First press release
The Court of Justice of the European Union (CJEU) has today released a long-awaited ruling regarding the regime of surveillance. For nearly fifteen years, the French government has been requiring ISPs and phone carriers to log metadata of the entire population (who talks to whom, when, from where). La Quadrature du Net, along with FDN, FFDN and Igwan.net, challenged the legality of French law in this matter before the EU jurisdictions.
A first reading suggests that it was a “victorious defeat”. Although the Court affirms that France can no longer impose this bulk metadata retention obligation, it reveals several important exceptions. This decision is a defeat in the sense that these exceptions reduce the effectiveness of the right to privacy and will inevitably lead to abuses, which we will detail later.
However, as disappointing as it may be, this morning’s ruling draws a legal framework that is much more protective of freedoms and right to privacy than the existing French law. For example, while the government can still require ISPs to keep the IP addresses of the entire population, these addresses can now only be used for the purpose of combating serious crime or of safeguarding national security (notably, terrorism). Another important victory is that web hosting services can no longer be forced by law to monitor all their users on behalf of the state, keeping track of who publishes what, with which IP address, when, etc.
French law thus ends up in flagrant contradiction with the decision of the CJEU: the principle of bulk metadata retention is refused by the Court while it is the principle in France. The Court notes that the French mechanisms for controlling the intelligence services are not sufficient, and we will ensure that the necessary safeguards are strengthened during the announced reform of French law.
This 85-page decision will require a long and careful analysis in the weeks and months to come.