Legal Actions Before the French Council of State and Constitutional Council

De La Quadrature du Net
Cette page est une version traduite de la page Recours au Conseil d État et au Conseil constitutionnel et la traduction est complétée à 100 %.

Autres langues :
English • ‎français

Paris, 4 October 2016 — Since January 2015, La Quadrature du Net, FDN and the FDN Federation have begun a series of legal actions before the French Council of State and the French Constitutional Council against the laws and the implementing decrees that these associations consider fatal to civil liberties. In order to help people to follow over time the different stages of these procedures, this page explains in a few lines each of these appeals and their progress.

Banniere fdn.png

All the texts of the legal actions are available on the website of the Éxégètes amateurs. This nickname was given by Minister of Defence Jean-Jacques Urvoas during the debates at the French National Assembly during the French Surveillance Law.

Sommaire

Non published implementation decree on the activities of the Directorate-General for External Security (DGSE)

Non published decree on the activities of the French Foreign Intelligence Services (DGSE)

Two parallel procedures have been initiated against this decree unravelled by an article in the French magazine L'Obs (fr) in July 2015. This unpublished decree that remained secret, authorises the massive tapping by the French foreign intelligence services of Internet communications going to or coming from French territory.

This legal action was prepared in collaboration of Spinosi & Sureau SCP.

Suspensive judgement

Status: rejected on 9 September 2015

This emergency procedure aims at asking the immediate suspension of the decree waiting for the judgement as a matter of law.

Read the text (fr).

This brief was rejected in an ruling issued on 9th September 2015 (fr) signed by Bernard Stirn, president of the litigation division of the French Council of State before having hold a contradictory hearing. In this very political decision, the judge does not consider the emergency of the plea.

Action for annulment before the Council of State

Status: in progress

The legal challenge focuses on two main points:

  • External legality: the decree is vitiated by a lack of jurisdiction and was adopted in an irregular procedure;
  • Internal legality: the decree has no legal basis. The surveillance law adopted in July 2015 should have given the decree a legal basis but the provisions on international surveillance have been censored by the French Constitutional Council.

Read the judgement as a matter of law of 31 August 2015 ;

Read the essay of 30 November 2015.

Read the essay answering the statement of defense of the Ministry of Defense of 1 April 2016.

Legal actions from other organisations

Decree on the retention and the communication of data allowing to identify any person having contributed to the creation of online content

Decree on the conservation and the communication of data allowing to identify any person that contributed to the creation of an online content.

Status: in progress

Following the decision of the EUCJ of April 2014 "Digital Rights" condemning the massive retention of personal data, LQDN, FDN and FFDN have submitted to the French government a request to repeal the decree n°2011-219 of 25 February 2011 and the article R. 10-13 of the Postal and Electronic Communications Code. Those provisions define the data to be retained by the Internet Service Providers (ISPs), in order to allow the identification of the people having contributed to the creation of online content. They also authorise the operators of electronic communication to delay for a year the erasure of some technical data of their clients. The absence of answer from the government during two months is considered as an implicit refusal to repeal those dispositions, which is leading the three associations to refer directly to the French Council of State. The legal challenges focus on the unconventionality of the general and undifferentiated retention of "technical data" and more especially:

  • The massive interference with fundamental rights, more especially the right to privacy;
  • The impossible limitation to the bare necessities of massive data retention;

On 4 May 2016, French Prime Minister and Ministry of Justice received a formal notice - in other words, it means they have been asked - to publish their observations and to answer to the initial query.

Following the silence of the French Government on the complementary essay transmitted on the 17 May 2016 to the French Council of State in order to present the complementary observations regarding the applicability of the European Charter of Fundamental Rights to the litigious provisions.

Read the brief (fr) of 27 April 2015.

Read the initiating application published on 1st September 2015.

Read the complementary essay published on 27 November 2015.

Read the third party intervention of International and CDT.

Read the complementary essay on the applicability of the Charter published on 17 May 2015.

On 20 June 2016, the applicant NGOs received the observations of the French Ministry of Justice on the brief (request to abrogation). Besides to insist on the legitimacy of the conversation of data, the Minister of Justice also considers that there is no need to send the Priority Preliminary rulings on the issue of constitutionality sent by the applicants to the European Court of Justice.

