On 23 July 2015, the French Constitutional Council approved, albeit with minor modifications, the new French Intelligence law (the "Intelligence Law") which enables the use of wide intelligence techniques and creates new obligations for telecom operators, internet access service providers and hosting providers.

Context

After the Intelligence Law was adopted by the French Parliament and Senate on June 24 -- amid fierce debates on the balance between these new provisions and individuals' fundamental democratic rights -- President François Hollande, the President of the Senate as well as over 100 members of the Parliament decided to submit the law to the French Constitutional Council for review.

On 23 July 2015, the French Constitutional Council broadly validated the Intelligence Law, the only substantial provisions stricken out being a provision that would have allowed the interception of communications “sent or received” abroad and a provision that would have allowed intelligence agencies to carry out intelligence operations without any prior authorization from the Prime Minister or his/her delegated official in emergency situations.

The Intelligence Law has thus been published in the Official Journal on 26 July 2015.

However, in practice, the Intelligence Law's full implementation will require that a number of decrees be issued. Most of them will probably be issued by the end of the year but there are no words yet on the timing for the appointment of the President of the new National Commission for the Control of Intelligence Techniques which is also the necessary condition for the implementation of most provisions.

Until such relevant decrees are issued, the existing intelligence framework will continue to apply (until 31 March 2016 at the latest).

Purpose of the Intelligence Law

The Intelligence Law broadly aims at enabling the collection of data, as necessary for the defense and promotion of the following "fundamental interests of the Nation":

  • National independence, territorial integrity and national defense
  • Major interests in foreign policy, performance of France's European and international obligations, prevention of all forms of foreign interference
  • Major French economic, industrial and scientific interests
  • Prevention of terrorism
  • Prevention of harm to the republican institutions, continuance or recreation of groups or associations which have been dissolved, and prevention of collective violence threatening the national security
  • Prevention of organized crime
  • Prevention of the proliferation of weapons of mass destruction

More specifically, the Intelligence Law provides French Intelligence Services (as well as other services from the Defense, Home Office, Economy, Budget and Customs ministries, as identified in a forthcoming Decree) with increased intelligence powers, including tapping phones, reading emails, setting up hidden cameras or microphones in people's homes, cars or other private areas, bugging electronic devices and using IMSI catchers.

While the Intelligence Law sets up an independent advisory group, the National Commission for the Control of Intelligence Techniques (composed of judges, members of Parliament, Senators and a technical advisor), to approve all intelligence operations, its prior control will only consist in issuing recommendations which are not binding.

New set of rules for telecom operators, Internet access service providers and hosting providers

In addition to this increase in individuals' surveillance by the French Intelligence (and other) Services themselves, the Intelligence Law also redefines the role and obligations of the various stakeholders participating to the processing of individuals' data communications, including telecom operators, internet access service providers and hosting providers.

Indeed, the Intelligence Law redefines the whole legal framework relating to the surveillance of individuals, including those rules relating to the retention and disclosure of traffic data as well as the interception of electronic communications.

In particular, those provisions which gave rise to most of the discussions in France, due to their extremely wide reach, are new Article L. 851-2 and L. 851-3 of the Intelligence Law, which respectively provide that, for the purpose of preventing terrorism:

  • Telecom operators (which was already the case under the Military Act that came into force in 2013), but also all those persons / entities enabling individuals to access the Internet (including for free and as an ancillary activity, such as Internet cafés, airports, hotels…) as well hosting providers may be required (for a duration of two months, unless renewed) to allow the authorities to access, in real-time, connection data relating to individuals who have been identified by the intelligence services as posing a threat.
  • Telecom operators, persons / entities allowing individuals to access the Internet (including for free and as an ancillary activity, such as Internet cafés, airports, hotels…) as well hosting providers may be required (for a duration of two months, unless renewed) to install, on their network, automatic processing equipment (so-called "black boxes") which would aim, through the use of algorithms processing connection data, at searching for patterns that may reveal terrorist threats.

In other words, this surveillance operation will not apply to a particular one targeted individual, but all users of the corresponding network.

After analysis of the data collected, the Prime Minister or his/her delegate may request, upon recommendation from the National Commission for the Control of Intelligence Techniques (which is not binding), that the anonymity be lifted whenever the screening operations will have revealed an actual terrorist threat. These data may be retained for a duration of 60 days as from their collection, unless a serious terrorist threat has been confirmed, in which case the data will be retained as long as necessary given the circumstances.

Sanctions

Persons / companies failing to allow members and agents of the National Commission for the Control of Intelligence Techniques to enter their premises where the collections of data are taking place, and operators and providers of electronic communications services failing to communicate to the authorities the information or document requested or willingly providing erroneous information, may be sanctioned for up to two years of imprisonment and 150.000 € in fine (multiplied by five for legal entities).

In addition, persons  / companies participating to the intelligence operations (i.e., including telecom operators, persons / entities allowing individuals to access the Internet and hosting providers) and disclosing the existence and implementation of these operations may be sanctioned for up to one year of imprisonment and 15.000 € in fine (multiplied by five for legal entities).

Finally, the Intelligence Law doubles the fines that may be issued in accordance with the French criminal code, for various hacking operations (e.g., entering or remaining, without authorization, in an information system, hampering the operation of an information system, introducing data into or extracting, copying, transmitting, modifying or deleting data from an information system), in view of the current sensitiveness of cybersecurity nowadays.

Calendar: Many implementing provisions have yet to come in force

Aside from limited provisions which are already in force (e.g., increased criminal sanctions for hacking-related offences), the implementation of most of the provisions of the Intelligence Law will require that a number of implementation decrees be issued.

The French Parliament already announced on its website that most of these implementation decrees will be issued by the end of the year. However, there are no words yet on the date the decree appointing the President of the National Commission for the Control of Intelligence Techniques (which is strictly necessary for most of the substantial provisions of the Intelligence Law to apply) will be issued.

Discussions over this appointment, as well as the creation of the various other decrees, will undoubtly give rise to new debates in France.