The Government itself collects personal data on social networks, without the consent of the parties concerned, but for a good cause: the fight against tax fraud. What should we think about it legally?

I. AN INNOVATION AND NOT AN ANALOGY

Efficiency is by nature the primary concern of the authorities in charge of prosecuting offenses.

The Judge, and the Regulators when they analyze the sanctions, take into consideration the guarantees of the defendants, that is to say technically having "vocation" to be condemned. However, by nature criminal, disciplinary, repressive administrative procedure, is a construction of fundamental procedural subjective rights, for example the rights of defense, having the object of giving these people every chance of escaping this conviction.

Thus by nature and as long as one is in a State of Law, that is to say a State which limits its powers, even when these are legitimate, founded and useful, because the sanction is inseparable from the procedure prior to it, this procedure, having the function of allowing the accused person (regardless of whether he is guilty or innocent) to increase his chances of not being the subject of a decision complaining, understanding irreducible elements of ineffectiveness with regard to repression.

Thus the prosecuting authority, an organ of the State, has by nature the principle of action for efficiency, while the Rule of Law, by the same effect of nature, has the principle of ineffectiveness. For example the right to remain silent, the right to lie, the right to hide, etc.

This concern for freedoms, private and public, is so deep that, for example, the Constitutional Council recalls that people prosecuted for drug trafficking should not have their rights diminished because of the gravity of the alleged acts, but on the contrary see their rights increased because because of this same seriousness, they risked sanctions decisions that would do them more harm.

In the present case, it is for the State to emphasize the difficulty of effectively prosecuting tax and customs fraud when it is expressed in an international and organized manner. This echoes the criminal qualifications of "organized gang" allowing more violent evidence-seeking procedures.

The State presents an "analogy" between the ordinary act for controllers to read certain newspapers, such as Point de vue-Image du monde, showing the actual standard of living and the real location of such and such a taxpayer, on occasion lavish weddings or chic vacations.

The media would have changed but the method would be the same: on social networks, we talk about weddings, trips, parties. It's probably less chic, the dresses are shorter, but these virtual publications are just as available and reading one is worth reading the other.

This analogy is not valid. Indeed, social networks and platforms are not publications even if they are media and if it is open to everyone to buy a newspaper and draw all the consequences by reading social chronicles, platforms and the networks are not available publications where each person mentioned can know that he is thus "unmasked".

"Personae" meant in Latin the "mask" and one can always refuse to be photographed, to have his identity revealed by a newspaper, in the name of his right to privacy, except that the right to information does not contradict this human right to remain hidden. What is true for newspapers is not true for social media and platforms.

Indeed, what the CNIL emphasizes is the fear of the appearance of the "born criminal". Through the use of machine learning, a self-learning algorithm, can emerge from the standard portraits of "tax offenders". One might think that two who correspond to this portrait, because of their purchases, their travels, their habitats, their frequentation, etc., are subject to an "automatic control", triggered by the algorithm itself, since they are "profiled" delinquents. In the same way as in digital finance, the algorithm triggers buy and sell orders, here the control algorithm would trigger the investigation.

This is logical, efficient, rational, time-saving. If the CNIL is so concerned with the contrary commitment made by the State, that of not resorting to "automatic controls", that is to say of not thinking about the legal action of finding an offense on of the subjugated through the robot portraits of the ideal offender is that the theory of the "born criminal" flourished in the second half of the 19th century, was at the center of the theory of "social defense" and left traces in a Law sanctioning in advance human beings who are on file since they correspond to the portrait of the "criminal by nature". The rule of law having remembered that this did not count for nothing in the Second World War in populations recognizable as "harmful" and recorded as such, excludes this Ex Ante system based on efficiency.

II. THE GRAVITY OF THE OFFENSES SEARCHED DOES NOT JUSTIFY THE CAPTURE OF INFORMATION CONCERNING PERSONS

In its deliberation of September 12, 2019 on the draft article of the Finance Law, the CNIL follows the government in that it links intruive probative method and justification of this by the gravity of the breaches sought: "Likewise, if some of the offenses referred to in draft article 9 seem to correspond to tax defaults considered by the administration to be serious in so far as they are liable to a substantial increase, she questions the relevance of using such a device for the offenses referred to in article 1791 of the CGI insofar as this article regulates all violations of the tax regime for indirect contributions regardless of a particular level of seriousness. ". Thus with large failures, possibilities of restricting freedoms in the search for evidence, with small failures no possibility of resorting to these effective means ...

Conventional criminal law and constitutional law do not make such a link, even reason conversely. The concern for the freedoms, private and public, of which the Law is the custodian, is so deep that, for example, the Constitutional Council recalls that people prosecuted for drug trafficking should not have their rights diminished due to the gravity of the charges, but on the contrary should see their rights increased because, because of this same seriousness, they risk sanctions decisions which harm them more.

We remember that in France this constitutional concern was crystallized by the creation in 1978 of the CNIL, in reaction to the creation of a file created to make the pursuit of terrorists more efficient, the Safari file, the title of this law retained as a framework in the transposition of the Community Regulation known as "GDPR", of Computing and Liberties showing that it is indeed a question of balancing the efficiency of technology (yesterday the power of storage and cross-referencing of information ; today the power of cross-traceability of information) and freedoms. It has not changed.

