フランスの合法的な傍受の要件には、複数の規制機関と複雑な法的枠組みが関わっている。フランスは、ヨーロッパで最も洗練され、厳しく規制された合法的傍受の枠組みを維持している。フランスのアプローチは、強力な制度構造、重複する複数の法的手段、情報機関、司法、規制当局間の明確な役割分担によって特徴付けられる。電気通信事業者（特に外資系企業、MVNO、OTTサービスプロバイダー）にとって、フランスのLIの状況を理解するには、1つの法律だけでなく、法律、政令、制度的指令が相互に関連したシステムをナビゲートする必要がある。.
The principal legal instruments are the Code de Procédure Pénale (CPP) for judicial interception, Book VIII of the Code de la Sécurité Intérieure (CSI) for security interceptions, and the Code des Postes et des Communications Électroniques (CPCE) for operators’ obligations. The Loi pour la Confiance dans l’Économie Numérique (LCEN) extends some of these duties to hosting providers. The institutional landscape includes the Groupement interministériel de contrôle (GIC), the Commissariat aux communications électroniques de défense (CCED), the Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI), the Direction Générale de la Sécurité Intérieure (DGSI), and the Commission Nationale de Contrôle des Techniques de Renseignement (CNCTR). Each plays a distinct role, and operators must understand how these pieces fit together to build a compliant LI operation.
合法的傍受 フランス規制の状況
The LCEN, adopted in 2004, establishes the general framework for digital services and electronic commerce in France. While its primary focus is broader than lawful interception, several provisions are directly relevant to operators. The LCEN (Law 2004-575) matters mainly because it brings hosting providers within the scope of the same cooperation duties (CPCE D. 98-7 III; CSI L. 871-4). Operators’ retention duties are in article L. 34-1 CPCE.
The CPCE is the more directly relevant instrument for telecommunications operators. It sets out the public-order and operating rules for providers of electronic communications services, including the obligation to cooperate with lawful interception requests. Article L. 33-1 CPCE subjects operators to public-order and security requirements, and article D. 98-7 III spells them out: operators must put in place the means to answer judicial (CPP) and intelligence (CSI Book VIII) requests, for which the State pays a fair remuneration (D. 98-7 IV). This obligation applies to every operator of a public network or publicly available electronic communications service, MVNOs included. France also requires the interception systems to be installed and operated on French territory, by qualified staff designated by the operator. Running LI from abroad is not allowed without a ministerial derogation (CPCE D. 98-7).
The CPP governs judicial interceptions — those ordered by a judge in the context of criminal investigations. Under Articles 100 through 100-7 of the CPP, a juge d’instruction (investigating judge) may order the interception of telecommunications when the offence carries a sentence of three years’ imprisonment or more (art. 100 CPP). Each order specifies the target and the scope of the interception, lasts at most four months and can be renewed up to a total of one year, or two years for organised crime (art. 100-2). In organised-crime inquiries the liberty and custody judge (JLD) can also authorise interception at the prosecutor’s request (art. 706-95). Operators must execute these orders promptly and deliver the intercepted communications to the designated authorities.
司法による傍受に加え、フランスには国家安全保障のために諜報機関が行う行政による傍受（interceptions de sécurité）のための別個の制度がある。このような傍受は、「国家安全保障法」（Code de la Sécurité Intérieure）によって規定され、CNCTRの監督下に置かれる。行政傍受制度は、2015年の情報公開法（Loi relative au renseignement）によって大幅に改革され、より体系的な法的枠組みが確立され、独立した監視機関としてCNCTRが導入された。.
ANSSIの役割
ANSSI — the French national cybersecurity agency — plays a direct role in lawful interception: its Director General issues the ‘R226’ authorisations that every manufacturer, seller and operator of interception equipment in France needs (Code pénal R. 226-1 to R. 226-10). Data produced by the LI systems must be encrypted with a state-validated means whenever it has to transit electronically outside French territory (CPCE D. 98-7 III). ANSSI is additionally responsible for the security of information systems, including those used by government agencies and critical infrastructure operators, and establishes security standards for the protection of sensitive communications infrastructure.
