France Data Retention 2016
Privacy International filed an intervention at the Conseil d'État in support of a claim seeking to abrogate legislation enabling indiscriminate data retention
Photo by Patrick Fore on Unsplash
Case name: FDN et al. c/ Gouvernement
Court: Tenth sub-section of the Conseil d'État
Application no.: 393099
Status: Closed
In February 2016, Privacy International and the Center for Democracy & Technology filed a third-party intervention before the Conseil d'État, France's highest administrative court, to challenge the government’s refusal to abrogate legislation containing data-retention provisions which were incompatible with human rights.
The claim sought to strike down provisions contained in two separate statutory instruments. Article R10-13 of the Code of Postal and Electronic Communications enabled electronic communications operators to retain user-identifying data and other communications data - such as the time, date and duration of each communication sent - for research, verification and criminal prosecution purposes. The Decree No. 2011-219 of 25 February 2011 allowed for similar indiscriminate retention, save that it applied to hosting providers and enabled them to retain data facilitating the identification of every individual creator of, or contributor to, any type of online content.
Privacy International argued that the data retention provisions in both pieces of legislation were incompatible with the Charter of Fundamental Rights of the European Union and the European Convention on Human Rights. The provisions were all-encompassing and disproportionate, neither allowing for any differentiation in the duration of retention based on the legitimate aim pursued nor including any exceptions for individuals whose communications are subject to an obligation of professional secrecy. Significantly, the provisions did not place any restrictions in the subsequent use of the data, which according to robust human rights jurisprudence should be confined to a limited set of purposes, such as the prevention, detection or criminal prosecution of offences.
In July 2017, the Conseil d'État referred the case to the CJEU for consideration. Privacy International joined the case as an intervener.