On December 19, 2013, the French Loi de Programmation Militaire (the Military Program law, or "LPM"), was enacted. Article 20 of the LPM, which will come into force on January 1, 2015, authorizes the government to require Internet Service Providers (ISPs) and web hosts to provide "information and documents processed or stored," including geolocation data and metadata in real time, without having to first ask for an authorization from a judge. The new law raises serious questions regarding separation of powers and the extent of administrative authority in France.
A Surveillance Law Both Broad and Vague
Article 20 of the LPM allows the Prime Minister to authorize specially designated agents from the ministers of police, defense, economics and budget to issue demands to ISPs for:
"information or documents processed or preserved by their networks or electronic communications services, including technical data relating to the identification subscription or connection to electronic communications service numbers, identification of all the numbers subscription or connection to a designated person, the location of the terminal equipment used as well as a subscriber's communications on the list of dialed numbers and callers, duration and timing of communications"
The Commission Nationale de l'Informatique et des Libertés (CNIL), France's data protection authority, issued a statement following the enactment of the LPM noting that "information and documents" was so vague a term that "it appears to allow intelligence services to have access to content data, not only connection data." Ironically, the law was purportedly enacted to make surveillance laws more precise, following a 2010 European Court of Human Rights decision, Uzun v. Germany, where the court had warned Member States that "[i]n view of the risk of abuse intrinsic to any system of secret surveillance, such measures must be based on a law that is particularly precise, especially as the technology available for use is continually becoming more sophisticated" (at 61).
A Not-So-Precise Geolocation Surveillance Law
So how did a law purportedly intended to clarify the use of surveillance technology wind up with such foggy language? When the LPM was first presented to the French Senate in August 2013, the explanatory memorandum about the section that would become article 20 presented it exclusively as an anti-terrorism measure. The memorandum indicated that the section would authorize police in charge of preventing terrorism to access geolocation information and communications metadata in real time. The new provisions were originally intended to become part of a 2006 anti-terrorism law that is currently set to lapse the last day of 2015, and would be limited by the scope of the 2006 law.
But then came the sleight of hand. Senator Jean-Pierre Sueur argued that article 20 of the LPM should not become part of the 2006 law, but instead should become part of an updated general administrative communications interception law. "If geolocation is inserted in Article L.34-1-1, it is confined to anti-terrorist purposes, even though the intelligence services might need it for much broader purposes," explained Senator Sueur. In fact, the senator quoted the ECHR's decision in Uzun to justify this expansion of administrative authority, noting that the Court had found that using a geolocation device "could be acceptable under the right to privacy guaranteed by Article 8 § 1 of the European Convention for the Protection of Human Rights, provided that the law is very specific in its description of the device" (p.47).
Sueur's argument succeeded, and article 20 of the LPM became articles L. 241-1 et seq. of France's Homeland Security Code -- an entirely new chapter VI broadly named “Administrative access to data connection.”
So Much for the Judiciary
The main problem with Senator Sueur’s invocation of Uzun was that he conveniently forgot to mention that Uzun involved authorization by a German judge, not the administration, for police to place the GPS device at issue in that case.
In Uzun, a German prosecutor had placed Bernhard Uzun and "S.," one of his presumed accomplices, under surveillance, as they were suspected to have participated in bombing attacks carried out by a terrorist organization. The police had placed a GPS device in S.'s car and monitored Uzun and S.'s whereabouts for three months until their arrest. Uzun was subsequently found guilty of having carried out a bomb attack and, on appeal to the ECHR, argued that using a GPS device as a surveillance tool had been an unjustified breach of his privacy, as protected by article 8 of the European Convention for the Protection of Human Rights. But the ECHR held unanimously that there had been no violation, as installing the GPS device had been done in accordance with the law, to pursue the legitimate goal of protecting public safety, and had been a proportionate measure to accomplish this goal.
The fact that Uzun involved judicially authorized surveillance is critical. French law explicitly separates administrative police power, which is exercised preventatively to limit crime and maintain public order, from judicial police power, which is exercised to enforce law and investigate crime. The administrative police power is under the control of the administrative/executive authority, while the judicial police power is under the control of the judicial authority. Only the judicial authority is deemed to be the “guardian of individual freedom” by article 66 of the French Constitution.
So while the ECHR in Uzun had unanimously found no violation of article 8 of the European Convention on Human Rights protecting privacy, it was considering an exercise of judicial police power under the oversight of a judge in the active investigation of a terrorism suspect. It was not a case about administrative police power.
