[Home] [Databases] [WorldLII] [Search] [Feedback] EPIC --- Privacy and Human Rights Report

EPIC --- Privacy and Human Rights Report 2006

French Republic

Constitutional Privacy Framework

The right of privacy is not explicitly included in the French Constitution of 1958. The Constitutional Court ruled in 1995 that the right of privacy was implicit in the Constitution,[2371] and confirmed this in 1999, by stating that the freedom proclaimed in Article 2 of the 1789 Declaration of the Rights of Man and the Citizen ("Déclaration des droits de l'homme et du citoyen de 1789") implies the respect of privacy.[2372]

Data Protection Framework

The Data Protection Act, enacted in 1978 and amended in 2004, covers personal information held by government agencies and private entities.[2373] This Act provides that anyone wishing to process personal data must register and obtain permission in many cases relating to processing by public bodies and for medical research. Individuals must be informed of the reasons for collection of information and may object to its processing either before or after it is collected. Individuals have rights to access information being kept about them and to demand the correction and, in some cases, the deletion of this data. Fines and imprisonment can be imposed for violations.

Data Protection Authority

The data protection authority is the Commission nationale de l'informatique et des libertés (CNIL), an independent agency that enforces the Data Protection Act and other related laws.[2374] The Commission takes complaints, issues rulings, sets rules, conducts audits, makes reports, and ensures the public access to information by being a registrar of all data controllers' processing activities. In addition, the 2004 amendments to the Data Protection Act allow the CNIL to investigate data processes, issue warnings, and impose sanctions (by fines of up to 150,000 EUR). In 2006 the CNIL issued its first financial sanction against la banque Crédit Lyonnais, (45,000 EUR) for violating its customers’ right of access to their personal data.[2375]

The CNIL has more limited powers over large government information systems known as "sovereignty files."[2376] Sovereignty file systems, defined to include files relating to the safety of the State, defense, public security or penal repression, or those that use the NIR (social security number), do not require CNIL approval.

The CNIL handled over 70,000 files in 2006; the CNIL has seen a 570% increase in its activity since 2003. The CNIL received 5,372 complaints, and issued 299 rulings in 2006. During that year, the CNIL also issued 11 fines, totaling 168,000 EUR, 7 injunctions, 94 other sanctions, and 2 warnings. The CNIL has handled a total of 1,160,000 files since 1978. Key issues addressed by the CNIL in 2006 included the use of biometrics, particularly in identity documents; spam and direct marketing; and video surveillance.[2377]

Statutory Rules Related to Privacy

The tort of privacy was first recognized in France as far back as 1858[2378] and was added to the Civil Code in 1970.[2379] There are additional specific laws on administrative documents,[2380] archives,[2381] video surveillance,[2382] correspondence,[2383] and employment.[2384] There are also protections incorporated in the Penal Code.[2385]

The Internal Safety Law[2386] ("Loi pour la sécurité intérieure") promulgated on March 18, 2003, has extended the list of infractions leading to a record in the National Computerized File of Genetic Data (Fichier national automatisé des empreintes génétiques or FNAEG), as well as the list of persons whose genetic data may be kept in the FNAEG or compared to its content. At its creation in 1998, the FNAEG was restricted to genetic data of persons who were condemned for serious sexual crimes, like rape and child abuse. After successive extensions of its use, it may now contain genetic data of persons simply suspected (but not yet condemned) of almost all infractions related to prejudice against property or people. While the CNIL has obtained a few minor improvements to this regime (e.g., the maximum duration of data retention limited to 25 years instead of 40), the FNAEG remains a strong concern in France.

During 2006 the use of FNAEG reached an unprecedented level. Following 2005 and 2006 protests that took place in various urban neighborhoods throughout France, many individuals were compelled to register their information in the FNAEG, effectively expanding the database to include a register of “civil disobedience.”[2387] Police decided who would be registered, and there was no judicial process authorizing the selection. Failure to oblige with the request carries a penalty of up to 15,000 EUR and up to one year in prison.[2388]

Furthermore, a new national file has been added to the many files already in place, with the adoption in March 2004 of the "Perben II Law"[2389] (Loi portant adaptation de la justice aux évolutions de la criminalité).[2390] It creates the National judicial computerized record system of sexual offenders (Fichier judiciaire national automatisé des auteurs d'infractions sexuelles or FNAIS). This file records, for up to 30 years, the identity and addresses of persons (including minors) who have committed all kinds of sexual offenses, except exhibitionism and sexual harassment. The records system can only be consulted by judicial authorities and specific government agencies.

