Hadopi law (2009–2026)

Hadopi is definitely a surveillance tool

Hadopi is the law that created the authority under the same name: the “High Authority for the Dissemination of Creative Works and the Protection of Rights on the Internet” (Haute Autorité pour la diffusion des œuvres et la protection des droits sur internet) with the aim of combatting illegal file sharing.

The mechanism put in place consists of two stages: firstly, rights holders identify internet users sharing cultural content online via peer-to-peer networks; they collect their IP address and send it to the Hadopi; secondly, the Hadopi, using these lists of IP addresses, requests the civil identity and contact details of the identified subscribers from internet service providers and stores this information in a database of users who have downloaded files. This triggers the ‘graduated response’ system: the first time a user is identified, the Hadopi sends an initial warning email. If the behaviour continues, a second email is sent, followed by a registered letter. Hadopi may finally refer the case to the judicial authorities if users ignore these warnings. The judicial authority may then impose a fine up to €1,500 (or €3,000 for a repeat offence) on the internet user for the fifth class minor offence of “failing to secure an internet connection”.

In 2021, the French Parliament merged the CSA (High Council for Audiovisual Media) with Hadopi to create Arcom (Authority for Regulation of Media and Digital Communication). However, Arcom merely took over Hadopi’s responsibilities, and this surveillance system has survived.

Christine Albanel, a Sarkozy-appointed Minister for Culture who defended the first Hadopi law in 2009, claimed that the text would reconcile privacy with the fight against piracy. However, she did not understand the technical realities and challenges of the bill she promoted. Already in 2009, it was clear that the law would not work, as internet users would simply switch from peer-to-peer to streaming or direct download of content, which inevitably created a market for illegal commercial platforms. Furthermore, piracy issues are closely linked to the availability of legal alternatives: piracy decreases when legal alternatives are easily accessible and increases when their quality decreases or when platforms become unavailable.

Today, we know that the violations of fundamental rights are so severe that this system cannot continue.

Seven years of legal actions

In 2019, La Quadrature du Net, French Data Network (FDN), Franciliens.net and Fédération FDN asked the Conseil d’État to overturn Hadopi’s central decree, which authorises the storage of personal data needed for the graduated response system, such as IP addresses, civil identity and downloaded material. The case was referred to the Constitutional Council, and in 2020 they had their first partial victory: the Constitutional Council restricted Hadopi’s broad access to personal data. Before that, the law provided that Hadopi could access “all documents“. However, contrary to La Quadrature’s initial assessment, this did not necessarily mark the end of the Hadopi.

They then turned to the Conseil d’État to draw conclusions from this partial invalidation of the law and pointed out that the Hadopi system was in breach of the case law of the Court of Justice of the European Union (CJEU): in principle, an independent review of the legality and proportionality of access to metadata — such as an IP address or the civil identity associated with that IP — must be carried out before any authority can access it. Such a review does not exist for the Hadopi. The rapporteur public (General Advocate) of the Conseil d’État was reluctant to acknowledge the illegality of the Hadopi, but nevertheless admitted the issue: “This case should, alas, delight millions of internet users since it indirectly raises the question of the very existence of the [Hadopi]”. However, rather than inviting the Conseil d’État to put an end to Hadopi, he suggested asking the CJEU for a ‘Hadopi exception’: to weaken European requirements to allow Hadopi’s mass surveillance to continue.

This case therefore brought the plaintiffs before the CJEU. The outcome was disappointing, as they lost on the principle: the CJEU agreed to weaken its case law. It accepted that, in certain cases, access to metadata might not be subject to prior independent review. However, it required numerous conditions to this possibility, relating to both the retention of such data and the requirements for prior independent review.

This year, the Conseil d’État, the French Administrative Supreme Court, ruled in favour of La Quadrature du Net, French Data Network (FDN), Franciliens.net and Fédération FDN. It recognised that the Hadopi law’s surveillance system, operated by Arcom since 2021, is a breach of fundamental rights protected by the European Union. In its ruling, it agreed with the plaintiffs on these two points. Firstly, it found that the retention of metadata is not carried out in a manner that safeguards civil liberties. The CJEU required ‘watertight separation’ of IP addresses and civil identity data, which can be understood as two distinct databases, or files, that can only be technically correlated after a formal request for access by Arcom. The Conseil d’État stated that “no legal provision imposes such retention, under these conditions, on electronic communications operators“.

Secondly, it also noted that access to this data is not subject to independent review. It fully endorses the CJEU’s own conclusions that Arcom cannot act both judge and jury: it cannot request access and then review the legality of that access itself, even though it is an independent authority. However, like the CJEU, the Conseil d’État considers that this lack of review only becomes an issue from the third access to the data onwards, at the stage when a registered letter is sent.

The need to find a new approach

In practical terms, this means that the ‘graduated response’ system is now stalled. The Arcom can no longer take French internet users to court, as the requirements set by the CJEU are not met. And it can only send them an email if it has first ensured that your internet service provider has stored your metadata with a ‘watertight separation’. It has now been downgraded to the function of a giant spam machine.

This case is emblematic of the archaic view held by successive French governments, both left-wing and right-wing, on the question of sharing online culture and knowledge. It is now up to the government to acknowledge the death of Hadopi and, instead of attempting to bring it back to life, the government could try again by creating a sort of an Arcom supervisory body to ensure compliance. If it were to go down this path, the French government would be stubbornly keeping an illegitimate surveillance system afloat.

By focusing on prosecuting internet users who share content online, the Hadopi system has missed the target. It has never been able to tackle the illegal commercial platforms that sell privileged access to their catalogues at the expense of artists. On the contrary, it has created a space for this illegal activity to thrive.

Similarly, the Hadopi system has not put an end to the exploitation of rights-holding companies, those ‘copyist monks‘ who keep artists in a state of political and economic submission, from which only a few can break free. The first step towards a necessary reform is to end the criminalisation of online non-commercial sharing of culture.

Contribution by: EDRi member, La Quadrature du Net (LQDN)