FRENCH REPUBLIC Ministry of […]

Decree No of implementing Law No 2022-300 of 2 March 2022 aimed at strengthening parental control over the means of access to the Internet

NOR: […]

Target audience:

Subject

Entry into force: the text shall enter into force on the day after its publication.

Notice:

References: the wording of these texts, as amended by this Decree, may be consulted on the Légifrance website (http://www.legifrance.gouv.fr).

Decree No 2023-588 of 11 July 2023 implementing Article
1 of Law No 2022-300 of 2 March 2022 aimed at
strengthening parental control over the means of access to
the Internet
NOR: ECOI2235065D
ELI: https://www.legifrance.gouv.fr/eli/decret/2023/7/11/ECOI2235065D/jo/texte
Alias: https://www.legifrance.gouv.fr/eli/decret/2023/7/11/2023-588/jo/texte
JORF No 0161 of 13 July 2023
Text No 2
Target audiences: manufacturers of terminal equipment, importers, distributors, order
fulfilment service providers.
Subject: laying down the obligations of manufacturers of terminals with regard to the
provision of terminal equipment incorporating compliant parental control means, the
obligations of importers, distributors and order fulfilment service providers in relation to
checking the compliance of the terminal equipment made available and details of monitoring
by the National Frequency Agency.
Entry into force: the text shall enter into force after 12 months from the day of its publication
in the Official Journal of the French Republic.
Notice: the Decree implements Article 1 of Law No 2022-300 of 2 March 2022 aimed at
strengthening parental control over the means of access to the Internet. It specifies the set of
obligations applicable to manufacturers of terminal equipment with regard to the minimum
functionalities and technical characteristics to be complied with by parental control means
installed on their equipment. It also specifies, for these actors, the information to be made
available to the end user regarding the configuration of the parental control means and the
risks inherent in the use of means of internet access by minors. The Decree lays down new
obligations for distributors, importers and order fulfilment service providers with regard to the
marketing of parental control means on terminal equipment. It also expands the market
surveillance powers of the National Frequency Agency in order to integrate the control of
these requirements on terminals placed on the market.
References: the wording of these texts, as amended by the Decree, may be consulted on the
Légifrance website (https://www.legifrance.gouv.fr).
The Prime Minister,

On the report of the Minister for the Economy, Finance and Industrial and Digital Sovereignty,

Having regard to Law No 2022-300 of 2 March 2022 aimed at strengthening parental control over the means of access to the Internet;

Having regard to Law No 2004-575 of 21 June 2004 on confidence in the digital economy, and in particular Article 6 thereof;

Having regard to the opinion of the French Data Protection Authority [CNIL],

Having heard the Council of State (... section),

On the report of the Minister for the Economy, Finance and Industrial and Digital
Sovereignty,
Having regard to Regulation (EU) 2018/644 of the European Parliament and of the Council of
18 April 2018 on cross-border parcel delivery services, in particular Article 2 thereof;
Having regard to Regulation (EU) 2019/1020 of the European Parliament and of the Council
of 20 June 2019 on market surveillance and compliance of products and amending Directive
2004/42/EC and Regulations (EC) No 765/2008 and (EU) No 305/2011;
Having regard to Directive 97/67/EC of the European Parliament and of the Council of
15 December 1997 on common rules for the development of the internal market in
Community postal services and the improvement of the quality of service, in particular Article
2 thereof;

Having regard to Directive (EU) 2015/1535 of the European Parliament and of the European
Council of 9 September 2015 laying down a procedure for the provision of information in the
field of technical regulations and of rules on Information Society services;
Having regard to the Commercial Code, in particular Article L. 321-1 thereof;
Having regard to the Consumer Code, in particular Articles R. 512-10 to R. 512-15 and R.
512-16-1 to R. 512-16-7 thereof;
Having regard to the Postal and Electronic Communications Code, in particular Articles L.
32, L. 34-9, L. 34-9-3, L. 40 and L. 43 thereof;
Having regard to Law No 98-468 of 17 June 1998 on the prevention and punishment of sexual
offences and the protection of minors, in particular Article 32 thereof;
Having regard to Law No 2004-575 of 21 June 2004 on confidence in the digital economy;
Having regard to Law No 2022-300 of 2 March 2022 aimed at strengthening parental control
over the means of access to the Internet, in particular Article 1 thereof;
Having regard to the comments made during the public consultation carried out from
5 September to 6 October 2022, pursuant to part V of Article L. 32-1 of the Postal and
Electronic Communications Code;
Having regard to notification No 2022/694/F to the European Commission of 14 October
2022 pursuant to Directive (EU) 2015/1535;
Having regard to Resolution No 2023-023 of the French Data Protection Authority [CNIL]
dated 9 March 2023;
Having regard to the opinion of the French Council for the Protection of Minors dated 12 May
2023;
Having heard the Council of State (public works section),
Hereby decrees:

Article 1

Article R. 9 of the Postal and Electronic Communications Code is amended as follows:

1° In 5., after the words ‘radio equipment’, the words ‘or terminal equipment’ are added;

2° In 6., after the words ‘radio equipment’, the words ‘or terminal equipment’ are added;

3° In 10., after the words ‘radio equipment’, the words ‘or terminal equipment’ are added;

4° In 12., after the words ‘radio equipment’, the words ‘or terminal equipment’ are added;

5° In 13., after the words ‘radio equipment’, the words ‘or terminal equipment’ are added;

6° 14. is amended as follows:

‘14. ‘Economic operators’ mean the manufacturer, the authorised representative, the importer, the distributor and the fulfilment service provider or any other natural or legal person who is subject to obligations in relation to the manufacture of products, making them available on the market or putting them into service in accordance with the relevant European Union harmonisation legislation.’;

7° In 24., after the words ‘radio equipment’, the words ‘or terminal equipment’ are added;

8° In 25., after the words ‘radio equipment’, the words ‘or terminal equipment’ are added;

9° After 27., a paragraph is added as follows:

‘28. ‘Fulfilment service provider’ means any natural or legal person offering, in the course of a commercial activity, at least two of the following services: warehousing, packaging, addressing and dispatching, without having ownership of the products involved, excluding postal services as defined in point 1 of Article 2 of Directive 97/67/EC of the European Parliament and of the Council (31), parcel delivery services as defined in point 2 of Article 2 of Regulation (EU) 2018/644 of the European Parliament and of the Council (32), and any other postal services or freight transport services.’

Article 2

After Article R. 20-13-1 of Subsection 2 of Section 5 of Chapter II of Title I of Book II of the Postal and Electronic Communications Code, the following Article is added:

‘Article R. 20-13-2: I. – Fulfilment service providers shall place radio equipment that is compliant on the market.

II. – Before placing such equipment on the market, they shall ensure that the appropriate conformity assessment procedure referred to in Article R. 20-5 has been carried out by the manufacturer and that the radio equipment is so constructed that it operates in at least one Member State of the European Union without infringing applicable requirements on the use of the radio spectrum. They shall ensure that the manufacturer has drawn up the technical documentation, that the radio equipment bears the ‘CE’ marking and is accompanied by the information referred to in Articles R. 20-10 and R. 20-11, and that the manufacturer has complied with the requirements set out in IV to X of Article R. 20-12.

Where a fulfilment service provider considers or has reason to believe that certain radio equipment does not comply with the essential requirements, it shall not place such equipment on the market until it has been made compliant. Furthermore, where the radio equipment presents a risk and where neither the manufacturer, the authorised representative nor the importer is established in the European Union, the fulfilment service provider established in the European Union shall inform the manufacturer and the National Frequency Agency accordingly.

III. – They shall ensure that radio equipment is accompanied by instructions and safety information in French.

IV. – They shall ensure that, while radio equipment is under their responsibility, its storage or transport conditions do not jeopardise its compliance with the essential requirements.

V. – When deemed appropriate with regard to the risks presented by radio equipment, fulfilment service providers shall, to protect the health and safety of end-users, carry out sample testing of radio equipment made available on the market; they shall investigate, and, if necessary, keep a register of complaints and of non-conforming radio equipment and radio equipment recalls, and shall keep distributors informed of any such monitoring.

VI. – Fulfilment service providers who consider, or have reason to believe, that radio equipment which they have placed on the market is not in conformity with the obligations laid down in this Subsection shall immediately take the corrective measures necessary to bring it into conformity, to withdraw it or recall it, if appropriate. Furthermore, where the radio equipment presents a risk and where neither the manufacturer, the authorised representative nor the importer is established in the European Union, fulfilment service providers established in the European Union shall immediately inform the National Frequency Agency and the competent national authorities of the Member States of the European Union in which they made the radio equipment available on the market to that effect, giving details, in particular, of the non-compliance and of any corrective measures taken.

VII. – Where neither the manufacturer, the authorised representative nor the importer is established in the European Union, fulfilment service providers established in the European Union shall keep a copy of the ‘EU’ declaration of conformity at the disposal of the market surveillance authorities and ensure that the technical documentation can be made available to those authorities, upon request, for 10 years after the radio equipment has been placed on the market.

VIII. – Further to a reasoned request from the National Frequency Agency or a national authority of another Member State of the European Union, within 15 days, and where neither the manufacturer, the authorised representative nor the importer is established in the European Union, fulfilment service providers shall provide it, in paper or electronic form, with all the information and documentation necessary to demonstrate the conformity of radio equipment in a language which can be easily understood by the Agency or that authority. They shall cooperate with that authority, at its request, on any measure taken to eliminate the risks posed by radio equipment which they have placed on the market.’

