France’s highest court validates mass surveillance in the long term

In total disregard of European case law, France’s court ruling ignores the fundamentals of many of the Court of Justice of the EU’s (CJEU) rulings. In October 2020, the CJEU considered that both the French law regulating intelligence services’ access to data (“Loi renseignement”) and the legislation obliging telecom operators to retain all communications metadata (IP addresses, location data, etc.) in a generalised and undifferentiated manner were contrary to fundamental rights. With its ruling, the Conseil d’Etat isolates France in its “security Frexit” and gets the rule of law principles out of the way of French intelligence services.

On the surface, the Conseil d’Etat’s decision leads to the invalidation or repeal of some of the decrees attacked by LQDN, the French Data Network (FDN), la Fédération des Fournisseurs d’Accès à Internet (FFDN) and Igwan.net, which introduced an obligation for telecom and hosting providers to retain connection data (such as IP addresses, location etc.) in a generalised and undifferentiated manner. But the illusion is immediately cleared up by the Conseil d’Etat, which prescribes superficial corrective solutions that will allow the French government to maintain its mass surveillance regime. Alongside this false concession, it rejects the rest of the plaintiffs’ arguments against the intelligence services.

The Conseil d’Etat authorises the general retention of metadata, even outside of exceptional periods of security emergency, contrary to what the CJEU required in its decision of 6 October 2020 against France. In order to reach such a blunt conclusion, the Conseil d’Etat reinterpreted the notion of “national security” to extend it far beyond the fight against terrorism and to include, for example, economic espionage, drug trafficking or the organisation of undeclared demonstrations. This way, it concludes that national security is systematically threatened, justifying the permanent circumvention of the guarantees protecting fundamental freedoms, even in the absence of official states of emergency which are subject to democratic control (however theoretical).

Similarly, the Conseil d’Etat allows for the access to data by the police for any of the purposes falling under this broad and vague concept of “national security”, while the CJEU requires that this surveillance measure be limited to the fight against serious crime.

This decision reflects the blank check given by the Conseil d’Etat to the government and to intelligence services. By reducing the rights to privacy, security or freedom of expression to a pure declaration of principle devoid of effectiveness, the Conseil d’Etat gives to the sacrosanct national security a definition that is so monstrous that it enables it to annihilate the rest of fundamental rights. The Conseil d’Etat overturned the basic principle in terms of state surveillance and permanently enshrined it in French law: everyone is a suspect, of everything, all the time.

The position of the Conseil d’Etat raises multiple questions: what legitimacy can France have to speak on behalf of the European Union after trampling its very principles and jurisdictions? What future is there for the respect of the rule of law when the French judge is so directly opposed to a legal decision? France is no longer legitimate to talk about European shared values, nor should it be. In a European Union threatened by authoritarian and nationalist pressures, France has just set a sinister precedent in the negation of the fundamental rights promoted in Europe since the end of the last world war. From now on, each Member State – and beyond – will be able to easily follow the French example and hide behind any “national security” claim to disregard its international obligations and the rule of law.

Read the original statement in French here.