While the wide-ranging SREN Bill appears to be near its final form, headline proposals on security and competition in the cloud market will continue to drive debate in Europe
French Parliament approves the SREN bill after a series of delays
On 10 April 2024, the French National Assembly approved the SREN Bill, a bill aimed at “securing and regulating the digital space”. An earlier version of the SREN Bill, which includes the country’s transposition of the EU’s Digital Services Act (DSA) and Digital Markets Act (DMA), was first approved by the French Senate and National Assembly in 2023. However, following two opinions from the EC published in October 2023 and January 2024, the wide-ranging legislation – that spans online safety, misinformation, privacy and more – was stalled until the chambers could construct a compromise text, which was completed in March 2024. The newly adopted version of the SREN Bill marks significant progress in a lengthy and at times stop-start legislative process, bringing the finish line into sight. Nevertheless, both the EC and the French Constitutional Council are expected to review the modified text before adoption can be finalised.
SREN would extend the DSA and DMA’s provisions on child safety and consumer protection
The legislation is constructed around three primary objectives related to the safety and the sovereignty of the internet in France:
Protecting and equipping all French citizens;
Safeguarding young users and improving child safety online; and
Strengthening online protections for French businesses and communities.
As part of its child and consumer protection provisions, the SREN Bill would introduce criminal penalties for posting of offensive, discriminatory or harassing content, including a minimum fine of €300 (£258) against the offender. Individuals found guilty of online hatred, cyber-harassment or other serious digital offences could also be subject to a six-month ban from social networks as an alternative to prosecution. The French Government would also be required to introduce a national anti-scam filter for SMS users and create technical standards for age verification systems for pornographic sites.
France forges ahead on cloud sovereignty through SREN, ratcheting up the battle over the EU Cloud Certification Scheme
Under its objective to protect French businesses, the SREN Bill also introduces a series of security and competition measures for the cloud services market. The legislation outlines a ban on transfer fees, requirements for interoperability and limits on commercial offerings of cloud credits, directly responding to a number of the anti-competitive harms outlined in the Autorité de la concurrence’s market power inquiry from 2023. The bill stands to highlight the EU’s lack of action thus far in leveraging its digital markets regulation to address the highly centralised cloud services market at the supranational level. The bill also introduces sovereign cloud requirements for the handling of sensitive data, including the Government’s Health Data Hub currently managed through Microsoft Azure. The French Government has been active in arguing for the inclusion of similar sovereignty conditions in the EU Cloud Certification Scheme (EUCS), garnering opposition from other Member States such as Ireland and the Netherlands. Such data localisation policies have been criticised by peers as a protectionist effort from France designed to support domestic cloud competitors like OVHcloud and Orange.
