WRITTEN QUESTION P-1427/98

by Astrid Thors (ELDR) to the Commission

(29 April 1998)

Subject: French legislation on encryption technologies

French telecommunications legislation significantly restricts the use of encryption technologies, as pointed out in the Commission's communication on encryption and digital signatures. Two regulations have just entered into force in France laying down conditions governing the use of such technologies and introducing a notification or licensing procedure in the sector. The restrictions include a provision that the majority of members of the board of administration of the TTP (trusted third party), which has to exist if encryption is to be permitted, must be French citizens. Furthermore, the encryption keys must be held by a TTP, which could mean that a message appearing in its converted form on a PC cannot legally be used in France.

Does the Commission consider the rules and state of affairs described above to be compatible with the provisions governing the internal market and, if not, what steps will it take to guarantee the right to provide services and to ensure that the confidentiality of communications can be maintained on French territory?

Answer given by Mr Monti on behalf of the Commission

(11 June 1998)

The French authorities notified in accordance with Council Directive 83/189/EEC of 28 March 1983 laying down a procedure for the provision of information in the field of technical standards and regulations(1) the four draft decrees concerning the implementation of the cryptography provisions of the French telecommunications law. The Commission commented in all four cases on the draft legislation. Recently, the French authorities formally adopted the decrees.

The French legislation distinguishes between, on the one hand, confidentiality products and services and, on the other hand, authentication, i.e. digital signatures, products and services.

With regard to confidentiality products and services the French legislation provides rules on their use, on the supply of low security products, on service providers established in France and on other supplies as products or services. Following the Commission's interpretation, there are no restrictions on their use if an authorised service provider is used, otherwise prior authorisation is needed. The supply of low security products is subject to a prior declaration procedure. Service providers established in France are obliged to meet a special prior authorisation procedure and for other supplies of products or services a prior authorisation procedure is stipulated.

The special prior authorisation procedure concerning providers of confidentiality services established on French territory does not contain, in the version which has been adopted, the requirement that a majority of the members of the board must possess French nationality. The decree only requires that the service providers employ a sufficient number of staff qualifying under decree 81-514 concerning the protection of defence and national security secrets.

The Commission reconfirms the position taken in the communication on digital signatures and encryption(2), which made clear that it would monitor closely the behaviour of Member States in the field of cryptography and assess the relevant national provisions with regard to their compatibility with the EC Treaty, the case law of the Court of justice and the requirements imposed by Directive 95/46/EC of the Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(3) and Directive 97/66/EC of the Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector(4).

(1) OJ L 109, 26.4.1983.

(2) COM(97) 503 final.

(3) OJ L 281, 23.11.1995.

(4) OJ L 24, 30.1.1998.