Criminal Law

custody and password

by Cabinet Roquefeuil | Nov 7, 2022

Updated November 7, 2022

One person was arrested for possession of narcotics. While in custody, she refused to give investigators codes to unlock two phones believed to have been used in drug trafficking.

This person, prosecuted before a criminal court, was not sentenced for having refused to give his telephone unlocking codes; she was released.

Passwords and encryption conventions allow the protection of data, and their disclosure imposed by the authorities can endanger individual freedom and democracy but also allow the repression of crime.

The Constitutional Council, on QPC where La Quadrature du Net intervenes, judges that the incrimination of refusal to communicate a password is not contrary to the Constitution.

Article 434-15-2 of the Penal Code, in its wording resulting from the law of June 3, 2016 provides:

"Is punished by three years' imprisonment and a fine of €270,000 the fact, for anyone having knowledge of the secret convention of deciphering a means of cryptology likely to have been used to prepare, facilitate or commit a crime or an offence, to refuse to submit said agreement to the judicial authorities or to implement it, on the requisitions of these authorities issued pursuant to Titles II and III of Book I of the Code of Criminal Procedure.

"If the refusal is opposed while the delivery or the implementation of the convention would have made it possible to avoid the commission of a crime or an offense or to limit its effects, the penalty is increased to five years of imprisonment and a €450,000 fine.

Article 29 paragraph 1 of the 2004 law for confidence in the digital economy (theoi n° 2004-575 of June 21, 2004 for confidence in the digital economy) provides:

Means of cryptology means any hardware or software designed or modified to transform data, using secret conventions or to perform the opposite operation with or without a secret convention. These cryptology means are mainly aimed at guaranteeing the security of the storage or transmission of data, by making it possible to ensure their confidentiality, their authentication or the control of their integrity.

The Council makes a classic reading of the text, that is to say strict, in application of the principle according to which criminal law is to be interpreted strictly, and deduces from this the constitutionality of the provision (in this case paragraph 1 of the article, the only one concerned).

The prosecution must characterize against the suspected person:

– knowledge of the password or the convention (the person who is required is the one who actually knows the password, and not only the person who is supposed to know, or who could, or should, know…the technical intermediaries as companies relying on their machines to manage and access passwords could justify their refusal by opposing the absence of any natural person (human being) having access to the secret agreement);

– the probability that the means of cryptology has been used for criminal or tortious purposes.

The legal authorities concerned are those which intervene within the framework of the preliminary investigation or of flagrance or the instruction (titles II and III of book I of the code of penal procedure). The request must respond to a formalism (official notification of the consequences of a refusal).

Decision 2018-696 of the Constitutional Council of March 30, 2018.

A simple request for the communication of a password by a police officer investigator therefore does not appear to allow the facts to be qualified. And the refusal to communicate the locking code, a "PIN" (for Personal Identification Number) is not a refusal to communicate an encryption convention. In this sense, moreover, Paris 16 April 2019, n°19/09267.

Conventionality. The Court of Cassation ruled that the offense of refusing to hand over a secret cryptological decryption agreement did not in itself infringe the right to remain silent and not to incriminate oneself arising from Article 6 of the European Convention on human rights (Cas. crime, Dec. 10 2019, No. 18-86.878)

The Court of Cassation indicates that the refusal to deliver the PIN may amount to refusing to deliver the decryption agreement (Crim.13 oct.2020, n°20-80150).

This involves distinguishing between the code allowing access to a terminal (computer, telephone, server, SIM card, etc.) and the key used to decipher the stored or circulating data or metadata.

In some cases the PIN or other secret codes and passwords do not prevent access to data, in others yes, the case law is therefore hesitant (CA Paris 16 April 2019, 18-09.267; Cas. crim., 13 Oct. 2020, no. 20-80.150; Cas. crim., 13 Oct. 2020, n° 19-85.984).

In its judgment of November 7, 2022, the Court of Cassation, plenary assembly, appeal no. K 2183.146, indicates, in its press release:

A " means of cryptology is intended to render information incomprehensible, in order to secure its storage or transmission. A " secret decryption convention allows the clearing of encrypted information. When a mobile phone is equipped with a " means of cryptology », their home screen unlock code may be a " decryption key » if the activation of this code has the effect of clarifying the encrypted data that the device contains or to which it gives access. Therefore, if a mobile phone with these technical characteristics - as is the case with most mobile phones today - is likely to have been used for the preparation or the commission of a crime or offense, its holder, who will have been informed of the penal consequences of a refusal, is required to give the investigators the unlock code for the home screen. If he refuses to communicate this code, he commits the offense of “refusal to deliver a secret decryption agreement ". Therefore, in this case, the decision of the Court of Appeal is quashed and another Court of Appeal is appointed to retry the case.

Supervision of access to data stored by telephone operators

Personal data: the CJEU retains the preponderant interest of official company registers, the communication law lawyer in Paris analyzes

by Cabinet Roquefeuil | Oct 5, 2022

#privacy #personal data #webdirectories #righttoforget: Court of Justice of the European Union – CJEU – Judgment in Case C-398/15 Camera di Commercio, Industria, Artigianato e Agricolturadi Lecce v Salvatore Manni March 9, 2017

In this ruling, the CJEU confirms the informative role of company registers, which, through the information they provide, including personal data, contribute to trade transparency.

Trade and company registers: legitimacy not in question

This position is classic.

Care will be taken to ensure that it does not benefit private directory companies which abound on the Internet, which buy data from official registers, to ensure increased and untimely publication on the Internet, without the prior authorization of professionals and of the companies concerned, for the sole purpose of attracting traffic to the advertisements they display alongside said data, and in their sole interest.

These private directory companies obviously remain condemnable for the unauthorized use of personal data and for the damage that they are likely to cause and that they actually cause for unsolicited “service”. An alleged freedom of expression or business loyalty cannot derive in law from infringing the freedom of enterprise and the choice of its mode of communication.

More generally, however, one can wonder about the need to indicate in these registers certain personal data of the directors. Managers can indeed be “found” by bailiffs without the publication of the manager's personal address being necessary; a simple collection by the registry and disclosure at the request of a bailiff or judge would be less detrimental to the exercise of the right to protection of privacy. At the present time, the interference of the public authority in the exercise of this right seems excessive and could undoubtedly be challenged before the ECHR.

