The urgent case for a new ePrivacy law

[text_block id=”c745f21016d79c2300da8f7e75395d2a” content=”‹¨›p‹˜›A swarm of misinformation and misunderstanding surrounds the case for revising our rules on the confidentiality of electronic communications, otherwise known as ePrivacy. It’s high time for some honest debunking.‹¨›/p‹˜›‹¨›p‹˜›We are now at the business end of the 2014-2019 term of office for MEPs and the current College of European Commissioners. The European Parliament and the Council are working hard to finalise negotiations on a number of Commission proposals which are important to the future of data protection and digital rights generally. These include the proposals on cross-border access to electronic evidence and terrorist content on the web. ePrivacy, however, is the indispensable missing piece of the jigsaw.‹¨›/p‹˜›‹¨›p‹˜›Here is why.‹¨›/p‹˜›” paragraph_whitespace=”true” text_size=”” line_height=”30″ text_color=”” margin=”0px 0px 15px 0px” class=”” __fw_editor_shortcodes_id=”ae31f86155e860444f93965d2233e42b” _fw_coder=”aggressive”][/text_block][text_block id=”3b8c90b6c34659de3e841460ecd1dce0″ content=”‹¨›h3‹˜›‹¨›span style‹´›‹²›color: #0000ff;‹²›‹˜›1. The GDPR regulates data protection, not the privacy of communications.‹¨›/span‹˜›‹¨›/h3‹˜›‹¨›p‹˜›The adoption of the‹¯›nbsp;‹¨›a href‹´›‹²›http://www.europarl.europa.eu/oeil-mobile/fiche-procedure/2017/0003(COD)‹²›‹˜›proposed ePrivacy Regulation‹¨›/a‹˜›‹¯›nbsp;is crucial to protect the fundamental rights to privacy and the protection of personal data in the digital age.‹¯›nbsp; Progress must be made quickly to allow legal certainty and a level playing field for market operators. It is also necessary to complete the EU’s framework for data protection and confidentiality of communications. Privacy and data protection are core values of the European Union, recognised in the European Convention for Human Rights and in the EU Charter of Fundamental Rights, which must be respected in all policies of the EU pursuant to the Treaty. The right to privacy articulated in Article 7 of the ECHR and Article 8 of the EU Charter is also protected in national constitutions of many EU Member States. The GDPR, however, only formally concerns Article‹¯›nbsp;8 of the Charter, the right to data protection. Hence the EU’s framework is not complete without ePrivacy reform.‹¨›/p‹˜›” paragraph_whitespace=”true” text_size=”” line_height=”30″ text_color=”” margin=”0px 0px 15px 0px” class=”” __fw_editor_shortcodes_id=”6859a61f8e63369632c3dbf04d4717e3″ _fw_coder=”aggressive”][/text_block][text_block id=”cb2162d25bfa852e40a35a87357b9204″ content=”‹¨›h3‹˜›‹¨›span style‹´›‹²›color: #0000ff;‹²›‹˜›2. GDPR is not enough to change the predominant business model of surveillance.‹¨›/span‹˜›‹¨›/h3‹˜›‹¨›p‹˜›2018 will go down as the year that the world realised that data is not secure and its use also brings disadvantages, not just benefits. Data is not secure even when processed by the technologically most advanced and financially-powerful resourced companies on the planet. The Facebook/Cambridge Analytica revelations are still‹¯›nbsp;‹¨›a href‹´›‹²›https://ico.org.uk/media/action-weve-taken/2259371/investigation-into-data-analytics-for-political-purposes-update.pdf‹²›‹˜›under investigation‹¨›/a‹˜›‹¯›nbsp;in Europe and America, but they are only the‹¯›nbsp;‹¨›em‹˜›tip of the iceberg‹¨›/em‹˜›, a sign of a much wider problem and a symptom of many more problems still unnoticed.‹¨›/p‹˜›‹¨›p‹˜›A vast ecosystem has developed over the recent years, financed by advertising, for exploiting these special types of personal data without meaningful consent. It has developed in the legal grey zone between electronic communications services and information society services. Traditional electronic communications services – fixed line and mobile telecommunications providers – have long been subject to clear limitations.‹¯›nbsp; They cannot snoop on conversations over their networks. They can use metadata – that is, data revealing the location, time and persons involved in the communication – for marketing and ‘value added services’ beyond the provision of the communications service itself‹¯›nbsp;‹¨›em‹˜›only‹¨›/em‹˜›‹¯›nbsp;with the consent of the user or subscriber. Companies within the category of information society services have been able to grow rapidly thanks to loopholes in our current legal environment. In essence, they can justify their data use practices without the obligation to seek consent for using communications data. There is a clear and urgent need to close these gaps and to strengthen the protection of privacy and security of online communications.