CEDH · CASELAW;CLIN;ENG — 5 novembre 2024

.s3ABFC313 { font-size:10pt } .sD4B5322E { margin-top:12pt; margin-bottom:12pt; text-align:justify } .sBB9EE52A { font-family:Arial } .sA241FE93 { margin-top:0pt; margin-bottom:18pt; text-align:justify; page-break-after:avoid; border-bottom:0.75pt solid #000000; padding-bottom:1pt } .s2EF62ED2 { margin-top:0pt; margin-bottom:0pt; font-size:12pt } .s4DDA3AA3 { font-family:Arial; font-weight:bold; font-style:italic } .s29100277 { font-family:Arial; font-weight:bold } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .s8F2B0B1B { margin-top:12pt; margin-bottom:12pt; page-break-after:avoid; font-size:12pt } .s65B66A85 { margin-top:12pt; margin-bottom:12pt } .s97EB40D9 { margin-top:12pt; margin-bottom:14pt; page-break-after:avoid } .sA36B60A1 { font-family:Arial; font-style:italic } .s5F48796F { margin-top:12pt; margin-bottom:0pt; text-align:justify } .s7ED160F0 { text-decoration:none } .s3DC36BA9 { font-family:Arial; text-decoration:underline; color:#0069d6 } .s8B6C6D43 { margin-top:0pt; margin-bottom:0pt; border-bottom:1pt solid #000000; padding-bottom:1pt } .sDF790F1E { margin-top:12pt; margin-bottom:0pt; text-align:center } Legal summary November 2024 Le Marrec v. France (dec.) - 52319/22 Decision 5.11.2024 [Section V] Article 8 Article 8-1 Respect for private life Collection and use of applicant’s IP address when logging in to Family Allowances Office website to determine his location: inadmissible Facts – The applicant was granted basic income support ( revenu de solidarité active – “RSA”). In early 2019 he logged in to the Family Allowances Office’s ( Caisse d’allocations familiales – “CAF”) caf.fr website, published and hosted by the National Family Allowances Office ( Caisse nationale d’allocations familiales – “CNAF”), in order to update his status as a welfare recipient under the “My account” rubric. His computer’s internet protocol (IP) address was converted into the geographical indicator “Other [countries]” on the server hosting the site. This resulted in an audit of the applicant’s situation. He explained to the CAF that he had used a virtual private network (VPN) when logging in so as to mask his IP address, while he actually lived in France. The CAF inspectors went on to check the applicant’s bank account and found that he was no longer eligible for the RSA. The director of the CAF thus discontinued the applicant’s RSA entitlement in two decisions delivered in June 2019. In October 2020 the Administrative Court dismissed the applicant’s appeals against those decisions. In July 2022 his appeal on points of law was declared inadmissible by the Conseil d’État . Before the Court, the applicant complained about the CAF’s collection and use of the IP address in order to determine his location. Law – Article   8: (1) Applicability ratione materiae of Article   8 – The use of an IP address masked by a VPN, combined with the welfare-recipient identification number, had resulted, in the applicant’s identification and, even though he had been in France at the time, in the automatic transfer of information to the CAF to the effect that he had logged in from abroad. The Court therefore considered that Article   8 was applicable ratione materiae to the processing of the IP address of the applicant’s computer. Conclusion : Article   8 applicable. 2) Merits – (a) Whether there was interference – The collection and use of the applicant’s IP address by the CAF constituted interference with his right to respect for his private life. (b) Whether the interference had a legal basis and pursued a legitimate aim – The impugned measure had been based on a combination of provisions contained in the Social Security Code, the EU Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ( GDPR ), the law on data processing, files and civil liberties ( “the Data Protection Act ”) and the regulation governing the caf.fr website. The Court found that, taken as a whole, this legal framework determined the scope and manner of the collection and use of the computer’s IP address by the CAF with sufficient precision, thus enabling the applicant to regulate his conduct, namely by making an informed decision as to whether or not to log on to the CAF website. Discerning no evidence before it that might impugn the lawfulness of the measure complained of, the Court considered the interference to have been “in accordance with the law”. As to the legitimate aim pursued, it had consisted in verifying the applicant’s eligibility for the welfare allowance sought (prevention of fraud) and in securing the caf.fr website and its use by welfare recipients. It followed that the impugned measure had pursued a legitimate aim in the interests of the economic well-being of the country and the prevention of crime. (c) Whether the interference was proportionate – The general principles for the assessment of the proportionality of personal data processing had been summarised in the L.F. v.   France decision. In particular, in its examination of proportionality, the Court took account of respect for the principles relating to processing of personal data as set out in the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ( Convention 108 ) and reiterated in the GDPR and the Data Processing Act: “lawfulness, fairness and transparency” of collection; “data minimisation” (namely, the data collected and processed should be adequate, relevant and limited to what is strictly necessary in relation to the purposes for which they are processed); and “accuracy”. In the present case, firstly, the item of data in question – the IP address converted into a geographical indicator “Other countries” – was not sensitive in nature and concerned neither the most intimate nor particularly important aspects of an individual’s life or identity. Moreover, it had not, in itself, yielded “substantial and precise information” about the applicant and did not allow for a detailed profile to be established by exhaustively tracing his browsing history. On the contrary, this was vague, purely geographical information, which did not warrant heightened protection. Unlike electronic communications providers, the CNAF did not systematically collect and store internet users’ log-in data. Since the item of data collected did not qualify as sensitive, the margin of appreciation afforded to the authorities was wider. Secondly, the item of data in question had been collected in a lawful, fair and transparent manner. Admittedly, the processing of the IP address had had significant repercussions on the applicant’s situation, as it had prompted an audit of his situation that had ultimately resulted in the discontinuation of his RSA entitlement. The fact remained that, in order to receive welfare benefits using the remote service, the applicant could not reasonably have expected, when logging in to the “My account” page of his CAF account, that his location would remain unknown to the staff of that public service provider. Thirdly, the data-minimisation principle had been respected, since nothing other than the geographical indicator “Other countries” had been processed by the CAF in order to verify the applicant’s place of residence in his capacity as a welfare recipient. The use of this information had been strictly limited to the purpose for which it had been collected: to determine the applicant’s place of residence in France in order monitor his situation and verify his eligibility for the RSA. Accordingly, this use had been strictly necessary for the purpose of providing the public service of paying out social benefits. No improper, excessive or unnecessary collection or use of the IP address had been established. As to the accuracy of the data, despite the fact that the applicant had logged in from France, the use of the VPN had mistakenly given his location as being abroad, a fact which was attributable to his decision not to reveal his real address in France. However, he had subsequently been able to correct this inaccuracy by giving explanations to the CAF. Lastly, and as a subsidiary consideration, there were a limited number of people authorised to access this information directly, namely only staff of the CAF. (d) Conclusion – The Court concluded that the collection and use of the IP address had had a legal basis which complied with the requirements of the Convention. Having regard to the margin of appreciation afforded to the authorities in the area of preventing social-welfare fraud, the aim pursued by the processing of the relevant personal data by the CAF and the safeguards surrounding its implementation under domestic law, the Court found that the measure had been based on relevant and sufficient grounds and had not manifestly interfered disproportionately with the applicant’s right to respect for his private life. Conclusion : inadmissible (manifestly ill-founded). (See also L.F. v.   France (dec.), 3866/20 and 9292/20 , 13   February 2024)   © Council of Europe/European Court of Human Rights This summary by the Registry does not bind the Court. To access legal summaries in English or French click here . For non-official translations into other languages click here .