The personal data of the manager of a legal person

Police custody and the right to silence

by Cabinet Roquefeuil | Sep 23, 2022

(Update of 14 February 2023: > On DNA and biometric samples, CJEU judgment 26 Jan. 2023, case C-205/21)

Exercising the right to silence of the person in custody, of the defendant, makes it possible to speed up the management of the case, to ensure better preparation time for the defence, not to produce a confession where there is no yet no proof or that there is nothing else to say.

At a time when the atomization of society makes inter-individual communication more difficult, the exercise of the right to silence by the person in custody allows him to guarantee his right of access to the file, and therefore to better know the charges brought against him. him, and to avoid errors of assessment.

The remark is particularly relevant during police custody in police premises as part of a preliminary investigation or an investigation procedure, procedures which a priori concern cases of a certain complexity.

The lawyer does not have access to the file and does not know the evidence against him

Indeed, in the context of police custody, the person in police custody is informed of his rights and the qualification of the facts with which he is charged, but without any details on the evidence that has been collected.

The lawyer also does not have access to the evidence file and therefore cannot give specific advice to his client.

He can therefore invoke his right to silence and remain silent in front of the investigators, at least as long as his lawyer does not have access to the file, or until he has not had time to have the file studied in depth ( at least for files of a certain complexity).

This right to silence is a constitutional right deriving from the right not to incriminate oneself following coercive measures, and from the right to a fair trial.

The right to silence must be recalled by the investigators themselves.

A constitutional right

The right not to "self-incriminate" is grounded in Article 14.3 of the International Covenant on Civil and Political Rights, as well as in the case law of the European Court of Human Rights (ECHR) on 6 of the Convention (ECHR 25 Feb. 1993, No. 10828/84, Funke v. France) (ECHR 21 Dec. 2000, No. 34720/97, Heaney and McGuinness v. Ireland), and in the European Directive 2012/13/EU relating to the right to information in the context of criminal proceedings, and of course in the code of criminal procedure during the hearing of the suspect placed in police custody (art. 63-1) or heard freely (art. 61-1), during the investigation as regards the indictment (art. 116) or placement under the status of assisted witness (art. 113-4), during the presentation before the prosecutor of the Republic in application of article 393, as well as before the trial courts, in contraventional (art. 535), tort (art. 406) or criminal (art. 32) matters 8), as well as articles 396 (translation of a defendant before the judge of freedoms and detention in the context of an immediate appearance), 199 (appearance of the defendant before the investigating chamber), 148- 2 (hearing of a defendant or an accused within the framework of an application for release from judicial review or release), and 12 of the order of February 2, 1945 (hearing of a minor before the services of the Judicial Protection of Youth). The Constitutional Council sees in this a guarantee of the presumption of innocence provided for in article 9 of the declaration of the rights of man and of the citizen.

Investigators seek confessions

Placement in police custody is only possible if the person incurs a prison sentence.

The suspicion leveled against him is therefore necessarily serious, and the least you can do is for him to have access to the file.

Sometimes the suspect, caught in a Stockholm syndrome, will tend to want to please the investigators, especially if they have a sympathetic and reassuring attitude, in the hope of quickly escaping his misfortune, and even though he is in cell after having been able to undergo a muscular arrest.

He will think that cooperating will be able to release him more quickly from his suffering (custody is stressful), and that it would be unreasonable not to be sympathetic in turn towards the investigators "since he has nothing to reproach".

He will therefore make confessions which are not always appropriate, or even which do not concern the precise subject of the investigation, and may aggravate his case, even though the file of the investigators may be thin or relate to other facts.

It is therefore recommended to follow the advice of your lawyer, and to exercise your right to silence if necessary, even if it means making a declaration of admission of acknowledgment of the facts, then exercising his right to silence.

This can also help to shorten the length of police custody and lengthy stringy hearings (where the suspect speaks but without conviction, and where the investigators stall), at least if the other investigative acts are finished (hearings of the others kept in custody in the event of offenses in meetings, searches, telephone and video exploitation, etc.).

Indeed, these acts may possibly justify the extension of police custody until they are completed.

But investigators may be tempted to extend to sanction, to put pressure.

Police custody, a coercive measure, is subject to legal conditions

Police custody is in all cases only justified under certain conditions, set out in Article 62-2 of the Code of Criminal Procedure:

“Custody is a measure of constraint decided by a judicial police officer, under the control of the judicial authority, by which a person against whom there are one or more plausible reasons to suspect that he has committed or attempted to commit a crime or an offense punishable by imprisonment is kept at the disposal of the investigators.

This measure must be the only way to achieve at least one of the following objectives:

1° Allow the execution of investigations involving the presence or participation of the person;

2° Ensure the presentation of the person before the public prosecutor so that this magistrate can assess the follow-up to be given to the investigation;

3° Prevent the person from modifying the evidence or material evidence;

4° Prevent the person from putting pressure on the witnesses or the victims as well as on their family or relatives;

5° Prevent the person from colluding with other people likely to be his co-authors or accomplices;

6° Guaranteeing the implementation of measures intended to put an end to the crime or misdemeanor.”

On the extension of police custody

Section 63

[…]
II. – The duration of police custody may not exceed twenty-four hours.
However, police custody may be extended for a further period of twenty-four hours at the most, with the written and reasoned authorization of the public prosecutor, if the offense that the person is suspected of having committed or attempted to commit is a crime or misdemeanor punishable by a prison sentence of at least one year and if the extension of the measure is the only way to achieve at least one of the objectives mentioned in 1° to 6° of the article 62-2 […]
The public prosecutor may make his authorization subject to the appearance of the person before him. This presentation can be made by using an audiovisual telecommunication means.
[…]

What happens next? What is the orientation of the file?

Section 395

If the maximum term of imprisonment provided for by law is at least equal to two years, the public prosecutor, when it appears to him that the charges brought together are sufficient and that the case is ready to be judged , may, if he considers that the elements of the case justify an immediate appearance, bring the defendant immediately before the court.

