Key privacy concerns in France 2007

(Dieser Artikel ist auch in deutscher Sprache verfügbar)

6 January 2008 was the 30th anniversary of the French Data Protection Act.
But no one really cared. The only French contribution to this 2nd European
DP day has been the publication by the CNIL (French DP Authority) of a poll
result that it commissioned in November 2007. The poll indicates that 50% of
the asked persons know the CNIL. However, only 26% of them feel they are
informed well enough on their rights in terms of personal data protection,
and 61% consider that the constitution of databases is breaching their right
to privacy. Moreover, a former study on Internet usages conducted in June
2007 reveals that the mostly cited barrier to Internet use is the fear that
personal data are not protected enough (by 29% of the Internet users and 23%
of non Internet users). In summary, French people seem better aware of and
more concerned by the possible violations of their privacy rights.
Unfortunately, the CNIL has not published the entire poll result. Otherwise,
we might have had some explanations to the apparent paradox between this
increasing awareness and the growing development of privacy and data
protection violations by the French legislation and regulation without much
opposition. 2007, a year of presidential and legislative elections, has seen
further extensions of police powers, major provisions for the control of
migrants, most notably using biometrics and genetic data, massive extension
of children databases and the confirmation that intellectual property rights
prevail on privacy rights in France.

a. Further extensions of police powers

Since data retention law is already in place with access to data granted to
police and intelligence services, new developments are rather related to the
implementation and use of the system. To ease the collection and processing
of traffic data directly by the police intelligence forces, a new technical
platform for the interception of traffic data in all types of communication
systems was put into operation in May by the French Ministry of Interior,
covering communication data related to text messages, mobile or Internet. It
is expected that this platform will process 20 000 requests yearly. In terms
of legislative developments, the French law for the prevention of
delinquency of March 2007, introduced a new provision granting dedicated law
enforcement authorities with new powers to fight child sexual abuses, since
they now can use pseudonyms when they participate in electronic exchanges
for the purpose of investigations, and they can also detain and provide
illegal content for the same purpose. However, they cannot use these
possibilities for crime incitement.

b. Migrants under total control

Whether they ask for a short or long stay visa in French consulates abroad
or they cross any frontier to enter the country (and in the near future to
leave it), migrants are traced and filed. If they are caught in illegal stay
status, they’re filed. If, even as legal residents, they choose to return to
their country of origin and benefit from an assistance mechanism for this,
they’re filed. If they’re legal residents, they’re filed too, and they’re
filed again if they want to bring their families. Files contain their
personal data, their biometric data, their genetic data, as well as data on
their families, including young children. 2007 has seen major developments
to achieve this total control of foreigners, resulting in their assimilation
to criminals. The immigration law of March 2007 has introduced DNA testing
to prove family links for foreign candidates applying for a more than 3
months visa on family regrouping grounds. It also introduced the requirement
that the beneficiaries of financial support (foreigners voluntarily
returning home) have their photograph and digital fingerprints taken and
stored in yet another biometric database. An administrative decree of
December 2007 created the ELOI database, aimed at facilitating the expulsion
of illegal migrants. A previous version of the text was cancelled in March
2007 by the French highest administrative court, after 4 French NGOs filed a
case against the Interior ministry. While the new version of the decree
requires fewer data to be kept on French citizens and associations in
contact with these illegal migrants, personal data of the migrants and their
families remain filed, and kept during 3 years after their expulsion.
Finally, another decree published in November 2007 created the VISABIO
biometric database, containing the photograph and the 10 fingerprints of all
foreigners requesting visas, including children over 6. Other data in
VISABIO are related to the foreigner’s entry and exit from the territory.
These data are kept for 5 years.

c. Children under surveillance

Children start to be filed at age 3, as soon as they enter elementary
school. This is the result of “Base-élèves”, a database set up by the
ministry of Education. “Base-élèves” has been created as an “experiment”
since 2004, and is currently being generalized. It contains personal data on
the children and their families, including psychosocial data, and a huge
number of information on their competence, skills and problems. Most of the
data are to be kept during 15 years. Such data were supposed to be accessed
only by educators and social actors. However, the French law for the
prevention of delinquency of March 2007 granted new powers to Mayors (as
elementary and primary schools are within their managerial jurisdiction).
Mayors may now “share the professional secret” with many social actors and
thus they are granted access to “Base-élèves”, for the purpose of preventing
delinquency. After important protests from NGOs, parents associations and
some schools directors, the ministry of Education accepted in October 2007
to remove from “Base-élèves” data related to citizenship, date of arrival in
France and “language and culture of origin” of the child. However, protests
are increasing and national petitions have been launched to demand the
suppression of this file.

d. IPR holders granted private police powers

The French Data Protection Act allows, since its August 2004 revision,
intellectual property rights societies to create private records of rights
infringers through the collection of their IP addresses in P2P networks, the
use of automatic software for such a collection being subject to CNIL
approval. Accordingly, the CNIL decided on October 2005 to reject the
introduction of surveillance devices proposed by Sacem and other 3 author
and producer associations asking for the automatic tracing of infringements
of the intellectual property code. In May 2007, the highest administrative
court cancelled this decision. The court found that the proposed device are
not disproportionate, and are acceptable considering the extent of the
piracy phenomenon in France. The author and producer associations have thus
resubmitted their request to the CNIL and obtained its agreement in
November 2007. Still in November 2007, an agreement was signed between some
French ISPs and the music and movie representatives in order to act directly
against the big illegal file-sharers. French ISPs would then spy on their
users to see if they are big file-sharers. Those who would be identified
could get first a formal warning, but then they could be even cut-off or
suspended. The agreement foresees also the possibility to have a national
register of the subscribers that were suspended. But the agreement is not
applicable yet, since there is no authority created yet to apply it.

EDRi-gram: ENDitorial: French law on delinquency: the threat to FoE is
elsewhere (14.03.2007)
http://www.edri.org/edrigram/number5.5/enditorial-french-law-delinquency

EDRi-gram: The French Ministry of Interior has a new interception platform
(6.06.2007)
http://www.edri.org/edrigram/number5.11/french-interior-interceptation

EDRi-gram: French High Court cancels the creation of illegal migrants
database (13.03.2007)
http://www.edri.org/edrigram/number5.5/france-cancels-database

EDRi-gram: DNA tests proposed in France for family visa
applicants(26.09.2007)
http://www.edri.org/edrigram/number5.18/dna-test-france-visa

EDRi-gram: Update on DNA and biometrics in French immigration
law(24.10.2007)
http://www.edri.org/edrigram/number4.20/dna-french-immigration-law

EDRi-gram: ELOI – a French database to manage the expulsion of illegal
migrants (16.01.2008)
http://www.edri.org/edrigram/number6.1/eloi-french-database

More details on “Base-élèves” and the protest actions (only in French)
http://www.ldh-toulon.net/spip.php?rubrique141

http://www.ldh-toulon.net/spip.php?rubrique106

EDRi-gram: French State Council allows tracing P2P users (6.06.2007)
http://www.edri.org/edrigram/number5.11/france-tracing-p2p

EDRi-gram: Is the IP address still a personal data in France? (12.09.2007)
http://www.edri.org/edrigram/number5.17/ip-personal-data-fr

EDRi-gram: French ISPs agree to spy on Internet users to stop online piracy
(10.10.2007)
http://www.edri.org/edrigram/number5.19/french-isp-piracy

EDRi-gram: New agreement between the French ISPs and record industries
(5.12.2007)
http://www.edri.org/edrigram/number5.23/french-agreement-piracy

(Contribution by Meryem Marzouki, EDRI member IRIS – France)