In an April 15, 2016 report, the French Data Protection Authority, the CNIL, provided details about its little-known responsibility as overseer of the French police’s website-blocking powers. The French legislature gave the CNIL this new role in a November 13, 2014 law designed to enhance French police powers against terrorism. The 2014 law increased French police and intelligence agencies’ powers to collect data without a court order. A lesser-known aspect of the November 2014 law is the provision that allows the French police to order ISPs to block websites that either provoke terrorist acts or support (provide an “apologia” or defense for) terrorism. When the French police identify online content that violates these rules, they may order ISPs to block access. The police also have this power with regard to child pornography. Search engines can also be ordered to delist content from search results.
During the debates leading up to the November 2014 law, civil libertarians argued that site blocking decisions should be overseen by a judge. The Ministry of Interior argued that a judge could not handle the volume of cases required and could not act quickly enough to allow speedy blocking. The French legislature compromised, and instead of appointing a judge to oversee the decisions of the French police, decided that the CNIL should do so. The CNIL’s designated overseer, Alexander Linden, published a report of his first year of activity. He noted that the police bureau in charge of making decisions about site blocking had done a good job applying the law and that he had not witnessed any cases of overzealous blocking. Mr. Linden mentioned that the criminal offense of making an “apologia” for terrorism is difficult to evaluate. He pointed out that the publication of shocking images in itself cannot constitute an apologia for terrorism unless the images are accompanied by words to that effect. Mr. Linden said that the identification of child porn is less susceptible to error. It is clear when a child porn violation has occurred.
Civil libertarians challenged all these measures as potentially unconstitutional on the ground that an administrative authority such as the French Ministry of Interior does not have the right unilaterally to block sites. The French Constitutional Council and the Conseil d’Etat disagreed, finding that any publisher who believes that its content was wrongfully blocked may appeal the decision to a court. According to Mr. Linden’s April 2016 report, no such appeal has occurred.
By giving the CNIL an oversight role in site-blocking, the French legislature is in fact giving the CNIL judge-like powers to balance freedom of expression against other fundamental rights such as public security. The concerns of data protection (which is what the CNIL was established to regulate) seem absent from the CNIL’s oversight role for site-blocking. The European Court of Justice’s Costeja decision has also transformed the CNIL into an agency that weighs freedom to access information and individual privacy. The CNIL is becoming an institution that balances fundamental rights beyond privacy — an interesting development, but one that has occurred without a clear legislative roadmap. When fundamental rights are involved, an administrative authority’s powers are usually crafted with care by the legislature, as is required under the case law of the European Court of Human Rights. The CNIL’s powers to enforce data protection are defined by clear statutory rules. Its powers to judge freedom of expression issues currently are not.