French court decision on traffic data retention

On 4 February 2005 the appeal court of Paris has extended the general obligations for data retention to companies. According to the verdict, like internet providers all companies are obliged to store traffic data originating from their employees, to allow identification of e-mails with illegal contents sent from company machines. The verdict is ominous since France does not have a specific law decreeing data retention.

The court decision follows proceedings from the company World Press Online (WPO) against the bank BNP Paribas. Two commercial partners from WPO received an litigious e-mail about the company at the end of 2003, sent from a Yahoo e-mail address. WPO tracked the IP-address back to a branch from the bank in France and demanded to know which employee had used the specific computer. BNP didn’t reply at first. WPO instigated a case and BNP was ordered on 12 October 2004 by the commercial court of Paris to hand over the requested information. BNP appealed, but lost again and was forced to hand-over data about their employees.

The court also said that the obligation to retain identification data and provide these data upon judicial request does not imply that the company has to do any investigations on the raw material to identify the possible sender of the e-mail.

The Court has based this obligation on the law on liberty of communication (adopted in 1986 but amended in 2000). This law defines certain legal responsibilities for access providers that were superseded by the French transposition of the E-commerce directive, the LEN, adopted in June 2004. However, the case began before the LEN was adopted, so the Court had to go back to these older provisions.

The general legal framework for data retention in France is provided by the ‘Loi sur la Sécurité Quotidienne’, a controversial general security-law adopted in the autumn of 2001. This law decrees that traffic data can be retained for billing purposes or to comply with a judicial request, but nobody knows which data should be retained for what period of time, because no decree has yet been published defining mandatory data retention.

Conservation des données(…) (in French, 02.03.2005)
http://www.zdnet.fr/actualites/internet/0,39020774,39209610,00.htm

Verdict of the Paris appeal court (in French, 04.02.2005)
http://www.foruminternet.org/telechargement/documents/ca-par20050204.pdf

(Thanks to Meryem Marzouki, EDRI-member IRIS)