Wiretaps and Surveillance Rules

Electronic surveillance is regulated by a 1991 law that requires permission of an investigating judge before a wiretap is installed. The duration of the tap is limited to four months and can be renewed.[2391] The law created the Commission nationale de contrôle des interceptions de sécurité (CNCIS), which sets rules and reviews wiretaps each year. In 2006, law enforcement conducted 5,985 interceptions (4,176 new interceptions and 1,809 renewals). This represents a 3.5% increase over 2005. There was a 15% decrease in 2006 in emergency interception requests (714 requests compared to 854 in 2005).[2392]

On March 13, 2007, the Conseil d'État, the French highest administrative court, cancelled a ministerial order (“Arrêté”) by which the Interior Ministry created the ELOI file, a database aimed at facilitating the expulsion of illegal migrants. While the database creation itself was allowed by the French code on immigration and asylum, NGOs argued that the ELOI file would contain excessive and inadequate personal data on foreigners, their children, the citizens with whom they were staying, and, for those in retention centers, their visitors. Moreover, this data would be kept for an excessive duration. The Conseil d'État’s order was based on a procedural issue and did not address privacy concerns; as a result, the French Ministry of Interior announced the next day that it plans to resubmit a new draft text.[2393]

The Daily Safety Law (LSQ) requires Internet Service Providers (ISPs) to store log files on all their customers' activities for up to one year. Moreover, the government has access to private encryption keys, import and export of encryption software are restricted, and strict sanctions are imposed for using cryptographic techniques to commit a crime.

In addition to the LSQ, the LEN also provides for data retention provisions. The concerned data are personally identifying information (including name, address, and log data). ISPs (host and access providers) are required to collect and keep identification and log data of their subscribers. These data are covered by the "professional secret," so that they may only be disclosed upon judicial request. The law also requires all persons wishing to post content on the Internet to identify themselves, either to the public, by publishing their name and address on their website (in the case of a business), or to their host provider (in the case of a private individual). These provisions will enter into force when their implementing decrees (décret d'application) are published. In addition, the LEN now includes the LSQ provisions on cryptography, with the following two additions: first, a lower penalty is applicable (jail and fine) in cases where cryptography has been used to commit or prepare an infraction, where the suspect herself provided decryption keys to the police, thus allowing for self-incrimination; second, some uses of cryptography for research or professional purposes are not specifically mentioned anymore, therefore assimilating these categories of people to cybercriminals, when they conduct such activities.[2394]

A new Anti-Terror Act was enacted on January 23, 2006.[2395] It grants increased powers to the police and intelligence services, allowing them to directly get telecom data from ISPs.[2396] It also extends telecom data retention possibilities, by assimilating cybercafe owners and WiFi providers (whether for free or with payment) such as bars, restaurants and hotels to telecom operators. Any logged data may be seized directly by the police, without any judicial order, “in order to prevent acts of terrorism.” It extends the use of video surveillance, authorizing private parties to install CCTV cameras in public places “likely to be exposed to terrorist acts” and in places open to the public when they are “particularly exposed to risks of aggression or theft.” In case of emergency, CCTV cameras may be installed prior to any authorization. Furthermore, the Act allows the police to automatically monitor cars on French roads and highways, taking pictures of license plates and people in the cars, with various purposes ranging from the fight against terrorism to the identification of stolen cars.[2397] The same article provides for the monitoring of street gatherings during “big events.” Finally, the Act provides that the Ministry of the Interior may process PNR (passenger name records) data collected on any travel by air, sea or rail to or from non-EU countries.[2398] This article’s objective is “to improve border controls and to fight against illegal immigration.”[2399]

Soon after the adoption of this Anti-Terror Act, in March 2006, the long-awaited application decree regarding the data retention provisions of the LSQ, adopted in November 2001, was published — almost 5 years after their introduction in so-called emergency.[2400] This decree also provides for application measures of some articles of the Anti-Terror Act. It determines the duration of data retention by telecom operators, setting it to the maximum time allowed by the LSQ (one year) and the type of data to be retained (all kinds of data involved in a telephone or Internet communication, except its content).