The French Conseil Constitutionnel (Constitutional Council), which is in charge of reviewing the constitutionality of laws, had found in 2006 that it is also permissible for administrative police officers to have access to stored electronic communication data without a warrant, but only when acting to prevent acts of terrorism. The LPM, however, contains no such limitation in its text and, once placed in the Homeland Security Code instead of the 2006 terrorism law, lost any limitation that could have been drawn from context.
The New Process: Collecting Geolocation and Metadata in Real Time Without a Warrant
So now the LPM authorizes the collection of geolocation and metadata in real time without a judicial warrant and not only for terrorist crimes. This is how it works: under the new article L. 246-3 of the Homeland Security Code, the ministers of homeland security, of defense, of economy, and of budget may ask for authorization to have access in real time to the "information and documents" subject to the LPM (the definition of which now appears in article L. 246-1 of the Code). The authorization is not granted by a judge, but by the Prime Minister (who heads the government under article 21 of the French Constitution). The authorization may be granted initially for a maximum time of thirty days, but can be renewed for the same amount of time.
The Prime Minister‘s decision is communicated within forty-eight hours to the President of the Commission Nationale de Contrôle des Interceptions de Sécurité (the National Commission to Control Security Interceptions, or "CNCIS"). The CNCIS was created by a July 10, 1991 law, following the European Court of Justice's condemnation of France in 1990 in two cases, Kruslin v. France and Huvig v. France. These cases noted France's lack of a precise communication surveillance law, holding that since "[t]apping and other forms of interception of telephone conversations represent a serious interference with private life and correspondence [they]... must accordingly be based on a 'law‘ that is particularly precise. It is essential to have clear, detailed rules on the subject, especially as the technology available for use is continually becoming more sophisticated" (Kruslin at 33).
If the President of CNCIS does not believe the legality of the Prime Minister's authorization is "certain," he is to meet with the whole CNCIS, which must make a decision about the legality of such authorization within seven days.
But even forty-eight hours, and possibly seven days more, is quite a long time for potentially illegal surveillance to take place. Also, the control is only a posteriori and is only made by the CNCIS, which is an independent administrative authority, not a judicial authority. Geolocation and metadata surveillance in real time are thus left entirely in the hands of administrative authorities with no judicial oversight.
Is it Constitutional?
This new scheme seems unlikely to fare well with France's Supreme Civil Court, the Cour de Cassation. The day the Senate bill was sent to the Assemblée Nationale, France's lower chamber, the Cour de Cassation ruled in two geolocation cases. The court quoted, in full, article 8 of the European Convention of Human Rights, and concluded that "geolocation technology constitutes an interference with privacy of such gravity that this requires it to be executed under the supervision of a judge."
Therefore, there is a real chance that the LPM will eventually be declared unconstitutional. In fact, opponents to the LPM tried to have the law found unconstitutional by the Conseil Constitutionnel before its enactment, but could not gather the signatures of sixty Representatives or sixty Senators necessary to petition the Conseil Constitutionnel. The LPM may now only be declared unconstitutional if a party to a lawsuit argues that the LPM infringes on her rights and freedoms as guaranteed by the Constitution. If the conditions of admissibility would be met, the Cour de Cassation would refer the question of constitutionality of the LPM to the Conseil Constitutionnel, which could then repeal the law.
Conclusion
Even though the LPM had been presented as the law which would put France in compliance with Uzun, Christine Taubira, the Minister of Justice, announced on December 23 that the government had presented another geolocation surveillance law to the Senate intended "to bring French law into conformity with the requirements laid down by the European Court of Human Rights in its Uzun v. Germany judgment ... and the October 22, 2013 decisions of the Court of Cassation."
The French Senate adopted this bill on January 20, and it will be debated at the lower Assembly next month. It adds a new article to the French criminal procedure code which would authorize the police to put in place geolocation surveillance without requesting a warrant, if investigating a crime punishable by at least five years imprisonment, or at least three years imprisonment for crimes against property.
Hopefully, the new bill will give France another chance to publicly debate whether it is advisable for a democracy to authorize real time surveillance without judicial oversight. For now, it is hard to believe that France was the home of Montesquieu, who famously wrote in The Spirit of the Laws about the tripartite separation of powers: legislative, judicial and executive.
Marie-Andrée Weiss is a solo attorney admitted in New York, and her admission is pending in France. Her practice focuses on intellectual property, privacy, and social media law. She frequently writes on these topics and on European Union law.
(Image of Charles-Louis de Secondat, Baron de La Brède et de Montesquieu on 1989 200-franc note courtesy of Flickr user Drew XXX pursuant to a Creative Commons CC BY-NC 2.0 license.)
