LQDN, FDN and others v. France

On 26 November 2018, Privacy International submitted its legal briefing to the Court of Justice of the European Union on the case of LQDN, FDN and others v. France, concerning the retention of personal data under French law.

In July 2018, the French highest administrative court (the Conseil d’État) decided to send France’s legislation to be considered by the CJEU. This decision follows from two lawsuits started by La Quadrature du Net, the French Data Network, and the Fédération FDN (federation of non-profit Internet access providers), joined by Privacy International and the Centre for Democracy and Technology. Privacy International intervened in February 2016 before the Conseil d’État, along with the Center for Democracy and Technology, in support of the request of French organizations requesting the annulment of the regulatory provisions, in particular, from Decree  No. 2006-358 of 24 March 2006, which allows the indiscriminate retention of personal data, in contravention of applicable EU law.

In the case before the CJEU, Privacy International argues firstly that European law (Article 15 (1) of Directive 2002/58 and the European Charter on Fundamental Human Rights and Freedoms) must be interpreted as precluding national rules providing, for the purpose of ensuring national security, the widespread and indiscriminate retention of all subscriber and user data. Secondly that the EU law must be interpreted as precluding national rules governing the real-time collection of traffic data and the location of specific individuals, without submitting this collection to the prior authorization of a Court or an independent authority. Thirdly that EU law shall be interpreted as precluding national rules governing the collection by national authorities of login data relating to one or more persons, without notifying the persons concerned as soon as the notification is no longer likely to jeopardize investigations carried out by those authorities.

The CJEU decided to hold a joint hearing with two other cases, the case C-623/17 (Privacy International), as well as case C-520/18 (Ordre des barreaux francophones et germanophone and others) from Belgium. On 15 January 2020, the CJEU Advocate General issued his opinion on how he believes the Court should rule and suggested that the French data retention regime is incompatible with EU law.

The CJEU issued its judgment on 6 October 2020 on joint-cases against France and Belgium, while it issued a separate judgment on the UK case. The CJEU, first, ruled that EU law applies every time a national government forces telecommunications providers to process data, including when it is done for the purposes of national security. Second, it concluded that EU law sets out privacy safeguards regarding the collection and retention of data by national governments, which countries such as the UK, France and Belgium must follow. The cases will return to each individual country’s courts for implementation of the judgment.

* Image taken by Katarina Dzurekova, Outside the European Court of Justice

This page also exists in French, here.