In the event of a flagrant offence, if the maximum term of imprisonment provided for by law is at least equal to six months, the public prosecutor, if he considers that the elements of the case justify an immediate appearance, may bring the immediately charged to court.

The defendant is detained until his appearance, which must take place the same day; he is escorted to court.

An “information” is an investigation procedure carried out by an investigating judge

The rate of opening of investigation procedures (known as “information”) on the procedures for the elucidation of offenses is very low.

The investigation is compulsory only for crimes and can only be opened for misdemeanors for which the penalty incurred is equal to or greater than three years.

Section 137

Any person charged, presumed innocent, remains free.

However, because of the requirements of the investigation or as a security measure, he may be subject to one or more obligations of judicial control or, if these prove to be insufficient, be placed under house arrest with electronic surveillance.

Exceptionally, if the obligations of judicial control or house arrest with electronic monitoring do not allow these objectives to be achieved, she may be placed in pre-trial detention.

Section 143-1

Subject to the provisions of article 137, provisional detention may only be ordered or prolonged in one of the cases listed below:
1° The person charged incurs a criminal penalty;
2° The person under investigation incurs a correctional sentence of a duration equal to or greater than three years' imprisonment.
Pre-trial detention may also be ordered under the conditions provided for in Article 141-2 when the person under investigation voluntarily evades the obligations of judicial review or house arrest with electronic surveillance.

The instruction is supposed to complete the proof and the study of the personalities, in the complex files.

Under what conditions can one assert one's right to silence before the investigating judge? In the context of an investigation procedure, a first appearance interrogation, the exercise of the right to silence, possibly accompanied by a declaration of acknowledgment of the facts, can also make it possible to speed up the processing of the file or to get better defense preparation time.

With regard to an investigation procedure (also called "information"), it is article 144 of the code of criminal procedure which is pleaded before the judge of freedoms and detention, possibly with an incursion on the debate of based on the facts:

“Pre-trial detention may only be ordered or extended if it is demonstrated, in the light of the precise and detailed elements resulting from the procedure, that it constitutes the only means of achieving one or more of the following objectives and that these cannot be achieved in the event of placement under judicial supervision or house arrest with electronic monitoring:

1° Preserve the proofs or material indices which are necessary for the manifestation of the truth;

2° To prevent pressure on witnesses or victims as well as on their families;

3° Prevent fraudulent consultation between the person charged and his co-authors or accomplices;

4° Protect the person under investigation;

5° Ensure that the person under investigation is kept at the disposal of the justice system;

6° Put an end to the infringement or prevent its recurrence;

7° Put an end to the exceptional and persistent disturbance to public order caused by the seriousness of the offence, the circumstances of its commission or the extent of the harm it has caused. This disturbance cannot result from the media repercussions of the affair alone. However, this paragraph is not applicable in correctional matters. »

Section 145

“[…] the liberty and detention judge cannot immediately order detention when the person under investigation or his lawyer requests time to prepare his defence.
In this case, he may, by means of an order reasoned by reference to the provisions of the preceding paragraph and not subject to appeal, prescribe the incarceration of the person for a fixed period which may in no case exceed four days. open. Within this period, he has the person appear again and, whether or not the latter is assisted by a lawyer, proceeds as stated in the sixth paragraph. If he does not order the placement of the person in pre-trial detention, the latter is automatically released.
To enable the investigating judge to carry out checks relating to the personal situation of the accused or to the facts of which he is accused, when these checks are likely to allow the person concerned to be placed under judicial supervision, the judge of freedoms and detention may also decide ex officio to prescribe by reasoned order the provisional imprisonment of the accused for a fixed period which may not exceed four working days until the adversarial hearing is held. In the absence of a debate within this period, the person is automatically released. The order mentioned in this paragraph may be the subject of the appeal provided for in article 187-1. […]”

On data encryption: https://roquefeuil.avocat.fr/les-mots-de-passe-et-le-conseil-constitutionnel-lavocat-en-droit-informatique-analyse/

Update 14 February 2023: On DNA and biometric samples, the CJEU judgment 26 Jan. 2023, Case C-205/21

Article 10 of the Police-Justice Directive (EU) 2016/680 of 27 April 2016 provides:

Article 10

Processing of special categories of personal data

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning the sex life or sexual orientation of a natural person shall be permitted only in case of absolute necessity, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:

a)

where they are permitted under Union law or the law of a Member State;

b)

to protect the vital interests of the data subject or another natural person; or

c)

where the processing relates to data which are manifestly made public by the data subject.

According to the above-mentioned judgment :

The systematic collection of biometric and genetic data from any defendant for the purpose of police registration is contrary to the requirement to ensure greater protection against the processing of sensitive personal data

French law provides for the feeding of several files, which can be checked against this case law; only a few provisions are cited here for reference:

Article 706-56 of the Criminal Procedure Code provides:

II -Refusing to submit to the biological sample provided for in the first paragraph of I is punishable by one year's imprisonment and a fine of 15,000 euros.

The first paragraph of I provides:

I.-The judicial police officer may take a biological sample, or have it taken under his supervision, from the persons mentioned in the first, second or third paragraphs of Article 706-54, in order to analyse their genetic fingerprint. Prior to this operation, he or she may check or have checked by a judicial police officer under his or her control or by a specialised officer, technician or forensic engineer under his or her control, that the genetic fingerprint of the person concerned is not already registered, solely on the basis of his or her civil status, in the national automated genetic fingerprint database.

The first three paragraphs of 706-54 provide:

The automated national DNA database, placed under the control of a magistrate, is intended to centralise the genetic fingerprints from biological traces as well as the genetic fingerprints of persons convicted of one of the offences mentioned in Article 706-55 with a view to facilitating the identification and investigation of the perpetrators of these offences. The genetic fingerprints of persons prosecuted for one of the offences referred to in Article 706-55 who have been found not criminally responsible pursuant to Articles 706-120, 706-125, 706-129, 706-133 or 706-134 shall be stored under the same conditions.

The genetic fingerprints of persons in respect of whom there is serious or corroborating evidence making it likely that they have committed one of the offences referred to in Article 706-55 shall also be kept in this file on the decision of a judicial police officer acting either ex officio or at the request of the public prosecutor or investigating judge; this decision shall be noted in the file of the proceedings.

