French Council of State (Conseil d’État), French Data Network and others, Nos. 393099, 394922, 397844, 397851, 424717, 424718, 21 April 2021

Right to a private life. Storage of information by service providers. Limits to the invasion of private life for the protection of national security.

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications)
Art. 10-13 code des postes et des communications électroniques (France)
Decree 2015-1185 (France)

The decision of the Presidency of the Council of Ministers, refusing to abrogate article R. 10-13 of the Code of postal and electronic communications and the decree of 25 February 2011 on the storage and communication of data identifying any person, is annulled. The Council gives the government six months to change the law disposing on the surveillance of any content posted online  as far as they don’t limit the storage (generalized and indiscriminate) of personal data different from the identity of the data, the contact and payment details, contract data, account data and IP addresses, to the only aim of protecting national security, and as far as they don’t provide for a periodical review of the existence of a “serious, real, and current or foreseeable threat to national security”.