The French LOPSSI 2 Act of 2011 [LOPSSI stands for Loi d’Orientation et de Programmation pour la Performance de la Sécurité Intérieure] introduced into the French Penal Code a new Article 226-4-1 to criminalise the “act of usurping the identity of an individual or the act of using one piece or several pieces of data of any kind enabling her identification with a view to disturb her tranquillity or that of others, or with a view to prejudice her honour or reputation” [unofficial translation. For those who can read French see here]. In passing the penalty prescribed by Article 226-4-1 is one year of imprisonment and a fine of 15,000 euros.

And in a judgment of 18 December 2014 the Tribunal de Grande Instance de Paris, for the first time, interpreted and applied Article 226-4-1.

The facts of the case somehow recall those of the English case Matthew Firsht v Grant Raphael involving the creation of a fake Facebook profile containing information as to the claimant’s sexual orientation, relationship status, birthday, political and religious views (not everything was accurate); and a Facebook profile mainly containing defamatory material. [The English judge awarded the claimant £2000 for the breach of his privacy, and £20,000 for libel (for both Matthew Firsht and his company)].

The French case concerned the creation of a fake website containing the name and picture of the claimant (a French public figure… Rachida Dati for those knowledgeable of French politics) as well as arrangements similar to that of the claimant’s website. The fake website allowed the display of fake press releases written by individuals other than the defendants when a user was browsing the official website of the claimant [the creator of the fake profile had been exploiting a security vulnerability in the claimant’s website called cross-site scripting]. The address of the fake website had been sent to 4000 twitter followers.

For the French Tribunal, the situation is straightforward. As the fake website could only confuse Internet users as to its origin, an act of usurpation was characterised. In addition it was enough to characterise the intention to disturb the tranquillity or to prejudice the honour or reputation of the claimant to characterise the offence. [“Les faits visés doivent être commis en vue de commettre un trouble ou une atteinte, l’intention suffisant dès lors seule à caractériser l’infraction” says the Tribunal. This would mean that there is no need to establish the prejudice to characterise the offence]. The judge also observed that the fake website had won itself some notoriety and that the defendant “liked to play with words” so to speak [he had substituted the expression “groupe PPE” with “groupe PIPE”. For those who do not know, the French word PIPE is not always politically correct]. Moreover, because of his role as the moderator of the fake website, the defendant had “contributed” to the drafting of the defamatory press releases… even if those press releases had ultimately been drafted by others.

Interestingly, the hosting provider was considered to be an accomplice of the creator of the fake website.

But this is not the end of the story for the creator of the fake website. He is also convicted on the ground of Article 323-3 of the Penal Code, which sanctions the act of fraudulently introducing data into a system of automated processing.

In the end, the creator of the fake website is ordered to pay a fine of 3000 euros, while the hosting provider is ordered to pay a fine of 500 euros. Is it because the claimant is a public figure that the French Tribunal seems to be less severe than its English Counterpart? Or is it for another reason?

Happy new year!!!!

Sophie Stalla-Bourdillon