Judicial police officers may also, on their own initiative or at the request of the public prosecutor or investigating judge, have the fingerprint of any person against whom there are one or more plausible grounds for suspecting that he or she has committed one of the offences referred to in Article 706-55 matched against the data in the file, without, however, the fingerprint being kept in the file.

Finally, 706-55 provides:

The National Automated DNA Database centralises DNA traces and fingerprints relating to the following offences

1° The sexual offences referred to in Article 706-47 of the present Code as well as the offence provided for in Article 222-32 of the Criminal Code and the offences provided for in Articles 222-26-2, 227-22-2 and 227-23-1 of the same Code;

2° Crimes against humanity and crimes and offences of deliberate attacks on human life, torture and acts of barbarism, deliberate violence, threats to harm people, drug trafficking, attacks on personal freedoms, trafficking in human beings, pimping, exploitation of begging and endangering minors, as provided for in Articles 221-1 to 221-5, 222-1 to 222-18, 222-34 to 222-40, 224-1 to 224-8, 225-4-1 to 225-4-4, 225-5 to 225-10, 225-12-1 to 225-12-3, 225-12-5 to 225-12-7 and 227-18 to 227-24 of the Criminal Code, as well as the offences provided for in Articles 221-5-6 and 222-18-4 of the same Code;

3° The crimes and offences of theft, extortion, fraud, destruction, degradation, deterioration and threats of damage to property provided for by articles 311-1 to 311-13, 312-1 to 312-9, 313-2 and 322-1 to 322-14 of the Criminal Code;

4° Attacks on the fundamental interests of the Nation, acts of terrorism, counterfeiting of money, criminal conspiracy and war crimes and misdemeanours provided for in Articles 410-1 to 413-12, 421-1 to 421-6, 442-1 to 442-5, 450-1 and 461-1 to 461-31 of the Criminal Code;

5° The offences provided for in Articles 222-52 to 222-59 of the Criminal Code, Articles L. 2339-2, L. 2339-3, L. 2339-4, L. 2339-4-1, L. 2339-10 to L. 2339-11-2, L. 2353-4 and L. 2353-13 of the Defence Code and Articles L. 317-1-1 to L. 317-9 of the Internal Security Code ;

6° The offences of concealment or laundering of the proceeds of one of the offences mentioned in 1° to 5°, as provided for by Articles 321-1 to 321-7 and 324-1 to 324-6 of the Criminal Code.

Supervision of access to data stored by telephone operators

by Cabinet Roquefeuil | Mar 29, 2022

August 6, 2022 Update

Update of 22 September 2022

Update of 6 January 2023

Update of 15 March 2023

In the context of a preliminary investigation or an investigation of flagrante delicto, the public prosecutor has the possibility of requesting from a judicial police officer the transmission of the telecommunications data of a person concerned by the investigation. , including the suspect. This remedy is provided for by the French code of criminal procedure: article 60-1 and article 77-1-1.

Telecommunications data can be crucial in an investigation and reveal a lot of information to investigators. Whether in terms of geolocation data or traffic data, the information helps to advance a judicial investigation.

However, this mechanism could be severely limited following a judgment delivered by the Court of Justice of the European Union on March 2, 2021. This follows a case in Estonia but could nevertheless impact the French procedure.

Do you want to know your rights and obligations with regard to the retention of data by a telephone operator? Pierre de Roquefeuil, a lawyer specializing in information technology law in Paris, supports you to advise you and to ensure that your interests are respected. The specialized lawyer will help you to identify the procedure adapted to your situation.

In which cases can the device for accessing data stored by telephone operators be used?

French law requires telephone operators to retain metadata for one year so that the intelligence services and the authorities can access it in the context of a judicial investigation.

Stone of Roquefeuil, lawyer specializing in digital and communication law in Paris, provides you with some information on the management of access to data stored by telephone operators.

Files list all our telecommunications data: the date and time of telephone communications, the identity of the interlocutors, but also geolocation data. Private companies keep this data for one year in order to allow law enforcement and intelligence services to have the possibility of requesting this information in the context of an investigation.

Three decrees of October 20, 2021 determine the applicable framework for the retention of connection data by electronic communication operators, internet access providers and hosts. They specify the conditions for communicating authorization requests.

The request for authorization to communicate connection data and the prior authorization to access the data must be formulated in writing and transmitted in such a way as to ensure its confidentiality and to be able to certify that it has been received.

Thus, the legislation provides that the request for authorization to communicate connection data can specify for each survey:
– The name of the suspected person or the name of any other person for whom access to the connection data is necessary for the investigation. If necessary, when the name is not known, the IP address or any other connection data may be requested.
– The connection data or types of connection data requested for each person or in each case.
– The periods during which access to connection data is requested.
– The factual and legal elements that justify the request.

These decrees demonstrate the importance of connection data in the context of legal cases. The public prosecutor may, in the context of an investigation, request all the connection data concerning him. This data can allow investigators to obtain key information in an investigation.

Indeed, in the context of the prevention of terrorism, the use of metadata is essential. Location data of suspected individuals as well as wiretaps can provide investigators with key information. This information can prevent individuals from acting out. With a view to preventing national security, the use of this information is authorized by the French internal security code.

The Roquefeuil lawyers firm sheds light on French legislation on access to metadata. The specialized lawyer explains to you the consequences following the judgment of the Court of Justice of the European Union.

What are the consequences following the judgment of the Court of Justice of the European Union?

The Court of Justice of the European Union (CJEU) has ruled practices of “widespread and undifferentiated” retention of login data unlawful. Since these declarations, the conservation of this device in France remains uncertain.

In fact, in the CJEU C-793/19 SpaceNet preliminary ruling case, the Advocate General specified that European law "opposes national regulations which require providers of electronic communications services available to the public to retain, in a preventive, general and undifferentiated way, the traffic data and the location data of the end users of these services for purposes other than those of the protection of national security against an actual and present or foreseeable serious threat”.

