The court rejects Bull Bitcoin and Paymium’s request for lack of urgency, without examining the decree’s legality.
The Conseil d’État has rejected the request to suspend the French decree implementing DAC8, submitted by Bull Bitcoin together with Paymium. In its order of 14 September 2026, France’s highest administrative court found that the evidence of urgency was insufficient.
The interim application, filed on 26 August, sought to halt Decree No. 2025-1276 of 19 December 2025. Obtaining a suspension required demonstrating both urgency and serious doubt about the measure’s legality. The court found that the first condition had not been met and ruled without an investigation or hearing, under the procedure provided for in Article L. 522-3 of the Code of Administrative Justice.
According to the order, the impact of data collection and exchange activities on privacy does not justify an urgent suspension, given the public interest in preventing fraud and tax evasion. The court also found that the applicants had not demonstrated an increased risk caused by centralisation and described the possibility of a breach as having a “very low” probability.
In its response of 16 September, Bull Bitcoin challenges that assessment. It argues that combining identities, residential addresses and financial information makes databases more attractive to criminals, exposing digital asset holders and their families to physical security risks. It adds that a later annulment could not restore confidentiality to data already disclosed.
The case file cites intrusions into the French tax authority’s systems. The DGFiP had reported unauthorised access and data theft relating to incidents between June and August 2026, stating that the impots.gouv.fr website and users’ personal spaces had not been compromised.
The contested decree regulates the obligations of operators under the DAC8 directive: collecting, verifying and retaining user information, followed by reporting it to the tax administration. The applicants’ objections concern, among other matters, personal data protection and the lack of prior consultation with the CNIL, France’s privacy authority.
The annulment action, initiated on 24 February 2026, is continuing. Bull Bitcoin is also seeking a referral to the Court of Justice of the European Union on the validity of the directive.
