Jean-Marc Ayrault
Prime Minister
Hôtel de Matignon
57, rue de Varenne
75700 Paris
France
Paris, August 1, 2013
Re: Data surveillance claims and the right to privacy
Dear Prime Minister,
In recent weeks Human Rights Watch has expressed serious concerns about reports that intelligence agencies in the UK and the US have intercepted and collected vast amounts of phone and internet data from millions of people in breach of their right to privacy. Copies of those statements are annexed to this letter. These allegations raise questions about the role of other governments which may have been cooperating with and receiving data from those two countries.
In light of the seriousness of these reports, and of allegations that French intelligence agencies are carrying out similar interception, Human Rights Watch considers it essential that the French government clarifies how the system of interception operates in France, and what safeguards are in place to ensure intelligence agencies act within the law and respect the right to privacy of all.
In an article published on July 4, 2013, Le Monde claimed that French intelligence agencies are systematically collecting metadata from phones and computers in France, as well as data on communications between people in France and abroad.
We are aware of your office’s response that the claims by Le Monde are incorrect, and that interceptions by the French intelligence agencies fall under the Law of 1991 on the Secrecy of Electronic Communications—now codified in the Code of Internal Security—according to which interceptions are subject to an authorisation by the Prime Minister, following an opinion by the National Commission for the Control of Security Interceptions (CNCIS).
However, we believe the French government should provide a more detailed response, in particular in the following five areas.
Firstly, what is the jurisdiction of the law of 1991? In response to the article published by Le Monde, Jean-Jacques Urvoas, Chairman of the National Assembly’s Law Commission and member of the CNCIS, and, issued a statement on July 4 indicating that “French citizens are not subjected to mass and permanent spying outside any oversight.” Can you confirm that only metadata or communications by French citizens fall under the law of 1991? If so, what procedure applies to metadata or communications by non-French citizens, and what safeguards are in place to ensure that French intelligence agencies respect their right to privacy?
Second, could you clarify what falls under article L241-3 of the Code on internal security, which excludes “measures taken by public authorities, for the sole purpose of defending national interests, to ensure surveillance and control of transmissions by radio” from the procedure on interceptions? Does this article apply to transmissions from mobile phones, wireless internet connections, or other types of transmissions? If surveillance of mobile phones or wireless internet connections is excluded, then what protections are in place to guard against arbitrary intrusions on privacy or other misuse related to surveillance of these networks?
Third, article L242-2 gives the Prime Minister the authority to determine the maximum number of interceptions which can be carried out at any given time. According to a parliamentary report on the legal framework applicable to the intelligence services, published in May 2013, in October 2008 the CNCIS redefined this quota as relating to the maximum number of people targeted by interceptions. Can you confirm that such a quota is still in place? If so, how many interceptions are currently allowed simultaneously, how many individuals or devices are targeted, and according to what criteria is the quota is determined?
Fourth, does French law on interception apply to data intercepted or collected by other countries and then communicated to the French intelligence agencies? If so, is the procedure the same as for data gathered by French intelligence agencies? If not, which procedure applies in such cases and what oversight mechanisms are in place to guard against privacy breaches and other misuse? It is also important that the government clarify whether French intelligence agencies cooperated with the National Security Agency’s Prism program?
Fifth, the parliamentary delegation for intelligence (Délégation parlementaire au renseignement), created in 2007, has a very weak mandate. It can only evaluate the general activities of the intelligence services, has limited access to information from the authorities, and can only summon heads of intelligence services and not their staff. As Jean-Jacques Urvoas, who is also vice-president of the DPR, pointed out in his statement, “as the law currently stands the parliament is unable to know the real actions of the intelligence services and is limited to commenting on budgetary and general issues.” Human Rights Watch has previously expressed concerns about the lack of adequate parliamentary oversight of intelligence services in France in the context of intelligence cooperation with countries with poor records on torture. In June President Hollande announced that an inspectorate of the intelligence services would be created, and that the powers of the parliamentary delegation would be broadened so as to strengthen its oversight. Can you confirm what the timeline is for these plans, and what steps are being taken to ensure that oversight of the security services is effective and independent?
As you know, the European Convention on Human Rights requires that any interference by a public body, with the right to privacy musthave an appropriate legal basis and be necessary and proportionate.
In a report of April 2013 the UN Special Rapporteur on freedom of opinion and expression, Frank La Rue, urged States to regard communications surveillance as “a highly intrusive act that potentially interferes with the rights to freedom of expression and privacy and threatens the foundations of a democratic society.”
We would welcome any other information as to how the French government ensures these requirements are respected by intelligence agencies and by your services for the collection, storage and use of data relating to individuals in France and abroad.
Yours sincerely,
Jean-Marie Fardeau Hugh Williamson
France Director Europe and Central Asia Director
Cc:
Minister of Defense
Minister of the Interior
Minister of Justice
Minister of Foreign Affairs
President of the National Commission for the Control of Security Interceptions
President of the Parliamentary Delegation for Intelligence
President of the National Assembly’s Law Commission
President of the Senate’ Law Commission
President of the Human Rights National Consultative Commission
Defender of Rights