Operators that handle lawful interception data are expected to maintain security standards that align with ANSSI’s guidelines for the protection of sensitive systems. Beyond the R226 authorisations, ANSSI’s standards and recommendations inform the security expectations that apply to interception infrastructure. Operators should be familiar with ANSSI’s publications on information system security and ensure that their LI platforms, communications channels, and data storage systems meet the expected security levels.
ANSSIは、機密性の高い政府アプリケーションで使用される暗号製品やセキュリティ・ソリューションの認証においても役割を果たしている。LIシステムに暗号化技術やセキュア通信技術を導入する事業者は、ANSSI認定のソリューションが特定のユースケースに必要か推奨されるかを検討する必要があります。.
DGSIとインテリジェンス・サービスの役割
DGSIは、フランスの主要な国内情報機関であり、テロ対策、対スパイ活動、および国家安全保障の保護を担当している。DGSIは、行政情報の主要な利用者の一つである。 傍受能力, but operators do not deal with it directly for interceptions: security interceptions are executed through the Groupement interministériel de contrôle (GIC), a service of the Prime Minister that centralises them for all intelligence services. Operators’ LI staff may need a national-defence security clearance (CSI R. 872-1).
Administrative interceptions requested by the intelligence services follow a specific procedure. The competent minister (Interior, Defence, Justice, Economy/Budget or Customs) submits a written request. The Prime Minister authorises it after an opinion from the CNCTR; if the CNCTR objects, the Conseil d’État must rule before the measure is executed, except in urgent cases. Once authorised, the operator implements the interception on the Prime Minister’s order, through its own qualified agents, and delivers to the GIC (CSI L. 871-6, R. 823-1). The technical delivery infrastructure for administrative interceptions is operated by the GIC on behalf of all intelligence services and differs from the judicial channel, so operators must support both channels.
CNCTRの役割は、行政による傍受活動について独立した監視を行うことである。CNCTRは、傍受が許可される前に傍受要請を審査し、傍受の実施を監視し、傍受が違法に行われたと判断した場合にはConseil d'Étatに事件を付託することができる。事業者にとっては、CNCTRの存在は、傍受要求が独立した審査を受けていることをある程度保証するものであるが、事業者が有効な命令に従う義務を免除するものではない。.
技術インフラPNIJ
France operates a centralised technical platform for lawful interception known as the Plateforme Nationale des Interceptions Judiciaires (PNIJ). The PNIJ is managed by the Agence Nationale des Techniques d’Enquêtes Numériques Judiciaires (ANTENJ) under the authority of the Ministry of Justice and handles the technical processing of judicial interception orders. Judicial requisitions (interceptions, real-time geolocation and many data requests) are sent through the PNIJ, which also receives and stores the results for the magistrates and investigators (art. 230-45 CPP). The CCED, a service of the ministry for electronic communications, oversees how operators meet these defence and public-security obligations, including lawful interception, and validates their LI investment choices on the minister’s behalf (CPCE D. 98-7 IV).
The PNIJ was deployed in the mid-2010s and represents France’s effort to centralise and modernise its judicial interception infrastructure. The platform handles the end-to-end workflow for judicial interceptions, from the receipt of judicial requisitions to the delivery of intercepted data to the magistrates and investigators who use the platform. Operators interface with the PNIJ through defined technical specifications that cover the delivery of IRI and CC in formats aligned with ETSI standards but adapted to the PNIJ’s specific requirements.
PNIJは配備以来、技術的な問題、容量の制約、一部の司法・法執行関係者からの批判など、運用上の課題に直面してきた。しかし、PNIJは依然として司法傍受のための必須プラットフォームであり、事業者は接続性を維持し、その技術的要件に準拠しなければならない。フランス市場に参入する事業者は、オンボーディングとテスト手続きに時間がかかる可能性があるため、計画プロセスの早い段階でPNIJに関与すべきである。.
For administrative interceptions, the technical delivery infrastructure is separate from the PNIJ and is operated by the GIC. Operators must support both delivery channels, which may require different technical interfaces, security protocols, and operational procedures. The dual-channel model adds complexity to the operator’s LI infrastructure but is a fundamental feature of the French system.
データ保持要件
フランスは次のように主張している データ保持 obligations under article L. 34-1 CPCE. Operators keep identity data for five years after the contract ends, and account, payment and IP-source data for one year. Traffic and location data may be retained generally for one year only while a Prime Ministerial injunction, based on a serious threat to national security, is in force. Beyond that, authorities can order ‘quick freeze’ preservation. The Conseil d’État has issued rulings refining the scope of these obligations in light of CJEU jurisprudence.
