CJEU in second round of privacy dispute by La Quadrature du Net: national authorities get their cake but they have to eat it with cutlery

By Gionata Bouché and Etienne Valk

The information retention debate is turning into ever-more complicated, or so it’s written. For the reason that second La Quadrature du Web (LQDN) installment by the Court docket of Justice of the European Union (CJEU) on 30 April 2024, it’s at the least turning into a bit clearer. The CJEU solutions preliminary questions on the alignment of nationwide laws with Directive 2002/58 (the ePrivacy Directive), extra particularly in regards to the retention of and entry to private site visitors knowledge by public authorities for figuring out (alleged) copyright infringers.

We start this weblog publish by outlining the primary details of the case and the questions raised earlier than the CJEU. Secondly, we proceed to unpack the ruling by guiding the reader by the proportionality evaluation carried out by the CJEU in mild of Artwork. 52 of the EU Constitution of Elementary Rights (CFR). Our purpose is to contextualise the current judgment within the CJEU’s line of case regulation, whereas highlighting a few of the CJEU’s improvements.

Info and authorized questions

The preliminary questions had been prompted by a dispute between the French authorities and civil society organisations defending the rights and freedom of residents on the Web, together with NGO La Quadrature du Web. In France, Hadopi is the impartial public authority tasked with stopping copyright violations on the Web. With the intention to fight on-line illegal dissemination of copyrighted materials, rightholder organisations can submit complaints to Hadopi reporting infringing conduct by customers of digital communication providers related to a number of IP addresses.  

That is the place the imputed administrative process kicks in. The process consists of a ‘graduated response’ constructing on a number of steps. Upon receiving a notification of infringement, Hadopi is authorised below French laws from 2010 and 2017, to request from digital communication suppliers entry to the identification of the holders of the IP-addresses linked to the infringement. As soon as a match is made, Hadopi sends a primary warning to the (alleged) infringers. When the violation doesn’t stop inside a yr, Hadopi can notify infringers that their actions could also be thought of “gross negligence”. At this stage, Hadopi can also impose a minor positive, which may improve within the occasion of a repeat offence. As a final resort, in case of significant or persistent infringements, Hadopi can refer the case to the general public prosecution service for doable legal expenses, comparable to counterfeiting.

La Quadrature du Web and different organisations filed a case in opposition to the French state, claiming the French laws from 2010 and 2017 governing the process is in violation of EU regulation. They argued that knowledge retention and entry competencies for the aim of stopping copyright violations disproportionately infringe on the elemental rights of particular person residents. The case ended up earlier than the Conseil d’Etat (French Supreme Court docket for administrative justice), which determined to refer preliminary inquiries to the CJEU.

The Conseil d’Etat requested whether or not Article 15(1) of Directive 2002/58, learn in mild of Articles 7, 8, and 11 and Article 52(1) of the CFR, needs to be interpreted as prohibiting nationwide legal guidelines that permit a public authority accountable for defending copyright and associated rights, to entry knowledge retained by suppliers of publicly obtainable digital communications providers. These are the IP-addresses and the corresponding civil identification knowledge of the suspected infringers. Moreover, the referring courtroom seeks to know whether or not such entry may be granted with out prior evaluate by a courtroom or impartial administrative physique.

Whereas a substantial a part of the judgment pertains to the authorized permissibility of accessing civil identification knowledge of suspected infringers, our evaluation focuses totally on the retention of and entry to IP addresses. The CJEU does attain some attention-grabbing conclusions concerning the permissibility of entry to customers’ identities, comparable to when (partly) shelling out enforcement authorities from requesting prior evaluate by a courtroom or an impartial administrative physique for the disclosure of these identities. However, in our opinion, no substantial shifts within the CJEU’s coping with civil identification knowledge of communication providers customers happen. In earlier case regulation, the CJEU persistently burdened the broader margin for state authorities to realize entry to info purely revealing a person’s identification in comparison with different site visitors knowledge (Ministerio Fiscal, para. 60; LQDN I, para. 157). From a purely legalistic perspective, the decrease sensitivity attributed to this class of data certainly permits the CJEU to much less controversially scale back the burden on authorities in search of entry to the identification of infringing customers. The identical can’t be stated about its justification for the final retention of and entry to IP addresses serving that finish.

The CJEU’s proportionality evaluation

Any interference with the confidentiality of residents’ digital communications below Artwork. 15 of Directive 2002/58 should fulfil the requirement of proportionality inscribed in Article 52(1) CFR. The CJEU’s evaluation is due to this fact at all times explicitly guided by the target of putting the suitable steadiness between the competing wants of nationwide authorities and the residents’ rights to privateness and knowledge safety, whereas safeguarding the latter’s essence (CJEU Digital Rights Eire, para. 40). Legislative measures imposing basic and indiscriminate knowledge retention necessities on digital communication suppliers, for instance, didn’t move the CJEU’s check (See Digital Rights Eire and Tele2 Sverige).  

