Law N# 96-659 26 July 1996
French Telecommunications act of 1996

© Secretary of State for industry - France

Art. 17.

Article 28 of law n· 90-1170 of 29 December 1990 on the regulatory framework for telecommunications shall be amended as follows:

I - I shall be amended as follows:

1) At the end of the first paragraph there shall be added the following sentence, "Encryption device means hardware or software designed or modified for this purpose."

2) For the second, third, fourth and fifth paragraphs there shall be substituted the following provisions:

"In the interests of national defence and internal and external State security, while protecting data and developing the security of communications and transactions:

"1) the use of an encryption device or service shall be:

"a) unrestricted

"- if the encryption service or device does not provide confidentiality, particularly when its only purpose is to authenticate a communication or to ensure the integrity of the information transmitted;

"- or if the encryption device provides confidentiality functions based solely on secret conventions managed under approved procedures and by an organisation approved under the conditions defined in II;

"b) subject to authorisation by the Prime Minister in any other case.

"2) the supply, importation from countries outside the European Union, or exportation of an encryption device or service:

"a) shall be subject to authorisation from the Prime Minister if it performs functions of confidentiality; to obtain an authorisation the supplier may be required to reveal the identity of the purchaser.

"b) shall be subject to declaration in all other cases."

"3) A decree shall lay down the conditions under which declarations are made and authorisations granted. This decree shall provide for:

"a) a simplified declaration or licensing regime for certain types of device or service and for certain categories of users;

"b) the substitution of the authorisation by the declaration for the use of encryption devices or services which are not subject to authorisation with regard to the above-mentioned provisions, but which justify supervision.

"c) derogation of all previous formalities for operations concerning encryption devices and services, the technical characteristics and usage conditions of which should not effect the interests mentioned at the beginning of the second paragraph.

"d) The timescale for responses to licence applications."

II - For II there shall be substituted II and III, worded as follows:

"II - The bodies responsible for managing the secret keys pertaining to encryption devices and services which provide confidentiality, on behalf of third parties, shall be subject to prior approval from the Prime Minister.

"They shall not disclose information brought to their notice while carrying out their approved functions.

"The approval shall specify the resources and services that they may use or provide.

"They shall be required to store the secret keys that they manage. They shall be required to send a copy thereof to the legal authorities and to the authorised bodies, or to implement them, as requested, in application of law n· 91-646 of 10 July 1991 on the confidentiality of information transmitted by telecommunications networks, or within the framework of inquiries conducted under articles chapters I and II of title II of book I of the Criminal Procedure Code.

"If the entities disclose the secret keys under their control during their investigations undertaken under chapters I and II of title II of book I of the Criminal Code, following investigations by the public prosecutor, they shall inform users of this disclosure.

"They shall carry out their activities on the national territory.

"A State Council decree shall define the conditions governing the approval of these organisations and shall set out the procedures and technical provisions required to implement the obligations described above.

"III - a) Notwithstanding the application of the Customs Code, a person who provides, imports from countries outside the European Union or exports an encryption device or service without having obtained the authorisation referred to in point I or who does not respect the conditions of the authorisation issued shall be guilty of an offence and liable to imprisonment for a term of six months and to a fine of 200 000 French francs.

"A person who provides encryption devices or services without having obtained the approval referred to in point I or does not comply with the conditions of the approval referred to in point II, shall be guilty of an offence and liable to imprisonment for a term of two years and to a fine of 300 000 French francs.

"A person who provides, imports from countries outside the European Union, or exports an encryption device in order to facilitate the preparation or commission of a crime or an offence shall be liable to imprisonment for a term of three years and to fine of 500 000 French francs.

"Any attempt to commit the offences described in the previous paragraphs shall be liable to the same punishment.

"b) - A natural person guilty of an offence described in this paragraph shall also be liable to the additional penalties provided for in articles 131-19, 131-21 and 131-27 of the Criminal Code.

"c) - An artificial person may be declared criminally responsible for the offences defined in the first paragraph, under the conditions described in article 121-2 of the Criminal Code. The penalties to which artificial persons shall be liable are as follows:

"1) a fine according to the terms set out in article 131-38 of the Criminal Code;

"2) the penalties referred to in article 131-39 of the same code. The prohibition referred to in 2) of article 131-39 above concerns the activity in the exercise of which or at the time of the exercise of which the offence was committed."

III - III shall become IV.

For the last paragraph there shall be substituted the following provisions:

"A person who refuses to supply information or documents or to obstruct the inquiries referred to in paragraph IV, shall be liable to imprisonment for a term of six months and to a fine of 200 000 French francs."

IV - IV shall become V.

After the word, "authorisations", there shall be inserted the words "and declarations".

V - VI below shall be added:

"VI - The provisions of this article shall not prevent the decree of 18 April 1939 laying down the regime governing armaments, weapons and munitions from being applied to encryption devices which are especially designed or modified to permit or facilitate the use or implementation of weapons."

VI - V shall become VII.

VII - This article shall be applicable to the overseas territories and to the island of Mayotte.