French cybersecurity bill National Assembly, Digi Mart USA News (France): A long-awaited bill on the resilience of critical infrastructure and the strengthening of cybersecurity is due to reach the floor of France’s National Assembly on Monday, after a lengthy debate over encrypted messaging services and a summer marked by new cyberattacks.
The bill, which is intended to transpose three European texts into French law, has had an unusual legislative path. It was first filed in the Senate in October 2024, two days before the deadline for transposing two European directives, and was approved in committee the following year.
Its progress was slowed by a major debate over encrypted messaging.
The use of the accelerated legislative procedure did not allow the deadlines to be met. After an announced return to the chamber in early October, the bill’s examination was postponed again due to the parliamentary calendar.
“It is both a relief to see that we are finally able to examine this text and, at the same time, a regret that we did not do so sooner,” Renaissance deputy Éric Bothorel, one of the bill’s rapporteurs, told AFP.
In early July, the European Commission launched legal action against three countries, including France, for failing to transpose one of the directives. The revelation in August of massive data thefts affecting the tax authority further added to the bill’s urgency.
Vincent Strubel, director of the national cybersecurity agency (Anssi), told the special parliamentary committee in early October that the measures in the European texts would have been effective against most of the data thefts recorded in France in recent months against the state and companies. He also said the texts would give Anssi a binding power it currently lacks.
The transposition of the NIS 2 directive is especially awaited in the cybersecurity sector. According to a mapping carried out by the Campus cyber, which brings together companies and institutions, up to 19,000 companies could be affected by new cybersecurity obligations.
The examination of the text and of nearly 400 amendments filed is expected to spark debate, in a context of an “unprecedented rise in the cyber threat,” according to Digital Minister Anne Le Hénanff, who was questioned by the same special committee.
The text still contains a contested article on encrypted messaging services such as WhatsApp, Telegram and Signal. Article 16 bis, which is meant to guarantee the inviolability of encrypted messaging, was inserted in the Senate to respond to a separate parliamentary initiative on another bill in early 2025.
Senators had included an article 8 ter in the Narcotrafic bill that would have required these messaging services to open access to conversations of people under wiretap upon request from police services, a measure backed by intelligence agencies. That article was ultimately dropped from the final version of the text, but it prompted the inclusion of Article 16 bis in the cybersecurity bill, which some say goes too far in protecting encrypted messaging.
The government has therefore filed an amendment to delete the article, alongside several deputies from LR, Horizons, Renaissance and Liot, arguing that it presents “a major risk to national security” by “prohibiting the imposition of any mechanism or process allowing access to protected data.”
Anne Le Hénanff has pledged not to reintroduce, or support any reintroduction of, Article 8 ter before the end of the parliamentary session.
In a report submitted in September to the executive and reviewed by AFP, former deputy Florent Boudié recommended abandoning the provisions of Article 16 bis, given the serious legal uncertainties that its current wording would create.
