litigation unit

 IT security certification (often with external review)

 Strict rules for internal access to data

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 11

PROCEDURES (2/2)

DISSEMINATION PHASE – Validation of data (directly from internal users)

– Procedure of correction of errors

– Taking into account statistical confidentiality

 help from Statistical Methods unit

– Researchers’ accesses

Statistical confidentiality committee (opportunity/ proportionality) and dedicated centers

 Design of the datasets adapted to the conditions of access and control

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 12

SERVICES, METHODS AND TOOLS

SOME SHARED METHODS AND TOOLS – Metadata repository (RMéS)

– CSNS, linkage record service (WIP)

– Secured infrastructure for a self-service of data processing

– Sampling for households and business surveys

– Project management method

– Unified tool for the acquisition and first steps of transformation of administrative data

– ...

13

COMPLIANCE WITH THE COP

Within the process itself

Quality framework (with the Quality monitoring committee – CoSaQ every unit of Insee + ONAs)

Help possible from the Quality Unit to design a specific quality framework

• External views

Official Statistical Authority annual report (ASP)

European peer reviews – for France : 2007, 2014, 2021

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 14

COMMON CULTURE1-C

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 15

OFFICIAL STATISTICIANS : A COMMON CULTURE (1/2)

A HIGH LEVEL INITIAL TRAINING IN STATISTICS AND ECONOMICS – 2 schools (Ensae/Ensai) and Insee training center (Cefil)

 the same skills and strong links between people right from the training stage

– Introduction to quality and ethics

A CONTINUOUS TRAINING PLAN – Methods,

– Ethics&quality,

– Statiscal softwares and data processing (reproducibility, traceability , data confidentiality)...

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 16

OFFICIAL STATISTICIANS : A COMMON CULTURE (2/2)

ACCUMULATED EXPERIENCE THROUGHOUT THE CAREER – A mobility policy that allows us to work in different jobs, at different

steps of data life cycle (collection, design, processing, dissemination), in different environments (Insee, ONAs, other agencies, schools)

 open-mindedness and ability to engage in dialogue

 between Insee and ministerial statistical offices

– Possibility of being responsible for a statistical process from start to finish, with dialogue at every stage involving an expert/specialist in charge of a component of the process, an auditor, an internal user of the data

 constant questioning fuelled by a shared culture

– Specific rôle of the managers, especially for young colleagues

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 17

IN PRACTICE02

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 18

SURVEY : TEO

TRAJECTORIES AND ORIGINS SURVEY – Strong public demand on a sensible topic

– Social acceptability and impartiality ● Not all the questions allowed by law (no consensus) ● Strong neutrality for the results and studies

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 19

RÉSIL : STATISTICAL REGISTER OF INDIVIDUALS & HOUSING

STATISTICAL REGISTER – 2 points of attention : exhaustibility, linkage of administrative data

– Not only technical and legal challenges : they give capacity to do, but don’t ensure legitimity

SOCIAL ACCEPTABILITY – Special consultation supported by CNIS, but in a dedicated group of non

statisticians : challenge the proportionality, identify risks and mitigation : real impact on the design of the project and the implemented processes, recognized and “enforced” by CNIL

– Public communication : about the project, but as well about some of the core values (impartiality, independency…) and in a « non technical » approach (condition of transparency towards a large public)

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 20

THE FUTURE03

WORKSHOP ON ETHICS, GENEVA 26-28/03/24 21

THE FUTURE

OFFICIAL STATISTICIANS AND ETHICS – Daily practice, exchanges

– New opportunities (IT, AI), new questions

MORE TRANSPARENCY, MORE COMMUNICATION – Keep the confidence

27/03/24WORKSHOP ON ETHICS, GENEVA 26-28/03/24

insee.fr

Retrouvez-nous sur

Mylène CHALEIX Olivier LEFEBVRE Head of Quality Unit Director of Résil program Mél: [email protected] [email protected]

UNITED NATIONS ECONOMIC COMMISSION FOR EUROPE

CONFERENCE OF EUROPEAN STATISTICIANS

Workshop on Ethics in Modern Statistical Organisations

26-28 March 2024, Geneva, Switzerland

26 février 2024

Éthique et pratique, pratique de l’éthique, l’exemple de l’Insee Mylène CHALEIX (INSEE, France) - e-mail : [email protected]

Olivier LEFEBVRE (INSEE, France) - e-mail :[email protected]

Résumé

Créé en 1946, l’Insee a reçu pour mission de développer et de diffuser une information statistique pour éclairer le débat économique et social au service de la démocratie. Pilier de son mandat, la loi statistique de 1951 sur le secret, la coordination et l’obligation statistiques porte les valeurs du service statistique public français. En particulier, dès son origine, elle établit un équilibre entre les conditions de collecte des données et les modalités de leur protection.

Mais au-delà de son inscription dans le droit, ou dans les programmes de formation initiale, l’éthique se doit d’être inscrite dans les pratiques quotidiennes de chacun. À cet égard, l’organisation retenue pour la statistique publique française est de donner au statisticien une responsabilité de bout en bout sur son processus, qui inclut la production du résultat final, mais aussi le respect des valeurs de la statistique publique. De la conception à la diffusion des données et des études, le statisticien va rencontrer des interlocuteurs à de nombreuses occasions qui vont le (re)questionner sur les mesures prises pour y concourir :

 opportunité de lancer une opération statistique, accès aux données (existantes ou mise en place d’une enquête),

 conformité aux bonnes pratiques de la statistique européenne,

 déclarations RGPD pour les données individuelles,

 conditions d’accès des chercheurs aux données produites,

 traitement du secret statistique en diffusion,

 mais également sur les enjeux informatiques (conduite de projet, homologation, sécurisation des accès et des postes de travail).

Ces différentes étapes permettent une assurance collective de la prise en compte de la déontologie du statisticien public au plus près des travaux, tout en donnant du sens à ces questionnements. Conjuguées à une politique de mobilité des agents entre les différents services statistiques, elles renforcent à la fois l’appropriation par chacun et le croisement des approches, apportant une sécurité renforcée à l’ensemble.

1

Éthique et pratique, pratique de l’éthique, l’exemple de l’Insee

La pratique de l’éthique à l’Insee et dans le service statistique public français résulte d’un équilibre entre les idéaux et les réalités, entre les procédures et leur adaptation aux circonstances, entre la théorie et la pratique. Comme à bicyclette, cet équilibre n’est viable que s’il s’accompagne de mouvement, en d’autres termes que s’il est pratiqué au quotidien et si ses composants s’adaptent en continu.

L’ensemble des agents de la statistique publique peut ainsi s’appuyer sur un cadre juridique responsabilisant et protecteur, mais aussi sur un corpus de valeurs professionnelles et de bonnes pratiques régulièrement questionnées et confortées aux situations réelles. Des procédures en balisent la mise en œuvre, tout en restant assez adaptables pour tenir compte de circonstances exceptionnelles. L’organisation de l’Insee permet des échanges réguliers entre collègues, leur permettant de trouver des réponses à leurs questions, et de trouver les bons équilibres permettant de s’inscrire dans chacune de ces valeurs.

Le cadre juridique et organisationnel à l’Insee, porteur des valeurs de la statistique publique

L’Institut national de la statistique et des études économiques - l’Insee - a été créé par la loi de finances du 27 avril 1946, reprenant alors une activité de statistique publique qui s’était exercée sans discontinuité depuis 1833. Dans le cadre de la loi statistique française de 1951, il a pour mission de collecter, analyser et diffuser des informations sur l'économie et la société française sur l'ensemble de son territoire. Il coordonne le service statistique public français.

Par rapport à la plupart des autres instituts nationaux de statistique, l’Insee présente deux spécificités importantes : il réalise des études économiques et sociales, fondées sur les données qu’il produit, ainsi que des prévisions économiques de court terme ; il gère des répertoires inter-administratifs de personnes et d’entités économiques pour le compte de l’ensemble des acteurs. Une troisième particularité de l’Insee réside dans le mode de formation de ses agents : la plupart des agents recrutés suivent une formation initiale en économie et statistique, dans des écoles spécialisées qui forment à la fois les fonctionnaires de l’Insee et des cadres du secteur privé.

