Cybersecurity law: finally on track in the national Assembly

The bill, aimed at strengthening the resilience of critical infrastructure, has encountered significant obstacles, including a prolonged debate on encrypted messaging services and a complex parliamentary calendar. An accelerated legislative procedure was not enough to meet the deadlines.

“It is both a relief to see that we are finally able to examine this text and a regret that we didn’t do so earlier,” declared Renaissance MP Éric Bothorel, rapporteur for the bill.

The European Commission has already initiated proceedings against France, among other countries, for failing to comply with transposition obligations. Massive data breaches affecting the tax authorities in August have reinforced the urgency of adopting this text.

Vincent Strubel, director of the national cybersecurity agency (Anssi), emphasized before a parliamentary committee in early October the importance of rapid transposition, stating that some measures could have prevented the recent attacks. He also insisted on the need to give Anssi binding authority.

The NIS 2 directive, highly anticipated, could impact up to 19,000 companies, according to a study by Campus cyber.

The examination of the text, supplemented by nearly 400 amendments, promises to be challenging, in a context of an “unprecedented increase in cyber threats,” according to the Minister for Digital Affairs, Anne Le Hénanff.

A controversial article concerning encrypted messaging services, such as WhatsApp, Telegram, and Signal, remains at the heart of the debates. This Article 16bis, initially designed to respond to another parliamentary initiative, has been criticized for its perceived excessive protection of encrypted messaging. The government has filed an amendment to delete it, joined by MPs from different political parties, fearing a “major risk to national security.” Anne Le Hénanff has promised not to reintroduce a similar measure before the end of the parliamentary session. A report written by former MP Florent Boudié recommended abandoning this article due to its “legal grey areas.”