프랑스의 합법적 감청 요건에는 여러 규제 기관과 복잡한 법적 프레임워크가 포함됩니다. 프랑스는 유럽에서 가장 정교하고 엄격하게 규제되는 합법적인 감청 프레임워크 중 하나를 유지하고 있습니다. 프랑스의 접근 방식은 강력한 제도적 구조, 중복되는 여러 법적 수단, 정보기관, 사법부 및 규제 당국 간의 명확한 역할 구분이 특징입니다. 통신 사업자, 특히 해외 사업자, MVNO 및 OTT 서비스 제공업체의 경우 프랑스의 LI 환경을 이해하려면 하나의 법률이 아니라 상호 연결된 법률, 법령 및 기관의 명령 시스템을 탐색해야 합니다.
The principal legal instruments are the Code de Procédure Pénale (CPP) for judicial interception, Book VIII of the Code de la Sécurité Intérieure (CSI) for security interceptions, and the Code des Postes et des Communications Électroniques (CPCE) for operators’ obligations. The Loi pour la Confiance dans l’Économie Numérique (LCEN) extends some of these duties to hosting providers. The institutional landscape includes the Groupement interministériel de contrôle (GIC), the Commissariat aux communications électroniques de défense (CCED), the Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI), the Direction Générale de la Sécurité Intérieure (DGSI), and the Commission Nationale de Contrôle des Techniques de Renseignement (CNCTR). Each plays a distinct role, and operators must understand how these pieces fit together to build a compliant LI operation.
합법적 감청 프랑스: 규제 환경
The LCEN, adopted in 2004, establishes the general framework for digital services and electronic commerce in France. While its primary focus is broader than lawful interception, several provisions are directly relevant to operators. The LCEN (Law 2004-575) matters mainly because it brings hosting providers within the scope of the same cooperation duties (CPCE D. 98-7 III; CSI L. 871-4). Operators’ retention duties are in article L. 34-1 CPCE.
The CPCE is the more directly relevant instrument for telecommunications operators. It sets out the public-order and operating rules for providers of electronic communications services, including the obligation to cooperate with lawful interception requests. Article L. 33-1 CPCE subjects operators to public-order and security requirements, and article D. 98-7 III spells them out: operators must put in place the means to answer judicial (CPP) and intelligence (CSI Book VIII) requests, for which the State pays a fair remuneration (D. 98-7 IV). This obligation applies to every operator of a public network or publicly available electronic communications service, MVNOs included. France also requires the interception systems to be installed and operated on French territory, by qualified staff designated by the operator. Running LI from abroad is not allowed without a ministerial derogation (CPCE D. 98-7).
The CPP governs judicial interceptions — those ordered by a judge in the context of criminal investigations. Under Articles 100 through 100-7 of the CPP, a juge d’instruction (investigating judge) may order the interception of telecommunications when the offence carries a sentence of three years’ imprisonment or more (art. 100 CPP). Each order specifies the target and the scope of the interception, lasts at most four months and can be renewed up to a total of one year, or two years for organised crime (art. 100-2). In organised-crime inquiries the liberty and custody judge (JLD) can also authorise interception at the prosecutor’s request (art. 706-95). Operators must execute these orders promptly and deliver the intercepted communications to the designated authorities.
프랑스에는 사법 감청 외에도 정보기관이 국가 안보를 목적으로 수행하는 행정 감청(보안 감청)을 위한 별도의 제도가 있습니다. 이러한 감청은 내부 보안법(Code de la Sécurité Intérieure)의 적용을 받으며 CNCTR의 감독을 받습니다. 행정 감청 제도는 보다 체계적인 법적 체계를 확립하고 독립적인 감독 기관으로 CNCTR을 도입한 2015년의 재위임법(Loi relative au renseignement)에 의해 크게 개혁되었습니다.
ANSSI의 역할
ANSSI — the French national cybersecurity agency — plays a direct role in lawful interception: its Director General issues the ‘R226’ authorisations that every manufacturer, seller and operator of interception equipment in France needs (Code pénal R. 226-1 to R. 226-10). Data produced by the LI systems must be encrypted with a state-validated means whenever it has to transit electronically outside French territory (CPCE D. 98-7 III). ANSSI is additionally responsible for the security of information systems, including those used by government agencies and critical infrastructure operators, and establishes security standards for the protection of sensitive communications infrastructure.
Operators that handle lawful interception data are expected to maintain security standards that align with ANSSI’s guidelines for the protection of sensitive systems. Beyond the R226 authorisations, ANSSI’s standards and recommendations inform the security expectations that apply to interception infrastructure. Operators should be familiar with ANSSI’s publications on information system security and ensure that their LI platforms, communications channels, and data storage systems meet the expected security levels.