Article 3

Subsection 9 of Section 5 of Chapter II of Title I of Book II of the Postal and Electronic Communications Code is supplemented by the following Articles:

‘Article R. 20-29-10-1: I- The compliance of devices for controlling the access of minors to services or content, with which the terminal equipment referred to in Article L. 34-9-3 is equipped, shall be subject to the proposal to activate the device when the terminal equipment is first put into service and, subject to technical feasibility, compliance with technical functionalities and characteristics relating to:

The possibility of blocking the downloading of content made available by software application stores and for which access is legally prohibited for those under 18 years of age or for which access is governed by Article 32 of Law No 98-468 of 17 June 1998 on the prevention and suppression of sexual offences, as well as the protection of minors, or which is included in a list drawn up by the publisher pursuant to Law No 2004-575 of 21 June 2004 on confidence in the digital economy;

The possibility of blocking access to pre-installed content for which access is legally prohibited for those under 18 years of age or for which access is governed by Article 32 of Law No 98-468 of 17 June 1998 on the prevention and suppression of sexual offences, as well as the protection of minors, or which is included in a list drawn up by the publisher pursuant to Law No 2004-575 of 21 June 2004 on confidence in the digital economy.

II- The functionalities and technical characteristics of parental control devices integrated into the terminal pursuant to I:

Are implemented locally without causing the personal data of the minor user to be sent to servers and without the need for creating an account on a server to set up parental control, except in case of express consent of the adult user or where this is technically impossible;

Do not give rise to the processing of personal data of the minor user except in case of express consent of the adult user or where this is technically impossible.

III- Other functionalities and technical characteristics of parental control devices, integrated into the terminal on a voluntary basis:

Shall not give rise to the processing of personal data of the minor user except in case of express consent of the adult user or where this is technically impossible;

Shall not give rise to the collection of data on the minor user for commercial purposes, such as direct marketing, profiling or behaviourally targeted advertising.

‘Article 20-29-10-2: After ensuring that the terminal equipment incorporates the functionalities and technical characteristics referred to in Article R. 20-29-10-1, the manufacturer shall draw up technical documentation and a declaration of conformity for each type of terminal equipment thereby establishing their conformity.

In the case provided for in the fourth paragraph of I of Article L. 34-9-3, the operating system provider shall provide the manufacturer with a certificate attesting to the conformity of the operating system with the functionalities and technical characteristics referred to in Article R. 20-29-10-1. It shall provide any information at the request of the manufacturer in order to enable the latter to draw up the technical documentation and the declaration of conformity referred to in the preceding paragraph.

‘Article R. 20-29-10-3: The technical documentation shall contain all relevant data or details of the means used by the manufacturer or operating system provider to ensure that terminal equipment complies with the technical specifications referred to in Article R. 20-29-10-1.

I.- It shall contain at least the following:

Versions of software or firmware affecting compliance with the requirements referred to in Article R. 20-29-10-1;

User information and instructions for activating, using, updating and, where applicable, deactivating the device;

Description of the solutions adopted to meet the requirements referred to in Article R. 20-29-10-1. Where standards or parts of standards are applied, the test reports and, failing that or in addition to them, the list of other relevant technical specifications applied;

A copy of the declaration of conformity as set out in Article R. 20-29-10-4 when drawn up by the manufacturer or of the certificate of conformity as set out in Article R. 20-29-10-5 when drawn up by the operating system provider.

II.- The technical documentation shall be drawn up prior to the placing on the market of the equipment. It shall be updated regularly.

III.- Further to a reasoned request from a competent national authority and within 15 days, the manufacturer shall provide that documentation, in paper or electronic form, in French, with all the information and documentation necessary to demonstrate the conformity of the equipment with the requirements set out in this Section. At the authority’s request, they shall cooperate with it on measures to eliminate the risks posed by equipment which they have placed on the market.

‘Article R. 20-29-10-4: I. The purpose of the declaration of conformity is to certify that each type of terminal incorporates the functionalities and characteristics referred to in this I. It shall detail the terminals for which it has been drawn up. It shall include the following elements:

1) Identification of the radio equipment (product, type, batch or serial number);

2) Name and address of the manufacturer or its authorised representative;

3) Object of the declaration (identification of the radio equipment allowing traceability);

4) Statement that the terminal equipment complies with the provisions of Law No 2022-300 of 2 March 2022 aimed at strengthening parental control over the means of access to the Internet;

5) References to the technical specifications or, where applicable, the standards applied. For each reference, the identification number, version and, where applicable, date of issue shall be indicated;

6) Where applicable, a description of the accessories and components, including software, which allow the radio equipment to operate as intended and covered by the declaration of conformity;