Following an appeal by the operator Free, on 21 April 2021, the Council of State annulled the Prime Minister’s decision by which the latter had refused to repeal Article R.10-13 of the French Postal and Electronic Communications Code (Code des postes et des communications électroniques). Free was represented in this matter by Terence Cabot and Thomas Bernard, as well as by several associations.
This regulatory provision imposed an obligation on electronic communications operators to keep a large amount of data stored for a period of one year for the purposes of researching, establishing and prosecuting criminal offences (this data included, in particular, the subscriber’s telephone number, the date and time of the communications sent by the subscriber, the telephone number of the recipient of the communications, the volume of data consumed, the network used, the IMEI number, the IMSI number, etc.).
In its decision, the Council of State noted that the constitutional requirements of safeguarding the fundamental interests of the nation, preventing breaches of public order, combating terrorism and tracking down criminal offenders do not benefit, under EU law, from protections equivalent to those guaranteed by the French Constitution. The Council of State decided that it must therefore ensure that the limits set by the CJEU do not jeopardise these constitutional requirements.
The Council of State thus considered that the generalised storage of data is justified by the existing and current threat to national security (the high risk of terrorism, the risk of espionage and foreign interference, etc.). It also noted that the possibility of accessing such data for the purpose of combating serious crime makes it possible, to date, to guarantee the constitutional requirements of preventing breaches of public order and tracking down criminal offenders.
This decision was made after judgments of the CJEU dating 6 October 2020, which confirmed that EU law precludes national regulations from requiring that a provider of electronic communications services, for the purpose of combating crime in general or safeguarding national security, transmit or retain traffic and location data on a general and undifferentiated basis. In said rulings, the CJEU outlined a framework for determining what EU law allows in terms of data retention, depending on the purpose (threats to national security, serious crime, ordinary crime).
The Council of State accordingly granted the Prime Minister six months to repeal the law and amend the regulatory framework.