Because the EU legislator explicitly supposed the requirement of proportionality as ‘strict’ below the Directive (See Directive 2002/58, Recital 11), the CJEU has demanded that derogations from the fitting to knowledge safety stay ‘strictly mandatory’ (Digital Rights Eire, para. 52; Tele2 Sverige, para. 96). All through the final decade, nevertheless, the CJEU has tended to adapt its strategy in mild of evolving political priorities and technological circumstances. The reasoning adopted within the current case is an illustration of this pattern.

Overview of the CJEU proportionality evaluation in LQDN 2024

As talked about above, the CJEU needed to consider whether or not the French authorized framework secures a proportionate end result in offering Hadopi with the ability to retain and entry civil identification knowledge related to particular person IP addresses of (potential) copyright infringers. The judicial reasoning basically builds on three major elements: (1) the seriousness of the interference, (2) its legit purpose, and (3) the safeguards applied in opposition to abuse.

The seriousness of the interference

First, the CJEU assesses the seriousness of the interference with the rights of the customers entailed by the powers granted by the legislator to the enforcement authorities. For the CJEU, this has often boiled right down to figuring out to what extent the latter are put within the place of “drawing exact conclusions concerning the non-public lifetime of the individual” when retaining and/or accessing their private knowledge (Digital Rights Eire, para. 27; Prokuratuur v H.Ok., para. 45; LQDN II, para. 96). 

An necessary novelty right here is the CJEU’s removing of the “critical interference” label from the final and indiscriminate retention of IP addresses the place these are merely instrumental in revealing the identification of a possible infringer (para. 79). It is a clear departure from its earlier discovering in LQDN I that each retention and entry to IP addresses by default make for a critical interference (para. 153). As of the current judgment, the related issue is as an alternative whether or not there’s a “real” perception that such retention and entry couldn’t result in the fee of a critical interference with the non-public lifetime of the individual involved. Such real perception could be dispelled, as an example, by the suspicion that state authorities may probably hyperlink these IP addresses with different site visitors or location knowledge retained about the identical people (para. 82).

Secondly, in substantiating how this threat may very well be “genuinely dominated out”, the CJEU additionally delineates particular technical and organisational measures to be applied by administrative and regulation enforcement authorities (see Safeguards in opposition to abuse, under). To vital observers, the CJEU’s requirements utilized in earlier rulings to state authorities’ entry to the identification of web customers ought to have raised considerations within the absence of specific safeguards in opposition to on-line profiling.  That is much more evident contemplating the CJEU’s insistence on the necessity of bearing in mind all obtainable datasets “as an entire” when assessing profiling dangers (Ministerio Fiscal, para. 54; LQDN I, para. 184). One may certainly criticise the CJEU’s prior lack of engagement with the technical and procedural safeguards which ought to forestall, or at the least deter, any illegal profiling and cross-referencing of Web customers’ identification with their site visitors knowledge, and specifically their IP addresses. In LQDN I, the CJEU did recognise the potential of monitoring the clickstream of Web customers by IP addresses – liable to disclose extremely delicate info (para. 153) – in addition to the “dangers of abuse and illegal entry” inherent to the mass retention of site visitors knowledge (para. 119). Nonetheless, it avoided elaborating on how the function-creep temptation of state authorities – not to mention the influence of a possible knowledge leak – needs to be concretely mitigated if entry to Web customers’ identities is to be eased. A brand new framework, mentioned under, is elaborated within the current judgment and arguably makes an attempt to fill in these shortcomings.

Not so critical crimes

The second level the CJEU touches upon in its evaluation is the legitimacy of the interference based mostly on the purpose pursued by the state authorities. These could vary from the prevention of nationwide safety threats or critical crimes to unusual crimefighting.

Within the current case, the CJEU takes once more an attention-grabbing detour from its earlier stances on the retention of IP addresses. The CJEU now sanctions the target of combating “legal offences normally”, together with copyright violations, as a legit purpose for retaining IP addresses in a basic and indiscriminate method (para. 85). That is solely topic to the situation that no critical interferences with the non-public lifetime of the affected people happen (para. 82).

