The Directive on the re-use of public sector information (Directive 2003/98/EC, known as the 'PSI Directive' revised by Directive 2013/37/EU) establishes as general principle that documents held by public sector bodies of the Member States shall be re-usable for commercial or non-commercial purposes. The public sector body concerned is in charge to take the decision to communicate documents and to authorise their reuse.

“The definition of ‘document’ is not intended to cover computer programmes”, recital 9 of the directive "whereas" states. Yes, but any computer literate will tell you that the source code is not the computer programme: it is the human readable document that allows the reader to understand how the programme works. Good, but the same computer literate will admit that, having the source code and the corresponding compiler or interpreter, you may indeed generate the computer programme itself (without the linked data bases, files and other needed sources of input making the programme able to operate and to produce outputs).

So what? The question was recently pending at the administrative court in France, and the courts’ decision was made public in March 2016.

In France, the principle of the freedom of accessing administrative documents was implemented long before the adoption of the PSI Directive (originally by law 78-753 of the 17 July 1978, now integrated since 23 October 2015 in a larger “Code of relationship between the public and administrative authorities").

This regulation (art L311-2) covers any document produced by public authorities (as reports, studies, meeting minutes, statistics, instructions etc., in any form and on any media) provide the document status is final (“achevé” / not in progress) and after consideration of specific exceptions related to the protection of personal data, the States’ security or defence and other restricted documents as – for example - those produced by law enforcement authorities in the framework of inquiries.

In May 2014, M. A., student at the Ecole d’Economie de Paris requested the source code of the tax calculation software produced by the Ministry of Finance. Without obtaining any answer, which according to the law means implicitly the rejection of his request, M. A. went to court in 2015 and the Tribunal Administratif (Lecture of 16 March 2016) ruled two important points:

1. Software source code produced by administrative authorities may be considered as a covered document, and must therefore be communicated to the applicant, since its communication is not excluded by any of exceptions implemented by the law (security of the State, defence, secret, personal data and security of persons etc.)
2. Software source code could well be “evolutive” (like a “work in progress”, with frequent versions, contributions and modifications) but any particular produced version can be considered as a “final” administrative document and therefore it must be communicated on request.

The Ministry of Finance also argued that the obligation to communicate software code was excluded by European law, because recital 9 of Directive 2003/98/CE on the re-use of public sector information (as updated in 2013) states that “The definition of ‘document’ is not intended to cover computer programmes”. This point was also rejected by the court, since nothing in the Directive enforces national laws to exclude software code from their provisions. As stated in its article 1, the Directive establishes a minimum set of rules, and not a maximum. The exclusion of computer programmes is possible but is not an obligation. Therefore, the various national laws may handle this specific matter differently.

Concerning France, the court decision may have a considerable impact, as the source code of any software produced by or for the various national or local administrations becomes legally “libre” or open source under no or very permissive conditions. Therefore the interest to clarify the applicable licence: when communicating it, relevant administration should then apply the EUPL or the French CeCILL, according to the 12 September 2012 prime minister Ayrault circular.

Reacting to the court decision, a legislative amendment is now pending at the French National Assembly, where (in article L-311-5 of the code) it is proposed to extend the exception implemented for “the security of persons” to “the security of persons or the security of information systems of the administration”.

If adopted, the impact of such amendment could be high or reasonable, depending on the strict interpretation of the notion of “security of information systems”: if the relevant administration has to motivate its refusal by providing the evidence that its information system security could effectively be impacted by the disclosure of the source code, the impact will stay reasonable. Otherwise, it would be a serious backward step.  

More information:

The decision of the Tribunal Administratif: http://www.april.org/sites/default/files/20160216-jugement-tribunal-adm…

Code des relations entre le public et l’administration :
https://www.legifrance.gouv.fr/affichCode.do?cidTexte=LEGITEXT000031366…

Law 78-753 of the 17 July 1978
https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT00000033…

The proposed amendment http://www.assemblee-nationale.fr/14/amendements/3399/AN/836.pdf

Directive 2003/98/CE http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2003:345:009…

Previous Joinup news : https://joinup.ec.europa.eu/newsletter/joinup-open-source-news-service-…