IRIS protest against delay French government
The French digital rights organization IRIS is upset about the continuous delay by the French government in publishing administrative decrees that would define mandatory data retention for telecommunication companies. During the open workshop in Brussels on 21 September 2004, a representative from the French Ministry announced these decrees would be published ‘within the next few days’ and would set the time period on 12 months. (See EDRI-gram 2.18)
The legal regime for data retention in France has originally been set by the law on daily safety (Loi sur la Sécurité Quotidienne – LSQ) from 15 November 2001, and has been later included in Article L34-1 of the electronic communications Codes. But the administrative decree that would define the obligation to store data beyond the immediate business purpose of transmitting and billing, is still unknown.
Shortly after the LSQ was adopted, EDRI-member IRIS filed a complaint against France with the European Commission. According to the complaint, Article 29 of the LSQ violated EU legislation principles. Half a year later, on 29 July 2002, the European Commission informed IRIS that they would put the complaint on hold until the decree was published, “because it is difficult to judge the compatibility of Article 29 of the LSQ with Community legislation in the absence of an application decree.”
After the initial complaint, EU legislation was changed, specially with the 2002/58/CE Directive on personal data protection in the electronic communications sector and with the proposal for the draft framework decision on data retention. IRIS now writes: “By delaying for almost 3 years the publication of this decree, the French government has acted extremely opportunistic to avoid the risk of having to appear in the European Court of Justice. We have to recall that article 29 of the LSQ was presented, amongst the other provisions of the law, as a measure urgently required in the fight against terrorism.”
In an earlier response to the LSQ, the French privacy authority CNIL demanded a maximum period of 3 months.
Press release IRIS (17.10.2004)
http://www.iris.sgdg.org/info-debat/comm-dr-chrono1004.html
IRIS chronology of French and EU measures on data retention, with details on the complaint
http://www.iris.sgdg.org/actions/retention/index.html
EDRI-gram 2.18, Brussels workshop on telecom data retention (22.09.2004)
http://www.edri.org/edrigram/number2.18/workshop