The Advocate General also indicated that legislation is unlawful when it “does not make access by the competent authorities to data relating to traffic and location data stored subject to a control carried out beforehand by a court or by an administrative entity. independent.

Also, the Constitutional Council recalled that the generalized retention of all connection data is contrary to the Constitution.

For example, the Court of Justice of the European Union was seized of a question from a Spanish court in the context of the investigation of a case. This one concerns a robbery during which the victim's mobile phone was stolen. The judge in charge of investigating the case had refused to request the transmission of the telephone numbers activated by the stolen device, considering that the offense was not serious enough to justify access to personal data. Thus, the court of appeal questioned the Court of Justice of the European Union on this subject. The latter then replied that Article 15 of the directive, read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, "must be interpreted as meaning that access by public authorities to data aimed at identifying the holders of SIM cards activated with a stolen mobile telephone, such as the surname, first name and, where applicable, address of these holders involves an interference with the fundamental rights of the latter, enshrined in those articles of the Charter, which is not so serious that such access should be limited, in matters of prevention, investigation, detection and prosecution of criminal offences, to the fight against serious crime".

Consequently, access to personal data stored by telephone operators cannot be justified by minor offenses seriously infringing the right to privacy.

Nevertheless, the Court of Justice of the European Union specifies that it is up to each nation to apply its national law, specifying that it is up to the criminal court to discard data collected in a way that does not comply with Union law. in the event that the persons being prosecuted are unable to comment effectively on the information and evidence. These come from a field beyond the knowledge of the judges and which are likely to influence in a preponderant manner the assessment of the facts.

Indeed, the Court of Justice of the European Union recognizes that the retention of metadata can be useful for the purpose of preventing a serious threat to national security. However, it insists on the respect of three conditions: the limit of the mechanism in time, the possibility of justifying the seizure of this lever by a serious, real, current or foreseeable threat to national security. Finally, the use of metadata must be carried out under the effective control of a court or an independent administrative authority.

As a result, the automated processing of data relating to the location in the prevention of terrorism provided for by the Internal Security Code is authorized. This must make it possible to filter all the data to bring out only the data making it possible to search for and identify the person.

On the other hand, when there is no serious threat to national security, data retention for prevention must be targeted. For example, telephone tapping is only authorized for organized crime or terrorism investigations. They are possible for crimes and misdemeanors punishable by more than two years of imprisonment. As for the geolocation data, the intelligence services or the police can only use them for offenses punishable by more than five years of imprisonment, or three years in the event of harm to the person.

Your login details have been used as part of an investigation and you would like advice? Stone of Roquefeuil, lawyer specializing in digital and communication law in Paris, accompanies you to advise you and to ensure that your interests are respected. The specialized lawyer will help you to identify the procedure adapted to your situation.

Who keeps what? Operators keep the metadata, and transfer it to the authorities, under what conditions? What metadata?

Between national and community case law, the rules still seem to be floating, but to the advantage of GAFAM who try to uphold the confidentiality due to their subscribers and at the same time an American conception of freedom of expression which consists in admitting all slander , anonymous or not.

For a public opinion still fond of stoning, in defiance of the most basic objectives of social reintegration.

Passwords and custody

Police custody and the right to silence

Negative and disparaging reviews

The new internet regulation in preparation: DSA – DMA

The draft e-privacy regulation

August 6, 2022 Update

Court of Cassation.

Cas. crime, July 12 2022, no. 21-83.710,
Cas. crime, July 12 2022, no. 21-83.820,
Cas. crime, July 12 2022, no. 20-86.652,
Cas. crime, July 12 2022, no. 21-84.096,

EU law	Traffic and location data	iP addresses	Civil identity
Serious threats to national security	Retention by order of the authorities with the possibility of judicial recourse for verification	Retention by order of the authorities with the possibility of judicial recourse for verification	Retention by order of the authorities with the possibility of judicial recourse for verification
serious crime	Retention of certain data on limited injunction Rapid, more extensive retention of certain data on limited injunction, on prior control, (case law = in any case contestable before an independent judge in the event of a grievance)	Preservation on limited injunction	Conservation
Others	No conservation	No conservation	Conservation

CJEU

CJEU 20 September 2022, C793/19, C794/19

CJEU, March 2, 2021, aff. C-746/18, HK/Prokuratuur

Oct. 6, 2020, La Quadrature du net [Assoc.], aff. C-511/18, C-512/18 and C-520/18,
Apr. 5, 2022, Commissioner of An Garda Síochána, aff. C-140/20,
Oct. 2, 2018, aff. C-207/16

Relevant texts:
Article L. 34-1, III, and III bis of the Postal and Electronic Communications Code

The Law of July 30, 2021 – 2021-998 (art.17) amending the LCEN, art.6 II, (law no. 2004-575 of June 21, 2004) and L34-1 post and electronic communications code
Articles 60-1, 60-1-1, 77-1-1 and 77-1-2, articles 99-3 and 99-4, of the Code of Criminal Procedure

Three decrees of October 20, 2021

Decree No. 2021-1362 of October 20, 2021 relating to the retention of data enabling the identification of any person having contributed to the creation of content put online, taken pursuant to II of Article 6 of Law No. 2004-575 of June 21, 2004 for confidence in the digital economy, replacing (repealed) Decree No. 2011-219 of February 25, 2011 relating to the retention and communication of data allowing the identification of any person who creation of online content

“e-Privacy” Directive 2002/58/EC of the European Parliament and of the Council, of July 12, 2002, concerning the processing of personal data and the protection of privacy in the electronic communications sector (privacy and communications directive electronic)

cons. const.

May 20, 2022, No. 2022-993 QPC

Board of state

CE, 21 Apr. 2021, n° 394922, 397844, 397851, 393099, 424717 and 424718 (French Data Network)

AC Paris

18 Feb. 2022, n°20/13824, would limit the communication of identification data to criminal matters, confirming interim order on article 145 of the code of civil procedure and article 6 LCEN
April 27, 2022

TJ – TGI Paris

January 30, 2013
April 5, 2022

Comment :

In a judgment of March 2, 2021 (CJEU, March 2, 2021, aff. C-746/18, HK/Prokuratuur), the CJEU stated that access to login data can only be authorized:

– if this data has been kept in accordance with the requirements of European law;
– if it took place for the purpose that justified the storage or a more serious purpose, except for rapid storage;
– if it is limited to what is strictly necessary;
– with regard to traffic and location data, if it is limited to procedures aimed at combating serious crime, and;
– if it is subject to prior control by a court or an independent administrative body.