‹¨›/p‹˜›‹¨›p‹˜›While the news about data breaches, each affecting millions of users, indicates a serious issue in itself, it also reveals more about the underlying culture and business practice: the functions that were used illegally by attackers were often provided for supposedly legal use by data brokers and aggregators. The high impact of the breaches and misuse is the result of the standard surveillance or tracking business model that has taken hold of the entire internet for years.‹¨›/p‹˜›‹¨›p‹˜›This must stop. In order to create a digital environment in which users can feel safe, it is necessary that abusive, trust-corroding practices are robustly tackled with clear rules.‹¨›/p‹˜›” paragraph_whitespace=”true” text_size=”” line_height=”30″ text_color=”” margin=”0px 0px 15px 0px” class=”” __fw_editor_shortcodes_id=”0be4f8bb300449092e4f98a796a4b5c1″ _fw_coder=”aggressive”][/text_block][text_block id=”2fc6908d4da59d223f2219139e49492b” content=”‹¨›h3‹˜›‹¨›span style‹´›‹²›color: #0000ff;‹²›‹˜›3.‹¯›nbsp; Not all communications providers are required to give people control over their most intimate data.‹¨›/span‹˜›‹¨›/h3‹˜›‹¨›p‹˜›The mass of the most private information is collected by communications services, provided separately or as part of a social media or other internet platforms. These are the digital fountains from which very precise information about our lives is sourced. Location data reveals every movement, shows where we live, work and shop, which bars and restaurants we attend, which political events we attend, which medical services we need. Such metadata on when, how often and with whom we exchange messages and calls reveal our entire social position: who are good friends, how close are we with our family members, how much time we spend at work or with private contacts. All this information, and a lot more can be collected without ever looking into the content of the information. This is the information which people are entitled to expect to have the most control over.‹¨›/p‹˜›‹¨›p‹˜›The main legislative tool for giving people this control in EU law has been to require companies to seek‹¯›nbsp;‹¨›strong‹˜›consent‹¨›/strong‹˜›. Consent is susceptible to be abused, so the GDPR (Article 4(11)) has clarified the term to mean ‘any freely given, specific, informed and unambiguous indication of the data subject‹³›s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’. Additional conditions for valid consent are spelt out in Article‹¯›nbsp;7. Furthermore, in order to process sensitive data lawfully, such consent must also be ‘explicit’ (Article 9(2)(a)).‹¨›/p‹˜›‹¨›p‹˜›EU data protection rules have in principle applied to such data processing, and the GDPR clearly applies in its entirety to any processing of data concerning people in the EU, or any monitoring of people in the EU, regardless of where the controller is based. But the GDPR, like the EU’s previous 1995 Data Protection Directive, does not address itself specifically to communications or communications data as such. The Commission decided to propose reforms in two steps, first GDPR, and then ePrivacy (see Recital 173 of the GDPR). Without the ePrivacy rules applying to all providers of electronic communications, these service providers may argue that there is no need to ask permission‹¯›nbsp; – consent – from individuals to use their most private information.‹¯›nbsp; This is precisely the uncertainty which must be avoided. We cannot put data controllers in a position where they are required to apply simultaneously a modernised data protection regulation alongside outdated and fragmented rules on communications data which were designed to regulate a market and communication technologies which have changed beyond recognition in the last 17 years.