French Protective Public Policy framework for operation of new generation mobile radio network device

On 2 August 2019, the French Act No. 2019-810 of 1 August 2019 to preserve the French defence and national security interests in the operation of mobile radio networks (the Act) was published in the Official Journal.

The act sets up a prime minister authorisation regime prior to the operation of radio devices on French territory, the latter being defined as 'all hardware or software devices allowing to connect end users devices to a radio network except those of forth and previous generations which, because of their functions, present a risk to the continuity, integrity, security, availability of this network, or to the confidentiality of the messages communicated and the communications data, apart from

• (i) the devices set up to the end users premises or dedicated to an independent network
• (ii) the passive electronic or non-configurable devices, and
• (iii) the hardware devices not incorporated to these devices'

The list of devices requiring an authorisation for their operation will be issued by an order of the prime minister after consultation with the Electronic communications and Postal Authority (Autorité de Régulation des Communications Electroniques et des Postes).

The prior authorisation of the prime minister is requested for

• (i) the direct operation or

• (ii) the operation through a third-party provider of devices by the public network operators referred to in article L. 1332-1 of the Defence code (essential facilities), installed since the 01 February 2019.

The operators already operating such radio devices before this date shall request an authorisation within two months of the latest between the publication of the Order or the Decree referred to below, or at the end of the second month of the publication of the Act (ie. 02 December 2019 at the latest).

The authorisation can be delivered after examination of the application file specifying the model and version of devices for which an authorisation is required, for a maximum term of eight years, renewable with a renewal request file to be delivered at least two months before the expiry of the initial term and potentially with conditions.

The prime minister can refuse to grant its authorisation, should he consider that there is a serious risk for the French defence and national security interests because of a lack of warranty regarding the continuity, integrity, security, availability of this network or the confidentiality of the messages communicated and the communication data (the Risk).

Such refusal is motivated, except where the communication of such motivation could potentially breach one of the secrets or interests protected under article L. 311-5, 2° a-f, of the Code of relations between the administration and the public (eg the classified information, the secrecy of the deliberations of the government, the judicial secrecy, etc.).

In case of operation without authorisation, the prime minister can order the operator, after a formal notice to submit its comments within 15 days except in case of urgency

• (i) to apply for an authorisation, or

• (ii) to restore the status quo ante within a specific timeframe, with the threat of a possible sentence of five years imprisonment and €300k fine.

Such sentence is also provided for any operation without respecting the conditions defined by the prime minister.

When assessing the risk, the act only prescribes the prime minister to consider

• (i) the level of security of these devices
• (ii) their deployment and operation modalities, and more interestingly
• (iii) the fact that the operator or its suppliers (including subcontractors) are under the control of or subject to the interference of a non-European state

This last parameter clearly targets US and Asian’s operators such as Google or Huawei. We are now awaiting the decree which will specify the authorisation and renewal conditions and modalities (including the composition of the respective files).