On 19 March 2026, the Court of Justice of the European Union (CJEU), the highest court in the EU, issued a highly anticipated ruling named “Comdribus” regarding France’s law enforcement data collection practices. The Court assessed how French law allows the collection of fingerprints and photographs of suspects and concludes that it is disproportionate and contrary to EU law. La Quadrature du Net recently denounced police officers’ unchecked practice of taking photographs of people arrested on the streets. This court case showcases another illegal feature of the sprawling edifice of French police databases. It is urgent to dismantle it. The story begins in 2020 when the plaintiff HW , the person that initiated the lawsuit, participated in an Extinction Rebellion protest on the Champs-Elysées in Paris. HW was arrested because the protest was not registered and he was accused of “rebellion” (i.e. failing to follow police instructions). As it is usually the case, the French police ordereds protesters to give their phone access code and their biometric data (called “signaletic profile” in French), in order to feed and update police databases. Article 55-1 of the French Code of Criminal Procedure provides for the collection of data, including fingerprints and a photograph of individuals suspected of having committed an offence. The fingerprints are then stored in the Automated Fingerprints Database (FAED), while the photograph is sent to the Judicial Records Database (TAJ). The TAJ constitutes the highly controversial legal basis for identifying individuals through facial recognition. Police records biometric data for potential or future comparisons in other investigations. Back to 2020: HW refused to comply with the police identification procedure. However, refusing to provide such data collection is an offence in France, regardless of whether the individual was ultimately convicted of the original offence. This is known as a “stand-alone” offence. Although HW was acquitted of the charges of participating in the undeclared demonstration and of refusing to provide their phone code, they remained prosecuted only for refusing to give their biometric data to the police. During the proceedings, HW’s lawyer decided to forward the case before the CJEU, so that the Court could examine whether the law enforcement data collection system under French law respects fundamental rights and freedoms protected by the Charter of Fundamental Rights of the EU, in particular the right to privacy. The Court answered this question in its ruling of 19 March, which constitutes a scathing condemnation of France. ABSENCE OF “STRICT NECESSITY” Firstly, the Court addresses the compliance of French law with the principle of proportionality. The collection of fingerprints and photographs is considered a processing of biometric data, which are considered “sensitive” data under EU law. This type of processing is therefore prohibited in principle and is only permissible if “strictly necessary”. This notion of “strict necessity” offers strong protection because it means that the collection of fingerprints and photographs can never be carried out systematically. Firstly, the purposes of data processing in this particular case the identification of the perpetrators of an offence, must be sufficiently precisely defined. Secondly, the data collected must be strictly necessary and relevant to achieve that purpose. This means that no alternative method that is less intrusive to fundamental rights is available to achieve the objective just as effectively. Consequently, the processing of biometric data canis only be permitted in a very limited number of cases. However, Article 55-1 of the French Code of Criminal Procedure allows police officers to take police identification data from “any individual against whom there is one or more plausible grounds to suspect that they have committed or attempted to commit a criminal offence.” Indeed, as in HW’s case, a person simply placed in custody, even without charges being brought against them, is subject to the collection of fingerprints and photographs. The Court consider this scope to be far too broad: the mere existence of a suspicion does not satisfy the requirement of “strict necessity”. Furthermore, the legal provisions establishing the TAJ and FAED databases do not reflect this requirement and apply to a vast number of situations and individuals. The French government attempted to defend itself by claiming that the collection of biometric data was not an obligation, but merely a discretionary power for police officers, who had significant leeway to decide whether or not such collection was necessary. The Court rejected this argument , calling on the Court of Appeal, which will review the case at national level to examine the “effective implementation of the law”. The Court strongly invited the national court to check how the law is actually enforced by police on the ground rather than, solely considering the literal wording of the law. The Court’s interpretation allows us to conclude that the French legal framework for fingerprint and photograph collection is contrary to the law of the EU as it does not respect the condition of strict necessity. THE REQUIREMENT FOR JUSTIFICATION IS ABSENT FROM FRENCH LAW Secondly, the CJEU examines howwhether French law requires or not police officers to justify their decision to collect biometric data. It requires that a clear explanation must be provided to the individual concerned, even briefly, in order to allow them to exercise their right to an effective remedy. The Court adds that the possibility of a judge later reviewing the legality of the collection does not exonerate the police of their duty of providing an explanation to the individual. Finally, as biometric data collection must not be systematic but limited to a small number of cases of strict necessity and not systematic, the Court considers that requiring officers to justify their decision does not constitute an unreasonable burden. This is a direct response to the French government, which had argued during the hearing that complying with this requirement would place an excessive workload on police officers. French law does not impose any obligation to justify the collection of biometric data, and is therefore contrary to EU law. In practice, police officers never