France

[FR] Constitutional Council rules that Hadopi’s access to all documents, to combat piracy is unlawful

IRIS 2020-7:1/4

Amélie Blocman

Légipresse

On 13 February 2020, the Conseil d'État (Council of State) submitted to the Conseil constitutionnel (Constitutional Council) an application for a priority preliminary ruling concerning the constitutionality of the final three paragraphs of Article L. 331-21 of the Intellectual Property Code. This provision forms the legal basis for the Hadopi’s implementation of the graduated response procedure established under Act No. 2009-669 of 12 June 2009.

According to Article L. 336-3 of the Intellectual Property Code, the owner of a connection to online public communication services is obliged to ensure that such a connection is not used for piracy. When a failure to meet this obligation is reported, the Hadopi’s rights protection committee is responsible for taking measures to ensure it is respected. It issues a recommendation to the offending account holders, reminding them of their obligation, urging them to meet it and telling them what sanctions will be imposed if they fail to do so. Under the disputed provisions of the Code, Hadopi officials can obtain, on the one hand, information from electronic communication operators about the identity, postal address, e-mail address and telephone number of subscribers whose connection to online public communication services has been used in violation of the obligation set out in Article L. 336-3 and, on the other, a copy of “all documents, whatever their medium, including login data held by electronic communication operators”. These documents are listed in Decree No. 2010-236 of 5 March 2010 on the automatic processing of personal data authorised by Article L. 331-29 of the Intellectual Property Code.

According to the requesting associations, the disputed provisions of the Intellectual Property Code infringed the right to privacy, the protection of personal data and the confidentiality of correspondence. They claimed that they gave Hadopi staff access to all documents, whatever their medium, including login data, without any limitation or adequate guarantees.

The Constitutional Council began by considering the admissibility of the application, because this was not the first time it had been asked to address this issue. Indeed, it had previously ruled, after examining the law of 12 June 2009, that the final three paragraphs of Article L. 331-21 were compatible with the right to privacy. However, since declaring them compatible, the Council had, in a decision of 5 August 2015, ruled that provisions giving Competition Authority officials a similar right to obtain login data breached the right to privacy. This decision constituted a change of circumstances that justified the re-examination of the disputed provisions.

In substance, it ruled that, by extending the right to obtain data to “all documents, whatever the medium” and failing to define who the data subjects were, the legislator had not limited the scope of the exercise of this right or ensured that the documents concerned were directly linked to the breach of the obligation set out in Article L. 336-3 of the Code of Intellectual Property, which justified the procedure implemented by the Hadopi. Furthermore, this right could cover all login data held by electronic communication operators. In view of its nature and how it might be processed, such data provided a large quantity of specific information about the individuals concerned, violating their right to privacy. Moreover, not all of it was necessarily linked directly to the breach of the obligation set out in Article L. 336-3 of the Code of Intellectual Property.

However, concerning the communication to Hadopi officials of the identity, postal address, e-mail address and telephone number of subscribers whose connection to online public communication services had been used illegally, the Council pointed out that the legislator had wanted to step up the fight against Internet piracy in order to protect intellectual property. It noted that this right to information was not accompanied by compulsory enforcement powers, and was only granted to Hadopi public officials who were duly qualified, certified and bound by professional secrecy in relation to the use of such data. In addition, the Hadopi needed this information in order to remind the account holders concerned of their legal obligations and, if they continued to breach them, refer them to the public prosecutor’s office. The data was therefore directly linked to the procedure. For these reasons, the Constitutional Council ruled that the final paragraph of Article L. 331-21 of the Intellectual Property Code was in conformity with the constitution, apart from the word “notamment” (“especially”).

The Constitutional Council therefore decided that the third and fourth paragraphs of Article L. 331-21 of the Intellectual Property Code, as well as the word “notamment” in the final paragraph of the same article, were unconstitutional. In a press release, the Hadopi said “that the possibility” in question “has never been used by the rights protection committee to implement the graduated response”, and that “through this declaration of conformity, the Constitutional Council has approved the current functioning of the graduated response procedure and its continuing implementation.”

Whatever the Hadopi says, the Council believes that the immediate revocation of the provisions deemed unconstitutional would probably have “manifestly excessive” consequences. It therefore delayed their revocation until 31 December 2020. In the meantime, the audiovisual reform bill under which the CSA and the Hadopi will merge to become the ARCOM may be put to the vote and the  relevant provisions of the Intellectual Property Code amended in order to take this decision into account and improve the graduated response mechanism that was created under the law of 12 June 2009.