Key privacy concerns in France 2007
(Dieser Artikel ist auch in deutscher Sprache verfügbar)
6 January 2008 was the 30th anniversary of the French Data Protection Act. But no one really cared. The only French contribution to this 2nd European DP day has been the publication by the CNIL (French DP Authority) of a poll result that it commissioned in November 2007. The poll indicates that 50% of the asked persons know the CNIL. However, only 26% of them feel they are informed well enough on their rights in terms of personal data protection, and 61% consider that the constitution of databases is breaching their right to privacy. Moreover, a former study on Internet usages conducted in June 2007 reveals that the mostly cited barrier to Internet use is the fear that personal data are not protected enough (by 29% of the Internet users and 23% of non Internet users). In summary, French people seem better aware of and more concerned by the possible violations of their privacy rights. Unfortunately, the CNIL has not published the entire poll result. Otherwise, we might have had some explanations to the apparent paradox between this increasing awareness and the growing development of privacy and data protection violations by the French legislation and regulation without much opposition. 2007, a year of presidential and legislative elections, has seen further extensions of police powers, major provisions for the control of migrants, most notably using biometrics and genetic data, massive extension of children databases and the confirmation that intellectual property rights prevail on privacy rights in France.
a. Further extensions of police powers
Since data retention law is already in place with access to data granted to police and intelligence services, new developments are rather related to the implementation and use of the system. To ease the collection and processing of traffic data directly by the police intelligence forces, a new technical platform for the interception of traffic data in all types of communication systems was put into operation in May by the French Ministry of Interior, covering communication data related to text messages, mobile or Internet. It is expected that this platform will process 20 000 requests yearly. In terms of legislative developments, the French law for the prevention of delinquency of March 2007, introduced a new provision granting dedicated law enforcement authorities with new powers to fight child sexual abuses, since they now can use pseudonyms when they participate in electronic exchanges for the purpose of investigations, and they can also detain and provide illegal content for the same purpose. However, they cannot use these possibilities for crime incitement.
b. Migrants under total control
Whether they ask for a short or long stay visa in French consulates abroad or they cross any frontier to enter the country (and in the near future to leave it), migrants are traced and filed. If they are caught in illegal stay status, they're filed. If, even as legal residents, they choose to return to their country of origin and benefit from an assistance mechanism for this, they're filed. If they're legal residents, they're filed too, and they're filed again if they want to bring their families. Files contain their personal data, their biometric data, their genetic data, as well as data on their families, including young children. 2007 has seen major developments to achieve this total control of foreigners, resulting in their assimilation to criminals. The immigration law of March 2007 has introduced DNA testing to prove family links for foreign candidates applying for a more than 3 months visa on family regrouping grounds. It also introduced the requirement that the beneficiaries of financial support (foreigners voluntarily returning home) have their photograph and digital fingerprints taken and stored in yet another biometric database. An administrative decree of December 2007 created the ELOI database, aimed at facilitating the expulsion of illegal migrants. A previous version of the text was cancelled in March 2007 by the French highest administrative court, after 4 French NGOs filed a case against the Interior ministry. While the new version of the decree requires fewer data to be kept on French citizens and associations in contact with these illegal migrants, personal data of the migrants and their families remain filed, and kept during 3 years after their expulsion. Finally, another decree published in November 2007 created the VISABIO biometric database, containing the photograph and the 10 fingerprints of all foreigners requesting visas, including children over 6. Other data in VISABIO are related to the foreigner's entry and exit from the territory. These data are kept for 5 years.
c. Children under surveillance
Children start to be filed at age 3, as soon as they enter elementary school. This is the result of "Base-élèves", a database set up by the ministry of Education. "Base-élèves" has been created as an "experiment" since 2004, and is currently being generalized. It contains personal data on the children and their families, including psychosocial data, and a huge number of information on their competence, skills and problems. Most of the data are to be kept during 15 years. Such data were supposed to be accessed only by educators and social actors. However, the French law for the prevention of delinquency of March 2007 granted new powers to Mayors (as elementary and primary schools are within their managerial jurisdiction). Mayors may now "share the professional secret" with many social actors and thus they are granted access to "Base-élèves", for the purpose of preventing delinquency. After important protests from NGOs, parents associations and some schools directors, the ministry of Education accepted in October 2007 to remove from "Base-élèves" data related to citizenship, date of arrival in France and "language and culture of origin" of the child. However, protests are increasing and national petitions have been launched to demand the suppression of this file.
d. IPR holders granted private police powers
The French Data Protection Act allows, since its August 2004 revision, intellectual property rights societies to create private records of rights infringers through the collection of their IP addresses in P2P networks, the use of automatic software for such a collection being subject to CNIL approval. Accordingly, the CNIL decided on October 2005 to reject the introduction of surveillance devices proposed by Sacem and other 3 author and producer associations asking for the automatic tracing of infringements of the intellectual property code. In May 2007, the highest administrative court cancelled this decision. The court found that the proposed device are not disproportionate, and are acceptable considering the extent of the piracy phenomenon in France. The author and producer associations have thus resubmitted their request to the CNIL and obtained its agreement in November 2007. Still in November 2007, an agreement was signed between some French ISPs and the music and movie representatives in order to act directly against the big illegal file-sharers. French ISPs would then spy on their users to see if they are big file-sharers. Those who would be identified could get first a formal warning, but then they could be even cut-off or suspended. The agreement foresees also the possibility to have a national register of the subscribers that were suspended. But the agreement is not applicable yet, since there is no authority created yet to apply it.
EDRi-gram: ENDitorial: French law on delinquency: the threat to FoE is
EDRi-gram: The French Ministry of Interior has a new interception platform
EDRi-gram: French High Court cancels the creation of illegal migrants
EDRi-gram: DNA tests proposed in France for family visa
EDRi-gram: Update on DNA and biometrics in French immigration
EDRi-gram: ELOI - a French database to manage the expulsion of illegal
EDRi-gram: French State Council allows tracing P2P users (6.06.2007)
EDRi-gram: Is the IP address still a personal data in France? (12.09.2007)
EDRi-gram: French ISPs agree to spy on Internet users to stop online piracy
EDRi-gram: New agreement between the French ISPs and record industries
(Contribution by Meryem Marzouki, EDRI member IRIS - France)