Un environnement juridique national et européen, qui évolue pour s’adapter au contexte et aux enjeux, sans perdre de vue les fondamentaux (donner un cadre pour la collecte de données, garantir la pertinence des enquêtes et la protection des données) Enjeu : garantir les équilibres collecte-utilisation-protection

L’Insee évolue dans un contexte juridique national, à la fois relativement ancien, donc bien ancré dans les usages et pratiques, et évolutif, pour tenir compte des changements de contexte ou de besoins. La loi fondatrice de cette activité statistique date de 1951. Initialement centrée sur les enquêtes, elle définit les règles du jeu en matière de collecte (y compris les cas d’obligation de répondre), mais aussi d’opportunité (en lien avec le besoin d’éclairer tel ou tel phénomène, et en l’absence de sources alternatives) et la protection des données collectées (secret statistique). Elle s’est progressivement enrichie pour inscrire en droit l’indépendance

2

professionnelle et pour prendre en compte de nouvelles modalités de collecte (utilisation de données administratives et, plus récemment, de données détenues par des acteurs privés) tout en veillant à définir les règles d’appréciation de l’opportunité de telles collectes et de la protection des données ainsi recueillies. Concernant le traitement de données individuelles, celui-ci s’exerce dans le respect de la loi Informatique et libertés de 1978, qui a également su évoluer pour s’adapter d’une part au Règlement général pour la protection des données (RGPD), d’autre part aux nouvelles opportunités en matière d’appariement sécurisé de données individuelles. La Commission nationale Informatiques et libertés (Cnil) est chargée d’informer et de contrôler son application.

L’organisation de la statistique publique en France repose sur 3 piliers.

La loi de 1951 sur l’obligation, la coordination et le secret statistique, révisée notamment par la loi de modernisation de l’économie du 4 août 2008, a créé différentes instances qui jouent un rôle essentiel dans le fonctionnement et la régulation des activités de la statistique publique :

 le service statistique public (SSP), composé de l’Insee et de 16 services statistiques ministériels (SSM) qui réalisent les opérations statistiques dans leur domaine de compétence ;

 le Conseil national de l'information statistique (Cnis), organe de concertation entre producteurs et utilisateurs de la statistique publique, chargé de suivre les travaux statistiques ; ses attributions sont proches de celles que l’ESAC1 exerce pour la statistique européenne, même si son organisation est différente,

 l’Autorité de la statistique publique (ASP), chargée particulièrement de veiller à l'indépendance professionnelle des statisticiens publics. C’est l’équivalent français de l’ESGAB2.

Insee

● Usagers (directs, indirects)

● Gouvernement/décideurs publics ou privés

● Intermédiaires (relais d’information, réutilisateurs …)

● Fournisseurs (répondants, données administratives ou privées)

Garant indépendance, rigueur méthodologique et déontologie Contrôles

Concertation Opportunité

SSM Travail

SSM Santé/solidarité

SSM Éducation SSM Recherche/Ens.sup.

SSM Culture

SSM Sécurité intérieure SSM Défense

SSM Immigration

SSM Collectives locales

SSM Fonction publique

SSM Commerce extérieur

SSM Agriculture

SSM Environnement Énergie/Logement Transport/Dev. durable

SSM Justice

SSM Jeunesse/sports

SSM Finances publiques

Conformité

L’Insee a pour attributions de coordonner les méthodes, les moyens et les travaux statistiques du SSP et de réaliser la cohérence des nomenclatures statistiques. La façon dont le SSP mène ses activités sont évaluées par l'Autorité de la statistique publique. Le cadre de référence est celui défini notamment par le code de bonnes pratiques de la statistique européenne (CoP).

Créés également par la loi de 1951, le Comité du label de la statistique publique et le Comité du contentieux des enquêtes statistiques obligatoires interviennent sur les enquêtes respectivement sur la qualité et sur le respect de l’obligation de réponse. Le Comité du label intervient également, à la demande de l’ASP, sur la conformité des statistiques produites par d’autres organismes que ceux du SSP (avec des niveaux de conformité dépendant des niveaux de labellisation demandés).

1ESAC : European Statistical Advisory Committee 2ESGAB : European Statistical Governance Advisory Board

3

Une forte implication dans le partage des données dans le respect du secret statistique

Contrairement à plusieurs INS, l’Insee ne s’est pas vu confier une mission de « data stewardship » à l’échelle nationale, mission que d’ailleurs il ne revendique pas. Mais il exerce des missions transversales en matière d’administration et de partage de données, sur des publics, des types de données et des domaines bien spécifiques. Une première mission de partage de données statistiques à l’échelle du service statistique public (avec notamment la mise en place d’un identifiant individuel non signifiant interne à la statistique publique), ou en direction de chercheurs, selon des conditions définies par une instance spécifique appelée Comité du secret statistique. Une deuxième mission est de gérer un ensemble de nomenclatures, y compris géographiques, et de concepts communs destinées à faciliter le partage de ces données. Une troisième mission, que l’on pourrait qualifier de « statistics stewardship » consiste à diffuser très largement les données qu’il produit, en open data. Enfin, l’Insee, de par sa gestion de répertoires inter-administratifs, exerce une mission « d’ID-stewardship » non formalisée en tant que telle, mais qui permet de faciliter l’inter-opérabilité sémantique de fichiers administratifs au moyen d’identifiants uniques et partagés.

La pratique de l’éthique au quotidien, à l’Insee, le résultat de plusieurs facteurs

Un corpus de bonnes pratiques, de valeurs essentielles Enjeu : garantir la qualité, la réactivité, le concret

Ce cadre juridique et institutionnel complète un autre cadre, fait de valeurs professionnelles et de bonnes pratiques. Par certains aspects, le premier a traduit le second en droit, en « rendant ces valeurs opposables », autant que de besoin (face à des questions nouvelles, des opportunités nouvelles, des enjeux nouveaux) ; par d’autres aspects, on peut dire qu’il s’agit de formalisations cohérentes, et que les principes et valeurs permettent à chacun de « garder du sens ».

On peut ainsi citer le code de bonnes pratiques de la statistique européenne, dont les 16 principes balisent nombre de nos travaux, mais aussi les valeurs essentielles (core values) adoptées par l’Unece. Ce corpus se projette dans la vie quotidienne des statisticiens à travers des illustrations, des comportements, des points d’attention partagés. Avec pour but de maintenir un haut niveau de qualité, dans le respect de nos valeurs essentielles, tout en restant réactifs face aux situations réelles et tout ce qu’elles comportent d’imprévus.

Des guides, procédures, audits, plans d’action, qui sont des aides pour la mise en œuvre Enjeu : rester solides et ne pas perdre le sens

Au-delà de ces principes et de ces valeurs, les statisticiens publics s’appuient sur trois piliers. Le premier concerne des méthodes partagées pour leurs actions, permettant d’en sécuriser la mise en œuvre. Le deuxième s’exerce par le biais de procédures (pour les opérations courantes), de plans d’action (pour des améliorations ou

4

la mise en œuvre d’investissements). Le troisième mobilise des audits destinés à apporter un regard externe au processus sur nos pratiques, sous l’angle de l’efficacité (atteignent-elles le but recherché ?) ou de l’efficience (avec les allocations optimales de moyens) ? L’enjeu est que l’ensemble des statisticiens disposent de repères concrets et partagés pour la mise en œuvre de leurs travaux sans se laisser enfermer par des processus totalement formatés, et puissent les évaluer et les faire évoluer.

Une organisation permettant à la fois une responsabilisation des concepteurs d’opération et de chacun des acteurs, et des regards croisés sur chaque phase du processus Enjeu : intégrer des apports divers sans diluer les responsabilités

L’Insee a adopté une organisation du travail qui responsabilise pleinement le concepteur d’une opération statistique (de la collecte à l’analyse et la mise à disposition des premiers résultats) tout en lui apportant la technicité, l’expertise et les regards extérieurs dont il a besoin pour mener à bien son opération, et pour l’améliorer en continu s’il s’agit d’une opération récurrente. Le concepteur s’entoure d’experts du domaine pour cibler la collecte d’information en fonction des attentes exprimées, puis d’experts en méthodologie ou en design d’enquêtes (questionnement, protocole d’interrogation, usage ou non du multimode, échantillonnage), d’architectes et de développeurs IT pour une mise en œuvre performante et sécurisée de la collecte et des traitements ; il s’appuie sur des enquêteurs, puis des gestionnaires, pour ces opérations de collecte et de traitement… Des points de passage (avis d’opportunité, avis de conformité statistique, homologation de sécurité IT) permettent à des regards extérieurs de s’exprimer, de manière à améliorer le dispositif, ou, dans le cas contraire, d’exprimer une opposition à sa mise en œuvre.

Une pratique permettant de s’adapter à des chocs extérieurs ou à des contextes particuliers (sujets passionnels, questions sensibles, vigilance de l’opinion) sans sacrifier à nos valeurs Enjeu : savoir assouplir la règle quand il le faut sans en perdre l’esprit, ou savoir aller plus loin que le cadre proposé.