These provisions may be extended in the future with a new decree, the draft version of which was published in April 2007 by the French digital rights NGO IRIS. The draft would require webmasters, hosting companies, fixed and mobile telephony operators and Internet service providers to retain all information on Internet users and telephone subscribers and to deliver it to the police or the State at a simple request, and would even require retaining the passwords supplied when subscribing to a telephone service or an Internet account or payment details such as amount, date or type. The draft text establishes that the data retained by ISPs and hosting companies and obtained by the police can be kept by the latter for a period of three years in the automatic processing systems provided by the Ministry of Interior and the Ministry of Defense. Civil liberties organizations, ISP associations and major content providers organizations strongly opposed the provisions of this draft decree.[2401]

Although the draft decree may be revised following the opposition it raised, a major French daily newspaper revealed in June 2006 that the police and intelligence services have already set up their own technical platform allowing them to easily collect traffic data related to text messages, mobile or Internet. Security services are now in the position of knowing who has contacted whom, when and where and, by a simple click, they can obtain from the telephone operators the list of all calls from and to a subscriber. They can obtain the subscription documents of the respective person with address and bank information and can also require all the Internet sites or forum addresses the respective person has accessed. The March 2006 Anti-Terror Act makes this platform lawful.[2402]

The French Data Protection Act allows intellectual property rights societies to create private records of rights infringers through the collection of their IP addresses in P2P networks; however, the use of automatic software for such a collection is subject to CNIL approval. The CNIL decided in October 2005 to reject the introduction of surveillance devices, proposed by Sacem and other 3 author and producer associations, for the automatic tracing of infringements of the intellectual property code. This decision was cancelled by France’s highest administrative court, the Conseil d’État, on May 23, 2007. The court found that the proposed devices are not disproportionate, and are acceptable considering the extent of piracy occurring in France. The author and producer associations must resubmit their request to the CNIL, but the proposal now has a high chance of success, given the Conseil’s ruling.[2403]

National Identity Card Systems

The French biometric ID card project (INES) is still in a frozen state after it received strong criticisms from civil rights NGOs and the French Data Protection Authority, and through a report synthesizing a public debate commissioned by the Ministry of Interior. The only public presentation document of the project is dated March 2005. According to this document, the project aimed at providing the whole population with a new ID card by 2007, with a contact-less chip containing the civil status of the citizen as well as two biometric identifiers: photograph and fingerprints. These data would be filed in centralized databases. The card would be mandatory and would also include the address of the holder. It would also be programmable, to become an electronic portfolio that could be used for e-administration as well as commercial electronic transactions.[2404]

The use of biometric identifiers is increasing for immigration and border control.[2405] Since November 2003, the Immigration Law has set out the use of biometric techniques for visa delivery and border controls, and the storing of all visa requesters' fingerprints and biometric pictures in databases for further processing. As part of the implementation of this law, and at the request of the European Commision, an experimental file was created from November 2004 to November 2006 as a complement to the French worldwide visa requests management system called RMV2 (Réseau Mondial Visas 2). The RMV2 links central administration to French Consulates abroad and communicates with the Schengen Information System (SIS). This experimental file contains the digitized photograph and all fingerprints of persons who requested visas at select French consulates during that time period. These data are retained for two years for a short-stay visa request, five years for a long-stay visa request or in case of visa denial. Access to this file is allowed to some border police officers at some French airports, harbors or land frontiers. Biometric identifiers may be included in an electronic chip on the visa. In 2006, a new decree further extended the use of the file so as to allow identity controls by the police everywhere in France, not only upon entry at the borders. The same decree also extended the collection of biometric identifiers of other EU member State consulates, and the access of these data to other police officers than border control ones.[2406]

France has issued biometric passports since March 30, 2006, following ICAO requirements. Because the chip included in the passport only contains a digitized photograph, as provided by a December 30, 2005 Decree, and does not include fingerprints, it is officially called an “electronic” passport. In February 2007, the government crated the “National Agency for secured identity documents.” The agency’s missions include the definition, control and assessment of technical standards and tools used for the creation of electronic and biometric identity and travel documents.[2407]

