The Council of State’s Decision on Crypto Data Collection
The Council of State, which is France’s supreme administrative court, has denied an urgent plea from crypto companies Bull Bitcoin and Paymium to suspend a national decree that enforces the European Union’s Eighth Directive on Administrative Cooperation (DAC8). This decision stems from a summary suspension request aimed at halting the implementation of Decree No. 2025-1276, which mandates that crypto service providers collect and share sensitive user data with tax authorities across EU member states.
Concerns Over User Safety
The companies contended that this centralized databasing of digital assets presents significant risks to the safety and wellbeing of cryptocurrency users. They expressed concerns about potential breaches of this sensitive data, which could expose users to violence and extortion from criminals. Notably, France has experienced a surge in home invasions targeting cryptocurrency owners, raising alarms in the industry.
In a notable incident earlier this year, the French tax agency revealed a data breach affecting over 678,000 individuals, which intensified calls from the crypto sector for a halt on data collection by public entities.
Despite these concerns, the Council of State did not find enough urgency in the companies’ arguments to justify an immediate suspension of the decree. The court emphasized that the mere possibility of risk, especially when deemed low, is insufficient grounds for emergency action.
Legal Challenges Ahead
Francis Pouliot, the founder of Bull Bitcoin, highlighted that while this specific plea for suspension was denied, it doesn’t imply that their core arguments against the legality of the decree have been dismissed. The challenge to annul DAC8 entirely is still forthcoming. The plaintiffs maintain that the decree oversteps legal authority and infringes on basic rights as established by both French law and European privacy regulations.
Government Warnings and Future Actions
During discussions in February 2026, government tax officials had warned about the dangers of centralizing personal data in large databases, underscoring the need for security due to heightened vulnerability to potential cyberattacks. This reaction came amid a backdrop of documented physical attacks against cryptocurrency enthusiasts in Europe, reinforcing the argument for better safeguards.
Moving forward, Bull Bitcoin plans to release all legal documents and evidence related to their summary proceedings shortly. Meanwhile, DAC8 has been in effect since January 1, 2026, requiring registered service providers to submit their first data reports concerning the 2026 taxation year by September 30, 2027, ahead of the EU’s automatic data exchange among tax authorities.