Les procédures sont claires, juste assez contraignantes pour en garantir l’efficience (en évitant que chacun les ré-invente) et assurer la transparence nécessaire, mais en gardant la possibilité de les adapter aux circonstances. Ainsi, lors de la crise sanitaire, la statistique publique a été en capacité de réaliser une enquête auprès des entreprises et d’en publier les résultats moins de 30 jours après l’expression de la demande. Des procédures accélérées d’instruction en opportunité et en conformité statistique, alliées à un dispositif informatique souple et sécurisé, ont permis de répondre rapidement à une question cruciale (comment les entreprises se sont-elles adaptées au premier confinement ?) sans sacrifier la qualité ni la sécurité de la collecte et des traitements.

Un état d’esprit partagé autour des valeurs de qualité, confidentialité, indépendance Enjeu : une boussole commune utilisée au quotidien

Pour que tout cela fonctionne de manière optimale, il est essentiel que chacun partage la vision des finalités des opérations statistiques auquel il contribue, mais aussi des valeurs qui sous-tendent sa mise en œuvre, et de son propre rôle dans la réalisation du dispositif.

Les valeurs font partie des enseignements reçus dans les écoles, puis elles infusent en continu au gré des échanges entre collègues, des formations complémentaires, des actions de communication interne ou des pratiques managériales. Un des enjeux est de relier des actes du quotidien, des travaux courants ou exceptionnels à ces valeurs, de manière à les incarner. Le niveau de formalisation des valeurs est resté jusqu’à présent minimaliste, mais il sera peut-être nécessaire dans l’avenir de l’augmenter pour répondre aux attentes grandissantes des utilisateurs et faciliter la communication sur ces valeurs.

5

En pratique, illustration avec le parcours classique d’une enquête de la statistique publique

Tout projet d’enquête de la statistique publique doit faire l’objet d’un avis d’opportunité du Cnis qui s’assure de l’intérêt général et de l’utilité des opérations statistiques présentées dans les programmes de travail. Cet avis, émis par le président de la commission thématique dont relève l’enquête, permet de s’assurer qu’elle correspond à un besoin d’intérêt public (principe de pertinence) et qu’elle ne fait pas double emploi avec d’autres sources déjà disponibles - enquête statistique ou administrative, fichier de gestion, etc. (principe de minimisation de la charge des répondants).

Pour pouvoir être réalisé dans le cadre de la loi du 7 juin 1951, tout projet d’enquête statistique présenté par un service producteur de la statistique publique doit obtenir un label d’intérêt général et de qualité statistique.

Après avoir reçu un avis d’opportunité, le responsable de l’enquête (au sein du service producteur) prépare un dossier (qui reprend, depuis 2024, les principales rubriques du standard des rapports qualité orientés utilisateurs, SIMS – Single Integrated Metadata Structure, complété par des annexes méthodologiques) et le présente au comité du label de la statistique publique. Pour rendre son avis, celui-ci s’assure que l’enquête répond aux critères de qualité statistique en ce qui concerne la concertation avec les utilisateurs, la méthode de collecte et d’échantillonnage (plan de sondage, méthode de redressement des données, traitement des non- réponses garantissant la fiabilité des résultats…), de pertinence du questionnement et d’adaptation de la diffusion aux objectifs annoncés. Le dossier comporte également les résultats des tests du questionnaire. Il s’assure également que l’enquête n’entraîne pas de charge excessive sur les enquêtés, qu’une concertation a été menée avec les partenaires concernés et que les souhaits exprimés par le Cnis lors du débat d’opportunité ont bien été pris en compte.

Lors de la conception, le responsable d’enquête peut s’appuyer sur les experts des différentes unités transverses :

 pour la conception de son questionnaire (département des méthodes statistiques) et les spécialistes du domaine (internes ou externes au SSP) ;

 pour l’échantillonnage (département des méthodes statistiques) ;

 sur l’organisation de son enquête (divisions de maîtrise d’œuvre des enquêtes) ;

 sur la définition des produits de diffusion (direction de la diffusion et de l’action régionale) et le traitement de la confidentialité (département des méthodes statistiques) ...

6



Illustration avec TEO : enquête Trajectoires et Origines (éditions 2008 – 2019)

L'enquête Trajectoires et Origines (TeO) a pour objectif d'appréhender l’impact de l'origine géographique sur l'accès aux différentes ressources de la vie sociale (logement, langue et éducation, emploi, loisirs, services publics et prestations sociales, contraception, santé, nationalité, réseau de relations, marché matrimonial, etc.). Elle s'intéresse à l'articulation entre l'origine et les autres catégories de distinction dans la société française (genre, classe, âge, quartier, etc.) afin d'analyser les processus d'intégration, de discrimination et de construction de l’identité au sein de la société française dans son ensemble. La seconde édition de l’enquête (TeO2), réalisée en 2019-2020, permet d’actualiser les résultats issus de la première enquête (TeO1) sur ces différents thèmes dix ans après.

Suite à une forte demande publique de disposer d’informations sur les immigrés et leurs descendants et leur intégration (absence d’informations dans les données administratives ou dans le recensement), l’Insee et l’Ined (Institut national d’études démographiques, organisme public de recherche) se sont associés pour proposer une enquête originale sur les trajectoires et les origines. La particularité de l’enquête est de s’intéresser à des thématiques classées comme sensibles pour la loi Informatiques et libertés. Il s’agit en particulier des thématiques en relation avec les origines raciales ou ethnique, la religion, la santé ou encore la vie citoyenne (opinions politiques, engagement syndical).

La première édition a donné lieu à la constitution d’un groupe de travail pluridisciplinaire (statisticiens, démographes et chercheurs) pour la conception du questionnaire entre 2006-2007 (avec focus group et test terrain), à une consultation des associations concernées, des échanges au sein du Cnis sur la sensibilité des données (mai et octobre 2007) en complément des étapes habituelles d’opportunité et de conformité. L’avis de la Cnil a également été recueilli.

Portée à nouveau par la demande publique, une réédition a été inscrite au programme des enquêtes. Lors de la préparation de TeO2 (2016-2019), les mêmes étapes ont été reproduites (groupe de conception, avis d’opportunité ; de conformité, avis demandé auprès de la Cnil et inscription au RGPD) et leurs recommandations ont été incluses dans le protocole : caractère expérimental pour l’enquête sur la 3è génération ou possibilité de ne pas répondre sur les thèmes sensibles.

Au-delà des enquêtes, les services producteurs s’adressent également au Cnis pour accéder aux données administratives (loi de 1951 - article 7bis) ou aux données privées (loi de 1951 - article 3bis) et obtenir un avis d’opportunité. La question de la proportionnalité, qui n’est pas abordée par le prisme de la charge de réponse, demande une attention particulière. En France, cette attention est portée par la loi Informatique et Libertés qui précise que « les données collectées au regard d’un objectif déterminé doivent rester adéquates, pertinentes et non excessives, la liste des données doit se limiter à ce qui est strictement nécessaire pour répondre à l’objectif annoncé ». Avec le développement d’identifiants statistiques et la mise en place prochaine d’applicatifs dédiés, les réflexions sont en cours sur la mise en place d’une procédure concernant les appariements afin de maîtriser les objectifs et là encore de limiter les informations appariées aux seules données nécessaires.

Autres garde-fous sur la confidentialité et sécurité des données

L’AIPD une procédure au service de la protection des données individuelles Le Règlement général pour la protection des données (RGPD), transcrit en droit français dans l’évolution de la loi Informatique et libertés en 2018, impose à tout responsable de traitements des obligations Ces obligations s’articulent pour l’essentiel autour de deux grands principes : un principe de transparence et un principe de maîtrise et limitation des risques d’impact des traitements sur la vie privée des personnes concernées. Le principe de transparence impose l’information des personnes, notamment quant à la finalité du traitement, aux données mobilisées, à l’exercice de leurs droits et en réponse à leurs demandes, à la documentation des

7

traitements (cf lettre-avis pour les enquêtés et informations sur insee.fr). Le responsable de traitement doit également veiller à ce que le traitement mis en œuvre respecte bien les principes de nécessité, de minimisation et de proportionnalité au regard des données traitées.

Cette déclinaison française du RGPD se concrétise par l’inscription de tout traitement de données à caractère personnel dans un registre tenu par le service responsable du traitement et également une étude d’impact sur les conséquences pour les personnes, en cas de risque avéré. Le registre des traitements décrit, pour chaque traitement de données à caractère personnel, ses finalités et objectifs, les catégories de données mobilisées, les catégories de personnes concernées, les acteurs impliqués (producteurs, destinataires, sous-traitants), les durées de conservation. À partir de ce registre sont constituées des fiches descriptives des traitements, mises en ligne sur insee.fr ou des informations communiquées directement aux enquêtés.

