France

[FR] Graduated response mechanism designed to combat online piracy of protected works infringes European Union law

IRIS 2026-6:1/11

Amélie Blocman

Légipresse

Four organisations asked the Council of State (Conseil d'Etat) to repeal Decree No. 2010-236 of 5 March 2010 on the automatic processing of personal data, implemented pursuant to Article L. 331-23 of the Intellectual Property Code as part of the graduated response mechanism to combat the online piracy of protected works. The decree authorises the French audiovisual regulator (Autorité de régulation de la communication audiovisuelle et numérique – Arcom) to access certain data, in particular the IP address used to illegally download works and the civil identity of the person concerned, which electronic communication operators are required to retain.

The Council of State referred to the Court of Justice of the European Union (CJEU) three questions for a preliminary ruling concerning the regime applicable to civil identity data associated with an IP address and the procedural safeguards required before the administrative authority responsible for copyright protection is allowed to access such data.
On 30 April 2024, the CJEU explained that a member state could require internet service providers to retain civil identity data and corresponding IP addresses on a generalised basis, including for the purpose of combating non-serious criminal offences. However, in such cases, the data in question had to be retained separately in order to avoid the risk of serious interference with individuals’ privacy through cross-referencing with other retained data.
Furthermore, however serious the offence, if a national public authority was authorised to access the identity data of individuals suspected of committing offences, it should not be able to draw precise conclusions about the private lives of internet users. Consequently, if the public authority had already, on two occasions, linked the identity data of the same subscriber with information on the content of works that he was alleged to have pirated, it could not link such data for a third time without prior authorisation from a court or an independent administrative body.

In the light of these considerations, the Council of State found that the Decree of 5 March 2010 failed to comply with European Union law insofar as, on the one hand, for the purposes of combating criminal offences in general, it did not limit the data recorded to that retained by electronic communication operators under conditions meeting the requirements set out above; and, on the other hand, the provisions of Article 4(1) thereof allowed Arcom members and authorised officials to directly access the identity data of a person who, despite having been the subject of two recommendations pursuant to Article L. 331-20 of the Intellectual Property Code, had, for the third time, committed acts likely to constitute a breach of the obligation laid down in Article L. 336-3 of the Code.

The prime minister was therefore ordered to repeal the provisions of the Decree of 5 March 2010.

Pending the possible adoption of a new decree, the Council of State specified that, in the case of non-serious criminal offences, Arcom could only ask operators to identify a subscriber on the basis of their IP address if it was established that such personal data had been retained in accordance with the conditions laid down by the CJEU.

If serious criminal offences were reported to it under Articles L. 335-2, L. 335-3 or L. 335-4 of the Intellectual Property Code (the offence of counterfeiting), Arcom could request such identification from electronic communication operators without having to verify that the data had been retained in accordance with EU law.
Finally, regardless of the seriousness of the offence, Arcom could continue to cross-reference data on the content of works with the personal details of internet users for the sole purpose of sending them the first or second of the two successive recommendations provided for in Article L. 331-20 of the Intellectual Property Code.