[ARTICLE] What future for the SREN law?

France’s Endeavor to Surpass the Digital Service Act: Analyzing the SREN Act and Its Prospects Amid Disagreements with the EU Commission

By Luca Lefevre

On April 10, 2024, the French National Assembly approved the initial version of the “projet de loi visant à sécuriser et à réguler l’espace numérique” (SREN) Act. This legislation encompasses various measures designed to enhance internet safety, particularly by strengthening efforts to combat illegal activities.

The legislation builds upon a report on preventing minors from being exposed to pornographic content on the Internet and another report on France’s digital sovereignty. Furthermore, the law seeks to establish an authority responsible for coordinating digital regulation in alignment with European standards.

This blog post discusses the latest version of the law adopted on April 10, 2024. Two appeals have been submitted to the Constitutional Council. These appeals concern the creation of an “offense of online outrage” and the introduction of specific rules for monetizable digital objects.

What do the SREN Act’s provisions entail, and what objectives does it aim to achieve?

The law designates the “Autorité de Régulation de la Communication Audiovisuelle et Numérique” (ARCOM) as the regulatory authority for the Digital Service Act (DSA) and the “Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes” (DGCCRF) as the agency tasked with enforcing the Digital Markets Act (DMA) (SREN Act Article 25-II). It grants both entities expanded investigatory and enforcement capabilities to fulfill their respective roles (Article 25-III).

Regarding the first aspect, the law mandates the implementation of age verification systems on pornographic websites, in compliance with a general guideline issued by ARCOM. ARCOM is empowered to order search engines operators to block access to websites that violate these rules. Moreover, the Act mandates that web hosting service providers delete any unlawful pornographic content, particularly child pornography, within 24 hours of notification by French police authorities (SREN Act, article 3-I). Upon compliance, the hosting provider must notify the content provider and, upon request, provide the content provider with a copy of the injunction from the French authorities (Article 3-III).

The legislation extends similar enforcement powers to combating misinformation, allowing ARCOM to order search engine providers to halt the online broadcasting of a foreign “propaganda” channel within 72 hours (SREN Act Article 4 (18)). Additionally, the law requires platforms to effectively ban individuals convicted of online hate offenses (Article 16-3 ) at the judge’s request. Platforms that fail to ensure effective suspension of affected users face a €75,000 fine (Article 16-7).

The legislation includes provisions for establishing an “anti-scam filter” through the development of a centralized database that records all malicious sites reported by victims or authorities (article 6). This system aims to alert individuals via text message when they attempt to visit a malicious site.

What are the European Commission’s reasons for disapproving the SREN Act?

The European Commission’s disapproval of the SREN Act partly arises from its timing and scope. Drafted in April 2023, simultaneously with the finalization of the Digital Services Act (DSA) and before its enactment on February 17, 2024, the rapid development of the SREN Act suggests an intention by the French government and legislators to assert political control over online content regulation independently of the DSA. The French legislation exceeds the provisions of both the DSA and the Digital Markets Act (DMA), particularly with parliamentary amendments to government proposals, such as the initiative to develop a digital identity in France. Jean Noël Barrot, the former Minister for Digital Affairs in France, characterized the SREN law as an effort to “go a step further” than the DSA, rather than merely a measure for implementation and enforcement.

Consequently, the SREN law has led to escalating tensions between the French government and the European Commission. This conflict reached a peak with the Commission’s  detailed opinion issued on October 25, 2023. Firstly, the Commission emphasized that the Digital Services Act (DSA) is directly applicable and does not necessitate the enactment of transposing or adapting legislation. Secondly, the Commission identified inconsistencies between the French legislation and the Digital Services Act (DSA). Concerning the regulations applicable to all information society companies, as defined in Article 1(1)(b) of Directive (EU) 2015/1535^[1], providing services in France, the Commission highlighted that Article 3(1) and (2) of the Digital Markets Act (DMA) introduces the “principle  of control in Home Member State .” This principle mandates that the regulation of information society services should fall under the jurisdiction of the country in which the service providers are established, and thus, be governed by the legal framework of that Member State. However, the authority granted to ARCOM by the SREN Act to issue injunctions against any company providing services in France stands in opposition to this principle.