‹¨›/p‹˜›‹¨›p‹˜›We welcomed the‹¯›nbsp;‹¨›a href‹´›‹²›http://www.europarl.europa.eu/sides/getDoc.do?pubRef‹´›-//EP//NONSGML+REPORT+A8-2017-0324+0+DOC+PDF+V0//EN‹²›‹˜›Report‹¨›/a‹˜›‹¯›nbsp;on the ePrivacy proposal adopted by the European Parliament last year as an attempt to strike a good balance among the interests at stake. Progress in the Council has been more challenging. Exploring avenues for a possible compromise, therefore, seems inevitable. There are points where scope for negotiation is limited without compromising the principles of communications privacy themselves. For example,‹¯›nbsp;‹¨›a‹˜›the proposed clauses being considered to allow‹¯›nbsp;‹¨›em‹˜›“further processing‹¨›/em‹˜›‹¯›nbsp;‹¨›em‹˜›of metadata for compatible purposes”‹¨›/em‹˜›‹¨›/a‹˜›‹¯›nbsp;risk, in the case of the most sensitive personal data, widening the existing loophole and allowing the circumvention of the high level of protection provided for by the GDPR. Metadata could be used for any purpose that is judged by the service provider to meet the ‘compatibility’ clause. In effect this could devalue the limited safeguards of the GDPR, creating considerable additional risk for end-users and coming very close to introducing‹¯›nbsp;‹¨›em‹˜›“legitimate interest”‹¨›/em‹˜›‹¯›nbsp;as a legal basis for processing metadata by the provider. This is something that has consistently been ruled out in all previous legislative procedures on the matter, from 1997 to 2009, and for good reasons which remain valid and if any more are more important than ever give the growing speed and effectiveness of data processing technologies.‹¨›/p‹˜›” paragraph_whitespace=”true” text_size=”” line_height=”30″ text_color=”” margin=”0px 0px 15px 0px” class=”” __fw_editor_shortcodes_id=”536b32bbff4c99646332c2fd8ca2067d” _fw_coder=”aggressive”][/text_block][text_block id=”d1a34ed74537b88f342fea5a09634ad6″ content=”‹¨›h3‹˜›‹¨›span style‹´›‹²›color: #0000ff;‹²›‹˜›4. ePrivacy will help fix, not exacerbate, digital market imbalances.‹¨›/span‹˜›‹¨›/h3‹˜›‹¨›p‹˜›The existing ePrivacy rules required national transposing laws which are inevitably divergent in many ways; the GDPR, meanwhile, is directly applicable. Again, it is unfair and economically unsustainable to expect controllers providing electronic communications services to be subject to a patchwork of data rules, some EU-wide, some national.‹¨›/p‹˜›‹¨›p‹˜›And yet, there has been a concerted and very effective lobbying effort to paint updating confidential of communications rules as driving more business to the already mega powerful tech giants which sit at the centre of the adtech ecosystem. The argument goes that only intermediaries will be in a position to seek the consent of individuals under the new rules, driving customers further away from smaller players. The opposite is true.‹¨›/p‹˜›‹¨›p‹˜›In our‹¯›nbsp;‹¨›a href‹´›‹²›https://edps.europa.eu/data-protection/our-work/publications/opinions/online-manipulation-and-personal-data_en‹²›‹˜›Opinion on Online Manipulation‹¨›/a‹˜›‹¯›nbsp;this year, we tried to explain how concentrated markets and the power of a handful of platform intermediaries have driven a wedge between advertisers, publishers and other content producers and consumers. The new ePrivacy rules, like the GDPR, are in part motivated by the need to repair these direct relationships – crucial to restoring trust in online services. Meaningful, specific, legitimate consent can only take place between parties that trust each other. It is difficult to see how generalised user consent can legitimately be hoovered up by a gigantic intermediary on behalf of all services on the other side of the platform. Indeed,‹¯›nbsp;‹¨›a href‹´›‹²›https://www.reuters.com/article/us-europe-privacy-complaint/mozilla-co-founders-brave-files-adtech-complaint-against-google-idUSKCN1LS2JL‹²›‹˜›high profile complaints‹¨›/a‹˜›‹¯›nbsp;have been tabled to this effect under the GDPR.‹¨›/p‹˜›‹¨›p‹˜›Older arguments opposing the GDPR are being rehashed: the argument, ‹¯›nbsp;for example, that freedom to harvest personal data is needed in order to develop new technologies, such as Artificial Intelligence tools. It is posited that the lack of general data protection and privacy rules in the US and China will allow businesses in those countries to take advantage and increase their competitive edge. This argument is flawed in several ways. A technology which is developed under the control of a surveillance system such as exists in China cannot be the solution for a democratic society based on the rule of law and respect of fundamental rights. Meanwhile, there is clear momentum growing for general rules and limits in the United States as well as most countries around the world, as concern increases about the unlimited use and abuse of personal data.