Surveillance law

Queue before the "narrow door"

MP's referral procedures on the Surveillance Law

Status: finished. The French Constitutional Council published its decision on 23 July 2015.

The surveillance law authorizes bulk collection of data, a very broad field of application, the bypass of the judicial judge, and very weak oversight by the National Commission for Oversight of Surveillance Techniques (CNCTR), even non-existent for international surveillance. The French Constitutional Council has been forced to rule on a great number of questions through parliamentary and presidential referrals:

Some organizations have sent their own observations using the "narrow door" procedure. Here are several amicus briefs we have been able to identify:

Following the adoption of the French Surveillance Law, a number of legal actions have been initiated:

Verification request at the CNCTR

Letter to the CNCRT

Satus: finished

A letter was sent to the CNCTR in order to verify if surveillance measure were put in place against a specific person. The letter was not published because it contained numerous personal data.

Legal action before the French Council of State

Status: ongoing

Follow-up to the letter sent to the CNCTR, a legal action before the French Council of State was initiated.

  • External legality
    • Default notification on implemented measures
  • Internal legality
    • Unconstitutionality of interception carried out by the DGSE (French Foreign Intelligence Services)

Read the initiating application.

Legal actions initiated by other individuals

The MEP Sophie in't Veld has sent a letter to the CNCRT in May 2016

  • See her Twitter
  • See also on her blog the letter in French and the explanation in Dutch

Decrees foreseen by the Surveillance law

Those legal actions are prepared in collaboration with Spinosi & Sureau SCP.

Decree on the legalisation of specialised Intelligence services

Decree 2015-1185 of 28 September 2015 on the designation of the specialised intelligence services.

Status: in progress

The law of 24 July 2015 on intelligence allows French intelligence services to use highly intrusive surveillance techniques on the sole authority of the Prime Minister and a simple consultation of the national intelligence oversight technical Commission (CNCTR). But a decree designated the services, other than the intelligence ones, whose agents can resort to surveillance techniques. This decree is challenged on:

  • External legality
    • The final published version of the text doesn't correspond to the version submitted to the Council of State.
  • Internal legality
    • The decree doesn't have legal basis: it doesn't respond to the exigences of justification and proportionality regarding the Charter of Fundamental Right of the European Union and the European Convention on Human Rights and the 2002/58/CE Directive of 12 July 2008 on the processing of personal data. Indeed:
      • The control administration has fully control of the applicant to classified informations, which infringes to the right to a fair trial;
      • No arrangement has been foreseen to grand the applicant access to classified informations;
      • The measures on intelligence gathering on hertzian waves have no legal framework;
      • The collection and exploitation by French services of informations transmitted by foreign services can't be subject to judicial redress.

The list of services other than intelligence services having access to intelligence techniques is on this page (fr).

Read the initiating application published on 30 November 2015 (fr).

Read the complementary essay published on 29 February 2016 (fr).

Read the complementary observations published on 6 May 2016 (fr).


Decree on the organisation of the CNCTR

Decree 2015-1186 of 29 September 2015 relating to the administrative and financial organisation of the National Commission of Control of Intelligence Techniques (CNCTR).

Status: in progress

The intelligence techniques must be implemented by the intelligence services authorised by the Prime Minister, after simple notice of CNCTR. In cases of absolute urgency, this notice is not required. The decree on the organisation of the CNCTR is attacked on the following:

  • External legality
    • The final published version of the text doesn't correspond to the version submitted to the Council of State.
  • Internal legality
    • The decree doesn't have legal basis: it doesn't respond to the exigences of justification and proportionality regarding the Charter of Fundamental Right of the European Union and the European Convention on Human Rights and the 2002/58/CE Directive of 12 July 2008 on the processing of personal data. Indeed:
      • The control administration has fully control of the applicant to classified informations, which infringes to the right to a fair trial;
      • No arrangement has been foreseen to grand the applicant access to classified informations;
      • The measures on intelligence gathering on hertzian waves have no legal framework;
      • The collection and exploitation by French services of informations transmitted by foreign services can't be subject to judicial redress.