L’Analyse d’Impact relative à la Protection des Données (AIPD) est un outil qui permet de construire un traitement conforme au RGPD et respectueux de la vie privée. Elle concerne les traitements de données personnelles qui sont susceptibles d'engendrer un risque élevé pour les droits et libertés des personnes concernées.

Pour mener une AIPD, il convient de :

1. délimiter et décrire le contexte du(des) traitement(s) considéré(s) ;

2. analyser les mesures garantissant le respect des principes fondamentaux : la proportionnalité et la nécessité du traitement, et la protection des droits des personnes concernées ;

3. apprécier les risques sur la vie privée liés à la sécurité des données et vérifier qu’ils sont convenablement traités ;

4. formaliser la validation de l’AIPD au regard des éléments précédents ou bien décider de réviser les étapes précédentes.

L’analyse d’impact sur la protection des données comporte une description du traitement, plus détaillée que ce qui figure dans le registre des traitements. Elle traite également des éléments permettant d’apprécier la sensibilité du traitement, au regard notamment de son échelle (toute la population ou un échantillon ?), des variables traitées (notamment vis-à vis de leur sensibilité au sens du RGPD) et de la nature même du traitement (implique-t-il un croisement de plusieurs fichiers ?). Y figure notamment une analyse des risques en termes de sécurité des données ou d’atteinte à la vie privée, assortie d’éléments de remédiation. Ce document est établi par une unité spécialisée de l’Insee, en lien avec le concepteur du traitement, qui bénéficie ainsi d’une expertise indispensable quant à l’analyse de ces enjeux.

… et une autre procédure pour l’intégrité et la sécurité des données

La sécurisation des données à toutes les étapes du processus est également une préoccupation du statisticien public, préoccupation grandissante avec la montée de la cybercriminalité. À l’Insee, les systèmes d‘information font l’objet d’une homologation de sécurité, impliquant des experts de la direction du système d’information et des experts externes. À nouveau, le processus va être « ausculté » mais cette fois sous l’angle de la sécurité informatique : disponibilité, intégrité, confidentialité et traçabilité. Concernant les enquêtes, les outils de collecte étant mutualisés dans une filière d’enquête, l’homologation d’une enquête s’appuie sur ce qui est fait pour la filière.

8

Source : CNIL

Mais être capable de sortir du cadre quand c’est nécessaire

Comment s’assurer de l’acceptabilité d’un projet sensible ? Enjeu : la légitimité au-delà de la capacité à faire

L'Insee a lancé en 2021 un projet ambitieux appelé Résil qui vise à construire un répertoire statistique des individus et des logements basé sur le couplage de diverses données administratives.

Concernant ce projet, l'Insee a la conviction que les enjeux juridiques et éthiques sont aussi importants que les défis techniques et nécessitent une attention particulière, en s'appuyant pour cela sur des regards extérieurs. Au- delà de la capacité technique et juridique à faire Résil, il fallait aussi acquérir la légitimité, à travers un « mandat social ». Un processus ambitieux de consultation de la société civile a donc été mené sur ce projet, en parallèle des travaux d'ingénierie statistique. Il s'est notamment appuyé sur un groupe de travail extérieur à la statistique publique, qui a fonctionné de manière très intensive pendant 6 mois, de mai à octobre 2022. C’est une démarche extra-ordinaire, allant au-delà des processus de concertation habituels, mais adaptée aux enjeux très spécifiques du projet.

Le groupe ne s'est pas opposé au principe de Résil, en tant que répertoire à vocation exclusivement statistique alimenté par diverses sources et permettant des appariements, et fait confiance à l'institution sur le plan technique et déontologique pour le construire et le faire fonctionner dans les règles de l'art et le respect des bonnes pratiques.

Cependant, il a considéré que compte tenu de la nature de Résil et du contexte actuel concernant l'utilisation des données personnelles, marqué à la fois par une plus grande circulation de ces données et par une vigilance accrue sur leur utilisation, il est nécessaire de fixer et de rendre visibles les règles du jeu, de s'appuyer sur des regards extérieurs pour que différentes autorités ou agences nationales les garantissent et en fixent les limites. Il a estimé également qu'il est essentiel de poursuivre dans la durée les efforts de transparence et de consultation entrepris par l'Insee.

Cette expérience de concertation a été très prenante, mais très utile pour l’Insee, car elle a permis d'identifier certaines craintes qui pourraient émerger à propos d'un tel système, certains défis en matière de communication et de consultation sur Résil et l'utilisation de données externes, et d'améliorer la conception de notre projet.

Données sensibles Enjeu : une collecte proportionnée

Savoir ne pas aller trop loin pour des raisons liées à l’acceptabilité sociale : sur l’exemple de TeO, les exceptions prévues à la réglementation sur les données sensibles (sur les origines raciales ou ethniques notamment) permettaient à l’Insee de recueillir une information sur la couleur de la peau avec un consensus trouvé sur une auto-perception avec réponse libre sans catégories prédéfinies. Cependant le principe de ce recueil faisait débat et, constatant que l’acceptation sociale de ce questionnement n’était pas assurée, l’Insee et l’Ined ont préféré y renoncer.

Autre exemple avec Résil, certaines sources administratives envisagées n’ont pas été retenues suite aux échanges dans le groupe de concertation, ce dernier ayant alerté sur les risques (proportionnalité et acceptabilité). À cet égard, bénéficier d’un regard extérieur est un atout essentiel pour apprécier ce principe de proportionnalité.

Et communiquer… sur nos valeurs

Dans le cadre de Résil, au-delà de la transparence et la collaboration avec les parties prenantes pratiquées lors du groupe de concertation, il a été décidé de communiquer plus largement sur les valeurs sous-jacentes à la

9

construction des répertoires également en mettant en avant l’indépendance professionnelle, la confidentialité, la pertinence et l’impartialité.

En aval, encore des occasions de se poser des questions

Une fois les données collectées et traitées, d’autres occasions permettent au statisticien de se questionner sur la pertinence des résultats et la documentation associée. On citera en particulier sur certaines enquêtes la mise en place d’un comité d’exploitation associant au-delà de la statistique publique des chercheurs spécialistes du domaine. Ce comité permet à la fois un regard extérieur sur les données et des échanges sur les premiers résultats, ou encore sur le contenu et la documentation associée aux fichiers diffusés (fichiers de production et de recherche FPR, cf. infra). Ce comité s’appuie généralement sur des personnalités déjà présentes dans le comité de concertation mis en place lors de la conception ou de la refonte de l’enquête.

De nouveaux défis se posent lors de la diffusion des résultats : la prise en compte du secret statistique pour la diffusion Enjeu : trouver un équilibre entre open data et protection des données

Pour ce faire, le responsable d’enquête peut s’appuyer sur les experts de la division Méthodes et référentiels géographiques pour assurer le secret statistique sur les tableaux produits, particulièrement prégnant pour les enquêtes auprès des entreprises. Il peut également s’appuyer, en particulier pour la diffusion de données localisées, sur les compétences des experts de la direction de la diffusion.

La loi de 1951 sur l’obligation, la coordination et le secret en matière de statistique a instauré la mise en place d’un Comité du secret statistique pour veiller au respect des règles du secret statistique et émettre un avis sur les demandes de communication de données couvertes par le secret statistique à des fins de statistique publique ou de recherche scientifique ou historique. Les données concernées peuvent avoir été collectées par voie d’enquête statistique ou transmises au service statistique public à des fins d’établissement de statistique par des administrations ou opérateurs privés. Le demandeur dépose un dossier expliquant la finalité de son étude, justifiant la liste des données nécessaires, et après avis favorable, l’accès se fait généralement au CASD (centre d’accès sécurisé) qui permet au demandeur de travailler sur les données et d’en extraire des résultats respectant le secret statistique.

Une procédure simplifiée a été mise en place pour les chercheurs avec les fichiers de production et de recherche (fichiers moins riches que ceux disponibles au CASD pour limiter les risques de ré-identification).

