Cybersecurity and the Rights of the Internet User in France

• Jurisdiction: European Union
• Citation: Vol. 45 No. 3
• Publication year: 2017
• topic: Constitutional Law,Internet, Media and Communications

CYBERSECURITY AND THE RIGHTS OF THE INTERNET USER IN FRANCE

Jennifer Cross^*

[Page 609]

TABLE OF CONTENTS

I. INTRODUCTION ...............................................................................611

II. STATEMENT OF FACTS: HISTORY, MOTIVES, AND CONSEQUENCES ..............................................................................612

A. Motive Behind the Creation of the Loi Relative au Renseignement..........................................................................612
B. Public Backlash........................................................................613
C. French Constitutional Court....................................................614
D. 13/11 Terrorist Attacks in Paris...............................................615
E. European Court of Justice........................................................616

III. STATEMENT OF APPLICABLE LAW: FRENCH LAW AND EUROPEAN UNION LAW ..................................................................617

A. Loi Relative au Renseignement................................................617
B. European Court of Justice........................................................618
C. European Union Charter of Fundamental Rights....................619

1. Article 7 Analysis...............................................................621
2. Article 8 Analysis...............................................................624
3. Margin of Appreciation Analysis.......................................627

IV. DISCUSSION: EUROPEAN COURT OF JUSTICE INQUIRY ...................629

A. Does the French Law Violate Article 7?..................................629

1. Arbitrary use of Surveillance.............................................629
2. Lack of Governmental Transparency.................................631
3. Adequate Safeguards.........................................................632

B. Does the French Law Violate Article 8?.................................. 633

1. Right of Access...................................................................634
2. Specificity........................................................................... 635
3. Independent Authority........................................................ 637

[Page 610]

C. Does the Law Meet any Exceptions ?........................................637
D. Will the Law be Upheld under the Margin of Appreciation Doctrine?..................................................................................641

V. CONCLUSION ...................................................................................643

[Page 611]

I. INTRODUCTION

The rise of technology and its role in acts of terror, specifically the attacks in Paris on November 13, 2015, have reopened a longstanding debate on how state governments should regulate internet usage.¹ As accessibility to technology increases, a complicated question arises: what is the proper method for governments to legislate the balance between national security and personal freedom when it comes to the internet? The French government recently reacted to the killing of political cartoonists with a new law that regulates and collects data on French citizens.² This Note will analyze whether the Loi Relative au Renseignement (Law Concerning Intelligence) infringes on basic rights guaranteed in the European union charter of Fundamental Rights (ECFR), beyond what is permitted under the margin of appreciation doctrine, so as to violate France's requirements under the ECFR.

Part One of this Note will examine the creation, implementation, and potential consequences of the Loi Relative au Renseignement, providing context to better understand the content of this law and how it will affect the lives of people using the internet in France. Part Two will discuss the ECFR and its relevance to the controversy. The most applicable rights to this discussion are an individual's right to private and family life and the right to protection of personal data, found in Articles 7 and 8 of the ECFR.³ As a member of the European union, France is bound by the rules of the community and is subject to the rulings of the European Courts. Part Three will analyze how the European Court of Justice, the highest European Union court, should rule on the validity of this law based on the text of the Articles, jurisprudence, and legislative history of the ECFR. The European Charter of Fundamental Rights establishes all of the fundamental rights protected in the European Union. If the European Commission should decide to bring France to the European Court of Justice, this Note concludes that the court would likely hold that Loi Relative au Renseignement violates France's obligations to Articles 7 and 8 of the Charter.⁴

[Page 612]

II. STATEMENT OF FACTS: HISTORY, MOTIVES, AND CONSEQUENCES

A. Motive Behind the Creation of the Loi Relative au Renseignement

On January 7, 2015, two members of Al-Qaeda entered the office of the satirical newspaper Charlie Hebdo, where they killed twelve people.⁵ The newspaper was targeted because it had published cartoons of the Prophet Muhammad. The incident culminated in a shootout between the Al-Qaeda members and law enforcement. The event shocked the French public.⁶ Three days later, approximately 4 million people in Paris participated in a rally of national unity.⁷ Within two days, the Twitter hashtag #jesuischarlie had been tweeted over 5 million times.⁸ The rally and social media attention the shooting received were seen not only as a way to support the victims' families, but also as a unified message from the French people in support of freedom of speech.

