PARIS — In France, six years of battles over the state’s right to hold data on its citizens may soon be coming to a head.
In the coming days, the country’s highest administrative authority will decide on the legality of the French government’s data retention schemes, which requires telecom companies to conserve people’s connection data for one year. In October last year, the EU’s top court said the rules were illegal, but Paris asked the Council of State to ignore the ruling.
“It’s not black or white. The question that arises is how to find the balance between an effective protection of fundamental rights and, at the same time, taking into account the states’ needs in terms of national security,” said Theodore Christakis, a professor of international and European law at University Grenoble Alpes.
The French case has pitted the state against digital rights NGO La Quadrature du Net, an activist internet service provider called the French Data Network and the Federation of Associative Internet Service Providers since 2015.
While the government argues that data retention is essential to solving crime and fighting terrorism, privacy campaigners counter that it amounts to mass surveillance leading to a society where all citizens are constantly treated as suspicious.
During a Council of State hearing Friday, the rapporteur will present preliminary conclusions on the case, which are non-binding but often followed by the administrative body. The final decision will come in the following days.
According to La Quadrature du Net, the rapporteur will recommend repealing the executive orders forcing telecom operators to keep connection data for a year, but not the ones requiring internet hosting providers to retain IP addresses.
He will also demand that intelligence services only use connection and localisation data in situations of security emergency, and after having submitted to the control of an independent authority with enforcement powers.
The rapporteur will grant the government a six-month grace period.
Beyond the issue of data retention, the case’s outcome will reveal whether a national court is ready to challenge the Court of Justice of the European Union (CJEU).
Paris explicitly asked the Council of State not to follow the EU’s top court — an unusual move for a Western European country that raised eyebrows in Brussels. In a note dated January and seen by POLITICO, the French government argued that the ruling goes against the country’s “constitutional identity” and that the CJEU does not have jurisdiction over national security.
“The government’s affront vis-à-vis EU law is a major issue that arrived late in the process,” said Noémie Levain, a lawyer and member of La Quadrature du Net.
“At the beginning, we were focused on the substance, but the government’s brief from January is not legal but rather political. It’s a political dimension to which the Council of State will have to respond,” she added.
In March, Justice Commissioner Didier Reynders said that the CJEU’s decisions are “binding for us and all courts, including the highest courts in member states.”
A long road
It all started in 2015, when la Quadrature du Net, the French Data Network and the Federation of Associative Internet Service Providers asked then-Prime Minister Manuel Valls to repeal several texts on data retention. They turned to the Council of State when the prime minister’s office failed to respond.
Over the years, the three groups referred other texts that required companies to retain the personal information of citizens.
Under France’s current data retention regime, telecom operators and hosting providers are required to keep a range of connection data including numbers called, the dates and duration of calls, IP addresses and location data for up to a year.
In 2018, the Council of State passed the buck to the CJEU, which ruled in October last year that indiscriminate and bulk data retention is illegal and can only be allowed in the face of serious security risks. (The Luxembourg court had already struck down the EU data retention directive in 2014 and ruled against indiscriminate data retention again in 2016.)
Now that the French case is back before the Council of State, the government argues that holding people’s data is “essential” for the police, the judicial system and intelligence agencies to fight terrorism, crime, industrial espionage, cyberattacks and foreign interference. In 2020, there were over 2.5 million requests for data, the government wrote in an April note seen by POLITICO.
According to Daniele Pitrolo, a board member of the Federation of Associative Internet Service Providers, the government is playing the national security card when the vast troves of information retained are used for unrelated purposes, such as cracking down on illegal downloads of copyright-protected content.
“In the government’s communication toward the Council of State, there is a willingness to understate the data that are not used for the same purposes as those loudly proclaimed, such as safeguarding security and preventing terrorism,” he said.
Should the Council of State decide to strike down the French data retention schemes, the government is asking for a grace period of either six months or for “the necessary time” for legislators to amend the legal framework, according to another April note seen by POLITICO.
France is not alone in its quest to save data retention at all costs.
In March, European heads of states and governments mentioned the importance of such practices in a joint statement.
In Brussels, the European Commission and Council of the EU are currently working on solutions to allow countries to retain their citizens’ data while trying to respect the Luxembourg court’s decisions. The Commission itself acknowledged this week that most of the bloc’s national data retention rules are not compliant with the CJEU’s rulings — but said it did not plan to launch infringement proceedings, creating a stir in the European Parliament.
“Even member states who have started changing their schemes haven’t found the magic formula to be fully compliant with the court cases while ensuring effective access to data needed by law enforcement and judiciary authorities,” the Commission’s Olivier Onidi told MEPs Tuesday.
In at least two of the documents reviewed by POLITICO, the French government mulls a radical solution: Seeking to change EU’s founding treaties or the Charter of Fundamental Rights, known as the bloc’s primary law, to avert the EU’s top court rulings that relied on the Charter.
The French government wants to raise the data retention in the debate on security in the context of the Conference on the Future of Europe.
The prime minister’s office declined to comment on the ongoing case.
UPDATED: This story has been updated to include comment from la Quadrature du Net.