Medical Privacy

Computerized Patient Records (CPR) were created by law in 2004 for the entire population of France. In its study published in April 2007, the CNIL found a serious lack of data protection and many security breaches in the process, and called for reinforced security measures. Furthermore, the Ministry of Health proposed a modification to the law in 2006 that would use individuals’ social security numbers (NIR) to identify and link medical records. Civil rights NGO strongly protested against this project, as it would breach privacy rights by facilitating the interconnection between medical data and other personal data contained in various national files.[2408] The CNIL proposed in its conclusions the use of a different identifying number, derived through a non-reversible anonymization process; however, the government has not yet responded to CNIL’s statements.[2409]

NGOs’ Advocacy Work

In January 2007, the jury of the French Big Brother Awards presented seven of the famous negative Big Brother Awards to name and shame projects, people, institutions and companies for destroying privacy and promoting control. The winners were: sub-prefect in charge of security in the Seine St. Denis neighborhood, where the Charles de Gaulle de Roissy airport is located. Without cause or process, he denied thousands of individuals the chance of employment because he suspected that they had terrorist associations. Sony-BMG received its award for having embedded “rootkit” spyware into its audio CDs. The Mayor of Ploërmel was given his award for his enthusiastic use of video surveillance (50 cameras in a village of 9000 people). The Minister of Justice earned the Life Menace Award for his work on the sexual offender GPS tracking bracelet.[2410]

The Novlang Award was invented by the French organizers to honor the creative use of language to hide the real meaning, accurately described in George Orwell’s novel 1984 as “newspeak.” The Director of the Criminal Investigation Dept. received the 2006 Novlang prize for encouraging the expansion of the collection of genetic data on the entire population.

Freedom of Information

As far as access to information is concerned, two laws in France provide for a right to access administrative documents held by public bodies.[2411] The Commission d'accès aux documents administratifs (CADA)[2412] is charged with enforcing the acts.[2413] It can mediate and issue recommendations but its decisions are not binding. According to the CADA, 4,900 inquiries in 2000 and 5,400 in 2004.[2414] The law was amended in April 2000 to clarify access to legal documents and also identify the civil servant processing the request.[2415]

An ordinance was adopted in June 2005 to amend the 1978 law to implement the EU Directive on the re-use and commercial exploitation of public sector information (2003/98/EC).[2416] It also made a number of other changes to the law including setting out the structure and composition of the Commission, requiring bodies to appoint a responsible person, and allowing access in electronic form.[2417]

Voting Privacy

Voting is open to those 18 years or older, but is not mandatory. Although the right to privacy is not enumerated in the French Constitution, the French Constitutional Court ruled in 1994 that it is implied.[2418] The French Electoral Code requires voters to cast their vote in total confidentiality.[2419] Reform of the French electoral legislation leaves the regulation of electronic elections to the High Council for French Expatriates (CSFE). In 1993, the CNIL adopted recommendations on electronic voting systems.[2420] The recommendations warn about the need to maintain rigorous measures for the separation of the voter's identity and his vote.[2421] During the last presidential elections, 1.44 million voters used electronic voting machines.[2422] The “association Ordinateurs de vote,” an NGO dedicated to voter privacy circulated a petition opposing electronic voting machines. As of June 2007, the petition had over 86,000 signatures.[2423]

In September 2000, France allowed for the first time Internet voting on a five-year term referendum in the City of Brest.[2424] There are concerns regarding Internet voting and about voters not being intimidated or denied privacy in casting their ballots.[2425] On December 11, 2002, 860 volunteers participated in an Internet voting project conducted by the EU in the city of Issy-les-Moulineaux.

International Obligations

France is a member of the Council of Europe (CoE) and has signed and ratified the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data (ETS No. 108)[2426] and the European Convention for the Protection of Human Rights and Fundamental Freedoms.[2427] France has ratified on January 10, 2006 the Council of Europe Convention on cybercrime and its additional protocol against racism and xenophobia. Both texts entered into force in the country on May 23, 2006.[2428] France is a member of the Organization for Economic Cooperation and Development (OECD) and has adopted the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.