또한 ANSI는 민감한 정부 애플리케이션에 사용되는 암호화 제품 및 보안 솔루션의 인증에도 역할을 합니다. LI 시스템에 암호화 또는 보안 통신 기술을 배포하는 운영자는 특정 사용 사례에 ANSSI 인증 솔루션이 필요한지 또는 권장되는지 고려해야 합니다.
DGSI 및 인텔리전스 서비스의 역할
The DGSI is France’s primary domestic intelligence agency, responsible for counter-terrorism, counter-espionage, and the protection of national security. The DGSI is one of the principal users of administrative 감청 능력, but operators do not deal with it directly for interceptions: security interceptions are executed through the Groupement interministériel de contrôle (GIC), a service of the Prime Minister that centralises them for all intelligence services. Operators’ LI staff may need a national-defence security clearance (CSI R. 872-1).
Administrative interceptions requested by the intelligence services follow a specific procedure. The competent minister (Interior, Defence, Justice, Economy/Budget or Customs) submits a written request. The Prime Minister authorises it after an opinion from the CNCTR; if the CNCTR objects, the Conseil d’État must rule before the measure is executed, except in urgent cases. Once authorised, the operator implements the interception on the Prime Minister’s order, through its own qualified agents, and delivers to the GIC (CSI L. 871-6, R. 823-1). The technical delivery infrastructure for administrative interceptions is operated by the GIC on behalf of all intelligence services and differs from the judicial channel, so operators must support both channels.
CNCTR의 역할은 행정 감청 활동에 대한 독립적인 감독을 제공하는 것입니다. 위원회는 감청 요청이 승인되기 전에 감청 요청을 검토하고 감청의 실행을 모니터링하며 감청이 불법적으로 이루어졌다고 판단되는 경우 사건을 국가인권위원회에 회부할 수 있습니다. 사업자의 경우 CNCTR의 존재는 감청 요청이 독립적인 검토를 거쳤다는 어느 정도의 보증을 제공하지만, 사업자가 유효한 명령을 준수해야 할 의무가 면제되는 것은 아닙니다.
기술 인프라: PNIJ
France operates a centralised technical platform for lawful interception known as the Plateforme Nationale des Interceptions Judiciaires (PNIJ). The PNIJ is managed by the Agence Nationale des Techniques d’Enquêtes Numériques Judiciaires (ANTENJ) under the authority of the Ministry of Justice and handles the technical processing of judicial interception orders. Judicial requisitions (interceptions, real-time geolocation and many data requests) are sent through the PNIJ, which also receives and stores the results for the magistrates and investigators (art. 230-45 CPP). The CCED, a service of the ministry for electronic communications, oversees how operators meet these defence and public-security obligations, including lawful interception, and validates their LI investment choices on the minister’s behalf (CPCE D. 98-7 IV).
The PNIJ was deployed in the mid-2010s and represents France’s effort to centralise and modernise its judicial interception infrastructure. The platform handles the end-to-end workflow for judicial interceptions, from the receipt of judicial requisitions to the delivery of intercepted data to the magistrates and investigators who use the platform. Operators interface with the PNIJ through defined technical specifications that cover the delivery of IRI and CC in formats aligned with ETSI standards but adapted to the PNIJ’s specific requirements.
PNIJ는 배포 이후 기술적 문제, 용량 제약, 일부 사법 및 법 집행 기관 이해관계자의 비판 등 운영상의 어려움에 직면해 왔습니다. 하지만 여전히 사법 감청을 위한 의무 플랫폼으로 남아 있으며, 운영자는 연결성을 유지하고 기술 요건을 준수해야 합니다. 온보딩 및 테스트 절차에 많은 시간이 소요될 수 있으므로 프랑스 시장에 진출하는 운영자는 계획 초기에 PNIJ와 협력해야 합니다.
For administrative interceptions, the technical delivery infrastructure is separate from the PNIJ and is operated by the GIC. Operators must support both delivery channels, which may require different technical interfaces, security protocols, and operational procedures. The dual-channel model adds complexity to the operator’s LI infrastructure but is a fundamental feature of the French system.
데이터 보존 요구 사항
France maintains 데이터 보존 obligations under article L. 34-1 CPCE. Operators keep identity data for five years after the contract ends, and account, payment and IP-source data for one year. Traffic and location data may be retained generally for one year only while a Prime Ministerial injunction, based on a serious threat to national security, is in force. Beyond that, authorities can order ‘quick freeze’ preservation. The Conseil d’État has issued rulings refining the scope of these obligations in light of CJEU jurisprudence.