L’importance d’une culture partagée des personnels Insee

Les agents des corps de l’Insee suivent un cursus de formation initiale de haut niveau spécialisé en statistique et en économie dans l’une des deux écoles du Groupe des écoles nationales d’économie et statistique (Genes) ou au Centre de formation de l’Insee à Libourne (Cefil). Un programme de formation continue assure le développement des compétences des agents tout au long de leur carrière. La formation n’est pas le seul levier pour l’appropriation des valeurs éthiques de la statistique publique. La politique de mobilité permet aux agents des corps de l’Insee de régulièrement élargir leur champ de compétence, en pouvant soit aborder différents métiers au sein d’un même domaine, soit évoluer entre différents domaines d’activité. Ainsi, ils peuvent démarrer leur carrière sur un poste d’expertise méthodologique avant de prendre la responsabilité d’une enquête, ou le contraire. Ils sont également encouragés à travailler dans les services statistiques des ministères et concourir à la diffusion des bonnes pratiques en matière d’éthique au sein de l’ensemble du service statistique public.

10

Conclusion

Le contexte dans lequel nous exerçons nos missions est en perpétuelle évolution. Il offre de nouvelles opportunités, en termes d’accès aux données ou de traitement de ces données, il nous place en situation de concurrence face à des producteurs de données désormais capables de produire leurs propres analyses ou valorisations, il nous confronte à de nouveaux besoins de données ou d’analyses pour comprendre les phénomènes démographiques, économiques ou sociaux.

Face à la concurrence, les exigences de pertinence et de qualité sont essentielles, ainsi que le strict respect de la protection des données et de la transparence sur les traitements ; elles doivent s’accompagner d’un « faire savoir » qui les valorise en même temps qu’il valorise la donnée elle-même. Nous devons apprendre à mieux communiquer sur nos valeurs.

Les nouvelles opportunités nous confèrent de nouvelles responsabilités : il faut en faire le meilleur usage, tout en respectant le cadre de nécessité et de proportionnalité et en assurant la transparence sur leur usage. C’est un gage de la confiance que les citoyens comme les utilisateurs de nos données nous accordent.

Être réactifs et adaptables sans renoncer à nos valeurs ni à la qualité de nos productions implique plusieurs exigences : technicité, expertise, qualité des outils de collecte, de traitement, de mise à disposition, existence de processus éprouvés, mais aussi une vision partagée des finalités de nos travaux, permettant d’en optimiser la mise en œuvre, de manière sécurisée, en fonction des circonstances tout en restant alignés sur nos valeurs. Il s’agit de savoir faire du « sur mesure », en utilisant de manière optimale les « machines-outils », sans que le processus se transforme en travail à la chaîne.

Tailor-made vs Taylor-made...

11

Textes réglementaires

Loi n°51-711 du 7 juin 1951 sur l’obligation, la coordination et le secret statistique

Décrets n°2009-250 du 3 mars 2009 modifié et n°2009-318 du 20 mars 2009 pour les missions de l’ASP, le Cnis et les comités du label de la statistique publique, du secret statistique et du contentieux des enquêtes statistiques obligatoires

Loi n°78-17 du 16 janvier 1978 relative à l’informatique, les fichiers et aux libertés

Règlement (UE) n° 223/2009 révisé du Parlement européen et du Conseil du 11 mars 2009 relatif à la statistique européenne

Présentation de la statistique publique en France sur insee.fr

Bibliographie

 Anxionnaz I. et Maurel F., Le Conseil national de l’information statistique : la qualité des statistiques publiques passe aussi par la concertation, in Courrier des statistiques n° 6 (juillet 2021)

 Roth N. et Christine M., Le Comité du label : un acteur de la gouvernance au service de la qualité des services publics, in Courrier des statistiques n° 5 (décembre 2020)

 Bureau D., L’Autorité de la statistique publique : dix ans d’activité, pour une statistique indépendante et de qualité, in Courrier des statistiques n° 5 (décembre 2020)

 Redor P., Confidentialité des données statistiques : un enjeu majeur pour le service statistique public, in Courrier des statistiques n° 9 (juin 2023)

 Tavernier J.-L., Un système statistique intégré à l’administration centrale, in Courrier des statistiques n° 1 (décembre 2018)

 Isnard M., Qu’entend-on par statistique(s) publique(s) ? , in Courrier des statistiques n° 1 (décembre 2018)

 Lefebvre O. Towards a "social mandate" for the French project of a statistical directory of individuals and dwellings by France - Unece (juin 2023)

12

Using EGSS data for measuring circular economy

9th Joint OECD/UNECE Seminar on the Implementation of the System of Environmental-Economic Accounting (SEEA)

Geneva 18-20 March 2024

Frédéric NAUROY, Ministry of Ecological Transition, Statistical Department (SDES)

19/03/2024CGDD/SDES/SDIE - Sous-Direction de l’information environnementale

Contents

- How to define circular economy and delimitate its scope? - Approach in France for producing employment estimates in the CE; results - Relationship between CE and EGSS - Sources used for compiling employment in the CE - Strengths and weaknesses of using EGSS as a basis

19.03.2024 CGDD/SDES/SDIE - Sous-Direction de l’information environnementale 2

Different definitions for circular economy

Ministry of Ecological Transition

The circular economy consists in producing goods and services in a durable way by limiting the consumption and waste of resources and the generation of waste. The objective is to move from a throwaway society to a more circular economic model.

ADEME The circular economy can be defined as an economic system of exchange and production which, at all stages of the life cycle of products (goods and services), aims to increase the efficiency of the use of resources and to reduce the impact on the environment.

National Institute for Circular Economy (INEC)

The circular economy consists in producing goods and services in a durable way by limiting the consumption and waste of resources and the generation of waste.

Eurostat The circular economy goods and services sector is a sub-set of the whole economy. Economic goods and services of the circular economy sector are those that maintain the value of products and materials as long as possible and minimise waste and resource use, thereby, closing or narrowing the [raw] material cycle.

Basis of French perimeter on circular economy

Alternative: 9 purposes framework → refuse, rethink, reduce, reuse, repair, refurbish, remanufacture, repurpose, recycle, recover

Source: ADEME

19.03.2024 CGDD/SDES/SDIE - Sous-Direction de l’information environnementale

4

General approach and results

Reflexions and participation to working groups led to define a new EC perimeter in 2023

Following principles followed: o Only one perimeter considered, no connected pillar (or activities) o To consider the main purpose of activities rather than their impact o Main purpose of CE activities to be in phase with one of ADEME pillars (selection criterion) o As a consequence, public transports, renewable energy and energy saving are excluded

A specific CE database implemented, separately from the one used for EGSS • Observations from 2008 to 2021 • 4 pillars out of 7 are covered

19.03.2024 CGDD/SDES/SDIE - Sous-Direction de l’information environnementale 5

Source : SDES

Total: 811 426

Source: SDES

19.03.2024 CGDD/SDES/SDIE - Sous-Direction de l’information

environnementale 6

Comparison with EGSS and classification of environmental purposes

- Classification of environmental purposes (CEP) developed in international taskforces (Eurostat, UNSD)

- Question: which parts of CEP can be directly used for compiling CE, using EGSS data?

- In French CE framework 3 CEP divisions contribute to CE: 3, 4 & 5 • CEP3: Wastewater and water resources: fully included • CEP4: Waste, materials recovery and savings: fully included except landfilling and streets cleaning • CEP5: Soil, surface and groundwater, biodiversity and forest: only remediation of soils (incl. organic farming) and water bodies

included

19.03.2024 CGDD/SDES/SDIE - Sous-Direction de l’information environnementale 7

Environmental activities

Circular economy

- Air and climate (CEP1) - Biodiversity and landscapes (CEP5) - Forest resources management (CEP5) - Noise and radiation (CEP6) - Energy management (CEP2) - R&D (CEP7) - Cross-cutting and other environmental activities (CEP8)

- Wastewater and water resources (CEP3) - Waste, materials recovery and savings (CEP4) - Protection of soil, surface and groundwater (CEP5)

- Repair activities (for non- environmental products)

- Reuse of products (sales of second-hand goods)

- Rental activities - Downstream activities

(manufactured products using recycled materials)

Relationship between EGSS and CE

19.03.2024 CGDD/SDES/SDIE - Sous-Direction de l’information environnementale 8

Sources used for compiling

1) EGSS data: 30% of employment Use in Recycling and Sustainable supplying pillars However EGSS data is a secondary source, elaborated with a lot of (primary) information. Primary sources for compiling EGSS: Insee, ADEME, Agence Bio, EPEA, Ministries…

2) Insee data: 70% of employment Use in Longer Duration of Use, Sustainable supplying and Responsible consumption pillars 2 kinds of use:

- As a source for output of different products, employment being estimated with ratios - As a direct source of employment (NA, Insee social databases) when industry fully included into CE Case of e.g. repair

activities

19.03.2024 CGDD/SDES/SDIE - Sous-Direction de l’information environnementale 9

Strengths with using EGSS

 Availability of a comprehensive and coherent annual dataset covering well some purposes of CE (wastewater sewage, waste management and recovery)

 EGSS framework offers different variables: output, value added, employment, foreign trade in the format of national accounts

 Possible replication of EGSS estimation methods (e.g. for employment or value added) for CE activities not covered by EGSS

 Data sources used for EGSS can be extended to CE

 In conclusion: synergy and consistency expected when compiling CE in complementarity with EGSS

19.03.2024 CGDD/SDES/SDIE - Sous-Direction de l’information

environnementale 10

Weaknesses or limitations

 Strong dependence of CE to the perimeter adopted (harmonisation needed) - if strictly based on circularity and resources saving, EGSS value added is quite low - if perimeter enlarged to all environmental issues, EGSS VA is optimal

 EGSS not helpful for solving tricky issues as compiling CE data for: - Industrial and territorial ecology - Service economy

 Approach based on purposes or pillars (ADEME) difficult to comprehensively combine with monetary accounts classifications (CEP or CEPA/CReMA). Space left to interpretations

 In terms of organisation, distance between EGSS and CE to be reduced Often working groups are separated (different staff implied) as well as objectives and plans on indicators. Need of sharing information on a larger scale.