The EU Commission also emphasized that the French government possesses the authority to issue injunctions to information companies based outside of France, in accordance with Article 3(4) of the Digital Markets Act (DMA). This provision allows Member States to take actions against information companies established in another Member State, provided that three specific conditions are met:

– The measures must be essential for the pursuit of public policy objectives, the safeguarding of public health, the assurance of public security, or the protection of consumers.

– The information company in question must have violated the objectives outlined in the DMA or pose a significant and severe risk of harm to these objectives.

– The actions undertaken must be suitable for achieving the intended objective.

Thirdly, the Commission observed that the SREN Act contains provisions that closely resemble or are identical to those in European legislation, notably the Digital Services Act.  (DSA). For instance, Article 22, paragraph 5, point I of the SREN Act directly replicates Article 6 of the DSA. Other sections, despite differing in wording, achieve the same outcomes. Regarding the French government’s commitment to protecting minors, the Commission highlighted that Article 28 of the DSA already provides a specific clause for this purpose. Additionally, the DSA imposes particular obligations on significant platforms for the protection of minors. Concerning access to pornography, the Commission recalled that the DSA mentions age verification systems as an example of effective and targeted enforcement measures to safeguard children’s rights (Article 35).

Simultaneously, on November 9, 2023, the Court of Justice of the European Union (CJEU) ruled against Austria’s legislation aimed at addressing online hate, citing its non-compliance with the home country control principle^[2]. Should there be an infringement procedure against France regarding the SREN law, the Court would likely rule in favor of the Commission based on this precedent, as interpreted by the Conseil d’Etat (point 5)^[3]. The European Court of Justice also issued a ruling that prohibits the use of suspensive clauses in national legislation, which allow the implementation of measures before receiving approval from the European Commission.

What does the future hold for the SREN law following the Commission’s detailed opinions?

On December 22, 2023, the French government submitted a formal response to the Commission in defense of the law and notified a second version of the law including amendments. The Commission issued a second detailed opinion, echoing its initial arguments, which criticized the French government for replicating provisions of the Digital Services Act (DSA) and violating the principle of home country control of the Digital Markets Act (DMA).

This second response suggests that without significant amendments to the law, France faces the possibility of the Commission initiating an infringement procedure against it in front of the Court of Justice of the European Union (CJEU).

Specifically, the Commission demands that any injunctions issued to companies located in another member state adhere to the process established by Article 3(4) of the Digital Markets Act (DMA), and insists on the removal of provisions mirroring those in the Digital Services Act (DSA). Additionally, it calls for the elimination of measures that hold platforms accountable for banning individuals convicted of online hate, arguing that these measures violate the country of origin principle and lack proportionality.

In this context, the French Parliament drafted a new version of the SREN law in March 2024 wich was adopted in April 10, 2024. Parliamentarians have attempted to rewrite the text in such a way as to retain key measures without infringing European law. In particular, the possibility of administrative blocking of pornographic sites that do not verify the age of users no longer requires an injunction to be issued to the internet service provider, but the text now applies to video-sharing platforms. This brings the text into line with the Audiovisual Media Services Directive, which requires audiovisual media services to verify the age of users (Article 6(a)).

However, the final version of the law still permits injunctions against service providers hosting sites with child pornography (Article 4). The appeals submitted to the Constitutional Council, which concern the offense of online outrage and the rules for monetizable digital objects, do not address articles that conflict with the European Commission. Therefore, any potential modifications to the law following a decision by the Constitutional Council would not impact its compliance with conventional standards.

---

^[1] Companies that supply “Any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services”.

^[2] European platform of regulatory authorities Illegal, Content & Plateforms : The CJEU reaffirms the country of origin principle,11/21/2023 (last visit 04/11/2024) https://www.dbfbruxelles.eu/libre-circulation-des-services-services-de-la-societe-de-linformation-principe-du-controle-dans-letat-membre-dorigine-derogations-obligations-generales-et-abstraites/

^[3] Conseil d’État, 4ème chambre, Conclusions de M. Boutron, Rapporteur public sur les affaires N° 453763 Coyotte system N°s 461193 et 461195 Société Webgroup Czech republic et autre, 03/06/2024 https://www.conseil-etat.fr/fr/arianeweb/CRP/conclusion/2024-03-06/453763?download_pdf