In its 30 April 2024 ruling, the Court of Justice of the European Union (CJEU) shared its assessment of the legality of Hadopi’s massive surveillance system. The ruling is disappointing. The CJEU has considerably watered down its previous case law, with impacts beyond the Hadopi case. With this new ruling, access to IP addresses is no longer considered a serious interference with fundamental rights by default. As a result, the Court allows the possibility of mass surveillance of the Internet.
The CJEU has just authorised mass, automated access to IP addresses associated with the civil identity and content of a communication. This access can be done for petty purposes and without prior review by a court or an independent administrative authority.
The 30 April 2024 ruling is a major U-turn in EU case law. After a decade of legal struggle, during which European governments deliberately chose not to respect and implement the many previous CJEU rulings on data retention, police forces across Europe have just won the battle. With today’s judgment, the CJEU is admitting that it will eventually change its case law if its rulings are not applied. This is a worrying weakening of the Court’s authority in the face of Member States’ pressure.
Whereas in 2020, the CJEU considered that the retention of IP addresses constituted a serious interference with fundamental rights and that they could only be accessed, together with the civil identity of the Internet user, for the purpose of fighting serious crime or safeguarding national security, this is no longer true. The CJEU has reversed its reasoning: it now considers that the retention of IP addresses is, by default, no longer a serious interference with fundamental rights, and that it is only in certain cases that such access constitutes a serious interference that must be safeguarded with appropriate protection measures.
With regard to our case and the specificity of Hadopi in France, the Court is simply requesting Hadopi to slightly evolve. It considers that in certain “atypical” situations, access to the IP address and civil identity associated with works covered by copyright may constitute a serious interference with the right to privacy (for example, in case where the material allows conclusions to be drawn about political opinions, sexual orientation, etc.); it also considers that such access constitutes a serious interference in the event of “repetition” and therefore requires that access to IP addresses cannot be “entirely automated“. In all other cases, however, the CJEU clearly states that Hadopi can access people’s civil identities on a massive and automated scale.
In other words, the graduated response (named after the procedure followed by Hadopi, which consists of sending several initial warnings, before taking legal action if the Internet user does not “secure” their connection) will have to change form. French lawmakers will have to invent a complicated mechanism to provide some sort of independent external control of access to civil identity by Hadopi. While there is currently no obligation for Hadopi to be subjected to external checks, the authority will now have to undergo such checks when it intends to access civil identity in these “atypical” cases or in the event of a “repeated offence“. In other words, agents external to Hadopi will be responsible for clicking on a “validation” button, whereas the situation today is that Hadopi gives itself authorisation.
More generally, this decision from the CJEU has, above all, validated the end of online anonymity. While in 2020 it stated that there was a right to online anonymity enshrined in the ePrivacy Directive, it is now abandoning it. Unfortunately, by giving the police broad access to the civil identity associated with an IP address and to the content of a communication, it puts a de facto end to online anonymity.
We now expect the Conseil d’Etat to save the Hadopi, despite this ruling. La Quadrature du Net will continue its fight against online surveillance, including by Hadopi. To help us, you can consider making a donation.