Case Summary and Outcome

Two French NGOs working for on-line freedom of expression, and the French Association of Internet Service Providers, along with ARTICLE 19, the British freedom of expression NGO (in a different brief),  challenged in front of the French Conseil d’Etat two decrees adopted in 2015. The decrees permit the administrative blocking of websites that condone terrorism and child pornography and their de-referencing by search engines. (The Conseil d’Etat is a body of the French national government that acts both as legal adviser of the executive branch and as the supreme court for administrative justice.) The Court ruled that the administrative measures were lawful and did not violate freedom of expression as enshrined in Article 10 of the European Convention on Human Rights (“ECHR”) because, among other reasons, there was no European Convention requirement that blocking be ordered by a judge and no evidence that the state was exploiting personal data.

Facts

The French Data Network (“FDN”), FDN Federation (“FFDN”), and La Quadrature du Net (an online news publication) challenged the legality of two decrees that had been issued in 2015 as part of the implementation of France’s 2014 anti-terrorism legislation and 2011 internal security legislation known as the Loppsi Law.  The 3 French defendants were joined in the case by ARTICLE 19, the British freedom of expression organization.  Decree No. 2015-125 of February 5, 2015 related to the blocking of sites considered to cause or glorify acts of terrorism as well as sites containing child pornography; Decree No. 2015-253 of March 4, 2015 dealt with the delisting of websites causing or glorifying acts of terrorism and displaying child pornography. The applicants challenged the decrees on the following grounds: 1) Blocking is not effective at tackling the problems it purports to address. It is easily bypassed through the use of VPN, Tor, etc.  Therefore, the measure cannot pass the test of necessity and proportionality.  2) A restriction as severe as website blocking or delisting should only be ordered by a court or similar independent and impartial body.  It is not acceptable for the state to give ISPs and search engines lists of sites to block or delist without first receiving from an administrative judge or court prior confirmation of the illegality of the content on the sites listed.¹ . ARTICLE 19 also argued that: i) the French criminal law on the prohibition of speech condoning acts of terrorism is vaguely worded. As such, it lends itself to subjective and arbitrary interpretation. ii) Decree 2015-125 does no specify the technical measures that should be used to block access. Instead, it imposes a vague, indeterminate duty on ISPs to ‘take all appropriate measures’. As such, the decree is too vague and does not meet the requirements of international law.

1. Fr., Association French Data Network, et al. v. France, No. 389140 & 389896 (Feb. 15, 2016), para. 4-5.) The lack of judicial oversight violates fundamental rights.  3) The applicants also contested the fact that when people visited blocked sites, they were automatically redirected to a site of the Ministry of Interior, which potentially allows the ministry to know the IP addresses of those who visited pornographic or suspected terrorism sites and to interfere with their communications. ((Id. at para. 7. ↩

Decision Overview

The Conseil d’Etat delivered a sketchy decision with little elaboration and at times tautological analyses.  In keeping with French administrative law, and abuse of power cases, it first considered factors related to the actors and administrative mechanisms (legality externe) and then turned its attention to the content of the decrees (legality interne).

With regard to the first level (legalite externe), the Court ruled that there was no violation of the right to privacy of communication because the measures contained in the 2015 decrees are prescribed by a 2004 law related to the digital economy:  “This redirection of users to a page of information of the Ministry of Interior is only an implementation modality of the blocking mechanism provided by law and does not involve an infringement of the privacy of correspondence that could not be provided by the latter” and “Article 1 of the Decree of March 4, 2015 provides that the administrative authority may “notify operators of search engines or email addresses directories whose contents are contrary to Articles 421-2-5 and 227-23 of the Penal Code using a secure method of transmission, which guarantees the confidentiality and integrity “. Therefore the delisting mechanisms in the 2015 decree “does not provide for any restriction on freedom of communication which is not already enshrined in law.”

With regard to the second level (legality interne), the Court ruled the following:  i) the fact that users can bypass the blocking measures does not mean the measures are maladjusted;  ii) there is no requirement under Article 10 of the European Convention that a restriction be ordered by a judge; iii) the blocking measures are not disproportionate because the risks of “over-blocking” resulting from the technique of blocking by domain name are limited, and there are no alternative measures which would accomplish the same goal in ways less intrusive;  iv) the person responsible for reviewing the decisions to block or delist has the human, technical and financial resources required to assess the legality of the measures made by the administrative authority; v) Contrary to what the defendants argued, the blocking and delisting measures can be implemented without disproportionate interference with freedom of expression because the blocking or delisting decision itself can be challenged in front of an administrative judge, while the web addresses are reviewed every quarter to assess whether they still hold illegal content and removed from the blocking/delisting lists if they don’t.

The Court also ruled over the questions of legitimate expectations and legal security.  It highlighted that these principles are binding on national administrative authorities only when implementing Community rules but that no European law and policy related to privacy and personal data addresses blocking and delisting mechanisms. Therefore the principles cannot be invoked with regard to these particular decrees. In any case, the Court states, the decrees are sufficiently precise. It also stated that Article 6 of the European Convention related to the right to a fair trial does not apply to a matter of administrative policing.

Finally, with regard to the right to privacy, the Court held that the mere fact that the personal IP information of the users visiting a blocked site could be received by the French Government was not a violation of the users privacy. Reasons include: the redirection of users to an Interior Ministry website does not amount to intercepting users’  personal data and it could not be assumed that the Government would exploit whatever data it received.  Further, the decrees do not authorize the Administration to exploit such personal data.

In conclusion, the Conseil d’Etat ruled that the applicants are not justified in seeking the annulment of the decrees.  The applicants have appealed this decision to the European Court of Human Rights. Acceptance of the appeal and further developments are pending.