Beforehand, the CJEU had affirmed the incompatibility between the purpose of combating unusual crime and the imposition of basic and indiscriminate retention measures for site visitors and site knowledge of subscribers of an digital communications service supplier (Tele2 Sverige, para. 112). Later, in LQDN I, it eased this stance by conceding the legitimacy of broad retention measures focused at site visitors knowledge, together with IP addresses, topic to time limitations (LQDN I, para 168). Nonetheless, such interferences would solely be permitted for the aim of safeguarding nationwide safety, combating critical crime or stopping critical threats to public safety (LQDN I, para 168). Not even an expansive interpretation of the ruling may lengthen this discovering to the target of combating crime normally – till the current judgment, at the least.

The reasoning utilized by the CJEU to navigate the obstacles raised in LQDN I in relation to minor crimes is an attention-grabbing one. As additionally identified in AG Szpunar’s Opinion on the case, the CJEU couldn’t actually squeeze this type of violations below the heading of “critical crime” (AG Opinion, LQDN II, para. 74). The important thing for the CJEU to justify an enlargement of state powers even when coping with unusual offences is the danger of “systemic impunity” that would come up for copyright and associated rights infringement, in addition to analogous types of cybercrimes (LQDN II, para. 119). This might be the undesirable consequence of restraining the final and indiscriminate retention of IP addresses to distinctive circumstances, regardless of this being, within the eyes of the CJEU, the one means for the state to proportionately examine the perpetrators. The applicant organisations did advance extra privacy-friendly options to that finish, together with the potential of figuring out suspects by social media username and exercise. Nonetheless, the CJEU (and the AG) dismisses this, claiming that it might entail an much more critical interference of the information topics’ non-public sphere (para. 121).

Safeguards in opposition to abuse

After having balanced the seriousness of the interference with the pursued legit purpose, the final step of the evaluation within the CJEU’s proportionality evaluation is to have a look at present safeguards in opposition to state abuse below the imputed legal guidelines which can influence the proportionality of the interference in both path.

In sanctioning basic and indiscriminate measures to retain IP addresses and gathering associated civil identification knowledge, the CJEU delineates obligatory safeguards, as already talked about above, which needs to be integrated in nationwide legislative frameworks regulating knowledge retention and entry for the purpose of combating unusual crime. Particularly, the regulation should oblige state authorities to internally silo civil identification knowledge from corresponding site visitors knowledge (para. 86) and to implement technical measures making certain a “genuinely watertight” separation between these classes, by way of safe and dependable pc programs (para. 87). Any lawful linking between totally different datasets must be enabled by an “efficient technical course of” that doesn’t de facto undermine their separation (para. 88). Right here, the CJEU appears to trace to knowledge administration methods comparable to federated knowledge programs or different privacy-enhancing applied sciences (i.e. knowledge masking). The reliability of this course of should finally be topic to periodic evaluate by a reliable public physique which is impartial of the authorities in search of entry to the information (para. 89). Whereas it’s true that earlier judgments already burdened the decisive function of extra safeguards in proportionality assessments, we discover that is the primary time that the CJEU mandates the implementation of an specific technical requirement within the context of Artwork. 15 Directive 2002/58.

In accordance with the CJEU, these technical and organisational measures coupled with the imposition of strict confidentiality duties and a prohibition of profiling residents by way of their IP addresses and clickstreams, would allow a regulatory framework such because the one relevant to Hadopi’s actions to move the proportionality check (para. 122). Furthermore, the CJEU reiterates (see  LQDN I, para. 168) the significance of selling an organisational tradition of information minimisation and storage limitation by way of extra authorized ensures (LQDN II, para. 93).

Conclusion

With LQDN II, the CJEU guidelines in favour of efficient on-line enforcement by nationwide authorities. The judgment does elaborate extra concretely on the technical and organisational measures anticipated of state authorities within the processing of site visitors knowledge of customers of digital communication providers. Alternatively, it additional lowers, what constitutes, in our opinion, an (already mild) burden for nationwide authorities to entry civil identification knowledge of on-line customers.

What ought to strike from this judgment, nevertheless, is the outcome-based reasoning adopted by the Court docket in justifying the undermined safety for customers’ IP addresses. In comparison with earlier case regulation, the retention of and entry to IP addresses for regulation enforcement functions now not entail a critical interference and are justified for combating any type of on-line legal exercise, whether or not critical or not. The one requirement is that nationwide regulation topics enforcement authorities to technical and organisational safeguards dispelling the dangers of particular person profiling.

Typically, that is an attention-grabbing case of how the CJEU invests in knowledge safety accountability to supply extra slack for governments’ extension of legit on-line enforcement powers.  For La Quadrature du Web, as an alternative, the judgment dodges the elemental rights-nature of the questions requested and doesn’t obtain something greater than digging on-line anonymity a ‘little additional’ into its grave.