Montesquieu, Come Back! (The French Police Already Know Where You Are)

On December 19, 2013, the French Loi de Programmation Militaire (the Military Program law, or "LPM"), was enacted. Article 20 of the LPM, which will come into force on January 1, 2015, authorizes the government to require Internet Service Providers (ISPs) and web hosts to provide "information and documents processed or stored," including geolocation data and metadata in real time, without having to first ask for an authorization from a judge. The new law raises serious questions regarding separation of powers and the extent of administrative authority in France.

A Surveillance Law Both Broad and Vague

Article 20 of the LPM allows the Prime Minister to authorize specially designated agents from the ministers of police, defense, economics and budget to issue demands to ISPs for:

"information or documents processed or preserved by their networks or electronic communications services, including technical data relating to the identification subscription or connection to electronic communications service numbers, identification of all the numbers subscription or connection to a designated person, the location of the terminal equipment used as well as a subscriber's communications on the list of dialed numbers and callers, duration and timing of communications"

The Commission Nationale de l'Informatique et des Libertés (CNIL), France's data protection authority, issued a statement following the enactment of the LPM noting that "information and documents" was so vague a term that "it appears to allow intelligence services to have access to content data, not only connection data." Ironically, the law was purportedly enacted to make surveillance laws more precise, following a 2010 European Court of Human Rights decision, Uzun v. Germany, where the court had warned Member States that "[i]n view of the risk of abuse intrinsic to any system of secret surveillance, such measures must be based on a law that is particularly precise, especially as the technology available for use is continually becoming more sophisticated" (at 61).  

A Not-So-Precise Geolocation Surveillance Law

So how did a law purportedly intended to clarify the use of surveillance technology wind up with such foggy language? When the LPM was first presented to the French Senate in August 2013, the explanatory memorandum about the section that would become article 20 presented it exclusively as an anti-terrorism measure. The memorandum indicated that the section would authorize police in charge of preventing terrorism to access geolocation information and communications metadata in real time. The new provisions were originally intended to become part of a 2006 anti-terrorism law that is currently set to lapse the last day of 2015, and would be limited by the scope of the 2006 law.

But then came the sleight of hand. Senator Jean-Pierre Sueur argued that article 20 of the LPM should not become part of the 2006 law, but instead should become part of an updated general administrative communications interception law. "If geolocation is inserted in Article L.34-1-1, it is confined to anti-terrorist purposes, even though the intelligence services might need it for much broader purposes," explained Senator Sueur. In fact, the senator quoted the ECHR's decision in Uzun to justify this expansion of administrative authority, noting that the Court had found that using a geolocation device "could be acceptable under the right to privacy guaranteed by Article 8 § 1 of the European Convention for the Protection of Human Rights, provided that the law is very specific in its description of the device" (p.47).

Sueur's argument succeeded, and article 20 of the LPM became articles L. 241-1 et seq. of France's Homeland Security Code -- an entirely newchapter VI broadly named “Administrativeaccess to data connection.”

So Much for the Judiciary

The main problem with Senator Sueur’s invocation of Uzun was that he conveniently forgot tomention that Uzun involvedauthorization by a German judge, not the administration, for police to place theGPS device at issue in that case.

In Uzun, a German prosecutor had placed Bernhard Uzun and "S.," one of his presumed accomplices, under surveillance, as they were suspected to have participated in bombing attacks carried out by a terrorist organization. The police had plac