Controversial French Surveillance Regulation Should Re-Ignite EU Debate on Surveillance Reform

As has been widely reported in the press, France is moving ahead with new legislation to enable expanded electronic surveillance. As expected, the surveillance bill, the Projet de Loi Relatif au Renseignement, was passed by Members of the French National Assembly by an overwhelming majority on May 5, sparking a fresh round of heated debate.  The legislation will now move to France’s other parliamentary house, the Senate.

The bill is so excessive that we believe it could, and should, lead to a renewed debate on surveillance reform across Europe.

A wide range of French civil society groups, lawyers, and technology industry groups have voiced strong opposition to the bill from its inception. Some have even dubbed the law a French Patriot Act, and the expanded powers found in the legislation would in fact pose a serious threat to human rights in France.  Indeed, the bill is so excessive that we believe it could, and should, lead to a renewed debate on surveillance reform across Europe.   We have long believed that action at the EU level is critical to protecting human rights in the surveillance context, and the French bill shows that this need is more urgent than ever.

According to an analysis by one of the main opponents of the bill, the French digital rights group La Quadrature du Net, the draft bill was introduced by Prime Minister Valls with the ostensible goal of providing a clear legal framework for intelligence gathering that respects fundamental rights. In reality, however, the law expands the scope of permissible electronic surveillance and legalizes a range of highly problematic monitoring techniques that can be extended for potentially indefinite periods and are subject only to relatively weak oversight.  This creates a range of serious civil liberties concerns.

One issue is the widespread use of privacy-invasive surveillance technology. The law would authorize government officials to compel telecommunications service providers to install so-called “black boxes” to monitor the metadata of users’ personal communications for suspicious patterns or behavior, based on automated analysis and algorithms. No judicial review, or judicial warrant, would be required for such surveillance.  Additionally, although the data would initially be analyzed on an anonymous basis (and would not include the content of messages), the authorities would have the power to lift this anonymity for at least some individual users if they believe the patterns show a terrorist threat.  Some experts have already begun to highlight the risk of false positives as well as the technical flaws in the idea of “anonymous” data that can be “de-anonymized”. These practices show that the French interior minister’s claim that the bill is “not aimed at installing generalized surveillance” in France is flat wrong.

Another problem is the broad objectives for which the surveillance techniques foreseen in the bill can be used. The bill uses wording such as “essential foreign policy interests,” “international commitments,” “essential economic or scientific interests,” and “collective violence that could cause serious harm to the public peace.” This is in addition to protecting national security and fighting terrorism and organized crime. With such a vaguely defined and broad scope of application, the surveillance measures authorized by the bill could be brought to bear in a very wide set of contexts and cover large sections of society.

Now would be an excellent time to open a proper European debate on what sort of surveillance may be justified, and what proper oversight of surveillance programs looks like.

Furthermore, the bill creates a set of separate rules on “communications sent or received abroad.” LQDN’s analysis shows that interception, collection, retention, and use of such communications by the intelligence services would not be covered by any of the usual privacy protections found in French law. The rules on this data would be set out in a classified decree to be adopted sometime in the future.

Now would be an excellent time to open a proper European debate on what sort of surveillance may be justified, and what proper oversight of surveillance programs looks like. We are conscious of the limits on the authority of the EU institutions in matters of national security. However, the EU Member States have clear and inescapable obligations under EU law as well as the European Convention on Human Rights to conduct their surveillance activities in strict accordance with privacy and other fundamental rights.   Neither France nor any other Member State can ignore those obligations, including by passing laws as excessive as the one the French Parliament is currently considering.  These pressing issues need to be debated, and any country that overreaches must be held to account.

Thus far, the European Member States have been reluctant to engage in such a debate on their own initiative. Therefore, it would be appropriate for both the European Parliament and the European Commission to take the lead in getting that debate going.