운영자는 현행 법적 프레임워크에 따라 데이터 보존 시스템을 구현하고 사법 및 행정 당국의 액세스 요청에 대응할 수 있도록 준비해야 합니다. 데이터 보존과 실시간 차단 간의 상호 작용으로 인해 운영자는 두 가지 기능을 모두 유지하고 시스템이 두 가지 유형의 요청을 모두 효율적으로 처리할 수 있도록 해야 합니다.
MVNO별 고려 사항
The French MVNO market is one of the most developed in Europe, with numerous virtual operators serving significant subscriber bases. MVNOs bear the same lawful interception obligations as MNOs; the obligation applies to every operator of a public network or publicly available electronic communications service, and there is no reduced obligation for virtual operators. This means that MVNOs must either deploy their own LI infrastructure or establish comprehensive arrangements with their host MNOs to ensure compliance.
MVNO와 PNIJ 간의 관계는 매우 중요한 고려 사항입니다. MVNO는 직접 또는 호스트 MNO를 통해 필요한 형식으로 감청된 통신을 PNIJ에 전달할 수 있어야 합니다. 기술 모델은 MVNO의 아키텍처와 도매 계약 조건에 따라 달라집니다. 자체 핵심 네트워크 요소를 갖춘 완전 MVNO는 보다 직접적으로 제어할 수 있는 반면, 라이트 MVNO는 호스트 MNO의 감청 기능에 더 많이 의존해야 할 수 있습니다.
프랑스 법 집행 기관은 사업자가 정해진 시간 내에 감청 명령에 응답할 것을 기대하며, MVNO-MNO 조정 절차로 인한 지연은 규정 미준수에 대한 변명으로 허용되지 않습니다. MVNO는 감청 프로세스가 충분히 자동화되어 있고 호스트 MNO와의 계약에 구속력 있는 응답 시간 약속이 포함되어 있는지 확인해야 합니다.
실용적인 권장 사항
Operators preparing for LI 규정 준수 in France should begin by reviewing the CPCE, CPP, and the relevant provisions of the Code de la Sécurité Intérieure. Engage French legal counsel with expertise in telecommunications and national security law, as the interaction between judicial and administrative interception regimes requires specialist knowledge. Initiate contact with the CCED, which oversees operators’ lawful interception obligations and validates their LI investment choices on the minister’s behalf.
Invest in LI infrastructure that supports both the PNIJ and administrative interception delivery channels. Ensure that your systems meet the security standards expected by ANSSI and the intelligence services, that your interception equipment is covered by the required R226 authorisations, and that the LI systems are installed and operated on French territory as required by CPCE D. 98-7. If you are an MVNO, review your host MNO agreement and ensure that LI obligations are explicitly and comprehensively addressed. Finally, develop and document internal processes for handling both judicial and administrative interception orders, including confidentiality controls and audit mechanisms.
결론
France’s lawful interception landscape is complex, multi-layered, and demanding. The combination of the CPP, the CSI and the CPCE as legal foundations, the institutional roles of the GIC, the CCED, ANSSI and the CNCTR, and the technical infrastructure of the PNIJ creates a compliance environment that requires thorough preparation and ongoing engagement. For operators entering the French market, the key to success is early and systematic engagement with the regulatory and technical stakeholders, combined with investment in robust, flexible LI infrastructure that can support both judicial and administrative interception requirements. The French market rewards operators that take compliance seriously and penalises those that treat it as an afterthought: refusing to cooperate with an intelligence request is punishable by two years’ imprisonment and a EUR 150,000 fine (CSI L. 881-2).
Lawful interception France obligations extend beyond technical compliance to include operational procedures and staff vetting: only qualified agents designated by the operator, with a clean criminal record and, where required, a national-defence security clearance, may operate the LI systems (CPCE D. 98-7 III; CSI R. 872-1). Operators must ensure their lawful interception France programme addresses the full scope of regulatory expectations.
관련 기사
관련 주제에 대한 자세한 내용은 다음 문서를 참조하세요:
- LI Requirements in the Netherlands: Telecommunicatiewet Chapter 13, ETSI-IP.nl and What MVNOs Must Know
- 스페인의 LGTEL에 따른 합법적 감청 요건
- Auslandskopfüberwachung(AKÜ): 국제 통신사업자를 위한 독일의 합법적인 감청 의무
외부 리소스
다음 외부 리소스에서 추가 컨텍스트와 공식 문서를 확인할 수 있습니다:
