Legal Actions Before the French Council of State and Constitutional Council

De La Quadrature du Net
Aller à la navigationAller à la recherche
Autres langues :
English • ‎français

Paris, 3 August 2015 — Since January 2015, La Quadrature du Net, FDN and the FDN Federation have begun a series of legal actions before the French Council of State and the French Constitutional Council against the laws and the implementing decrees that these associations consider fatal to civil liberties. In order to help people to follow over time the different stages of these procedures, this page explains in a few lines each of these appeals and their progress.

All the texts of the legal actions are available on the website of the Éxégètes amateurs. This nickname was given by Minister of Defence Jean-Jacques Urvoas during the debates at the French National Assembly during the French Surveillance Law.

Sommaire

Non published implementation decree on the activities of the Directorate-General for External Security (DGSE)

Non published decree on the activities of the French Exterior Intelligence Services (DGSE)

Two parallel procedures have been initiated against this decree unravelled by an article in the French magazine L'Obs (fr) in July 2015. This unpublished decree that remained secret, authorises the massive tapping by the French foreign intelligence services of Internet communications going to or coming from French territory.

This legal action was prepared in collaboration of Spinosi & Sureau SCP.

Suspensive judgement

Status: rejected

This emergency procedure aims at asking the immediate suspension of the decree waiting for the judgement as a matter of law. Read the brief (fr).

Read the text.

This brief was rejected in an ruling issued on 9th September 2015 (fr) signed by Bernard Stirn, president of the litigation division of the French Council of State before having hold a contradictory hearing. In this very political decision, the judge does not consider the emergency of the plea.

Action for annulment before the Council of State

Status: in progress

The legal challenge focuses on two main points:

  • External legality: the decree is vitiated by a lack of jurisdiction and was adopted in an irregular procedure;
  • Internal legality: the decree has no legal basis. The surveillance law adopted in July 2015 should have given the decree a legal basis but the provisions on international surveillance have been censored by the French Constitutional Council.

Read the judgement as a matter of law.

Read the essay of 30 November 2015.

Read the essay answering the statement of defence of the Ministry of Defence.

1.3 Legal actions from other organisations

2. Decree on the retention and the communication of data allowing to identify any person having contributed to the creation of online content

Decree on the conservation and the communication of data allowing to identify any person that contributed to the creation of an online content.

Status: in progress

Following the decision of the EUCJ of April 2014 "Digital Rights" condemning the massive retention of personal data, LQDN, FDN and FFDN have submitted to the French government a request to repeal the decree n°2011-219 of 25 February 2011 and the article R. 10-13 of the Postal and Electronic Communications Code. Those provisions define the data to be retained by the Internet Service Providers (ISPs), in order to allow the identification of the people having contributed to the creation of online content. They also authorise the operators of electronic communication to delay for a year the erasure of some technical data of their clients. The absence of answer from the government during two months is considered as an implicit refusal to repeal those dispositions, which is leading the three associations to refer directly to the French Council of State. The legal challenges focus on the unconventionality of the general and undifferentiated retention of "technical data" and more especially:

  • The massive interference with fundamental rights, more especially the right to privacy;
  • The impossible limitation to the bare necessities of massive data retention;

On 4 May 2016, French Prime Minister and Ministry of Justice received a formal notice - in other words, it means they have been asked - to publish their observations and to answer to the initial query.

Following the silence of the French Government on the complementary essay transmitted on the 17 May 2016 to the French Council of State in order to present the complementary observations regarding the applicability of the European Charter of Fundamental Rights to the litigious provisions.

Read the brief (fr).

Read the initiating application published on 1st September 2015.

Read the complementary essay published on 27 November 2015.

Read the third party intervention of International and CDT.

Read the complementary essay on the applicability of the Charter published on 17 May 2015.

3. Parliamentary referral and the "narrow door" procedure on the surveillance law

3.1 Queue before the "narrow door"

Status: completed

MP's referral procedures on the Surveillance Law

Status: finished. The French Constitutional Council published its decision on 23 July 2015.

The surveillance law authorizes bulk collection of data, a very broad field of application, the bypass of the judicial judge, and very weak oversight by the National Commission for Oversight of Surveillance Techniques (CNCTR), even non-existent for international surveillance. The French Constitutional Council has been forced to rule on a great number of questions through parliamentary and presidential referrals :

Some organizations have sent their own observations using the "narrow door" procedure. Here are several amicus briefs we have been able to identify:

Following the adoption of the French Surveillance Law, a number of legal actions have been initiated:

Verification request at the CNCTR

Letter to the CNCRT

Satus: finished

A letter was sent to the CNCTR in order to verify if surveillance measure were put in place against a specific person. The letter was not published because it contained numerous personal data.

Legal action before the French Council of State

Status: ongoing

Follow-up to the letter sent to the CNCTR, a legal action before the French Council of State was initiated.

  • External legality
    • Default notification on implemented measures
  • Internal legality
    • Unconstitutionality of interception carried out by the DGSE (French Foreign Intelligence Services)

Read the initiating application.

3.2 Decree on the designation of the specialised intelligence services

Those legal actions are prepared in collaboration with Spinosi & Sureau SCP.

Decree on the legalisation of specialised Intelligence services

Decree 2015-1185 of 28 September 2015 on the designation of the specialised intelligence services.

Status: in progress

The law of 24 July 2015 on intelligence allows French intelligence services to use highly intrusive surveillance techniques on the sole authority of the Prime Minister and a simple consultation of the national intelligence oversight technical Commission (CNCTR). But a decree designated the services, other than the intelligence ones, whose agents can resort to surveillance techniques. This decree is challenged:

  • External legality
    • The final published version of the text doesn't correspond to the version submitted to the Council of State.
  • Internal legality
    • The decree doesn't have legal basis: it doesn't respond to the exigences of justification and proportionality regarding the Charter of Fundamental Right of the European Union and the European Convention on Human Rights.

The list of services other than intelligence services having access to intelligence techniques is on this page (fr).

Read the initiating application published on 30 November 2015.

Read the complementary essay published on 29 February 2016.

Read the complementary observations published on 6 May 2016.


3.3 Decree on the organisation of the CNCTR

Decree 2015-1186 of 29 September 2015 relating to the administrative and financial organisation of the National Commission of Control of Intelligence Techniques (CNCTR).

Status: in progress

The intelligence techniques must be implemented by the intelligence services authorised by the Prime Minister, after simple notice of CNCTR. In cases of absolute urgency, this notice is not required. The decree on the organisation of the CNCTR is attacked on the following:

  • External legality
    • The final version published of the text does not match the version submitted for an opinion to the French Council of State
  • Internal Legality
    • The decree is devoid of legal basis: It was taken on the basis of provisions of the law on intelligence that does not meet the requirements of justification and proportionality from the Charter of Fundamental Rights of the European Union, of the Directive 2002/58/EC of 12 July 2008 concerning the processing of personal data, and the European Convention on Human Rights.

Read the initiating application published on 30 November 2015.

Read the complementary essay published on 29 February 2016.

Read the complementary observations published on 6 May 2016.


3.4 Decree on the litigation and the files on State security

2015-1211 Decree of 1 October 2015 on litigation implementing intelligence techniques that require authorisation and files on the State security.

Status: in progress

The decree brings the proceedings concerning the implementation of intelligence techniques and the access to files on the State security. In particular, it determines the methods and limits for appeals before the Council of State by any person wishing to verify that no intelligence technique is improperly implemented against him or her. It is attacked on the following basis:

  • External legality
    • The final published text does not match the version submitted for an opinion to the State Council
  • Internal Legality
    • The decree is devoid of legal basis: It was taken on the basis of provisions of the law on intelligence that does not meet the requirements of justification and proportionality, look at the Charter of Fundamental Rights of the European Union of Directive 2002/58 / EC of 12 July 2008 concerning the processing of personal data, and the European Convention on human Rights.
  • Internal legality
    • The decree lacks of legal basis: it has been written considering the proposals of the Surveillance Law that are against to the Charter of Fundamental Rights of the European Union, to the 2002/58/CE directive of the 12 July 2008 on the processing of personal data, and against the Convention for the Protection of Human Rights

and Fundamental Freedoms. Hereunder some extracts from the points raised in the complementary observation sent to the Council of State on the 6 May 2016.

      • Litigious proposals constitute a limitation to the principle of confidentiality, of deletion and anonymization of those data according to European Law;
      • The Intelligence techniques tabled constitute an intrusion in privacy and thus a disproportionate violation in views of rights guaranteed by the article 7 and 8 of the Charter;
      • The absence of a legal framework for the conditions of access of data collected in application of the techniques constitute an disporportionate violation, the opposite of the articles 7, 8 and 52 of the Charter;
      • Excessive and disproportionate nature of the data retention periods is contrary to the jurisprudence of the Court of Justice of the European Union (ECJ, October 6, 2015, Maximillian Schrems, C-362/14, § 92);
      • The contested provisions also violate the right to an effective appeal and the right to a fair trial as guaranteed by the Charter;
      • Those concerned with the collection and exploitation of information provided by foreign services have no legal remedy to challenge its validity. This lack of safeguards surrounding the access to data transmitted by foreign service is interfering with the right to an effective appeal and is contrary to the requirements of Article 47 of the Charter of Fundamental Rights;
      • The obligation for operators to set up an automated data processing is contrary to Directive 2000/31/EC on electronic trade.

Read the initiating application published on 30 November 2015/

Read the essay published on 29 February 2016.

Read the complementary observations published on 6 May 2016.

Decree on the designation of services other than Intelligence specialised services

The Decree 2015-1639 of 11 December 2015 on the designation of the services other than specialised intelligence services, authorised to use the techniques mentioned in title V of book VIII of the code of Internal security, applied by to Article L. 811-4 of the code of Internal security.

Status: ongoing

This action was initiated by the NGO Igwan.net, member of the FDN Federation.

The decree determines the services in Defence and Interior Ministry who may be authorised to use the intelligence techniques (covered by Title V of Book VIII of the code of Internal Security), implementing the entire legal architecture in the code of Internal Security, as created by:

  • Law No. 2015-912 of 24 July 2015, the Surveillance Law;
  • And by Law No. 2015-1556 of 30 November 2015 on surveillance measures of international electronic communications.


This decree was attacked on the following points:

  • External legality:
    • The final text published does not match the version submitted for review to the Council of State. Hence the decree is marred by incompetence and was adopted in an irregular procedure.
  • Internal legality
    • The decree has no legal basis and is marred by an error of law.
      • The disputed provisions of the contested decree infringe the Constitution insofar as they do not take into account the transmissions via radio waves and therefore does not determine if intelligence services are likely to use wireless monitoring techniques (see QPC filed about it).
      • In addition, by allowing the administration the collection of data referred to, the attacked provisions constitute a limitation to the principles of confidentiality, erasure and anonymization of the data as provided by the law of the European Union (Directive 2002/58/EC, known as "ePrivacy"). It aimed "to ensure full respect for the rights set out in Articles 7 and 8" of the Charter of fundamental rights, the provisions of contested decrees are contrary to that same charter.

Read the initiating application published on 11 March 2015.

Read the complementary essay published on 6 May 2016.

Decree on Intelligence collection techniques

Decree 2016-67 published 29 January 2016 on Intelligence collection techniques.

Status: ongoing

The decree sets the missions of the GIC (Inter-ministry control group) the connection data that may be collected, the conditions of access to the connection data, the modalities of financial compensation of the obligations charged to electronic communications operators and finally the procedures applicable to actions brought by the CNCTR before the Council of State on international electronic communications surveillance. This decree was attacked on the following basis:

  • External Legality
    • The decree was adopted following an irregular procedure where the final published text does not match the version submitted for review to the Council of State
  • Internal Legality
    • The decree lacks of legal basis: It was taken on the basis of provisions of the Surveillance Law that are contrary to the Constitution, the Charter of Fundamental Rights of the European Union, to Directive 2002/58/EC of 12 July 2008 concerning the processing of personal data, and the European Convention on Human rights.

1. Ignorance of the Constitution: The GIC authorised to carry out all intelligence techniques without exception, the process of "monitoring and control of transmissions through radio waves." But under the provisions of Article L. 811-5 of the Code of internal security, like an intervention of the GIC - which notably involves the collection and retention of informations - will not subject to any legal framework and this against all constitutional requirements.

2. ignorance of the Charter of Fundamental Rights: The contested provisions, allowing the administration the collection of data, constitute a limitation to the principles of confidentiality, erasure and anonymization of the data as provided by Directive 2002/58/EC (called ePrivacy) and do not meet the need for proportionality as stated in the Charter in case of limitation of rights.

3. Concerning the breach of the right to privacy and the right to protection of personal data: The contested provisions bear a disproportionate infringement of the rights for privacy and protection of personal data. This is contrary to Articles 7, 8 and 52 of the Charter but also to the jurisprudence of the Court of Justice of the European Union (ECJ, April 8, 2014, Digital Rights Ireland, C-293/12 and C-594/12).

4. Concerning the disproportionate interferences: article 52 of the Charter of Fundamental Rights of the European Union requires legal safeguards to ensure the proportionality of the interferences. But the guarantees provided by the litigious provisions are not sufficient, for example regarding the aims which might justify the interference or types of information technology or the data retention periods. Other provisions demonstrate the disproportionate nature of the decree. This is the case for example of the lack of effective control by an independent authority.

5. Moreover, many provisions of the decree are contrary to Article 47 of the Charter of Fundamental Rights which guarantees the right to an effective appeal and access to an impartial tribunal. This is the case especially because: - Limitations on access to data within the judicial framework (Article 41 of Law No. 78-17 of 6 January 1978) - The lack of judicial appeal for international surveillance - The lack of safeguards concerning the access of data transmitted by foreign services - The lack of guarantees the applicant's access to parts protected by the secret defence

6. Furthermore the requirement for operators to set up an automated data processing is contrary to Directive 2000/31/EC on electronic trade.

7. Finally, the provisions attacked are contrary to Articles 8 and 13 of the European Convention on Human Rights, where: - They do not guarantee an effective possibility to challenge retrospectively implemented intelligence techniques. - They do not provide any mechanism to effectively and sufficiently balance the absence of any prior notification.

Read the initiating essay published on 11 March 2016.

Read the complementary essay published 6 May 2016.

Back to the Constitutional Council? (surprise!)

Status: ongoing

On 6 May 2016 a priority question of constitutionality was raised following the appeals lodged against 4 of the 5 aforementioned decrees:


It will first go before the Council of State, who will forward if it complies to the Constitutional Council.

The latest has already judged the constitutionality of the surveillance law but it turns out that Article 20 of the Act of 1991 slipped into the new laws by becoming Article L811-5 of the Code of Interior Security. Now this article states that in the case of "defending national interests," the communications going "through radio waves" are, by law, excluded from the control procedures established by the Surveillance Law.

For a start, the notion of "wireless communications" 5 might not be clear for everybody, and it is useful to provide a few examples. It might concern, for instance, all information sent:

  • between a mobile phone and its relay antenna (GSM/3G/4G);
  • between a WiFi hotspot and a computer, smartphone or tablet;
  • by a laptop using a 3G or 4G dongle;
  • between two Bluetooth devices (wireless microphones, etc);
  • between a cordless phone and its station;
  • between two ham radio practitioners or two walkie-talkies, etc.;
  • by users of Satellite, WiMax, WiFi etc.;
  • between an instant pay card and its station;
  • by a GPS beacon;
  • between an NFC chip (which you find in credit cards, or various other cards) and the reader.


The QPC is based not only on the constitutional principle of respect of privacy but also in two recent decisions of the Constitutional Council:

  • In the surveillance law: following referrals by 60 MPs, the President of the Republic and the President of the Senate in June 2016, provisions for international surveillance were censored, they do not sufficiently regulated.
  • In the Law on State of Emergency: the referral by the League of Human Rights (LDH) to the Constitutional Council who decided to censor the part on computer seizing during the house raids due to inadequate legal safeguards in particular regarding the data collected.


4. Terrorism Law: No Brake Dereferencing

The decree on the implementation of the Terrorism Law on dereferencing websites

Status: rejected

The decree on the implementation of the Terrorism Law was published on 4 march 2015. It allows the dereferencing of websites provoking to terrorist acts or supporting them and websites publishing pedopornographic images. LQDN, FDN and FFDN submitted an appeal for annulment to the State Council at the end of April 2015. The particular points attacked are:

  • External legality
    • damage to freedom of communication not foreseen by the law
    • the lack of an impact study prior to the decree
  • Internal legality
    • the decree violates the balance of powers
    • the decree is neither clear nor intelligible
    • there are alternative and more proportionate measures to dereferencing
    • the lack of judicial oversight violates fundamental rights
    • the law and the decree do not contain sufficient guaranties to avoid abuses
    • the a posteriori legal remedies are ineffective
    • supervision of the measures by a qualified staff of the CNIL[1] is ineffective

This essay has not been published yet

Read reply published on 24 October 2015.

Read the deliberate note published on 2 February 2016.

Read the decision of the French Council of State.

5. The decree on the implementation of article 20 of the French Military Programming Act

The decree on the implementation of article 20 of the French Military Programming Act

Two procedures have been implemented against this decree.

5.1. Action before the French Council of State

Status: rejected

The decree on the implementation of the LOPPSI and the Terrorism Laws allow the administrative blockade of website was published on the 5th February 2015. LQDN, FDN, and FFDN have filed an annulment appeal before the French Council of State in April 2015. This appeal focuses on:

  • External legality
    • infringement of freedom of communication not provided by law
    • infringement of secrecy of correspondences not provided by law
    • the absence of impact study
    • the absence of decree allowing the process of personal data by the administration
  • Internal legality
    • the decree is infringing the balance of powers
    • the decree is nor clear nor intelligible
    • blocking websites is an disproportionate infringement of freedom of speech
    • the absence of jurisdictional control is infringing fundamental rights
    • the interception of communications towards blocked websites is unlawful

For explanations see:

Read the appeal (fr) filed and the amicus brief (fr) filed by Article 19.

Read the reply published on 24 October 2015.

Read deliberate note published on 2 February 2016.

Read the essay from the voluntary intervention from Article 19.

Read the decision of the French Council of State.

Complaints to the CNIL

Status: ongoing

A complaint was filed to the CNIL on the unlawful processing of the connection data from the traffic redirection under the Decree 2015-125.

Read the complaint published on 12 April 2016.


5.2 Request for the publication of the list of the electronic addresses aimed by the decree n°2015-125 of 5 February 2015

Status: Rejected

This is a procedure initiated only by La Quadrature du Net. The list of websites blocked by the decree n°2015-125 of 5th February 2015 is not published. La Quadrature du Net has thus sent on 27th August 2015 à letter to the Central Office Fighting against Criminality related to Technologies of Information and Communication (OCLCTIC) in order to request the publication of the addresses that have been administratively blocked. Read the - Lettre demande OCLCTIC.pdf letter (fr).

Read the - Lettre demande OCLCTIC.pdf request we have sent (fr).

Read the answer received (fr).

6. Decree implementing article 20 of the French Military Programming Act

The decree on the implementation of article 20 of the French Military Programming Act

The Article 20 of the Military Programming Act (promulgated 13 December 2013) provides for a right to communication broadened to permit administrative bodies (especially the Ministry of Defence, but also the Ministry of the Interior or the Ministry of Finances) to have open access to "information" or "documents" held by hosters passing through telecoms operators or Internet service providers (ISP). The finalities necessary for this communication to be possible, are broad and often imprecise ("national security", "prevention of terrorism", "preserving essential elements of France's economic and scientific potential", etc.).

Two procedures have been initiated against this decree.

6.1. Action before the Council of State

Status: in progress - An audience is scheduled at the French Council of State the 27 January 2016 - Decision awaited for 12 February 4pm

The implementing decree, published on 26 December 2014, is attacked by LQDN, FDN and FFDN before the French Council of State for the following reasons:

  • External legality
    • The decree does not specify the correct article of the law. The decree must specify an article of law which does not foresee an implementation decree. Therefore it hasn't the competence to do so.
    • It has not been presented to the European Commission.
    • It has not been the subject of an impact study.
  • Internal legality
    • The decree contradicts the decision of the European Union Court of Justice of April 2014 on data retention
    • according to the jurisprudence of the European Court of Human Rights (ECHR), an intrusion into private life may be enacted only by a law, and not by a decree
    • The decree broadens the scope of the law by allowing to collect data on people not posting any content on the Internet.
    • The decree allows for a far too great collection, which breaches the need to remain "necessary and proportionate"
    • The decree provides no oversight procedure

For explanations see:

And read the essay presented.

Read the reply published on 22 January 2016.

And finally read the decision of the French Council of State.

6.2. Priority Preliminary rulings on the issue of constitutionality (QPC)

Status: completed

On 15 April the three associations submitted to the French Council of State an application for a preliminary ruling on the constitutionality of the same implementing decree. This application raises several points:

  • damages to privacy and especially to professional secrecy such as communications between an attorney and a client.
  • damages to freedom of expression and especially the secrecy of sources of journalists
  • the vagueness of the definition of "informations and documents"
  • the vagueness of the definition of "request for production of network information"

See the explanations on FDN blog.

On 5 June, the French State Council decided to forward this application for a preliminary ruling to the French Constitutional Council, judging that the questions raised are indeed "new" and serious. See the LQDN website.

The French Constitutional Council had three months to review this question and declare whether the implementing decree is or not conform to the French Constitution. It published its decision on 24 July 2015, rejecting the entirety of the application for a ruling.

See LQDN's reaction.

Read the QPC and the complementary essay on LQDN website

On 5 June, the French State Council decided to forward this application for a preliminary ruling to the French Constitutional Council, judging that the questions raised are indeed "new" and serious. See the LQDN website. The French Constitutional Council had three months to review this question and declare whether the implementing decree is or not conform to the French Constitution. It published its decision on 24 July 2015, rejecting the entirety of the application for a ruling.

See the reaction of LQDN (updated).

Read the Priority Preliminary rulings on the issue of constitutionality and the complementary essay on LQDN website.

Read the reply published on 29 May 2015.

Read the decision of the Council of State published on 5 June 2015.

Read the decision of the Constitutional Council published 24 July 2015.

  1. French Data Protection Watchdog