19.03.2024 CGDD/SDES/SDIE - Sous-Direction de l’information environnementale 11

Thank you for your attention

Submitted by the expert from France

Informal document GRVA-18-34 18th GRVA, 22–26 January 2024 Provisional agenda item 5 (a)

List of relevant GRVA Regulations for software updates

This document was prepared by the expert from France. It proposes a list of the relevant UN Regulations under the purview of GRVA, for the purposes of software updates.

I. List of relevant UN Regulations UN Regulation Title Relevant (Yes/No) UN Regulation No. 13 Braking Yes UN Regulation No. 13-H Braking (passenger cars) Yes UN Regulation No. 78 Braking (Category L) Yes* UN Regulation No. 79 Steering equipment Yes UN Regulation No. 89 Speed Limitation Devices Yes UN Regulation No. 90 Replacement brake lining

assemblies, drum brake linings and discs and drums for power-driven vehicles and their trailers

No

UN Regulation No. 130 Lane Departure Warning System Yes UN Regulation No. 131 Advanced Emergency Braking

System Yes

UN Regulation No. 139 Brake Assist System Yes UN Regulation No. 140 Electronic Stability Control Yes UN Regulation No. 152 Advanced Emergency Braking

System Yes

UN Regulation No. 155 Cyber security Yes UN Regulation No. 156 Software update and software update

management system Yes

UN Regulation No. 157 Automated Lane Keeping System Yes

II. Justification

During the 191st session of WP.29, the expert from France proposed that all subsidiary Working Parties of WP.29 consider the list of the Regulations under their respective purview which may be relevant for the purposes of software updates (see ECE/TRANS/WP.29/1175, para. 37). This identification of relevant Regulations is necessary to introduce the necessary provisions on identification and update of software in each affected Regulation, using the guidance provided in Annex 7 of the Consolidated Resolution on the Construction of Vehicles (R.E.3).

This document proposed a list of the UN Regulations under the purview of GRVA which may be relevant for the purposes of software updates. More specifically:

- UN Rs13, 13-H, 78*, 79, 130, 131, 139, 140, 152, 157 (Regulations on braking, steering, active safety and ADAS/ADS): Most systems directly or indirectly related to braking and steering greatly rely on software as part of their basic operation.

- UN R89 (speed limitation devices and functions): Most speed limitation devices and functions greatly rely on software as part of their basic operation.

- UN R90 (replacement brake parts): This Regulation only applies to physical replacement parts. If no software is present on these replacement parts, this Regulation is not relevant for the purposes of software updates at this stage. However, any introduction of connected replacement parts on the market should lead to a reconsideration of this classification.

2

- UN R155: Exact software versions of critical electronic control units (such as ECUs with external interfaces) are fully relevant for the purposes of type approval pursuant to R155.

- UN R156: Software versions of relevant electronic control units (such as telematics, infotainment or human-machine interfaces) may have an impact on the definition of a vehicle type with regard to R156.

Additionally, the authors believe that Global Technical Regulations No. 3 and 8 are also relevant for the purposes of software updates. However, they are outside of the scope of the Regulations for which guidance is given by Annex 7 of R.E.3. * UN R78 is a Regulation that only applies to vehicles of Category L, which are not part of the scope of UN R156. GRVA may wish to consider whether an extension of the scope of UN R156 is necessary before including provisions for software updates within UN R78.

Submitted by the experts of France (leader of the workshops group on UN-R 152) on behalf of the workshops group on UN-R 152

Informal document GRVA-18-24 18th GRVA, 22-26 January 2024 Provisional agenda item 7

Proposal for a supplement to 01 series of amendments to UN Regulation No. 152 (Advanced Emergency Braking System for M1 and N1 vehicles)

The text produced below was prepared by the workshops group on UNR-R 152 and replaces the working document GRVA/2023/22. The proposal is aimed at allowing the applicant to use virtual testing methodology as alternative methodology to the physical tests.

I. Proposal

Add a new paragraph 2.18., amend to read:

“2.18. “Virtual testing” is the process of testing a system using one or more simulation models.”

Add a new paragraph 6.7., amend to read:

“6.7. Virtual testing of dynamic tests

6.7.1. Virtual testing may be used by request of the vehicle manufacturer as an alternative for the tests described in paragraphs 6.4. to 6.6.,. The provided virtual testing shall be verified and validated according to and are used in accordance with annex 4.

6.7.2. Virtual testing may be used in the evaluation of the warning and activation tests in accordance with paragraph 1.8. of Schedule 3 and Schedule 8 of Revision 3 of the 1958 Agreement.

[6.7.3. In addition to the simulation results, simulated test runs [shall / may] be conducted as physical tests as well on the request of the type approval authority and technical service.]

6.7.4. In case of virtual testing is chosen by the manufacturer, a separated report including at least the additional data information specified in annex 4 paragraph 1.5. shall be annexed to the test report.”

GRVA-18-24

2

Add a new Annex 4, to read:

“Annex 4 - Virtual testing of dynamic tests

Introduction (for information only)

This annex describes the method that can be used to consider virtual testing as an alternative to physical testing, based on the manufacturer request.

This method is mainly based on 2 separate pillars:

- Pillar 1 : the validation of the virtual testing method by comparison with physical results and,

- Pillar 2 : the virtual testing results for approval process.

1. Validation of the virtual testing method (pillar 1)

1.1. General specifications

1.1.1. The manufacturer shall provide documentation to prove the credibility of the virtual testing results.

1.1.2. The vehicle manufacturer shall define the validity domain on which the virtual testing will be applicable. This annex only applies within this validity domain.

1.1.3. Credibility of the virtual toolchain that is used for the virtual testing shall be demonstrated by the vehicle manufacturer to the Type Approval Authority and Technical Service.

For this, the following five criteria shall be considered :

(a) Capability – what virtual toolchain can do, and what are the associated risks;

(b) Accuracy – how well virtual toolchain does reproduce the target data;

(c) Correctness – how sound & robust is the used data and the algorithm in the tools;

(d) Fit for Purpose – how suitable is the virtual toolchain for the assessment (e.g. vehicle dynamic model, sensor model, system control model, environment model, scenario model, targets model, …) within its validity domain.

(e) Usability – What training and experience is needed and what is the quality of the process that manage its use.

1.2. Physical validation tests

1.2.1. At the request of the technical service, in addition to the documentation provided by the vehicle manufacturer, physical tests shall be performed or witnessed to confirm the accuracy between the physical and the simulation results.

1.2.1.1 The number of physical tests to be tested shall be defined in agreement between the manufacturer and the technical service in order to sufficiently cover the validity domain specified by the vehicle manufacturer.

GRVA-18-24

3

1.2.2. The number of tests performed shall ensure a statistical comparison between physical and simulation results.

1.3. Simulation model

1.3.1. The simulations (including development of the model) shall be run under the responsibility of the vehicle manufacturer. It shall reflect the architecture of the vehicle, system and components to be tested in relation to the requirements of the current regulation on the specified validity domain.

1.3.2. The models that are developed and tested shall be capable of accurately representing the relevant aspects of the physical AEBS system that is being modelled. The models are used in tools and the tools are incorporated into toolchains which emulate the overall physical behaviour of the AEBS system with the appropriate quality within the declared domain of validity.

1.4. Simulation model validation process

1.4.1. The simulation model shall be validated in comparison with the physical validation tests performed under paragraph 1.2. and comparability of the test results shall be proven.

