France's "three strikes" law threatening Internet disconnections for repeat copyright infringers should have been in effect by now, but it hasn't yet become law due to one French privacy agency.

The country's Commission nationale de l’informatique et des libert�s (CNIL) was created in the late 1970s in order to vet new legislation for privacy concerns, and to keep an eye on government databases and data collection efforts. CNIL's somewhat dramatic motto is "information technology must respect the human identity, the human rights, privacy and liberties"—and CNIL is not yet convinced that the new three strikes law will do that.

The sticking point is the new authority (referred to as HADOPI after its initials) that oversees the graduated response process. HADOPI will compile lists of (alleged) offenders, along with dates, number of infractions, penalties, etc. CNIL wants to make sure that this data collection safeguards privacy, and so it has refused to issue the necessary sign-off letter that the government needs to put the law into operation. First, CNIL want more information on how HADOPI's data collection and archiving processes will work.

Until it gets it, the law is on hold. The government appears ready to provide CNIL with the information it wants, so HADOPI will probably be up and running within a few months.