Today, the Conseil d’État (the French Administrative Supreme Court) ruled in favour of La Quadrature du Net, French Data Network (FDN), Franciliens.net and Fédération FDN. It recognised that Hadopi’s surveillance system (operated by Arcom since 2021) is a breach of fundamental rights protected by the European Union. As a result, it has ordered the government to repeal the core provisions of Hadopi key decree that organises the “graduated response” system. This fight against Hadopi, in which La Quadrature is involved since the first legislative debates in the National Assembly in 2009, is emblematic of the archaic view held by successive governments, both left-wing and right-wing, on the question of sharing online culture and knowledge. It is now up to the government to acknowledge the death of Hadopi and, instead of attempting to bring it back to life, to finally admit that online cultural sharing for non-commercial purposes must not be criminalised.
Hadopi is definitely a surveillance tool
Hadopi is the law that created the authority of the same name: the “High Authority for the Dissemination of Creative Works and the Protection of Rights on the Internet” (Haute Autorité pour la diffusion des œuvres et la protection des droits sur internet). The mechanism put in place consists of two stages: firstly, rights holders identify internet users sharing cultural content online via peer-to-peer networks; they collect their IP address and send it to the Hadopi; secondly, the Hadopi, using these lists of IP addresses, requests the civil identity and contact details of the identified subscribers from internet service providers and stores this information in a database of users who have downloaded files. This triggers the “graduated response” system: the first time a user is identified, the Hadopi sends an initial warning email, followed by a second one in the event of a repeated occurrence, then a registered letter if the behaviour continues, and may finally refer the case to the judicial authorities for users who ignore these warnings. The judicial authority may then impose a fine (of up to €1,500; €3,000 in the event of a repeat offence) on the internet user for the fifth class minor offence of “failing to secure an internet connection”1Hadopi does not directly sanction downloading, as it is technically impossible to verify that the subscriber is indeed the person who carried out the download. The solution adopted in the law was to create an obligation for Internet users to secure their access, with penalties for non-compliance..
In 2021, the French Parliament merged the CSA (High Council for Audiovisual Media) with Hadopi to create Arcom (Authority for Regulation of Media and Digital Communication). However, Arcom merely took over Hadopi’s responsibilities, and this surveillance system has survived.
Christine Albanel, a Sarkozy-appointed Minister for Culture who defended the first Hadopi law in 2009, claimed that the text would reconcile privacy with the fight against piracy, even though she did not understand the technical realities and challenges of her own bill. Yet it was already clear in 2009 that the law would not work, given that Internet users would stop using peer-to-peer to turn to streaming or direct download (which inevitably created a market for illegal commercial platforms), and that piracy issues are closely linked to the availability of legal alternatives (piracy decreases when legal alternatives are easily accessible and increases when their quality decrease or when platforms are not available).
Today, we know that the violations of fundamental rights are so severe that this system cannot continue.
Seven years of legal actions
In 2019, we asked the Conseil d’État to overturn Hadopi’s central decree, which authorises the storage of personal data needed for the graduated response system (IP addresses, civil identity and downloaded material). The case was referred to the Constitutional Council and in 2020 we had our first partial victory: the Constitutional Council restricted Hadopi’s broad access to personal data (the law at the time provided that it could access “all documents”). However, despite to our initial assessment, this did not necessarily mark the end of the Hadopi.
Back before the Conseil d’État to draw conclusions from this partial invalidation of the law, we then pointed out that the Hadopi system was in breach of the case law of the Court of Justice of the European Union (CJEU): in principle, before an authority can access to metadata (such as an IP address or the civil identity associated with that IP), there must be an independent review of the legality and proportionality of such access. Such a review does not exist for the Hadopi. The rapporteur public (General Advocate) of the Conseil d’État, unhappy at having to acknowledge the illegality of the Hadopi, nevertheless admitted the issue: “This case should, alas, delight millions of internet users since it indirectly raises the question of the very existence of the [Hadopi]”. However, rather than inviting the Conseil d’État to put an end to Hadopi, he made a bad sport of it and suggested instead to ask the CJEU for a “Hadopi exception”: to weaken European requirements so that Hadopi’s mass surveillance could continue.
This case therefore brought us before the CJEU. The outcome was disappointing, as we lost on the principle: the CJEU agreed to weaken its case law. It accepted that access to metadata might, in certain cases, not be subjected? to prior independent review. However, it required numerous conditions to this possibility, relating to both the retention of such data and the requirements for prior independent review.
In its ruling, the Conseil d’État finally agreed with us on these two points. Firstly, it found that the retention of metadata is not carried out in a manner that safeguards civil liberties. The CJEU required “watertight separation” of IP addresses and civil identity data (which can be understood as two distinct databases, or files, that can only be technically correlated after a formal request for access by Arcom). The Conseil d’État notes that “no legal provision imposes such retention, under these conditions, on electronic communications operators”.
Secondly, it also notes that access to this data is not subject to independent review. It fully endorses the conclusions already made by the CJEU, that Arcom cannot be both judge and jury: it cannot request access and then review the legality of that access itself, even though it is an independent authority. However, like the CJEU, the Conseil d’État considers that this lack of review is only an issue from the third access to the data onwards, the stage at which a registered letter is sent.
The need to find a new approach
In practical terms, this means that the ‘graduated response’ system is now stalled. The Arcom can no longer take you to court, as the requirements set by the CJEU are not satisfied. And it can only send you an email if it has first ensured that your internet service provider has stored your metadata with a “watertight separation”2The Minister for Culture claims to have asked SFR, Free, Orange and Bouygues Telecom whether this data retention was carried out in a watertight way. These operators replied that it was, but Arcom will need to verify this. This is an opportunity to encourage you to sign up for an internet subscription with an ethical provider from the Fédération FDN!. It has now been downgraded to the function of a giant spam machine.
However, this does not mean that the Hadopi is definitively dead. The government could try again, creating a sort of Arcom supervisory body to ensure compliance. If it were to go down this path, the government would be stubbornly keeping an illegitimate surveillance system afloat. By focusing on prosecuting Internet users who share content online, the Hadopi system has missed the target. It has never been able to tackle the illegal commercial platforms that sell privileged access to their catalogues at the detriment of artists. On the contrary, it has created a space for this illegal activity. Nor has the Hadopi system put an end to the exploitation of rights-holding companies, those “copyist monks” who keep artists in a state of political or economic submission from which only a few can break free. The first step towards a necessary reform is to end the criminalisation of online non-commercial sharing of culture.
La Quadrature du Net has been fighting against the Hadopi since 2009, so this victory is particularly significant for us. However, the fight is not over. Not against a Hadopi that could rise, like a zombie, from its grave. Nor against all those laws that seek to turn the internet into a space where fundamental rights do not apply. So you can help us by making a donation.
References