[2371] Décision 94-352DC du Conseil constitutionnel du 18 Janvier 1995, available at <http://www.conseil-constitutionnel.fr/decision/1994/94352dc.htm> (in French).
[2372] Décision 99-416DC du Conseil constitutionnel du 23 juillet 1999, available at <http://www.conseil-constitutionnel.fr/decision/1999/99416/index.htm> (in French).

[2373] Loi n° 78-17 du 6 janvier 1978, Loi relative à l'informatique, aux fichiers et aux libertés, available at <http://www.cnil.fr/index.php?id=301> (in French).

[2374] Homepage <http://www.cnil.fr>.
[2375] See "Première sanction pécuniaire prononcée par la CNIL," September 9, 2006, available at <http://www.cnil.fr/index.php?id=2104>.

[2376] Stéphane Foucart, "Les pouvoirs de la CNIL devraient être considérablement amoindris," Le Monde, July 14, 2004, available at <http://www.lemonde.fr/web/recherche_articleweb/1,13-0,36-372444,0.html> and "La nouvelle loi Informatique et libertés autorise le fichage des internaures," Le Monde, July 17, 2004, <http://www.lemonde.fr/web/recherche_articleweb/1,13-0,36-372827,0.html>.

[2377] CNIL Annual Report 2006, available at <http://www.cnil.fr/fileadmin/documents/La_CNIL/publications/CNIL-27erapport-2006.pdf> (in French).

[2378] The Rachel affaire. Judgment of June 16, 1858, Trib. pr. inst. de la Seine, 1858 D.P. III 62. See Jeanne M. Hauch, Protecting Private Facts in France: The Warren & Brandeis Tort is Alive and Well and Flourishing in Paris, 68 Tul. L. Rev. 1219 (May 1994).
[2379] Civil Code, Article 9, Statute No. 70-643 of July 17, 1970.
[2380] Loi n° 78-753 du 17 juillet 1978 portant diverses mesures d'amélioration des relations entre l'administration et le public et diverses dispositions d'ordre administratif, social et fiscal (Journal officiel, July 18, 1978, at 2851), available at <http://www.cnil.fr/textes/text05.htm> (in French).
[2381] Loi n° 79-18 du 3 janvier 1979 sur les archives (Journal officiel, January 5, 1979, at 43, erratum at Journal officiel, January 6, 1979, at 55) (in French).
[2382] Loi d'orientation et de programmation n° 95-73 du 21 janvier 1995 relative à la sécurité (Journal officiel, January 24, 1995, at 1249), available at <http://www.cnil.fr/textes/text054.htm>; see also Décret n° 96-926 du 17 octobre 1996 relatif à la vidéo-surveillance pris pour l'application de l'article 10 de la loi n° 95-73 du 21 janvier 1995 d'orientation et de programmation relative à la sécurité (Journal officiel, October 20, 1996, at 15432), available at <http://www.cnil.fr/textes/text055.htm>, and Circulaire du 22 octobre 1996 relative à l'application de l'article 10 de la loi n° 95-73 du 21 janvier 1995 d'orientation et de programmation relative à la sécurité (décret sur la vidéosurveillance) (Journal officiel, December 7, 1996, at 17835), available at <http://www.cnil.fr/textes/text056.htm> (in French).
[2383] Code of Post and Telecommunications, L. 41.
[2384] Loi n° 92-1446 du 31 décembre 1992 relative à l'emploi, au développement du travail à temps partiel et à l'assurance chômage. (Journal officiel, January 1, 1993, at 19).
[2385] Penal Code, Article 368.

[2386] Loi n° 2003-239 du 18 mars 2003, Loi pour la sécurité intérieure, available at <http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=INTX0200145L> (in French).

[2387] "Les insoumis du fichier génétique,” dossier de candidature au Prix Voltaire des Big Brother Awards France, available at <http://bigbrotherawards.eu.org/Les-insoumis-du-fichier-genetique-FNAEG.html>; see also L'association "Refus AND," <http://refusadn.free.fr>.
[2388] Le Figaro, 16 mai 2007, available at <http://www.lefigaro.fr/france/20070516.FIG000000039_prelevements_de_salive_le_front_du_refus_s_organise.html>.

