4 Data Protection and Digital Forensics
The Act of 20 June 2018 inserted a new chapter XIII in the LIL. Since the Ordinance of
12 December 2018 it is a new title III. There are also specific rules in the Code of
Criminal Procedure (CCP) in articles 100 to 100-8 and in the Title on the procedure
applicable to organized crime and delinquency,
127 in articles 706-95 to 706-95-10, and
articles 706-102-1 to 706-102-9. These provisions were amended for the most part by
the Act of 3 June 2016 reinforcing the fight against organized crime, terrorism and their
financing and improving the effectiveness and safeguards of criminal procedure.
128
All of the rules allow the interception of e-mails, the use of “MSI catchers”, the
interception of correspondence; access in all places to stored computer data that are
displayed on screen, are captured, received or issued, and their recording,
safeguarding and transmission.
129 The capture, fixing, transmission and recording
of words spoken privately in private or public places or vehicles and the image of
natural persons in a private place are also possible but obey different rules.
130
A distinction must be made between remote access to stored data and real-time
access.
In the case of remote access, the magistrate ( juge de la liberté et de la détention
(JLD)), to whom the case is referred by the public prosecutor (procureur de la
République), and the examining magistrate ( juge d’instruction) have jurisdiction.
The ordinance authorising the measure must state the grounds for doing so.
131 Under
penalty of invalidation, the data can be for no other purpose than investigating and
finding that offences have been committed.
132
In the case of real-time access to data, the examining magistrate may order such
access since the Act of 14 March 2011
133 and the magistrate (JLD) since the Act of
3 June 2016 for expedited or preliminary investigations.
134 This makes it possible,
then, to record, safeguard, and transmit computer files hosted on hard drives or
removable discs. In both instances, under penalty of invalidity, the magistrate or
examining magistrate must specify the offence in question, the exact location or
detailed description of the systems of automated data processing and the duration of
the operations.
135 The operations are conducted under the authority and supervision
of the magistrate or examining magistrate.
136
127 Infringements in the scope of Code de procédure pénale (CPP), Article 706-73 and Article
706-73-1.
128 Act no 2016-731 of 3 June 2016, JORF 4 June 2016.
129 CPP, Article 706-102-1 to Article 706-102-3.
130 CPP, Article 706-96, Article 706-96-1, Article 706-97, Article 706-98, Article 706-98-1, Article
706-99, Article 706-101 and Article 706-101-1 (new articles).
131 CPP, Article 706-95-1 and Article 706-95-2.
132 CPP, Article 706-95-3.
133 Act no 2011-267 of March 14, 2011, JORF 15 March 2011, p. 4582. CPP, Article 706-102-1.
134 CPP, Article 706-102-1 to Article 706-102-3.
135 CPP, Article 706-102-3, §1.
136 CPP, Article 706-95-4.
174
L. Nicolas-Vullierme
The Act of 20 June 2018 inserted a new chapter XIII in the LIL. Since the Ordinance of
12 December 2018 it is a new title III. There are also specific rules in the Code of
Criminal Procedure (CCP) in articles 100 to 100-8 and in the Title on the procedure
applicable to organized crime and delinquency,
127 in articles 706-95 to 706-95-10, and
articles 706-102-1 to 706-102-9. These provisions were amended for the most part by
the Act of 3 June 2016 reinforcing the fight against organized crime, terrorism and their
financing and improving the effectiveness and safeguards of criminal procedure.
128
All of the rules allow the interception of e-mails, the use of “MSI catchers”, the
interception of correspondence; access in all places to stored computer data that are
displayed on screen, are captured, received or issued, and their recording,
safeguarding and transmission.
129 The capture, fixing, transmission and recording
of words spoken privately in private or public places or vehicles and the image of
natural persons in a private place are also possible but obey different rules.
130
A distinction must be made between remote access to stored data and real-time
access.
In the case of remote access, the magistrate ( juge de la liberté et de la détention
(JLD)), to whom the case is referred by the public prosecutor (procureur de la
République), and the examining magistrate ( juge d’instruction) have jurisdiction.
The ordinance authorising the measure must state the grounds for doing so.
131 Under
penalty of invalidation, the data can be for no other purpose than investigating and
finding that offences have been committed.
132
In the case of real-time access to data, the examining magistrate may order such
access since the Act of 14 March 2011
133 and the magistrate (JLD) since the Act of
3 June 2016 for expedited or preliminary investigations.
134 This makes it possible,
then, to record, safeguard, and transmit computer files hosted on hard drives or
removable discs. In both instances, under penalty of invalidity, the magistrate or
examining magistrate must specify the offence in question, the exact location or
detailed description of the systems of automated data processing and the duration of
the operations.
135 The operations are conducted under the authority and supervision
of the magistrate or examining magistrate.
136
127 Infringements in the scope of Code de procédure pénale (CPP), Article 706-73 and Article
706-73-1.
128 Act no 2016-731 of 3 June 2016, JORF 4 June 2016.
129 CPP, Article 706-102-1 to Article 706-102-3.
130 CPP, Article 706-96, Article 706-96-1, Article 706-97, Article 706-98, Article 706-98-1, Article
706-99, Article 706-101 and Article 706-101-1 (new articles).
131 CPP, Article 706-95-1 and Article 706-95-2.
132 CPP, Article 706-95-3.
133 Act no 2011-267 of March 14, 2011, JORF 15 March 2011, p. 4582. CPP, Article 706-102-1.
134 CPP, Article 706-102-1 to Article 706-102-3.
135 CPP, Article 706-102-3, §1.
136 CPP, Article 706-95-4.
174
L. Nicolas-Vullierme