France / Council of State / 393099

La Quadrature du Net, French Data Network, Igwan.net, Fédération des fournisseurs d'accès à internet associatifs, Free Mobile and Free v. France
Deciding body type
National Court/Tribunal
Deciding body
Council of State
Typ
Decision
Decision date
21/04/2021
ECLI (European case law identifier)
ECLI:FR:CEASS:2021:393099.20210421
  • France / Council of State / 393099

    Key facts of the case: 

    The plaintiffs challenge the regulatory provisions requiring electronic communications operators, Internet service providers and content hosts to store the traffic and location data of all their users, together with their civil identity data and certain data relating to their accounts and the payments they make online, in a generalised, undifferentiated way, for a period of one year. They also challenge the regulatory provisions allowing intelligence services to collect and process this data.

     

    Key legal question raised by the Court: 

    Can generalised data retention be justified and if so, under what conditions?

     

    Outcome of the case: 

    Firstly, the State Council emphasized that the data retention framework under European law does not call into question the constitutional requirements relating to national security and combating crime.

    The State Council then considered that safeguarding the fundamental interests of the Nation, preventing public order offences, combating terrorism and tracking down the perpetrators of criminal offences may not always be guaranteed, under Union law, with a protection equivalent to that provided by the Constitution. It was therefore up to the State Council to ensure that the limits set by the CJEU do not jeopardise these constitutional requirements.

    Finally, the State Council ruled that generalised data retention is now justified by the existing threat to national security. It noted that the possibility of accessing this data for combating serious crime has so far made it possible to meet the constitutional requirements involved in preventing public order offences and tracking down the perpetrators of criminal offences (although only the most serious ones can be targeted in this way). However, it ordered the government to regularly reassess the threat to the nation to justify the generalised retention of data and to make the use of such data by the intelligence services subject to the authorisation of an independent authority. It also ruled that the general retention of data obligation was illegal (other than for non-sensitive data: marital status, IP address, accounts and payments) for purposes other than national security.

    With regard to the use of data retained for intelligence purposes, the State Council  noted that the planned prior control by an independent authority as provided for by the French legal framework is not sufficient, since the opinion issued by the national commission for the supervision of intelligence techniques - Commission nationale de contrôle des techniques de renseignement (CNCTR) before any authorisation is not binding. The State Council  ordered the Prime Minister to amend the regulatory framework in order to comply with these requirements within six months.