[2389] Called "Perben II" after the name of the French Minister of Justice, Dominique Perben.
[2390] Loi n° 2004-204 du 9 mars 2004, Loi portant adaptation de la justice aux évolutions de la criminalité, available at <http://www.legifrance.gouv.fr/citoyen/jorf_nor.ow?numjo=JUSX0300028L> (in French).

[2391] Loi n° 91-646 du 10 juillet 1991 relative au secret des correspondances émises par la voie des communications électroniques. available at <http://www.legifrance.gouv.fr/WAspad/Visu?cid=20655&indice=1&table=CONSOLIDE&ligneDeb=1> (in French).
[2392] Commission nationale de contrôle des interceptions de sécurité - 15ème rapport d'activité 2006, 21 mars 2007, available here <http://www.ladocumentationfrancaise.fr/rapports-publics/074000237/index.shtml> (in French).

[2393] Text of the Conseil d’Etat decision of March 13, 2007, available at <http://www.conseil-etat.fr/ce/jurispd/index_ac_ld0712.shtml>; see also EDRigram n°5.7, 14/03/07: “French High Court Cancels The Creation Of Illegal Migrants Database”, available at <http://www.edri.org/edrigram/number5.5/france-cancels-database>.

[2394] The LEN has also added a definition of electronic mail, as part of the transposition of the EU Directive on Privacy and Electronic Communications (2002/58/EC). This definition does not provide that e-mail is a correspondence, notwithstanding the fact that all the legislation on privacy (including the already cited 1991 law) refers to correspondence.

[2395] Loi n° 2006-64 du 23 janvier 2006 relative à la lutte contre le terrorisme et portant dispositions diverses relatives à la sécurité et aux contrôles frontaliers, available at <http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=INTX0500242L>.
[2396] Id. at Art.6.
[2397] Id. at art. 8.
[2398] Id. at art. 7.
[2399] See generally EDRigram n°4.2, 02/02/06: “French Anti-Terrorism Law Not Anti-Constitutional,” available at <http://www.edri.org/edrigram/number4.2/frenchlaw>.

[2400] Décret n°2006-358 du 24 mars 2006, relatif à la conservation des données des communications électroniques, available at <http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=JUSD0630025D>; see also EDRigram n°4.6, 29/03/06: “Telecom Data To Be Retained For One Year In France,” available at <http://www.edri.org/edrigram/number4.6/franceretantion>.

[2401] Projet de décret portant application de l'article 6 de la loi n°2004-575 du 21 juin 2004 pour la confiance dans l'économie numérique (document de travail version de janvier 2007), available at <http://www.iris.sgdg.org/actions/len/ProjetDecretLCEN0107.pdf>; see also EDRigram n°5.8, 25/04/07: “French Government Decree On Data Retention - Another Big Brother Act,” available at <http://www.edri.org/edrigram/number5.8/france-data-retention>.

[2402] Le Figaro, 28/05/07, available at <http://www.lefigaro.fr/france/20070528.WWW000000165_lantiterrorisme_espionne_aussi_mails_et_textos.html>; see also EDRigram n°5.11, 06/06/07: “The French Ministry of Interior has a new interception platform,” available at <http://www.edri.org/edrigram/number5.11/french-interior-interceptation>.

[2403] CNIL press release of May 25, 2005, available at <http://www.cnil.fr/index.php?id=2221&news[uid]=464&cHash=57a0f43bbe>; see also EDRigram n°5.11, 06/06/07: “French State Council allows tracing P2P users”, available at <http://www.edri.org/edrigram/number5.11/france-tracing-p2p>.

[2404] See website of the NGO campaign with relevant documents, available at <http://www.ines.sgdg.org/>.

[2405] Loi n°2003-1119 du 26 novembre 2003. relative à la maîtrise de l'immigration, au séjour des étrangers en France et à la nationalité, available at <http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=INTX0300040L> (in French); Décret 2004-1266 du 25 novembre 2004 portant création à titre expérimental d'un traitement automatisé des données à caractère personnel relatives aux ressortissants étrangers sollicitant la délivrance d'un visa, available at <http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=INTD0400325D> (in French).
[2406] Décret 2006-470 du 25 avril 2006 modifiant le décret n° 2004-1266 du 25 novembre 2004, available at <http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=INTD0600085D> (in French).