explain why they take fingerprints or photographs when a person is detained or interrogated. According to lawyers’ testimonies, these procedures have become routine in police stations, even for individuals attending voluntary interviews or minors. That explains the staggering numbers of 9 million photographs in the TAJ and 6.5 million fingerprints in the FAED. Moreover, Article 55-1 is often used to pressure individuals, threatening them with sanctions or detention if they refuse to have their data collected. It should also be noted that, since 2022, fingerprint collection can even be carried out by force. Lastly, the Court examines the “stand-alone” nature of the offence of refusing to provide one’s fingerprints. This stand-alone offence means that a person can be prosecuted solely for their refusal, independently of the circumstances that led to their arrest. Unfortunately, the Court does not condemn this principle. However, they require very strict conditions to be met before prosecuting someone for such refusal. Prosecution must take into account the individual circumstances of the person in question (behaviour, profile, prior record) and should be reserved for the most serious cases. Once again, French law fails to meet these requirements, as many individuals are prosecuted solely on the basis of this offencewithout any individual assessment of their situation. FRENCH LAW ENFORCEMENT DATA COLLECTION SYSTEM UNDER CROSSHAIR This decision by the CJEU marks a significant change in French law. In fact, its conclusions delegitimise the whole philosophy that has allowed the police files to be compiled. In France, data collection by law enforcement is not considered an exception but as a way to gather as much data as possible. Practice shows that if this information is available or retrievable, the police will take it “just in case,” for later use. If a person is at a police station, their biometric data will be collected. If a person is stopped, their photo will be taken and they may be identified through facial recognition, even if this practice is illegal, just as La Quadrature du Net recently denounced in partnership with the media outlet Disclose. According to this logic, anybody could potentially be a future suspect or be found guilty, justifying the collection of data in a “preventive” way and without any valid reason. This vision that anybody is suspect by default is the very foundation of mass surveillance. Thanks to its decision, the Court of Justice requires an upheaval of this ideology. Contrary to what French law provides for, the collection of information and biometric data should not be routine or should not affect a big part of the population, but rather an exceptional measure reserved for rare cases. The Comdribus judgment is therefore delivers a major blow to the abusive and mass surveillance that has been in place for years. The Ministry of the Interior must break its silence, be held accountable, and immediately order the end of systematic collection of fingerprints and photographs by the police. This landmark ruling should lead to a complete overhaul of the law and the deletion of the millions of illegitimate records currently contained in the TAJ and FAED databases.

Today, the Conseil d’État (the French Administrative Supreme Court) ruled in favour of La Quadrature du Net, French Data Network (FDN), Franciliens.net and Fédération FDN. It recognised that Hadopi’s surveillance system (operated by Arcom since 2021) is a breach of fundamental rights protected by the European Union. As a result, it has ordered the government to repeal the core provisions of Hadopi key decree that organises the “graduated response” system. This fight against Hadopi, in which La Quadrature is involved since the first legislative debates in the National Assembly in 2009, is emblematic of the archaic view held by successive governments, both left-wing and right-wing, on the question of sharing online culture and knowledge. It is now up to the government to acknowledge the death of Hadopi and, instead of attempting to bring it back to life, to finally admit that online cultural sharing for non-commercial purposes must not be criminalised. HADOPI IS DEFINITELY A SURVEILLANCE TOOL Hadopi is the law that created the authority of the same name: the “High Authority for the Dissemination of Creative Works and the Protection of Rights on the Internet” (Haute Autorité pour la diffusion des œuvres et la protection des droits sur internet). The mechanism put in place consists of two stages: firstly, rights holders identify internet users sharing cultural content online via peer-to-peer networks; they collect their IP address and send it to the Hadopi; secondly, the Hadopi, using these lists of IP addresses, requests the civil identity and contact details of the identified subscribers from internet service providers and stores this information in a database of users who have downloaded files. This triggers the “graduated response” system: the first time a user is identified, the Hadopi sends an initial warning email, followed by a second one in the event of a repeated occurrence, then a registered letter if the behaviour continues, and may finally refer the case to the judicial authorities for users who ignore these warnings. The judicial authority may then impose a fine (of up to €1,500; €3,000 in the event of a repeat offence) on the internet user for the fifth class minor offence of “failing to secure an internet connection”1Hadopi does not directly sanction downloading, as it is technically impossible to verify that the subscriber is indeed the person who carried out the download. The solution adopted in the law was to create an obligation for Internet users to secure their access, with penalties for non-compliance.. In 2021, the French Parliament merged the CSA (High Council for Audiovisual Media) with Hadopi to create Arcom (Authority for Regulation of Media and Digital Communication). However, Arcom merely took over Hadopi’s responsibilities, and this surveillance system has survived. Christine Albanel, a Sarkozy-appointed Minister for Culture who defended the first Hadopi law in 2009, claimed that the text would reconcile privacy with the fight against piracy, even though she did not understand the technical realities and challenges of her own bill. Yet it was already clear in 