The tension remains the same: the more serious it is, the more the State wants an effective prosecution tool; the more serious it is, the more the Law wants a tool which preserves those liable to be punished, that is to say the ineffectiveness of prosecutions.

However, as "Data Law" falls under "Compliance Law", that is to say a Law which decentred to rebuild itself on the imperative of effective action to reach the objective of public interest, the more this second dimension recedes.

But first, the CNIL which was established to temper the ardor of efficiency of the technology could in September 2019 only formulate a very reserved opinion on this article 57 of the finance law.

Secondly and in general, the constitutional courts are reserved with regard to Compliance Law, considering their office to preserve the classical principles of procedure against the infatuation of efficiency in the Law of Regulation and Compliance law.

III. THE "PUBLIC" CHARACTER OF INFORMATION DOES NOT TRANSFORM IT IN "INFORMATION AVAILABLE"

In the state of the voted text, which differs from the text of the bill, before even being received by the State, public information should have been made intentionally available to all, by an unequivocal act of publication.

We know that digital companies, which build, operate and regulate second-level social networks and platforms, take great care not to be qualified as publishers. Despite some court decisions, the texts have therefore followed in their footsteps.

According to the text voted by the National Assembly, the content must first of all be "public". However, platforms are not always so, the "real identity policy" does not always apply to it, etc. Furthermore, the definition was so uncertain that parliamentarians indicated that only "manifestly made public" information could be collected.

Such an adverb, especially the one frequently used in summary proceedings and on which decades of case law has focused to determine what is "manifest" and what is not ", can only cause fear as to the precision of the criterion, however, since it is a question of using this information to obtain a conviction, as specified in article 57 which distinguishes a retention period for information simply available to the administration which wants to know more about a taxpayer and a conservation time as much as it is necessary when this is integrated into a criminal, customs or administrative sanction procedure. But the jurisprudence always made go back in time the guarantees of procedure, so that it does not take shape. Therefore constitutionally, the vagueness of what is information "manifestly made public" poses a problem.

IV. IS THE ACT OF PUBLICATION THE EQUIVALENT OF THE ACT OF CONSENT TO OTHERS?

What is more, it emerges from the discussions and the justifications provided by the Government that we actually wanted to leave the old world of paper newspapers to build factual reasoning and adequate law in the digital world which is now ours, with the effectiveness of Compliance Law, not defeating the authority of the State and on the contrary using the technological power of operators to better concretize its authority.

Indeed, after being concerned about the lack of definition of what is "available information", the CNIL in its deliberation of September 12, 2019, considers that in any event the fact of "availability "information is not enough, an act is needed:" In general, the Commission recalls that the only circumstance that the data is accessible on the internet, and that people are possibly aware that a potential risk of aspiration their data exists, is not enough for the administrations which wish to exploit them to be exempt from the obligation to collect these data in a fair and lawful manner. ".

This act necessary for the information to become available for the benefit of the administration so that it pursues its mission of general interest, this will be "publication". We go from availability to publication. We pass from a fact to an act. And "publication" is a unilateral act of will.

It is clear that the reasoning is actually borrowed no longer from the law of investigations and the usual evidentiary systems but rather from what is the basis for the free use of personal data for the moment: "consent".

Indeed, the idea is that since a user has freely and unambiguously ("manifestly") used his will to "publish", then even if this is not in the sense intended by intellectual property, c that is to say from an "editor", the information will therefore be available and usable.

But the difficulty will come when the information thus made available does not concern the Internet user who has manifestly expressed his will and given information on a third party. Because if consent is so important in Personal Data Law, it is because it is worth renouncing protection. And thus makes the information available to third parties ....

However, how could there be information available for the administration, if it is information on the private life no longer of the one who publishes it but on a third party, of which the first speaks, even whether it could be effective in making it possible, for example, to assess the standard of living or to locate it? (admittedly facial recognition is excluded, but not the capture of information on the third party if a surfer visits him and publishes a photo of his beautiful house, his car, tells an event, etc.).

However, fiscally useful information is often collected in stories about meetings and collective celebrations, therefore from third parties compared to the one who took the initiative to publish. These third parties have not consented to such publication. Even if facial recognition is expressly prohibited, the "collection" of information on third parties who have consented to nothing concerning them is not.

It is a "publication" in a digital space which is not governed by specific texts for the press, which gives personal information about people, ie those who wanted "to manifestly public "personal data, this" consent "can probably make it available while one might think that third parties who may be" affected "by this" publication ", which has consented to nothing, does not cannot see their constitutional right to private life thus disregarded, since they did not consent to this act of will, not being at the origin of it and they will often not be aware of this publication, when they are presumed to know it when it is a publication in a media of the world of yesterday.

Parliament has to think twice.

Indeed, consent and the act of free will, here publication, must not be divided in a liberal society and the rule of law. Especially when we are in a context of prospect of sanction, justifying a restrictive reasoning.

No doubt out of prudence and with a view to the control that the Constitutional Council will operate, the Senate will have to take all of this into account, so that the efficiency of tax and customs administration, driven by Compliance Law , nevertheless finds a way to deploy, that technologies do not hinder but serve it.