[2407] Décret n° 2005-1726 du 30 décembre 2005 relatif aux passeports électroniques, available at <http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=INTD0500343D>; Décret n° 2007-240 du 22 février 2007 portant création de l'Agence nationale des titres sécurisés, available at <http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=INTA0700020D> (in French).

[2408] The NGOs’ petition had reached 12,000 signatures by May 2007.
[2409] CNIL conclusions on the CPR experimentation, April 14, 2007, available at: <http://www.cnil.fr/index.php?id=2212> (in French); see also EDRigram n°4.23, 06/12/06: “France - Using Social Security Number To Identify Medical Records”, available at <http://www.edri.org/edrigram/number4.23/nir>.

[2410] See BBA France press release, 20 janvier 2007, available at <http://bigbrotherawards.eu.org/Palmares-2006-des-Big-Brother-Awards-France.html>.

[2411] Loi n° 78-753 du 17 juillet 1978 sur la liberté d'accès au documents administratifs; Loi N° 79-587 du juillet 1979 relative à la motivation des actes administratifs et à l'amélioration des relations entre l'administration et le public. Amended by Loi N° 2000-321 du 12 avril 2000 relative aux droits des citoyens dans leurs relations avec les administrations (Journal officiel, April 13, 2000).
[2412] <http://www.cada.fr>.
[2413] 12e rapport d'activité 2002. Commission d'accès aux documents administratifs, July 2003, available at <http://www.ladocumentationfrancaise.fr/brp/notices/034000645.shtml>.
[2414] For more details, see David Banisar, Freedom of Information and Access to Government Records Around the World, available at <http://www.freedominfo.org/survey.htm>.
[2415] Loi n° 2000-321 du 12 avril 2000 relative aux droits des citoyens dans leurs relations avec les administrations (J.O. April 13, 2000).

[2416] Ordonnance n° 2005-650 du 6 juin 2005 relative à la liberté d'accès aux documents administratifs et à la réutilisation des informations publiques, available at <http://admi.net/jo/20050607/JUSX0500084R.html>.
[2417] See freedomofinfo.org Country Survey – France, available at <http://www.freedominfo.org/countries/france.htm#4>.

[2418] Décision 94-352 du Conseil Constitutionnel du 18 Janvier 1995, available at <http://www.conseil-constitutionnel.fr/decision/1994/94352dc.htm>.
[2419] European Commission, CyberVote Report Chapter 3: "The Election regulations today," July 1, 2001, available at <http://www.eucybervote.org/Reports/KUL-WP2-D4V2-v1.0-02.htm>.

[2420] Commission Nationale de l'informatique et des libertés (CNIL), Vote électronique, July 1, 2003, available at <http://www.cnil.fr/index.php?id=1009>.

[2421] Id.
[2422] Machines à voter ou machines à truquer?" Politis, 8 mars 2007, available at <http://www.politis.fr/Machines-a-voter-ou-machines-a,527.html>.
[2423] See <http://www.ordinateurs-de-vote.org/petition/>. Pierre Muller, founder of the organization, received le Prix Voltair, a positive Big Brother Award, for his work in this area. See <http://bigbrotherawards.eu.org/Pierre-Muller-le-webmaster-de-Ordinateurs-de.html>.

[2424] European Commission, Cybervote Report, An Innovative Cyber Voting System, supra.
[2425] "What is the Future of Electronic Voting in France, Recommendations," September 26, 2003 available at <http://www.foruminternet.org/telechargement/documents/reco-evote-en-20030926.htm>.

[2426] Signed January 28, 1981; ratified March 24, 1983; entered into force October 1, 1985.
[2427] Signed November 11, 1950; ratified May 3, 1974; entered into force May 3, 1974.
[2428] Council of Europe. Convention on Cybercrime, CETS N°185 available at <http://conventions.coe.int/Treaty/Commun/ListeTraites.asp?CM=1&CL=ENG&NT=185>. Décret n°2006-580 du 23 mai 2006 portant publication de la Convention sur la cybercriminalité, faite à Budapest le 23 novembre 2001, available at <http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=MAEJ0630050D>.