Abstracts from a confidential "observation letter", sent by the EC in Brussels to the French Minister for Foreign Affairs - no date in the document we obtained, but we learned that the French got it at the end of October, 1997.
See 3.07 + 3.08 for details
---
According to the EEE agreement, the EC states that, if an encryption product has been tested and approved in a single country, it must be approved everywhere.
"The wording [of the draft] let people think that the [French] administration hold a discretionary power to accept or not the tests' results that have been done in other members' states, althought according to the Article 30 [of the EU Treaty], and regarding jurisprudence from the European Court of Justice, member states have to accept and to take into consideration such results".
The Commission also tackles the core of the present French rules regarding encryption: every product, for use, furniture or export, must pass a government-backed "authorization" procedure:
"Such authorization may hinder the free flow of encryption products legally produced and/or sold in other ... EEE member states".
Another problem resides in a directive the EU passed in 1995, regarding "protection of personal data" that requires all member states to allow people to secure their personal communications.
"The actual rules for use and export of encryption means and schemes can obstruct ... the way individuals protect their personal data and the free flow of these data [because] appropriate means to secure these personal data wouldn't be available in France and/or couldn't "travel" with the data they should secure if they come from other member states."
The creation of a special "authorization scheme regarding licenced agencies" [TTPs] "could also obstruct the directive", the letter reads, "because these schemes don't allow the use and the free circulation of appropriate encryption means. In the public view, encryption [tools] which are under the control of these licenced agencies, as proposed, are often considered as non-appropriate to avoid some major risks."
The letter concludes that, if the French fail to submit again to the Commission the final draft of their decrees, it could be considered as a "breach" or "violation" of the EU Treaty.