Out-Law News 3 min. read

New French communications surveillance regime subject to legal challenge


Digital rights campaigners in France have launched a legal challenge against new communications surveillance powers introduced in the country.

La Quadrature du Net, together with the FDN Federation, which represents not-for-profit internet service providers (ISPs) in France, is opposed to a new executive decree that gives more detail to and brings into force parts of a law passed by the French parliament in 2013 on internet surveillance.

The new framework requires electronic communication service providers to retain more information about users' communications and provide access to that data to an increased number of law enforcement bodies. French law enforcement agencies also have powers to intercept communications under the regime.

The executive decree was implemented on 24 December 2014 and brought into force on 1 January 2015. La Quadrature du Net said the French government was pursuing a "securitarian agenda" and that the new legal framework failed to take proper account of a judgment by the Court of Justice of the EU (CJEU) last year.

"Police and courts must of course be able to do their job, but in a proportionate way and within the boundaries of the rule of law," La Quadrature du Net said in a statement. "That is the aim of this joint appeal before the Council of State."

In April 2014, the CJEU ruled that an EU directive that required internet service providers (ISPs) and other communication providers to store communications data and pass it to law enforcement agencies for use in investigations aimed at the prevention and detection of terrorism and other serious crimes should be re-written. It said the Data Retention Directive disproportionately infringed on individuals' privacy rights.

'Communications data' is information that details who the sender and recipients of communications are, their respective locations and the time of those communications, for example, but does not refer to the contents of those communications.

Paris-based privacy and telecoms regulations expert Annabelle Richard of Pinsent Masons, the law firm behind Out-Law.com, said: "Telecoms operators have had to facilitate communications interceptions and the collection of data about communications for many years. What is new here is that the number of persons who can access communications and communications data has been increased and that there has also been a broadening of the type of data that law enforcement bodies can request."

"Most of the criticisms leveled at the new data retention framework by La Quadrature du Net relate to what is stated in the 2013 law – Loi de programmation militaire – and not the decree itself. The law extended the number of bodies with a right to access the data stored by telecoms companies and widened the scope of the type of data accessible to those bodies. The decree allows the new law to be enforced and gives more detail on some of the provisions in the law."

Richard said that the wording of the decree was questioned by the Commission nationale de l'informatique et des libertés (CNIL), the data protection authority in France, when it was in its draft stage.

"CNIL said that the wording in a previous draft of the decree was too vague in that it failed to adequately define what information and documents can be requested by law enforcement bodies under the new framework," Richard said. "Amendments were made before the decree was finalised but there remains questions about whether the surveillance powers are too broad."

"The legal challenge will also test whether there is suitable oversight of and control over French authorities' access to data. While there is an independent body responsible for supervision of the interception of communications by administrative bodies in France, there is no such independent oversight of their access to and use of communications data," Richard said.

To comply with the new decree and with their obligations to privacy, telecoms operators need to check whether bodies asking for access to communications data are entitled to the information under the new regime and ensure that they only disclose the information that is necessary and proportionate, Richard said. She said that there had been significant public debate about powers to combat terrorism and implications for privacy since the January terrorist attacks in and around Paris.

Richard said, though, that operators are "fairly well structured to deal with surveillance requests".

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.