Read the initiating application published on 30 November 2015.

Read the complementary essay published on 29 February 2016.

Read the complementary observations published on 6 May 2016.


Decree on the litigation and the files on State security

2015-1211 Decree of 1 October 2015 on litigation implementing intelligence techniques that require authorisation and files on the State security.

Status: in progress

The decree brings the proceedings concerning the implementation of intelligence techniques and the access to files on the State security. In particular, it determines the methods and limits for appeals before the Council of State by any person wishing to verify that no intelligence technique is improperly implemented against him or her. It is attacked on the following basis:

  • External legality
    • The final published text does not match the version submitted for an opinion to the Council of State.
  • Internal legality
    • The decree lacks of legal basis: it has been written considering the proposals of the Surveillance Law that are against to the Charter of Fundamental Rights of the European Union, to the 2002/58/CE directive of the 12 July 2008 on the processing of personal data, and against the Convention for the Protection of Human Rights and Fundamental Freedoms. Hereunder some extracts from the points raised in the complementary observation sent to the Council of State on the 6 May 2016.
      • Litigious proposals constitute a limitation to the principle of confidentiality, of deletion and anonymization of those data according to European Law;
      • The Intelligence techniques tabled constitute an intrusion in privacy and thus a disproportionate violation in views of rights guaranteed by the article 7 and 8 of the Charter;
      • The absence of a legal framework for the conditions of access of data collected in application of the techniques constitute an disporportionate violation, the opposite of the articles 7, 8 and 52 of the Charter;
      • Excessive and disproportionate nature of the data retention periods is contrary to the jurisprudence of the Court of Justice of the European Union (ECJ, October 6, 2015, Maximillian Schrems, C-362/14, § 92);
      • The contested provisions also violate the right to an effective appeal and the right to a fair trial as guaranteed by the Charter;
      • Those concerned with the collection and exploitation of information provided by foreign services have no legal remedy to challenge its validity. This lack of safeguards surrounding the access to data transmitted by foreign service is interfering with the right to an effective appeal and is contrary to the requirements of Article 47 of the Charter of Fundamental Rights;
      • The obligation for operators to set up an automated data processing is contrary to Directive 2000/31/EC on electronic trade.

Read the initiating application published on 30 November 2015.

Read the essay published on 29 February 2016.

Read the complementary observations published on 6 May 2016.

Decree on the designation of services other than Intelligence specialised services

The Decree 2015-1639 of 11 December 2015 on the designation of the services other than specialised intelligence services, authorised to use the techniques mentioned in title V of book VIII of the code of Internal security, applied by to Article L. 811-4 of the code of Internal security.

Status: ongoing

This action was initiated by the NGO Igwan.net, member of the FDN Federation.

The decree determines the services in Defence and Interior Ministry who may be authorised to use the intelligence techniques (covered by Title V of Book VIII of the code of Internal Security), implementing the entire legal architecture in the code of Internal Security, as created by:

List of the services, other than intelligence services, having access to intelligence gathering techniques is here.

This decree was attacked on the following points:

  • External legality:
    • The final text published does not match the version submitted for review to the Council of State. Hence the decree is marred by incompetence and was adopted in an irregular procedure.
  • Internal legality
    • The decree has no legal basis and is marred by an error of law.
      • The disputed provisions of the contested decree infringe the Constitution insofar as they do not take into account the transmissions via radio waves and therefore does not determine if intelligence services are likely to use wireless monitoring techniques (see QPC filed about it).
      • In addition, by allowing the administration the collection of data referred to, the attacked provisions constitute a limitation to the principles of confidentiality, erasure and anonymization of the data as provided by the law of the European Union (Directive 2002/58/EC, known as "ePrivacy"). It aimed "to ensure full respect for the rights set out in Articles 7 and 8" of the Charter of fundamental rights, the provisions of contested decrees are contrary to that same charter.

Read the initiating application published on 11 March 2015.

Read the complementary essay published on 6 May 2016.

Decree on Intelligence collection techniques

Decree 2016-67 published 29 January 2016 on Intelligence collection techniques.