A few months later, in May 2015, a bill entered the French Parliament seeking to regulate and collect data in order to combat terrorism.⁹ This bill was hotly contested by the French public, with some critics referring to it as the "French Patriot Act," a reference to the United States' Patriot Act that was passed in the wake of the 9/11 terrorist attacks.¹⁰ These critics claimed the law would create a police state in France that would rival the government in George Orwell's 1984.¹¹ Despite this criticism, by June 9, 2015, the French National Assembly and Senate passed the Projet de Loi Relative au Renseignment by an overwhelming majority.¹² The law allows the French government to monitor internet usage through complicated algorithms,

[Page 613]

commonly referred to as boites noires, or "black boxes," based on an individual's internet usage.¹³ This kind of technology is new and sophisticated, and therefore there is not a great deal of information available. Further, the details of the algorithm are classified, though internet service providers (ISPs) are required to use these algorithms and make the information readily available to French intelligence services.¹⁴

The law also allows the French government to monitor a person's web searches, e-mails, and mobile phone calls more intrusively than before, without requiring permission from a judge.¹⁵ Some of the more intrusive measures include planting cameras, microphones, and recording keystroke logs.¹⁶ The French Prime Minister bears ultimate responsibility for authorizing these measures. The Prime Minister is required to consult with a new, nine-person body, known as the National Committee of Intelligence Techniques Control, before engaging in these types of surveillance techniques; however, he does not have to follow the Committee's recommendations. The panel is made up of two deputies, two senators, two members of the Couseil d'Etat or State Council, two judges, and an electronic communications expert.¹⁷

B. Public Backlash

Hundreds of people attended protests in France leading up to the passage of this new law.¹⁸ Protesters claimed that the proposed vast unchecked

[Page 614]

powers posed a threat to their civil liberties.¹⁹ Many human rights, internet rights, and civil rights groups joined the protests. One such advocacy group, Quadrature du Net, wrote, "Representatives of the French people have given the Prime Minister the power to undertake massive and limitless surveillance of the population . . . by doing so, they're ensuring the power of the state and the basis of our democratic system are getting ever more distant from one another."²⁰ Today, when so much of an individual's personal and business lives are online, this message resonated with millions of French people, despite the law receiving overwhelming support in the French parliament.

C. French Constitutional Court

The French Conseil Constitutionel, or Constitutional Court, is a body that decides whether a proposed law will go into effect. Cases can come to the Constitutional Court upon recommendation arranged by French officials, including: the President; the Prime Minister; the President of the National Assembly; the President of the Senate; a group of sixty members of the National Assembly; a group of sixty members of the Senate; or in special circumstances, other French courts.²¹ If the Constitutional Court determines that a law violates the Constitution, the decision is binding and cannot be appealed.²² Since the Loi Relative au Renseigment sparked so much controversy, President Francois Hollande submitted it to the Constitutional Court before it was implemented.²³ The Constitutional Court upheld the law on July 16, 2015, and it subsequently went into effect.²⁴ However, the Court did hold two aspects of the law unconstitutional: first, the provision allowing surveillance by French intelligence services abroad; and second, the provision allowing authorities to bypass the Prime Minister and the National Committee of Intelligence Techniques Control in "emergency" situations.²⁵ The Constitutional Court was concerned that what qualified as an "emergency" situation was not defined and could potentially result in

[Page 615]

executive abuse. The French Constitutional Court upheld the rest of the law, including both the mass collection of metadata and the utilization of the law without the permission...