The Court of Cassation rules that Articles 60-1, 60-1-1, 77-1-1 and 77-1-2 are contrary to EU law in that they do not provide for prior control by a jurisdiction or an independent administrative entity.

Article L. 34-1, III bis, of the Postal and Electronic Communications Code:

"The data retained by the operators pursuant to this article may be the subject of a rapid retention order by the authorities having, in application of the law, access to data relating to electronic communications for prevention purposes. and repression of crime, serious delinquency and other serious breaches of the rules for which they are responsible for ensuring compliance, in order to access this data. »

Update September 22, 2022

Article 60-1-2 of the Code of Criminal Procedure:

Creation LAW n°2022-299 of March 2, 2022 – art. 12

On pain of nullity, requisitions relating to the technical data making it possible to identify the source of the connection or those relating to the terminal equipment used mentioned in 3° of II bis of Article L. 34-1 of the Post and electronic communications or on the traffic and location data mentioned in III of the same article L. 34-1 are only possible, if the necessities of the procedure so require, in the following cases:

1° The proceedings relate to a felony or misdemeanor punishable by at least three years' imprisonment;

2° The proceedings relate to an offense punishable by at least one year's imprisonment committed through the use of an electronic communications network and these requisitions have the sole purpose of identifying the perpetrator of the offence;

3° These requisitions relate to the terminal equipment of the victim and intervene at the latter's request in the event of an offense punishable by imprisonment;

4° These requisitions tend to find a missing person within the framework of the procedures provided for in articles 74-1 or 80-4 of this code or are carried out within the framework of the procedure provided for in article 706-106-4.

=> Waivers of anonymity are in principle prohibited, in particular with regard to civil offenses without criminal qualification or minor offenses (typically defamation and insults that do not discriminate against individuals), which goes against the requirements the right to a fair trial provided for by the ECHR. Advances in case law are therefore still to be awaited.

The texts (articles L34-1 and R10-13 of the postal and electronic communications code, L34-1 resulting from the reform Law of July 30, 2022) only allow a waiver of civil identity and data provided when signing the contract (by the prosecution only?) “for the purposes of criminal proceedings”.

The provision of civil identity and contract data (initially provided by the user) by an operator or a host may be insufficient to flush out the perpetrator of an infringement; the so-called technical data for the location and identification of the machines and software used are most of the time essential for the precise identification of the author and the circumstances of the offence.

Several avenues are mentioned to challenge this current approach of the legislator:

contesting the applicability of the directive “e-Privacy” 2002/58/EC of the European Parliament and of the Council, of 12 July 2002, concerning the processing of personal data and the protection of privacy in the electronic communications sector (directive on privacy and electronic communications Directive which underlies the reform, but which would not be intended to govern public expression, only private communications;
by challenging the constitutionality of the law of July 30, 2022 for infringement of the right to a fair trial;

Update of January 6, 2023:

A remarkable summary order of the Paris judicial court of 21 December 2022 (Tribunal judiciaire de Paris (ref.), 21 December 2022, n° 22/55886, Noctis Event and M. X. c/ Wikimedia Foundation Inc.) issued against Wikimedia recognises the right of access to the civil identity of the author of the malicious content, to his contact details, to his name and address, and to his phone number. but excluding, however, his login data – , in a context of invasion of privacy, denigration and cyberbullying (press offenses are not invoked), violations likely to justify civil and criminal actions.

The judge recalls the conditions of the summary procedure:

Article 145 of the Code of Civil Procedure provides that if there is a legitimate reason to preserve or establish before any trial the proof of facts on which the solution of a dispute could depend, the legally admissible investigative measures may be ordered at the request of any interested party, on request or in summary proceedings.

The summary court, referred to in application of Article 145, has sovereign power to assess whether the plaintiff has a legitimate reason and does not have to determine whether there is urgency. It must verify whether the trial in germ alleged by the plaintiff is not manifestly doomed to failure.

Are legally admissible, investigative measures limited in time and in their purpose and proportionate to the objective pursued. It is his responsibility to verify whether the measure ordered is necessary for the exercise of the right to evidence and proportionate to the conflicting interests involved.

The judge opportunely specifies, as in response to articles L34-1 and R10-13 of the postal and electronic communications code, L34-1 resulting from the reform Law of July 30, 2022:

The mere fact that the prosecutor has the opportunity to prosecute, as the company Wikimedia Foundation Inc. maintains, cannot suffice to render unlawful the measure of investigation requested, which aims to identify the perpetrator of these acts.

> The "legitimate reason" required to justify a request for interim relief prior to a trial, in particular for the purposes of establishing evidence, cannot be annihilated by a prognosis on the prosecutor's decisions regarding future prosecutions, as the judge pointed out .

Update of 15 March 2023:

Transmission to the Court of cassation of a QPC relating to Article 60-1-2 of the Code of Criminal Procedure

Cour d’appel de Versailles / 14 déc.2022, n°22-90.019 / 6 déc. 2022. n°22-90.018

(Defamation of an individual - criminal prosecution)

The examining magistrate recalls that the new provisions of Articles 60-1 and 60-1-2 of the Code of Criminal Procedure (Code de la Cour de l'État) are not applicable to the case of the procedure do not allow for requisitions to be made technical connection data anonymous authors of defamatory content, taking into account the nature of the facts denounced and the penalty (a simple criminal fine).

The Investigating Chamber referred the priority question of constitutionality raised by the civil party to the Court of Cassation, stating that these provisions The new law makes it impossible for victims of defamation to access the search for the truth. the identity of those responsible for offences committed and to a judge to obtain compensation for damage that may be significant in terms of harming the honour and morality of the persons concerned, with repercussions on their life and personal situation, since only by obtaining the technical connection data can an indisputable identification of those responsible.