1.4.2. The validation strategy shall be based on scientific methods, defined by the car manufacturer and agreed with the type approval authority and technical service.

1.4.3. For the validation, key performance indicators shall be assessed such as time to collision, remaining distance or impact speed.

1.5. Additional data and information

For this application, the following information shall be supplied to the approval authority and technical service in addition to the data, and drawings listed in paragraph 3.2. of this Regulation.

1.5.1. A description of the applied simulation and calculation method which has been used such as identification of the model, the analysis software, its producer, its commercial name, the version and contact details of the developer.

1.5.2. A description of the input parameters.

1.5.3. A description of the validity domain taking into account AEBS performance influencing factors.

1.5.4. All parts of the simulation toolchain such as interlinked simulation modules and tools shall be described by the manufacturer.

1.5.5. The methodology used to generate physical validation data, such as data recording equipment, data processing, calculation of scalar valuesshall be documented in the simulation report.

1.5.6. A description of the data management archiving system shall be provided by the manufacturer.

1.5.7. A description of the versions control and the review processes in case of modification within the simulation toolchain shall be provided by the manufacturer.

GRVA-18-24

4

2. Virtual testing results for approval process (pillar 2)

2.1. Compliance of the Advanced Emergency Braking System with the performance requirements as defined in Paragraphs 5.2.1 to 5.2.3 of this regulation may be demonstrated by the vehicle manufacturer to the Type Approval Authority or Technical Service by making use of virtual testing of the dynamic maneuvers of the paragraph(s) 6.5 to 6.7 of this Regulation.

2.2. All simulation results provided by the manufacturer in applying for an approval in accordance with paragraph 4. of this regulation shall refer to the method evaluated and validated according to paragraph 1 of this annex.

2.3. Additional data and information

For this application, the following information shall be supplied to the technical service in addition to the data, and drawings listed in paragraph 3.2. of this Regulation.

2.3.1. A description of the applied simulation method which has been used such as identification of model, the analysis software, its producer, its commercial name, the version and contact details of the developer.

2.3.2. A description of the input parameters.

2.3.3. A reference to the validated simulation method used in application of paragraph 1 of the current annex.

2.3.4. All parts of the simulation toolchain such as interlinked simulation modules and tools shall be described by the manufacturer.”

II. Justification

1. This proposal targets to let the opportunity to applicant to use virtual testing methodology as alternative methodology to the physical tests. As it is already defined at European Union Whole Vehicle Type Approval system (WVTA), in other regulations or in the current activities on automated driving systems by the Informal Working Group on Validation Method for Automated Driving (VMAD) Subgroup 2, this approach requires the preliminary assessment of the methodology to be used.

2. This proposal defines a practical approach to preserve safety main principles letting the flexibility to the applicant in the virtual tools to be used.

3. An example of the application is presented in informal document GRVA-15-20.

Note by the secretariat: this amendment proposal, if adopted as supplement to the 02 series of amendments, would require adjustments as para. 6.7. already exist in the 02 series of amendments, reading:

“6.7. Warning and Activation Test with a Bicycle Target”

Submitted by the experts of France (leader of the workshops group on UN-R 152) on behalf of the workshops group on UN-R 152

Informal document GRVA-18-23 18th GRVA, 22-26 January 2024 Provisional agenda item 7

Confidential C

Proposal for a supplement to 01 series of amendments to UN Regulation No. 152 (Advanced Emergency Braking System for M1 and N1 vehicles)

The text produced below was prepared by the workshops group on UNR-R 152 and is based on working document GRVA/2023/22. The proposal is aimed at allowing the applicant to use virtual testing methodology as alternative methodology to the physical tests. The modifications to the existing text GRVA/2023/22 are marked in bold red for new or strikethrough for deleted characters.

I. Proposal

Add a new paragraph 2.18., amend to read:

“2.18. “Virtual testing” is the process of testing a system using one or more simulation models.

Add a new paragraph 6.7., amend to read:

“6.7. Computer simulation Virtual testing of dynamic tests

6.7.1. A computer simulation model Virtual testing may be used by request of the vehicle manufacturer as an alternative for the tests described in paragraphs 6.4. to 6.6.,. The provided virtual testing the simulation model and simulation toolchain have been shall be verified and validated according to and are used in accordance with annex 4.

6.7.2. Simulation tools and mathematical models Virtual testing may be used in the for evaluation of the warning and activation tests may be used in accordance with paragraph 1.8. of Schedule 3 and Schedule 8 of Revision 3 of the 1958 Agreement. Manufacturers shall demonstrate the scope of the simulation tool, its validity for the scenario and concrete vehicle concerned as well as the validation performed for the simulation tool chain (correlation of the outcome with physical tests) in accordance with annex 4.

6.7.3. The technical service shall be able to validate the simulation model using physical validation tests.

[6.7.3. In addition to the simulation results, at least 30% of the simulated test runs [shall / may] be conducted as physical tests as well on the request of the type approval authority and technical service. The results of simulated test runs and physical test runs shall be checked for differences on an individual basis and using standard statistical tests by the technical service.]

GRVA-18-XX

2 Confidential C

6.7.4. In case the computer simulation of dynamic tests of virtual testing is chosen by the manufacturer, a separated report including at least the additional data information specified in annex 4 paragraph 1.5. shall be annexed to the test report.”

Add a new Annex 4, to read:

“Annex 4

Computer simulation Virtual testing of dynamic tests

Introduction (for information only)

This annex describes the method that can be used to consider virtual testing as an alternative to physical testing, based on the manufacturer request.

This method is mainly based on 2 separate pillars:

- Pillar 1 : the validation of the virtual testing method by comparison with physical results and,

- Pillar 2 : the virtual testing results for approval process.

This annex describes the processes that can be used to consider simulation results instead of physical results demonstrating compliance with regulatory requirements.

These processes allow both to optimise the reactivity of manufacturers to cover different vehicle definitions and to optimise the economic aspect by limiting the number of physical means involved.

However, this approach is only possible if the framework of the process is clearly defined and if the level of confidence in the results presented is sufficient and based on objective criteria of physical representativeness.

This approach is mainly based on 2 separate axes: the validation of the simulation method and the simulation results for approval process.

The validation of the simulation method is a key stage in the comprehensive digital validation process because it defines the mathematical model’s level of representativeness with respect to the physical test. The quality of the correlation is therefore critical and is assessed via a simulation / test comparison. Once the model has been correlated or, in other words, when the behaviour calculated is similar to the behaviour of the subject in the actual tests, the model can be used to predict the subject’s behaviour within its validity domain.

The simulation results for approval process are the final stage of the whole procedure, namely the type-approval of a vehicle in respect of a regulatory act based solely on a virtual type-approval. Once the digital model’s representativeness has been demonstrated within a scope of validity, this process can be used to assess the performance of the model tested against the requirements of the regulatory text.

This global approach is summarized step by step in the scheme below figure 5 and further detailed in the following chapters.

Figure 5 Generic flow chart of the “Computer simulation of dynamic tests as an equivalent approval method”

GRVA-18-XX

3 Confidential C

1. Validation of the simulation virtual testing method (pillar 1)

In order to guarantee that the simulation method used by the manufacturer is able to provide representative results acceptable for approval process, this simulation method shall be evaluated and validated by the technical service.

1.1. Definition of the validity domain General specifications

1.1.1. The car manufacturer shall define the boundary conditions for the simulation method. These boundary conditions define the limits within the simulation method can be used. The manufacturer shall provide documentation to prove the credibility of the virtual testing results.

1.1.2. The validity domain definition shall cover both vehicle characteristics (e.g. mass, equipment, exact sensor type, control algorithm) and scenario characteristics (e.g. speeds, target). The vehicle manufacturer shall define the validity domain on which the virtual testing will be applicable. This annex only applies within this validity domain.

1.1.3. Depending on the validity domain required by the manufacturer, the Technical Service will define the matrix of vehicle and scenarios to be tested in order to cover the entire domain, in accordance with paragraph 1.2. Credibility of the virtual toolchain that is used for the virtual testing shall be demonstrated by the vehicle manufacturer to the Type Approval Authority and Technical Service.

GRVA-18-XX

4 Confidential C

For this, the following five criteria shall be considered :

(a) Capability – what virtual toolchain can do, and what are the associated risks;

(b) Accuracy – how well virtual toolchain does reproduce the target data;

(c) Correctness – how sound & robust is the used data and the algorithm in the tools;

(d) Fit for Purpose – how suitable is the virtual toolchain for the assessment (e.g. vehicle dynamic model, sensor model, system control model, environment model, scenario model, targets model, …) within its validity domain.

