Thread by @ChloBemy

.@edri member @laquadrature is today at the CJEU on the #HADOPI case to defend to right to privacy and anonymity online.

Member States are stubbornly demanding the Court to reopen its case law to enable #MassSurveillance

https://twitter.com/laquadrature/status/1658012087447085056

@edri @laquadrature The HADOPI case basically asks the question whether retention and access to IP addresses associated with civil identity data and the content of a communication (a file shared via P2P) are considered 'serious interferences with privacy rights'

@edri @laquadrature A dozen Member States are here to explain how impossible it would be to prosecute any crime committed online without a complete revamp of the CJEU case law, making the internet a de facto "lawless zone" (words of France)

@edri @laquadrature The process is quite extraordinary: there was already a hearing in July 2022 👉

https://twitter.com/edri/status/1544650277663526912

However the Grand Chamber referred the case to the CJEU plenary, which reopened the oral procedure by hosting a two-day hearing

@edri @laquadrature The reason is unclear. This referral was made after the publication of the Advocate General's (AG) opinion. @edri analysed this opinion as a dangerous call for watering down privacy protections developed in the CJEU case law on #DataRetention
edri.org/our-work/advoc…

@edri @laquadrature Was the Grand Chamber uncomfortable with the AG's call to revisit the case law and thus, invites the plenary to firmly restate its interpretation without concessions? Or should this move be seen as an indication that the Court is ready to bend its own jurisprudence?

@edri @laquadrature Several Member States are openly criticising the CJEU's position from the past ten years as being "unpracticable", "non-operational" and posing a lot of challenges for law enforcement capacities to investigate crimes online.

@edri @laquadrature France stresses that it is the reason why the CJEU keeps receiving questions for preliminary ruling from Member States - a convenient way to justify the current lack of compliance with and blunt disregard of many MS for its case law!

@edri @laquadrature .@laquadrature and 🇫🇷 ISP associations are demonstrating how HADOPI is a clearly disproportionate mass surveillance system of internet users for 'insignificant purposes' (sanction for failing to secure its internet connection used for illegal file sharing)

@edri @laquadrature They are asking the CJEU to uphold its case law, which currently restricts the retention and access to IP addresses to the fight against serious crime - given that sensitive info can be deduced from them when linked with the files (sexual orientation, political opinions, etc.)

@edri @laquadrature Lastly they also demand the Court to remind France that its data retention regime is still in violating EU law, after the Council of State circumvented and manipulated the #LaQuadratureDuNet judgment
Background 👉 edri.org/our-work/franc…

In the morning, most MS have on the contrary asked for facilitated access to IP addresses, heavily referring to the AG opinion of Nov 2022. Such access should be declared lawful for prosecution of non-serious crimes where there are no other means of investigation.

One recurring argument by MS is that access to the source IP address combined with civil identity data is not liable, in itself, to reveal sensitive info or to profile the person. Therefore it's not a serious interference, which allows data access for non-serious crimes

.@EU_Commission (rightly) recalls that HADOPI *does* access the content of the communication (name of the file shared) in addition to the IP address and civil identity data: account should thus be given to the access conditions to that extended range of data

It further explains how access to the name of a movie can reveal sensitive info (e.g. political opinions) and the chilling effect this could have on freedom of information and expression - will the Commission joins the conclusions of @laquadrature ?

Commission then stresses that the right to data protection (even sensitive) is not absolute and that other rights such as protection of intellectual property should be guaranteed.

Also data in HADOPI does not reveal sensitive info on people to the same extent as the case of mass data retention of all traffic and location data that CJEU ruled on in its La Quadrature judgment..

(I was a bit hopeful for a moment)

Commission finishes with the same argument of the systemic impunity online if access to IP address i the only means to identify the perpetrator of an online offence. This could justify the implementation of mass surveillance measures - *sighs*

EDPS is going next by explaining what are the practices of P2P (in a more nuanced way to MS). After going in details on the issue of control and false positives linked to the automated processing involved, he aligns with the MS and the Commission...

In general he invites the Court into account the fact that for some online offences, access to IP addresses is the only means of investigation... Thus joining the AG call for revisiting the CJEU case law. Baaaaaaad!