The current law

Since 1997, European law has required our consent in order to analyse or sell our electronic communications (calls, texts, email, Internet use) for commercial purposes (articles 5 and 6 of Directive 97/66/CE, later included in Directive 2002/58/CE).

This requirement protects our fundamental right to private communications. It guarantees that no one can put together a list of people we communicate with, or a list of information we look up on the net, and that the content of our messages remain confidential.

What will change

Under pressure from big corporations (as Orange, Deutsche Telekom, Google, Whatsapp ou Snapchat), Member States position is likely to favor the ongoing exploitation of our communications for commercial purposes without our consent.
Fortunately, their ambitions were hindered by the European Parliament in October. But Member States are capable of overthrowing the whole situation in order to open the Pandora’s box of commercial surveillance.
These corporations try to establish two exceptions in order to bypass our consent.

Legitimate interest

If a company claims it has a ‘legitimate interest’ (such as an economic interest) in analysing or monetizing our communications, it will be authorised to do so without our consent. It will only have to claim that its activity does not cause ‘excessive harm’ to the person whose communications have been processed.

However, this notion of excessive harm is particularly permissive. It is the company itself which gets to decide what is ‘excessive’ or not. Afterwards, a complaint shall need to be lodged before a Data Protection Authority for it to ensure that a proper balance is struck.

In any case, whether harm is excessive or not, commercial interests will now allow the violation of our communications’ privacy. Until now, this was only possible with our explicit consent.

Further processing

When using a phone or the Internet, we rely on many providers to relay our communications over the network. Our recourse to their service naturally authorizes them to process these communications in order to be able to convey our communications.

However, these providers would now be allowed to engage in any ‘further processing’ of our communications to re-use and monetize them – without our permission. They will only have to ensure that this new processing pursues a ‘compatible’ purpose with our initial request.

It is difficult to anticipate what a ‘compatible’ processing might mean or imply. Nevertheless, companies that support this exception make it clear that they want it for commercial reasons.

As a consequence, once again, each company will get to decide on its own what is ‘compatible’ or not.

The current law

Since 2002, European law has protected data emitted by our electronic devices (articles 6 and 9 of Directive 2002/58/CE). Typically, the protected data are those our devices automatically broadcast to connect to Wi-Fi access points or to cell phone antennas.

There is only one reason for which companies can use such data: to let us connect to a communication network. For any other reason, such as determining our geographic location, our consent is required.

What will change

The European Commission is proposing to get rid of this consent requirement (article 8§2 of the Regulation proposal).
Instead, it means to authorise businesses to geolocate us, as long as they notify users situated in a given location (with a poster, for example) that they are being surveilled, and indicating how this surveillance may be avoided (namely, by disconnecting from the network).
The European Parliament decided to allow such tracking exclusively for ‘statistical’ purposes, so that the tracked individuals cannot be identified in the resulting statistics. This limitation is alarmingly insufficient: the identification data required would be kept for as long as it takes to put up the statistic (for example, to find out how often and when you visited the same shop over the last two years, one has to identify every single customer during this period).
Besides, anonymising sensitive data like our daily movements is hardly offering any protection regarding the constant development of re-identification technologies. What today seems to be anomymous is likely to give insight about our individual behaviour tomorrow.

The current law

Since 2009, EU law forbids websites from saving or reading information (such as cookies) on our devices without our consent (article 5§3 of Directive 2002/58/CE). In other words, this Directive forbids tracking users from site to site to establish behavioral profiles.

Unfortunately, over time, this requirement has been applied far too leniently and has lost all of its strength.

A silent consent

Our consent is assumed as long as we have been informed tracking takes place on a website and keep visiting it. These are the well-known ‘cookie banners’. There is no need to click on any « Accept » button; silence is enough.

Generally speaking, the only way to limit this tracking is to configure our browser to forbid cookies (which is neither simple nor effective, as there are other ways to track us), or to install adblockers (which, as well, will never be entirely effective).

A forced consent

Many websites restrict access if we refuse to allow them to track us in some way. For example, your access to a site may be blocked if you use an adblocker.

This kind of blockade forces us to consent. To access the site’s content we have to somehow « pay » with our personal data, by agreeing – against our will – to disclose information that may sometimes be particularly intimate.

Our personal data becomes a sort of currency, turning the right to privacy into a luxury, available only to those who can pay in some other way.

It is unacceptable that our fundamental freedoms may be compromised this way according to purely commercial criteria.

What will change

Last year the EU adopted the General Data Protection Regulation (GDPR), which will come into force in May 2018. It will bring about two major changes:

• To be valid, consent will now have to be given through a ‘positive act’: silence will no longer constitute acceptation (article 4§11 of the GDPR).
• Consent given under threat of not accessing a service will no longer be valid (article 7§4 of the GDPR).

These changes deeply challenge the economic model of websites based on targeted advertising and willing to monetize our privacy without our consent. These websites, including the big media companies, are put under an enormous pressure by their actual customer base: the advertising industry.

Today, they stand up for a system of mass surveillance which goes as much against their readership as it goes against the journalistic profession. Mainly, they ask for two things:

• That the advances made under the GDPR do not apply to websites (in other words, that the law return to its previous state);
• That tracking may be conducted without our prior consent, as simple as that: as with the analysis of communications (see above), invoking a ‘legitimate’ or ‘compatible’ interest should suffice to bypass consent.

The current law

For as long as the EU has forbidden companies from monetizing our communications, European States have had the authority to coerce these same companies into overseeing communications to participate in citizen surveillance (article 15 of Directive 2002/58/CE).

Unfortunately, this authorisation has been particularly permissive.

Mass surveillance

States may require companies to participate to the surveillance of the entire population. Everyone is a suspect to them: as States have no way of knowing exactly who should be monitored, they prefer to watch everyone indiscriminately.

Thus in France, Germany, Spain, Italy and in many other countries, ISPs are required to retain data on all their users for long periods (in France, one year).

Commercial purposes

States may require businesses to take part to this surveillance for reasons other than just anti-terrorism or law enforcement.

For instance, this kind of surveillance is permitted in case of protection of a State’s ‘important economic interests’ (a particularly broad and permissive concept) or to protect individual rights (such as copyright, which leads to surveillance of populations to prevent private sharing of works of art).

The lack of effective oversight

In this legal framework, States do not need a judge’s authorisation to require companies’ cooperation. Member States alone decide who should be monitored, and how.

From a citizen’s perspective, existing legal remedies to contest unjustified or illegal measures are rare and ineffective.

What is changing

In 2014 and 2016, the European Court of Justice clearly held that population-wide surveillance infringes our fundamental liberties (see the Digital Rights Ireland and Tele2 cases). With these decisions, the Court set new limits on State surveillance:

• Only measures targetting individuals for limited periods are permitted.
• In the fight against criminal offenses, the analysis of communications should be limited to most serious crimes.
• Surveillance measures must be subjected to independent and effective oversight.

Despite their clarity, these new limits are not yet reflected in European states’ national laws. The current applicable law in the majority of European States ignores them entirely.

The European Parliament has included in it’s first position certain boundaries put forward by the European Court of Justice. In particular, Parliament opposes any surveillance for economic interests and urges intelligence supervisory authorities to be more transparent. However, these several improvements are at risk of being dismissed by the Member States which apparently wish to worsen the initial situation.