2009 that the law would not work, given that Internet users would stop using peer-to-peer to turn to streaming or direct download (which inevitably created a market for illegal commercial platforms), and that piracy issues are closely linked to the availability of legal alternatives (piracy decreases when legal alternatives are easily accessible and increases when their quality decrease or when platforms are not available). Today, we know that the violations of fundamental rights are so severe that this system cannot continue. SEVEN YEARS OF LEGAL ACTIONS In 2019, we asked the Conseil d’État to overturn Hadopi’s central decree, which authorises the storage of personal data needed for the graduated response system (IP addresses, civil identity and downloaded material). The case was referred to the Constitutional Council and in 2020 we had our first partial victory: the Constitutional Council restricted Hadopi’s broad access to personal data (the law at the time provided that it could access “all documents”). However, despite to our initial assessment, this did not necessarily mark the end of the Hadopi. Back before the Conseil d’État to draw conclusions from this partial invalidation of the law, we then pointed out that the Hadopi system was in breach of the case law of the Court of Justice of the European Union (CJEU): in principle, before an authority can access to metadata (such as an IP address or the civil identity associated with that IP), there must be an independent review of the legality and proportionality of such access. Such a review does not exist for the Hadopi. The rapporteur public (General Advocate) of the Conseil d’État, unhappy at having to acknowledge the illegality of the Hadopi, nevertheless admitted the issue: “This case should, alas, delight millions of internet users since it indirectly raises the question of the very existence of the [Hadopi]”. However, rather than inviting the Conseil d’État to put an end to Hadopi, he made a bad sport of it and suggested instead to ask the CJEU for a “Hadopi exception”: to weaken European requirements so that Hadopi’s mass surveillance could continue. This case therefore brought us before the CJEU. The outcome was disappointing, as we lost on the principle: the CJEU agreed to weaken its case law. It accepted that access to metadata might, in certain cases, not be subjected? to prior independent review. However, it required numerous conditions to this possibility, relating to both the retention of such data and the requirements for prior independent review. In its ruling, the Conseil d’État finally agreed with us on these two points. Firstly, it found that the retention of metadata is not carried out in a manner that safeguards civil liberties. The CJEU required “watertight separation” of IP addresses and civil identity data (which can be understood as two distinct databases, or files, that can only be technically correlated after a formal request for access by Arcom). The Conseil d’État notes that “no legal provision imposes such retention, under these conditions, on electronic communications operators”. Secondly, it also notes that access to this data is not subject to independent review. It fully endorses the conclusions already made by the CJEU, that Arcom cannot be both judge and jury: it cannot request access and then review the legality of that access itself, even though it is an independent authority. However, like the CJEU, the Conseil d’État considers that this lack of review is only an issue from the third access to the data onwards, the stage at which a registered letter is sent. THE NEED TO FIND A NEW APPROACH In practical terms, this means that the ‘graduated response’ system is now stalled. The Arcom can no longer take you to court, as the requirements set by the CJEU are not satisfied. And it can only send you an email if it has first ensured that your internet service provider has stored your metadata with a “watertight separation”2The Minister for Culture claims to have asked SFR, Free, Orange and Bouygues Telecom whether this data retention was carried out in a watertight way. These operators replied that it was, but Arcom will need to verify this. This is an opportunity to encourage you to sign up for an internet subscription with an ethical provider from the Fédération FDN!. It has now been downgraded to the function of a giant spam machine. However, this does not mean that the Hadopi is definitively dead. The government could try again, creating a sort of Arcom supervisory body to ensure compliance. If it were to go down this path, the government would be stubbornly keeping an illegitimate surveillance system afloat. By focusing on prosecuting Internet users who share content online, the Hadopi system has missed the target. It has never been able to tackle the illegal commercial platforms that sell privileged access to their catalogues at the detriment of artists. On the contrary, it has created a space for this illegal activity. Nor has the Hadopi system put an end to the exploitation of rights-holding companies, those “copyist monks” who keep artists in a state of political or economic submission from which only a few can break free. The first step towards a necessary reform is to end the criminalisation of online non-commercial sharing of culture.   La Quadrature du Net has been fighting against the Hadopi since 2009, so this victory is particularly significant for us. However, the fight is not over. Not against a Hadopi that could rise, like a zombie, from its grave. Nor against all those laws that seek to turn the internet into a space where fundamental rights do not apply. So you can help us by making a donation. References[+] References ↑1 Hadopi does not directly sanction downloading, as it is technically impossible to verify that the subscriber is indeed the person who carried out the download. The solution adopted in the law was to create an obligation for Internet users to secure their access, with penalties for non-compliance. ↑2 The Minister for Culture claims to have asked SFR, Free, Orange and Bouygues Telecom whether this data retention was carried out in a watertight way. These operators replied that it was, but Arcom will need to verify this. This is an opportunity to encourage you to sign up for an internet subscription with an ethical provider from the Fédération FDN!