Paris, 19 February 2015 — Together with FFDN, a federation of community-driven non-profit ISPs, La Quadrature du Net is bringing a legal action before the French Council of State against a decree on administrative access to online communications metadata. Through this decree, it is a whole pillar of the legal basis for Internet surveillance that is being challenged. This appeal, which builds on the European Union Court of Justice’s recent decision on data retention, comes as the French government is instrumentalizing last month’s tragic events to further its securitarian agenda, with an upcoming bill on intelligence services.
French Council of State – Marie-Lan Nguyen – Public Domain – Wikimedia Commons
In December 2013, the French Parliament voted the 2014-2019 Military Planning Act (Loi de programmation militaire, or LPM), which included provisions on the extra-judiciary surveillance of the Internet: it not only increased the number of police and intelligence services with access to connection data, but the very scope of the data has also been widened (the law refers to the “information and documents”, “as well” as metadata both ISPs and hosting service providers may have). Furthermore, this new legal regime comes with no preliminary control by the CNCIS, the independant administrative authority in charge of supervision of administrative interceptions of communications, an administration which remains largely underfunded. Finally, this law makes it possible to engage in realtime surveillance of communications, “by soliciting the network” of operators, which in this case requires preliminary control by the CNCIS, but still leaves wide open the threat of direct and massive data interception.
At the time, in the midst of a global debate surrounding Edward Snowden’s revelations and as the French government was stubbornly refusing to be transparent on its own surveillance practices, these new provisions – which, according to their promoters, aim to validate existing “alegal” practices (that is to say, illegal practices) – sparked a strong opposition from civil society. But despite outcries, French Members of Parliament nonetheless refused to appeal to the Constitutional Council to check the conformity of these measures with the Constitution.
Now on 24 December 2014, the government quietly passed the executive decree implementing these measures. The publication of this decree is now the occasion for La Quadrature du Net, together with the FFDN ISPs, to challenge the entire legal construct of Internet surveillance, which developped over more than a decade.
Through this legal challenge, it is indeed the very principle of a generalised surveillance of the population that is targeted. The applicable law is based on a wide-ranging data retention regime, whereby access providers and hosting platforms based on the French territory are forced to keep all their users’ metadata for one year.
Data retention was extended to the entire European Union by a 2006 directive adopted following the emotion created by the Madrid and London attacks. Some national transposing laws had been declared contrary to the constitution in several Member States, including Germany where such a system currently remains unenforced. Then, on 8 April 2014, the European Court of Justice (ECJ) issued a historical decision invalidating the entire 2006 directive. In its Digital Rights Ireland ruling, the Court clearly explained that such broad data retention measures are contrary to fundamental rights. According to the ECJ:
“Directive 2006/24 affects, in a comprehensive manner, all persons using electronic communications services, but without the persons whose data are retained being, even indirectly, in a situation which is liable to give rise to criminal prosecutions. It therefore applies even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime. Furthermore, it does not provide for any exception, with the result that it applies even to persons whose communications are subject, according to rules of national law, to the obligation of professional secrecy.” (§ 58, 2014-04-08 Judgment of the Court)
In this decision, it is the principle of massive data retention obligations that is challenged, in favour of a targeted surveillance of individuals for which there already exists a legitimate reason to restrict the right to privacy.
Everywhere in Europe, the ECJ judgment puts into question current Internet surveillance practices, in the context of the debate created by E. Snowden’s revelations. In Austria, in Romania, in Slovakia and in Slovenia, constitutional courts have since suspended or canceled national laws on data retention. In Sweden, in the Netherlands, and in the UK, important debates are ongoing. As part of procedures distinct from the ECJ’s judgment, the UK’s GCHQ was also recently convicted for not being transparent regarding its data exchange practices with the NSA. Lastly, the GCHQ’s programs are also the subject of a legal challenge before the European Court of Human Rights (ECHR) issued by a coalition of NGO, and to which La Quadrature du Net is taking part.
In France, up until now, the government has always refused to draw the lessons of the Snowden revelations or of the ECJ’s judgment. On the contrary, these past months have seen the adoption of new exceptional measures, not only with the Military Planning Act but also the 2014 law against terrorism. While the odious crimes in the Middle-East and in Africa and the deadly and tragic Paris attacks are currently being shamefully used to further authoritarian tendencies, with calls for once again extending surveillance and criminalising the encryption of communications, it is high time for France to also have this debate, both in the public space and before its jurisdictions.
Police and courts must of course be able to do their job, but in a proportionate way and within the boundaries of the rule of law. That is the aim of this joint appeal before the Council of State. This is also the first legal challenge carried directly by La Quadrature du Net, whose 2013 by-laws have made it possible to take legal action to defend citizens’ fundamental rights in the digital sphere. Eventually, this legal challenge will make it possible not only to formally refer the issue to the Constitutional Council, since the LPM never underwent a constitutionality check, but also to confront existing French Law with the ECJ and the ECHR’s case laws.