France’s Council of State, the country’s highest legal entity, is meeting on Friday (16 April) to decide whether to allow the widespread retention of connection data, despite the EU Court of Justice in Luxembourg having already ruled against the practice several times. EURACTIV France reports.
According to a request made by several associations, including digital rights group La Quadrature du Net, several decrees put forward by the French government would have breached EU law because they allow the widespread and indiscriminate storage of French citizens’ connection data.
With these decrees, operators have been requested by intelligence services to store data such as identifiers, IP addresses, names and associated addresses, and lists of telephone antennas used, for criminal investigations or national security purposes.
If the French court were to conclude against the association and in favour of the government, France could become embroiled in infringement proceedings before the EU Court of Justice.
“The effects of the future decision of the Council of State are likely to be considerable: if we win, it will be the end of generalised retention of connection data, the limitation of purposes, the appearance of effective independent control. If we lose, France will become de facto independent of the European Union in order to continue its mass surveillance,” reads the Quadrature’s statement.
At a time when the EU is trying to bring Hungary and Poland back into the fold of the rule of law, this “security Frexit” would cause “an earthquake throughout the EU” and send “a catastrophic message to our European partners,” said La Quadrature du Net’s Bastien Le Querrec.
A ‘desperate argument’
The French government is arguing that the EU Court has been overstepping its mandate since the EU treaties provide that national security matters are within the sole competency of member states, a desperate argument according to the digital activist.
“The government is asking for an ultra vires review on the grounds that the CJEU has allegedly misused its powers,” Le Querrec told EURACTIV.
In its so-called Tele2 judgment, the CJEU recalled that the 2002 ePrivacy Directive “must be interpreted as precluding national legislation which, for the purpose of fighting crime, provides for the general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication” as well as be subject to “adequate safeguards.”
Although the directive states that it does not aim “to affect the ability of Member States to carry out lawful interception of electronic communications or take other measures,” it does call on such national measures to be “appropriate, strictly proportionate to the intended purpose and necessary within a democratic society.”
Clearly unconvinced by the CJEU’s reasoning, the French Council of State asked the EU court in July 2018 whether the “obligation of a generalised and undifferentiated retention” that operators are subject to should not be considered as an “interference justified by the right to security guaranteed by Article 6 of the EU’s Fundamental Rights Charter” as well as by the need to ensure “national security for which member states are solely responsible” under the EU framework.
In its decision of 6 October last year, the Court in Luxembourg reinforced its jurisprudence, stating that general and undifferentiated data retention measures may nevertheless be taken if a threat to national security is “real and present or foreseeable”. However, such measures must nevertheless be subject to “effective supervision” and only “for a period of time which is limited to what is strictly necessary,” the court added.
In short, “the retention imposed on operators does not comply with European Union law in that it is based on overly broad collection purposes, is not supported by any sufficient guarantees, and is not subject to effective control,” according to Quadrature du Net’s defence statement.
“The government is at an impasse because it knows it has lost,” said La Quadrature du Net’s Bastien Le Querrec, adding that “France’s policy in defending its intelligence legislation is very aggressive and comes at the expense of fundamental freedoms.”
Contacted by EURACTIV, the prime minister’s office in Matignon said it would not communicate on a procedure that is ongoing.
An uncertain outcome
The public rapporteur informed the parties on Wednesday (14 April) of what he would be arguing before the Council of State on Friday, though the legal entity is in no way obliged to follow up on his conclusions.
He is expected to call for most of the government’s decrees criticised by the associations to be repealed and to oppose the government’s challenge to the scope of EU law in this area.
He should also ask the judges to broaden the powers of the National Oversight Commission for Intelligence-Gathering Techniques so that it can effectively control the use of these data by the intelligence services.
The public rapporteur is also expected to suggest a six-month deadline for the government to comply with such demands. “The French government has known for several years that France is violating European law and there is, therefore, no pragmatic reason to delay respect for our fundamental freedoms,” the Quadrature du Net has said.
[Edited by Frédéric Simon]