April 30, 2026 | Public Lawsuit Ruling | Data Governance

On 30 April 2026, the French Council of State issued a ruling in case No. 433539 partially annulling the Prime Minister's implicit decision refusing to repeal Decree No. 2010-236 of 5 March 2010 on the automated processing of personal data authorised under Article L. 331-23 of the Intellectual Property Code, known as the "System for the Management of Measures to Protect Works on the Internet" (SGMPOI). The Decree governs the automated processing operated by the Audiovisual and Digital Communication Regulatory Authority (ARCOM) in implementing the three-step "graduated response" procedure for online copyright infringement. The case was brought by La Quadrature du Net, French Data Network, Franciliens.net, and the Federation of Associative Internet Access Providers, and follows the Court of Justice of the European Union (CJEU) ruling in case C-470/21 of 30 April 2024 on preliminary questions referred by the Council of State on 5 July 2021. The Council of State holds that the Decree is incompatible with Directive 2002/58/EC interpreted in the light of the Charter of Fundamental Rights on two grounds. Firstly, the Decree does not require that personal data registered in the SGMPOI be retained by electronic communications operators under conditions of strict separation from other data categories. Secondly, Article 4(I) authorises ARCOM agents to access subscriber identity data for the third stage of the graduated response without prior authorisation by a court or independent administrative entity. The Council of State enjoins the Prime Minister to repeal the relevant provisions of the Decree, rejects the Minister of Culture's request to defer the effects of the annulment by 12 months, and orders the State to pay each of the four claimants EUR 1'000 under Article L. 761-1 of the Code of Administrative Justice.