The Crim judgment. Oct. 5, 2021 – 20-85.985 and the 2022 reform of the LCEN – an update on the responsibilities of internet and media players

by Cabinet Roquefeuil | Mar 1, 2022

https://www.courdecassation.fr/en/decision/615bea2b2cfb606bf051019e

This judgment is an opportunity to take stock of the national regulations applicable to the audiovisual sector, the press and the Internet, with regard to liability in so-called press offenses provided for by the law of July 29, 1881 on the freedom of the hurry.

It recalls that "communication to the public online" and "audiovisual communication", which both come under "communication to the public by electronic means" and the cascading liability regime of press law, do not refer to the "press audiovisual” referred to in several articles of the penal code which punish attacks similar to press offenses (incitement to suicide, attacks on the representation of the person, on minors, on the authority of the State, on judicial decisions).

Larticle 2 paragraph 3 of law 86-1067 of September 30, 1986, Léotard law, relating to the freedom of communication, noted :

Electronic communications means the emissions, transmissions or receptions of signs, signals, writings, images or sounds, by electromagnetic means.

Communication to the public by electronic means means any making available to the public or categories of public, by an electronic communication process, of signs, signals, writings, images, sounds or messages of any kind. which do not have the character of private correspondence.

Audiovisual communication is understood to mean any communication to the public of radio or television services, regardless of the methods of making them available to the public, any communication to the public by electronic means of services other than radio and television and not falling communication to the public online as defined in article 1 of law n° 2004-575 of June 21, 2004 on confidence in the digital economy, as well as any communication to the public of on-demand audiovisual media services .

Article 93-2 of Law No. 82-652 of July 29, 1982 on audiovisual communication provides:

Any service of communication to the public by electronic means is required to have a director of publication.

When the director of publication enjoys parliamentary immunity under the conditions provided for by article 26 of the Constitution and by articles 9 and 10 of the protocol of 8 April 1965 on the privileges and immunities of the European communities, he appoints a co-director of the publication chosen from among persons who do not benefit from parliamentary immunity and, when the communication service is provided by a legal person, among the members of the association, of the board of directors, of the management board or the managers according to the form of the said legal person.

The co-director of publication must be appointed within one month from the date from which the director of publication benefits from the immunity mentioned in the preceding paragraph.

The director and, possibly, the co-director of the publication must be of legal age, have the enjoyment of their civil rights and not be deprived of their civil rights by any judicial conviction. By way of derogation, a minor over the age of sixteen may be appointed director or co-director of the publication produced on a voluntary basis. The responsibility of the parents of a minor aged sixteen or over who has been appointed director or co-director of publication cannot be engaged, on the basis ofarticle 1242 of the civil code, only if he has committed an act likely to engage his own civil liability under the conditions provided for by the law of July 29, 1881 on the freedom of the press.

All legal obligations imposed on the director of publication are applicable to the co-director of publication.

When the service is provided by a legal person, the director of publication is the chairman of the management board or the board of directors, the manager or the legal representative, depending on the form of the legal person.

When the service is provided by a natural person, the director of publication is this natural person.

and article 93-3 of the same law:

In the event that one of the offenses provided for in chapter IV of the law of July 29, 1881 on the freedom of the press is committed by a means of communication to the public by electronic means, the director of publication or, in the case provided for in the second paragraph of article 93-2 of this law, the co-director of the publication will be prosecuted as the main author, when the offending message has been fixed prior to its communication to the public.

Failing that, the author, and failing that the author, the producer will be prosecuted as the main author.
When the director or co-director of the publication is implicated, the author will be prosecuted as an accomplice.
Any person to whom article 121-7 of the penal code is applicable may also be prosecuted as an accomplice.
When the offense results from the content of a message sent by an Internet user to an online public communication service and made available by this service to the public in a space for personal contributions identified as such, the director or co-director of publication cannot be held criminally liable as the main author if it is established that he had no actual knowledge of the message before it was put online or if, from the moment he became aware of it, he acted promptly to remove this message.

Article 1 of Law No. 2004-575 of June 21, 2004 on confidence in the digital economy provides:

Communication to the public by electronic means means any making available to the public or categories of public, by an electronic communication process, of signs, signals, writings, images, sounds or messages of any kind. which do not have the character of private correspondence.

Communication to the public online means any transmission, on individual request, of digital data not having the character of private correspondence, by an electronic communication process allowing a reciprocal exchange of information between the sender and the receiver.

Electronic mail means any message, in the form of text, voice, sound or image, sent by a public communication network, stored on a network server or in the recipient's terminal equipment, until that he recovers it.

And

(1 of III of article 6 of the same law 🙂

III.-1. Persons whose activity is to publish an online public communication service make available to the public, in an open standard:

a) In the case of natural persons, their surname, first names, domicile and telephone number and, if they are subject to the formalities of registration in the trade and companies register or in the business directory, the number of their registration ;

b) In the case of legal persons, their name or company name and their registered office, their telephone number and, in the case of companies subject to the formalities of registration in the trade and companies or in the directory of trades, their registration number, their share capital, the address of their head office;

c) The name of the director or co-director of the publication and, where applicable, that of the editorial manager within the meaning of article 93-2 of the aforementioned law n° 82-652 of July 29, 1982;

d) The name, denomination or company name and address and telephone number of the service provider mentioned in 2 of I.

This omission is moreover sanctioned under the visa of paragraph 2 of VI of article 6 of the same law:

“2. Is punished by one year's imprisonment and a fine of 75,000 Euros the fact, for a natural person or the de jure or de facto manager of a legal person exercising the activity defined in III, of not having respected the prescriptions of this same article.

Legal persons may be declared criminally liable for these offenses under the conditions provided for in article 121-2 of the criminal code. They incur a fine, in accordance with the procedures provided for by article 131-38 of the same code, as well as the penalties mentioned in 2° and 9° of article 131-39 of this code. The prohibition mentioned in 2° of this article is pronounced for a maximum period of five years and relates to the professional activity in the exercise or on the occasion of which the offense was committed.

“Communication to the public by electronic means” is opposed to “private correspondence” and includes “communication to the public online” and “audiovisual communication”.