‹¨›/p‹˜›” paragraph_whitespace=”true” text_size=”” line_height=”30″ text_color=”” margin=”0px 0px 15px 0px” class=”” __fw_editor_shortcodes_id=”c7038c276c144c5fd4f92728cd8a17e8″ _fw_coder=”aggressive”][/text_block][text_block id=”c2dac64b8e91966069eb1f35c06db252″ content=”‹¨›div class‹´›‹²›field field-name-field-ne-body field-type-text-with-summary field-label-hidden‹²›‹˜›‹¨›div class‹´›‹²›field-items‹²›‹˜›‹¨›div class‹´›‹²›field-item even‹²›‹˜›‹¨›h3‹˜›‹¨›span style‹´›‹²›color: #0000ff;‹²›‹˜›Eyes on the prize.‹¨›/span‹˜›‹¨›/h3‹˜›‹¨›p‹˜›Last week, the Chair of the European Data Protection Board was invited to ‹¨›a href‹´›‹²›https://www.c-span.org/video/?452550-1/senate-panel-data-privacy-protection‹²›‹˜›testify before the US Senate‹¨›/a‹˜›, which held a hearing on data protection law. Andrea Jelinek was invited alongside US experts, such as the sponsor of the ‹¨›a href‹´›‹²›https://www.caprivacy.org/‹²›‹˜›California Consumer Privacy Act‹¨›/a‹˜› and ‹¨›a href‹´›‹²›https://cdt.org/insight/nuala-oconnors-written-testimony-before-senate-commerces-consumer-data-privacy-hearing/‹²›‹˜›the president of the Center for Democracy and Technology‹¨›/a‹˜›, a non-profit organisation, and she was asked about the first experiences with enforcing the GDPR. While the Senate hearing may be seen in the context of the coming US elections, it also reflects an increasing anxiety in the US that its lack of comprehensive privacy legislation may become a disadvantage in economic terms. The legal developments in the EU and, this year, in ‹¨›a href‹´›‹²›https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id‹´›201720180AB375‹²›‹˜›the State of California‹¨›/a‹˜›, and the growing number of GDPR-inspired data protection laws in ‹¨›a href‹´›‹²›http://www.planalto.gov.br/ccivil_03/_Ato2015-2018/2018/Lei/L13709.htm‹²›‹˜›Brazil‹¨›/a‹˜› and around the globe, as well as the stream of revelations of misuse and insecurity of personal data, are putting pressure on lawmakers.‹¨›/p‹˜›‹¨›p‹˜›To sum up: as the absolute minimum, the ePrivacy Regulation must not lower the level of protection as foreseen in the GDPR. Instead, we urgently need a higher level of protection, given the importance of the principle of confidentiality of communications and the particularly sensitive nature of metadata‹¨›em‹˜›.‹¨›/em‹˜› Nevertheless, the co-legislators may find that not all potentially controversial issues are of the same level of importance, and may find compromises on many of them which ensure the necessary protection of fundamental rights. From a data protection and privacy perspective, there is no excuse for not agreeing on the ePrivacy Regulation under the present legislature and to risk an even less certain outcome in the year or years to come.‹¨›/p‹˜›‹¨›p‹˜›It is inevitable that the profound and worrying deficiencies of the current data harvesting economy will become more and more visible to more and more people, in Europe and elsewhere. Missing the chance to ensure better respect for privacy now would be a disservice to the citizens who look to the EU to safeguard fundamental rights regardless of a handful of powerful vested interests.‹¨›/p‹˜›‹¨›p‹˜›This is the moment for Europe to consolidate its lead in developing AI solutions for a democratic society and provide a sustainable model for other economies. ‹¨›a href‹´›‹²›https://icdppc.org/wp-content/uploads/2015/02/38-Conference-communique-.pdf‹²›‹˜›The world’s data protection and privacy commissioners have discussed privacy, data protection and AI‹¨›/a‹˜› over the last couple of years, and ‹¨›a href‹´›‹²›https://twitter.com/ICDPPCSec‹²›‹˜›will issue guidance next week‹¨›/a‹˜›. Europe should press on and reconcile technology to the principle of democracy and rule of law. A strong ePrivacy Regulation, adopted as soon as possible, will create legal certainty and incentivise investments in that direction.‹¨›/p‹˜›‹¨›/div‹˜›‹¨›/div‹˜›‹¨›/div‹˜›‹¨›div class‹´›‹²›field field-name-field-edpsweb-subjects field-type-taxonomy-term-reference field-label-above clearfix‹²›‹˜›‹¨›div class‹´›‹²›field-label‹²›‹˜›Topics:‹¨›/div‹˜›‹¨›ul class‹´›‹²›links‹²›‹˜›‹¨›li class‹´›‹²›taxonomy-term-reference-0‹²›‹˜›‹¨›a href‹´›‹²›https://edps.europa.eu/data-protection/our-work/subjects/eprivacy-directive_en‹²›‹˜›This piece was originally posted onedps.europa.eu under ePrivacy Directive‹¨›/a‹˜›‹¨›/li‹˜›‹¨›/ul‹˜›‹¨›p‹˜›#DigitalRights #ePrivacy #Consent #GDPR #Adtech #Advertising‹¨›/p‹˜›‹¨›/div‹˜›” paragraph_whitespace=”false” text_size=”” line_height=”30″ text_color=”” margin=”0px 0px 15px 0px” class=”” _fw_coder=”aggressive” __fw_editor_shortcodes_id=”fa76be80871eef958de1ec1525b5ebf9″][/text_block]