(e) Usability – What training and experience is needed and what is the quality of the process that manage its use.

1.2. Physical validation tests

1.2.1. At the request of the technical service, in addition to the documentation provided by the vehicle manufacturer, The technical service, physical tests shall be performed or witnessed tests to prove confirm the validity accuracy between the physical and of the simulation model results.

1.2.2. 1.2.1.1 The number of scenarios physical tests to be tested shall be defined in agreement between the manufacturer and by the technical service in order to sufficiently cover the validity area domain requested specified by the vehicle manufacturer.

1.2.3. At least 10 repetitions of worst cases scenarios shall be performed and results of the stop relative distance from target or target impact velocity shall be inside a defined interval from the median value. This interval is defined by the technical service.

1.2.3.1. Worst case scenarios are those where model uncertainties are expected to have the greatest impact on the representativeness of the simulation model (e.g. impact with target during full braking would lead to a significant spread in results, lowest possible speed for car-bicycle-scenarios where sensor angle is most relevant).

1.2.4. As mentioned under paragraphs 6.10. of this regulation on the robustness of the system, some physical tests may be repeated in case the system fails to meet the performance requirements. The number of repeated tests shall not exceed:

(a) 10.0 per cent of the performed test runs for the Car to Car tests; and

(b) 10.0 per cent of the performed test runs for the Car to Pedestrian tests.; and

(c) 20.0 per cent of the performed test runs for the Car to Bicycle tests.

1.2.52. The physical tests used for building a physical reference for the numerical model validation shall be repeatable. The repeatability shall be evaluated on the impact speed or remaining distance values of the 10 repetitions which shall be within a corridor defined by the technical service around the median value of the physical tests. The number of tests performed shall ensure a statistical comparison between physical and simulation results.

GRVA-18-XX

5 Confidential C

1.3. Simulation model

1.3.1. The simulations (including development of the model) shall be conducted run under the responsibility of by the vehicle manufacturer. It shall reflect the complexity of the architecture of the vehicle, system and components to be tested in relation to the requirements of the current regulation and its boundary conditions on the specified validity domain.

1.3.2. The model shall be capable of describing the real physical behaviour on the validity domain. 1.3.3. The simulation model shall be constructed, and assumptions prescribed, in such a way that the calculation gives conservative solution, in which the result is independent of the incremental time step.

The models that are developed and tested shall be capable of accurately representing the relevant aspects of the physical AEBS system that is being modelled. The models are used in tools and the tools are incorporated into toolchains which emulate the overall physical behaviour of the AEBS system with the appropriate quality within the declared domain of validity.

1.3.4. In addition to the parameters listed in paragraph 1.4. of the current annex, at least the following elements have to be defined in the simulation model:

(a) Vehicle dynamic model including transmission, power train, etc;

(b) Sensor model;

(c) ADAS control model;

(d) Environment model;

(e) Scenario model;

(f) Target model for pedestrians, cyclists and cars;

The technical service shall check the model for correct physical behaviour.

1.4. Simulation model validation process

1.4.1. The simulation model shall be validated in comparison with the physical validation tests performed under paragraph 1.2. and comparability of the test results shall be proven.

1.4.2. The model shall be checked against the repeatability tests and the median value defined as specified in paragraph 1.2.5.

The validation strategy shall be based on scientific methods, defined by the car manufacturer and agreed with the type approval authority and technical service.

1.4.3. The simulation model shall be considered valid in the requested validity domain if, based on a significance level of 5%, there is no reason to believe that the simulation model results and the test results come from two different distributions for at least the following key performance indicators:

GRVA-18-XX

6 Confidential C

(a) Time to collision FCW in s;

(b) Mean vehicle speed between 4s TTC and before AEB activation in km/h (= initial speed);

(c) Average of absolute Lateral deviation in m;

(d) Brake distance in m (only for test cases with avoidance);

(e) Mean fully developed brake deceleration in m/s²;

(f) Remaining distance to the target after standstill in m (set to zero for non-avoidance);

(g) Impact speed into target in km/h set to zero for avoidance);

(h) Brake force build-up time from start of braking to maximum brake deceleration in s;

(i) Time to collision for start of braking in s (align wording with Euro NCAP test procedure).

Standard significance tests shall be used by the manufacturer.

For the validation, key performance indicators shall be assessed such as time to collision, remaining distance or impact speed.

1.4.4. It shall be verified that the measured data describes the correct physical quantities. This means it needs to be checked for plausibility and filtered appropriately. If quantities are not measured directly, an argumentation is required to show that they still can be used.

1.5. Additional data and information

For this application, the following information shall be supplied to the approval authority and technical service in addition to the data, and drawings listed in paragraph 3.2. of this Regulation.

1.5.1. A description of the applied simulation and calculation method which has been used such as with identification of the model, the analysis software, including at least, its producer, its commercial name, the version and contact details of the developer.

1.5.2. A description of the input parameters encoding the models used including at least systems functionalities characterization, mechanical hypothesis, values for defined masses, centre of gravity, moments of inertia and boundary conditions.

1.5.3. A definition description of the validity domain taking into account based AEBS performance influencing factors. vehicle parameters as mass distribution, speed ranges, etc. used in the application of paragraph 1.1. of the current annex.

1.5.4. Each of the All parts of the simulation toolchain calculation such as interlinked simulation modules and tools shall be described detailed by the manufacturer : pre-processing, processing and post-processing including a justification of the normal termination of the simulation (post processing logfile for example).

1.5.5. The methodology used to generate physical validation data test correlated data, such as (at least but not limited to: data recording equipment, data processing, calculation of scalar values, statistical calculations,

GRVA-18-XX

7 Confidential C

performance indicator values as specified in paragraph 1.4.3., results of the statistical calculations ) shall be documented in the simulation report.

1.5.6. A description of the data management archiving system and the updates management process (braking system design, soft updates, regulation amendments) shall be provided by the manufacturer.

1.5.7. A description of the versions control and the review processes in case of modification within the simulation toolchain shall be provided by the manufacturer.

2. Simulation Virtual testing results for approval process (pillar 2)

2.1. The manufacturer may provide simulation results to meet the requirements specified in paragraphs 6.4. to 6.6. of this Regulation only if the method used to obtain the results have already been evaluated and validated in application of the current annex. Compliance of the Advanced Emergency Braking System with the performance requirements as defined in Paragraphs 5.2.1 to 5.2.3 of this regulation may be demonstrated by the vehicle manufacturer to the Type Approval Authority or Technical Service by making use of virtual testing of the dynamic maneuvers of the paragraph(s) 6.5 to 6.7 of this Regulation.

2.2. All simulation results provided by the manufacturer in applyingication for of the an approval following in accordance with paragraph 4. of the current this regulation shall refer to the method previously evaluated and validated according to paragraph 1 of this annex. in application of the current annex.

2.4. Additional data and information

For this application, the following information shall be supplied to the technical service in addition to the data, and drawings listed in paragraph 3.2. of this Regulation.

2.4.1. A description of the applied simulation and calculation method which has been used such as with identification of model, the analysis software, including at least, its producer, its commercial name, the version and contact details of the developer.

2.4.2. A description of the input parameters encoding the models used including at least systems functionalities characterization, mechanical hypothesis, values for defined masses, centre of gravity, moments of inertia and boundary conditions.

2.4.3. A reference to the validated simulation method used in application of paragraph 1 of the current annex.

2.4.4. Each step of the calculation All parts of the simulation toolchain such as interlinked simulation modules and tools shall be described detailed by the manufacturer: pre-processing, processing and post-processing including a justification of the normal termination of the simulation.”

II. Justification

1. This proposal targets to let the opportunity to applicant to use virtual testing methodology as alternative methodology to the physical tests. As it is already defined at

GRVA-18-XX

8 Confidential C

European Union Whole Vehicle Type Approval system (WVTA), in other regulations or in the current activities on automated driving systems by the Informal Working Group on Validation Method for Automated Driving (VMAD) Subgroup 2, this approach requires the preliminary assessment of the methodology to be used.

2. This proposal defines a practical approach to preserve safety main principles letting the flexibility to the applicant in the virtual tools to be used.

3. An example of the application is presented in informal document GRVA-15-20.

Note by the secretariat: this amendment proposal, if adopted as supplement to the 02 series of amendments, would require adjustments as para. 6.7. already exist in the 02 series of amendments, reading:

“6.7. Warning and Activation Test with a Bicycle Target”

List of tables

Table1

Table2

Table 2a

Table 2b

Table 3

Table 4

Table 5

Table 5a