Cascading liability applies to the written press, to “communication to the public by electronic means”, but not to the “audiovisual press” referred to in certain articles of the penal code for offenses similar to press offences.

Cascading responsibility: The director of publication is the first responsible, at least when he can control the publication by means of his prior fixation.

Be assisted by a lawyer specializing in press law in Paris:

Roquefeuil law firm

World-Check, ICIJ, Pandora papers, have personal data removed

by Cabinet Roquefeuil | Feb 16, 2022

computer law lawyer paris

In the name of transparency, the fight against money laundering, and freedom of the press, press consortia make it their business to seek suspicious financial flows, parallel to or upstream of police or judicial investigations.

Also, they tend to pin more or less known personalities on the basis of public documents that they can find on the internet.

These public documents are sometimes the result of data leaks, known as “Pandora papers”, “Panama papers”, etc… and also from official public registers.

These press organs sometimes go to work quickly and make hazardous deductions, to scoop up the scoop and entice the reader, or even, more legitimately, to try to bring about clarifications on a case.

People are thus publicly suspected and then filed in shared databases, such as World-Check, on which certain banks, poorly equipped in means of investigation - and above all wishing to close small accounts (<3ME) not very lucrative and at risk – , rush to check if the bank accounts they hold do not involve people targeted by these files.

They will hasten to close these accounts without explanation, and will thus be able to justify their compliance with the authorities of control and international cooperation, without spending too much.

The ICIJ is one of these consortia of journalists, and intends to participate in the fight against tax evasion and the impoverishment of Nations.

This type of consortium assumes that governments and public authorities manage public money correctly and that there is in any case no justification for fraud. No one will dispute that fraud is indeed reprehensible in itself in that it seeks to unduly evade its legal obligations, and that tax evasion can have the effect of impoverishing the conscientious taxpayer.

On the other hand, the opinion according to which the public authorities cannot provoke legitimate mistrust is unfortunately not shared.

Above all, a person can claim to be unjustly the victim of the oukazes of press organs, and complain that he has not benefited from the guarantees due to him within the framework of the investigations carried out by the judicial or administrative authorities.

These include guarantees of secrecy of the investigation, the presumption of innocence, and the possibility of being heard impartially before a conviction is pronounced.

What recourse does a person unjustly denounced have against the press?

The person denounced by the press can choose to “communicate” or not, and thus create such or such an image with the public, depending on their situation.

It will take care to reconcile its communication with the requirements of the secrecy of the investigations (provided for example by article 11.of the French code of criminal procedure), or other secrets, in particular business secrecy, provided for by the directive (EU) 2016/943 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against unlawful acquisition, use and disclosure.

Thus article 11 of the French code of criminal procedure provides, in its version of the December 24, 2021:

Except in the case where the law provides otherwise and without prejudice to the rights of the defence, the procedure during the investigation and the instruction is secret.

Any person who participates in this procedure is bound by professional secrecy under the conditions and under the penalties provided for in Article 434-7-2 of the Criminal Code.

However, in order to avoid the dissemination of fragmented or inaccurate information or to put an end to a disturbance of public order or when any other imperative of public interest justifies it, the public prosecutor may, ex officio and at the request of the investigating court or the parties, directly or through a judicial police officer acting with his agreement and under his control, to make public objective elements drawn from the procedure which do not include any assessment of the property -founded the charges against the persons implicated.

On a legal level, the law of European countries offers an action for defamation against press organs, according to a particular procedure.

We will refer for example, for French law, to the law of July 29, 1881 on the freedom of the press and to its article 29 according to which:

Any allegation or imputation of a fact which undermines the honor or consideration of the person or body to which the fact is imputed is defamation. The direct publication or by way of reproduction of this allegation or this imputation is punishable, even if it is made in doubtful form or if it targets a person or a body not expressly named, but whose identification is made possible by the terms speeches, cries, threats, writings or printed matter, placards or posters incriminated.

Protection of privacy can also be sought, through, for example, Article 8 of the European Convention on Human Rights (or Convention for the Protection of Human Rights and Fundamental Freedoms of 4 November 1950

Everyone has the right to respect for his private and family life, his home and his
correspondence.
There may be interference by a public authority in the exercise of this right only for
provided that such interference is prescribed by law and constitutes a measure which, in
a democratic society, is necessary for national security, public safety,
economic well-being of the country, the maintenance of order and the prevention of crime
criminal offenses, the protection of health or morals, or the protection of the rights and freedoms
from others.

What are the recourses against the databases?

The right to the protection of personal data aims to sanction the processing, in particular computer processing, of personal data which infringes the freedoms or the consent of the person.

This right can be invoked against files and databases, internet search engines.

The files, registers, processing, search engines and other databases that collect personal data allow the person to be profiled, sometimes to their detriment.

Indeed, a query, in the database, on a name or other personal data, will inevitably result in drawing up a profile of the person concerned, adding a category and any possible negative opinion, public or not, from a journalistic source or not. , from an official source or not, depending on the type of database consulted.

The file, insofar as it allows direct and instantaneous access to the profile of a person from the information of one of his personal data, has a capacity for nuisance which can be particularly stinging when the database is public, without restriction of access, not reserved for law enforcement authorities, such as an internet search engine, for example.

In European Union law, it is Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (general data protection regulation) which provides for the personal data protection regime.

This protection is ensured by means of judicial and administrative remedies open to the citizen, and also by the initiative of dedicated authorities able to act in a network (for example, in the EU, network of national authorities of each of the Member States of the EU ).

This right to the protection of personal data includes a "right to be forgotten", provided for in Article 17 of the Regulation, which allows the erasure of personal data.

This right does not in any way call into question the freedom of expression of the press but makes it possible to restrict the processing of personal data (in other words the "registration of the person") when the fundamental rights of the person are at stake, in particular their privacy. and its safety.

It is therefore necessary to distinguish

Firstly :

"the news" which appears spontaneously in the form of a bulletin on such and such a subject, according, precisely, to the news of the moment, which commands, and which freedom of expression intends to promote,

And on the other hand :

the "processing of personal data" whose use requires the prior information of personal data; here it is the information of personal data, and not the “news”, which controls the search result.

We will lynch you: the right to be forgotten on the internet

« Older Entries