French lawmakers reached a compromise on Tuesday (26 March) on a hard-fought all-encompassing digital bill, agreeing to water down provisions that would otherwise conflict with EU legislation, while putting sovereign cloud requirements into law.
France’s digital bill of the hour (Sécuriser et réguler l’espace numérique, SREN) received two reasoned opinions from the European Commission, on 25 October 2023 and 17 January, both regarding its Senate and National Assembly versions. The legislative process was hence blocked until mid-March.
On Tuesday, seven MPs and seven senators reached an agreement between the two chambers, deciding to comply with EU law.
The agreed text is scheduled to be presented at the Senate on 2 April and at the National Assembly on 10 April.
“France is a leader on digital issues, particularly with laws regarding influencers or this SREN law,” MP Louise Morel (MoDem, Renew) who participated in the negotiation, told Euractiv. She added that the French legislators did a “good job” incorporating the Commission recommendations.
Some of the purported firmness was watered down in the compromise text, following the Commission’s concerns about conflicts with EU laws.
Pornographic content
Lawmakers modified the requirement that pornographic websites should notify users before they watch a scene mimicking a criminal offense such as rape or sexual assaults.
The Commission previously criticised this provision, saying it would have pushed pornographic platforms to conduct mass surveillance on the content they host, something prohibited under EU’s landmark content moderation law, the Digital Services Act (DSA).
Moreover, the Court of Justice of the EU ruled against such a general obligation for platforms in November 2023.
The compromise text now stipulates that “at any moment”, platforms shall display a warning message, reminding viewers that what they are watching simulated illegal behaviours.
French lawmakers also decided to comply with EU laws on jurisdictional authority, particularly on the age verification of users on pornographic websites.
In a previous version of the bill, age verification requirements applied to all companies offering services in France. But EU law does not allow member states to impose general obligations on companies domiciled in other EU countries.
To circumvent the conflict, under the compromised bill, the age verification requirements will apply to companies headquartered in France or outside the EU.
Finally, French lawmakers adapted a “right to be forgotten” provision, which empowers people shot in a pornographic video published without their consent to ask for deletion from online platforms. Details regarding the notification requirements and determination of unlawfulness were changed to fit with the DSA.
Cloud strategy
In previous versions, Senators had added specific provisions on cloud sovereignty, putting the “cloud to the centre” strategy into law.
The strategy covers government administrations and their technology providers, as well as public interest groups that shall move their IT infrastructure from traditional data centers to cloud-based solutions.
When moving these systems onto the cloud, these public organisations are expected to ensure they are protected from the extraterritorial application of foreign laws. This provision is understood to be directed against US laws that could be used for surveillance of cloud systems, such as the Foreign Intelligence Surveillance Act and the Cloud Act.
Under the latest version of the bill, most provisions of the strategy will become law, while data hosting service providers will also have to abide by France’s sovereign cloud requirements when handling health data.
This move is understood to be targeting the national Health Data Hub, which handles health data of millions of French citizens on Microsoft Azure cloud.
France has been looking to include its sovereign cloud requirements at the EU level and copy-paste them into the EUCS cloud certification scheme, whose purpose is to create a common EU cloud sovereign requirements. This has attracted negative criticism from other EU countries, including the Netherlands, which consider this a protectionist move.
Next steps
The SREN compromise bill outlines several other requirements for the digital space.
It implements some of the most important new EU digital laws into French national law. It delineates the powers given to its national authorities under the EU’s digital competition law, the Digital Markets Act (DMA), the content moderation law, the DSA, and data sharing laws.
Moreover, an anti-scam filter will be introduced to fight against pervasive fraudulent SMS.
French lawmakers decided to regulate games with in-app purchases, which they say are somewhere in between video games and gambling.
They will also introduce special penalties for online offences, looking to punish discriminatory, injurious or harassing online behavior.
The French Constitutional Council will likely examine these two last provisions closely. It might look to determine whether the in-app purchases regulation creates an uneven playing field for online casinos. It will also examine the punishment of online offences for their alignment with French criminal law.
The compromise text still has a long way to go, including a third review by the European Commission.
Opposition MP Ségolène Amiot (LFI, The Left) told Euractiv that “the verification of users’ ages to access pornographic websites is technically unfeasible and incompatible with the right to online anonymity”.
[Edited by Eliza Gkritsi/Zoran Radosavljevic]