Procedure before the Council of Sate

Status: ongoing

The decree sets the missions of the GIC (Inter-ministry control group) the connection data that may be collected, the conditions of access to the connection data, the modalities of financial compensation of the obligations charged to electronic communications operators and finally the procedures applicable to actions brought by the CNCTR before the Council of State on international electronic communications surveillance. This decree was attacked on the following basis:

  • External Legality
    • The decree was adopted following an irregular procedure where the final published text does not match the version submitted for review to the Council of State
  • Internal Legality
    • The decree doesn't have a legal basis: it has been adopted on the basis of the proposals of the French Surveillance Law which are against the French Constitution, to the Charter of Fundamental Rights of the European Union, to the 2002/58/CE of 12 July 2008 Directive on the processing of personal data and to the European Convention on Human Rights
      • On the ignorance of the Constitution: the GIC (Inter ministerial Control Group) must originally intervene on the ensemble of intelligence techniques without exception, among which the "surveillance and control of transmissions using the Hertzian Waves". But the implementation of the proposals of article L. 811-5 of the Interior Security Code, such an intervention of the GIC —implying the collection and the conservation of informations— wouldn't be subject to any legal framework against Constitutional exigences;
      • On the ignorance of the Charter of Fundamental Rights: the litigious proposals, allowing the administration to gather data, constitute a limitation to the principles of confidentiality, to erasure and anonymisation and those data such as foreseen by the 2002/58/CE directive (ePrivacy) and do not respect the necessary and proportionate such as found in the Charter in case of rights limitation;
      • Concerning the ignorance of the right to privacy and the right to personal data protection: the litigious proposals are a disproportionate infringement of the the right to privacy and to protection to personal data. This is against the articles 7, 8 and 52 of the Charter but also against the jurisprudence of the European Court of Justice (CJUE, 8 April 2014, Digital Rights Ireland, C-293/12 et C-594/12).
      • Considering the disproportionate intervention: the article 52 of the Charter of Fundamental Rights of the European Union requires legal warranties to ensure the proportionality of the intervention. But the guaranties given by the litigious proposals are not sufficient, for example concerning the purposes justifying the intervention or the type of intelligence techniques or the retention of the data. Other proposals add to the disproportionate aspect of the decree. It is the case for the absence of a effective control by an independent authority;
      • Moreover, a number of proposals of the decree question the article 47 of the Charter of Fundamental Rights which guarantees the right to an effective legal redress and the access to an impartial court. It is the case for:
        • the limitation of the access to data in a judicial context (article 41 of Law 78-17 of 6 January 1978)
        • the absence of judicial appeal regarding international surveillance
        • the absence of guarantees around the access of to transmitted data by foreign services
        • the absence of procedure to guarantee the access of the claimant to classified information
      • Also, the obligation for operators to implement an automated processing of data is contrary to the 2000/31/EC directive (called eCommerce);
      • Finally, the questioned measures are contrary to the article 8 and 31 of the European Convention of Human Rights in:
        • they don't guarantee the effective possibility for contest retrospectively intelligence gathering techniques;
        • they don't foresee any procedure destined to compensate effectively and sufficiently the absence of any notification a posteriori

Read the initiating essay published on 11 March 2016.

Read the complementary essay published 6 May 2016.

Call for repeal

On August 5, a call for repeal of Decree No. 2016-67 of the Intelligence on real-time data gathering were sent by Spinosi & Sureau SCP, representing the three organisations (French Data Network, Fédération FDN and La Quadrature du Net). This decree were amended by the law No. 2016-987 of 21 July 2016 extending the application of the law No. 55-385 of 3 April 1955 on state of emergency and related measures to strengthen the fight against terrorism and it thus allows real-time data collection from any person "who may be linked to a threat". Failure to respond within two months is an implicit rejection of our call for repeal from the Government.

Back to the Constitutional Council? (surprise!)