事業者は、現行の法的枠組みに従ってデータ保持システムを導入し、司法当局や行政当局からのアクセス要求に対応できるように準備しなければならない。データ保持とリアルタイム傍受の相互作用により、事業者は両方の機能を維持し、システムが両方のタイプの要求を効率的に処理できるようにする必要がある。.
MVNO特有の考察
The French MVNO market is one of the most developed in Europe, with numerous virtual operators serving significant subscriber bases. MVNOs bear the same lawful interception obligations as MNOs; the obligation applies to every operator of a public network or publicly available electronic communications service, and there is no reduced obligation for virtual operators. This means that MVNOs must either deploy their own LI infrastructure or establish comprehensive arrangements with their host MNOs to ensure compliance.
MVNOとPNIJの関係は極めて重要な検討事項である。MVNOは、直接またはホストMNOを介して、必要な形式でPNIJに傍受通信を配信できることを保証しなければならない。技術的なモデルは、MVNOのアーキテクチャとその卸売契約の条件によって異なります。独自のコアネットワークエレメントを持つフルMVNOはより直接的な制御が可能かもしれないが、ライトMVNOはホストMNOの傍受能力に大きく依存する必要があるかもしれない。.
フランスの法執行機関は、事業者が定められた時間内に傍受命令に対応することを期待しており、MVNOとMNOの調整プロセスによって引き起こされる遅延は、コンプライアンス違反の言い訳として容認されるものではない。MVNOは、傍受プロセスが十分に自動化されていること、およびホストMNOとの契約に拘束力のある応答時間のコミットメントが含まれていることを確認する必要があります。.
実践的な提言
準備を進めている事業者 LIコンプライアンス in France should begin by reviewing the CPCE, CPP, and the relevant provisions of the Code de la Sécurité Intérieure. Engage French legal counsel with expertise in telecommunications and national security law, as the interaction between judicial and administrative interception regimes requires specialist knowledge. Initiate contact with the CCED, which oversees operators’ lawful interception obligations and validates their LI investment choices on the minister’s behalf.
Invest in LI infrastructure that supports both the PNIJ and administrative interception delivery channels. Ensure that your systems meet the security standards expected by ANSSI and the intelligence services, that your interception equipment is covered by the required R226 authorisations, and that the LI systems are installed and operated on French territory as required by CPCE D. 98-7. If you are an MVNO, review your host MNO agreement and ensure that LI obligations are explicitly and comprehensively addressed. Finally, develop and document internal processes for handling both judicial and administrative interception orders, including confidentiality controls and audit mechanisms.
結論
France’s lawful interception landscape is complex, multi-layered, and demanding. The combination of the CPP, the CSI and the CPCE as legal foundations, the institutional roles of the GIC, the CCED, ANSSI and the CNCTR, and the technical infrastructure of the PNIJ creates a compliance environment that requires thorough preparation and ongoing engagement. For operators entering the French market, the key to success is early and systematic engagement with the regulatory and technical stakeholders, combined with investment in robust, flexible LI infrastructure that can support both judicial and administrative interception requirements. The French market rewards operators that take compliance seriously and penalises those that treat it as an afterthought: refusing to cooperate with an intelligence request is punishable by two years’ imprisonment and a EUR 150,000 fine (CSI L. 881-2).
Lawful interception France obligations extend beyond technical compliance to include operational procedures and staff vetting: only qualified agents designated by the operator, with a clean criminal record and, where required, a national-defence security clearance, may operate the LI systems (CPCE D. 98-7 III; CSI R. 872-1). Operators must ensure their lawful interception France programme addresses the full scope of regulatory expectations.
関連記事
関連トピックについては、以下の記事を参照されたい：
- LI Requirements in the Netherlands: Telecommunicatiewet Chapter 13, ETSI-IP.nl and What MVNOs Must Know
- LGTELに基づくスペインの合法的傍受要件
- Auslandskopfüberwachung（AKÜ）：国際通信事業者に対するドイツの合法的傍受義務
外部リソース
以下の外部リソースは、さらなる背景と公式文書を提供している：