Status: ongoing

  • On 22 July 2016, the Council of State decided to refer this priority question of constitutionality to the Consitutional Council, judging that the issues raised were "new" and "serious".
  • The hearing at the Consitutional Council is plan on 11 October at 9.30 am

On 6 May 2016 a priority question of constitutionality was raised following the appeals lodged against 4 of the 5 aforementioned decrees:

The latest has already judged the constitutionality of the surveillance law but it turns out that Article 20 of the Act of 1991 slipped into the new laws by becoming Article L811-5 of the Code of Interior Security. Now this article states that in the case of "defending national interests," the communications going "through radio waves" are, by law, excluded from the control procedures established by the Surveillance Law.

For a start, the notion of "wireless communications" 5 might not be clear for everybody, and it is useful to provide a few examples. It might concern, for instance, all information sent:

  • between a mobile phone and its relay antenna (GSM/3G/4G);
  • between a WiFi hotspot and a computer, smartphone or tablet;
  • by a laptop using a 3G or 4G dongle;
  • between two Bluetooth devices (wireless microphones, etc);
  • between a cordless phone and its station;
  • between two ham radio practitioners or two walkie-talkies, etc.;
  • by users of Satellite, WiMax, WiFi etc.;
  • between an instant pay card and its station;
  • by a GPS beacon;
  • between an NFC chip (which you find in credit cards, or various other cards) and the reader.


The QPC is based not only on the constitutional principle of respect of privacy but also in two recent decisions of the Constitutional Council:

  • In the surveillance law: following referrals by 60 MPs, the President of the Republic and the President of the Senate in June 2016, provisions for international surveillance were censored, they do not sufficiently regulated.
  • In the Law on State of Emergency: the referral by the League of Human Rights (LDH) to the Constitutional Council who decided to censor the part on computer seizing during the house raids due to inadequate legal safeguards in particular regarding the data collected.

Terrorism Law: No Brake Dereferencing

The decree on the implementation of the Terrorism Law on dereferencing websites

Status: rejected - The hearing at the Council of State took place on 1st February 2016 - The decision were released on 15 February.

The decree on the implementation of the Terrorism Law was published on 4 march 2015. It allows the dereferencing of websites provoking to terrorist acts or supporting them and websites publishing pedopornographic images. LQDN, FDN and FFDN submitted an appeal for annulment to the State Council at the end of April 2015. The particular points attacked are:

  • External legality
    • damage to freedom of communication not foreseen by the law
    • the lack of an impact study prior to the decree
  • Internal legality
    • the decree violates the balance of powers
    • the decree is neither clear nor intelligible
    • there are alternative and more proportionate measures to dereferencing
    • the lack of judicial oversight violates fundamental rights
    • the law and the decree do not contain sufficient guaranties to avoid abuses
    • the a posteriori legal remedies are ineffective
    • supervision of the measures by a qualified staff of the CNIL[1] is ineffective

Read the initiating essay of 29 April 2015.

Read reply published on 24 October 2015.

Read the deliberate note published on 2 February 2016.

Read the decision of the French Council of State.

Terrorism Law and LOPPSI : blocking administrative blocking

Implementation decrees of the LOPPSI and the Terrorism Law on administrative blocking of websites

Two procedures have been implemented against this decree.

Legal actions before the French Council of State

Statut : rejeté - Une audience au Conseil d'État a eu lieu le 1er février 2016 - La décision a été rendue le 15 février à 14h

The decree on the implementation of the LOPPSI and the Terrorism Laws allow the administrative blockade of website was published on the 5th February 2015. LQDN, FDN, and FFDN have filed an annulment appeal before the French Council of State in April 2015. This appeal focuses on:

  • External legality
    • infringement of freedom of communication not provided by law
    • infringement of secrecy of correspondences not provided by law
    • the absence of impact study
    • the absence of decree allowing the process of personal data by the administration
  • Internal legality
    • the decree is infringing the balance of powers
    • the decree is nor clear nor intelligible
    • blocking websites is an disproportionate infringement of freedom of speech
    • the absence of jurisdictional control is infringing fundamental rights
    • the interception of communications towards blocked websites is unlawful

For explanations see:

Read the initiating application of 31 March 2015.

Read the reply published on 24 October 2015.

Read deliberate note published on 2 February 2016.

Read the essay from the voluntary intervention from Article 19.

Read the decision of the French Council of State.

Complaints to the CNIL

Status: ongoing

A complaint was filed to the CNIL on the unlawful processing of the connection data from the traffic redirection under the Decree 2015-125.

Read the complaint published on 12 April 2016.


Request for the publication of the list of the electronic addresses aimed by the decree n°2015-125 of 5 February 2015

Status: Rejected

This is a procedure initiated only by La Quadrature du Net. The list of websites blocked by the decree n°2015-125 of 5th February 2015 is not published. La Quadrature du Net has thus sent on 27th August 2015 à letter to the Central Office Fighting against Criminality related to Technologies of Information and Communication (OCLCTIC) in order to request the publication of the addresses that have been administratively blocked.

Read the - Lettre demande OCLCTIC.pdf request sent on 27 August 2015 (fr).

Read the answer received (fr).

Legal action before the European Court of Human Rights

Status: ongoing (waiting for admissibility)

The legal action before the French Council of State has been rejected, thus the claimants NGOs have decided to continue the fight at the European level by starting a new procedure before the ECHR.

Decree implementing article 20 of the French Military Programming Act

The decree on the implementation of article 20 of the French Military Programming Act

The Article 20 of the Military Programming Act (promulgated 13 December 2013) provides for a right to communication broadened to permit administrative bodies (especially the Ministry of Defence, but also the Ministry of the Interior or the Ministry of Finances) to have open access to "information" or "documents" held by hosters passing through telecoms operators or Internet service providers (ISP). The finalities necessary for this communication to be possible, are broad and often imprecise ("national security", "prevention of terrorism", "preserving essential elements of France's economic and scientific potential", etc.).

Two procedures have been initiated against this decree in collaboration of the Spinosi & Sureau SCP office.

Action before the Council of State

Status: rejected - An audience took place at the French Council of State on 27 January 2016 - Decision has been maid public on 12 February 2pm

The implementing decree, published on 26 December 2014, is attacked by LQDN, FDN and FFDN before the French Council of State for the following reasons:

  • External legality
    • The decree does not specify the correct article of the law. The decree must specify an article of law which does not foresee an implementation decree. Therefore it hasn't the competence to do so.
    • It has not been presented to the European Commission.
    • It has not been the subject of an impact study.
  • Internal legality
    • The decree contradicts the decision of the European Union Court of Justice of April 2014 on data retention
    • according to the jurisprudence of the European Court of Human Rights (ECHR), an intrusion into private life may be enacted only by a law, and not by a decree
    • The decree broadens the scope of the law by allowing to collect data on people not posting any content on the Internet.
    • The decree allows for a far too great collection, which breaches the need to remain "necessary and proportionate"
    • The decree provides no oversight procedure

For explanations see:

Lire la requête introductive du 18 février 2015.

Read the reply published on 22 January 2016.

And finally read the decision of the French Council of State of 12 February 2016.

Priority Preliminary rulings on the issue of constitutionality (QPC)

Status: completed

On 15 April the three associations submitted to the French Council of State an application for a preliminary ruling on the constitutionality of the same implementing decree. This application raises several points:

  • damages to privacy and especially to professional secrecy such as communications between an attorney and a client.
  • damages to freedom of expression and especially the secrecy of sources of journalists
  • the vagueness of the definition of "informations and documents"
  • the vagueness of the definition of "request for production of network information"

See the explanations on FDN blog.

On 5 June, the French State Council decided to forward this application for a preliminary ruling to the French Constitutional Council, judging that the questions raised are indeed "new" and serious. See the LQDN website. The French Constitutional Council had three months to review this question and declare whether the implementing decree is or not conform to the French Constitution. It published its decision on 24 July 2015, rejecting the entirety of the application for a ruling.

See the reaction of LQDN (updated).

Read the Priority Preliminary rulings on the issue of constitutionality and the complementary essay on LQDN website.

Read the reply published on 29 May 2015.

Read the decision of the Council of State published on 5 June 2015.

Read the decision of the Constitutional Council published 24 July 2015.

Legal action before the European Court of Human Rights

Status: ongoing (waiting for admissibility)

The legal action before the French Council of State has been rejected, thus the claimants NGOs have decided to continue the fight at the European level by starting a new procedure before the ECHR.
  1. French Data Protection Watchdog