The current law

Since 1997, European law has required our consent in order to analyse or sell our electronic communications (calls, texts, email, Internet use) for commercial purposes (articles 5 and 6 of Directive 97/66/CE, later included in Directive 2002/58/CE).

This requirement protects our fundamental right to private communications. It guarantees that no one can put together a list of people we communicate with, or a list of information we look up on the net, and that the content of our messages remain confidential.

What will change

Under pressure from big corporations, many MEPs are ready to allow private companies like Orange, Deutsche Telekom , Gmail, WhatsApp or Snapchat to use our communications for commercial purposes without our approbation (see the amendments tabled on this issue).

Two new exceptions would remove the need for our consent.

Legitimate interest

If a company claims it has a ‘legitimate interest’ (such as an economic interest) in analysing or monetizing our communications, it will be authorised to do so without our consent. It will only have to claim that its activity does not cause ‘excessive harm’ to the person whose communications have been processed.

However, this notion of excessive harm is particularely permissive. It is the company itself which gets to decide what is ‘excessive’ or not. Afterwards, a complaint shall need to be lodged before a Data Protection Authority for it to ensure that a proper balance is struck.

In any case, whether harm is excessive or not, commercial interests will now allow the violation of our communications’ privacy. Until now, this was only possible with our explicit consent.

Further processing

When using a phone or the Internet, we rely on many providers to relay our communications over the network. Our recourse to their service naturally authorizes them to process these communications in order to be able to convey our communications.

However, these providers would now be allowed to engage in any ‘further processing’ of our communications to re-use and monetize them – without our permission. They will only have to ensure that this new processing pursues a ‘compatible’ purpose with our initial request.

It is difficult to anticipate what a ‘compatible’ processing might mean or imply. Nevertheless, companies that support this exception make it clear that they want it for commercial reasons.

As a consequence, once again, each company will get to decide on its own what is ‘compatible’ or not.

The current law

Since 2002, European law has protected data emitted by our electronic devices (articles 6 and 9 of Directive 2002/58/CE). Typically, the protected data are those our devices automatically broadcast to connect to Wi-Fi access points or to cell phone antennas.

There is only one reason for which companies can use such data: to let us connect to a communication network. For any other reason, such as determining our geographic location, our consent is required.

What will change

The European Commission is proposing to get rid of this consent requirement (article 8§2 of the Regulation proposal).

Instead, it means to authorise businesses to geolocate us, as long as they notify users situated in a given location (with a poster, for example) that they are being surveilled, and indicating how this surveillance may be avoided (namely, by disconnecting from the network).

This way, for example, shopping mall management will be able to track all customers, following the stores they visit, how long they remain in each one of them, with whom, how often they return in the following months, and so on. This tracking could very well be extended to an entire city or at national level, for advertisement purposes, to set consumption, movements or lifestyle profiles, etc.

Some MEPs are proposing to keep the protection currently guaranteed by European law, which requires our consent. We ought to support them (see their amendments).

The current law

Since 2009, EU law forbids websites from saving or reading information (such as cookies) on our devices without our consent (article 5§3 of Directive 2002/58/CE). In other words, this Directive forbids tracking users from site to site to establish behavioral profiles.

Unfortunately, over time, this requirement has been applied far too leniently and has lost all of its strength.

A silent consent

Our consent is assumed as long as we have been informed tracking takes place on a website and keep visiting it. These are the well-known ‘cookie banners’. There is no need to click on any « Accept » button; silence is enough.

Generally speaking, the only way to limit this tracking is to configure our browser to forbid cookies (which is neither simple nor effective, as there are other ways to track us), or to install adblockers (which, as well, will never be entirely effective).

A forced consent

Many websites restrict access if we refuse to allow them to track us in some way. For example, your access to a site may be blocked if you use an adblocker.

This kind of blockade forces us to consent. To access the site’s content we have to somehow « pay » with our personal data, by agreeing – against our will – to disclose information that may sometimes be particularly intimate.

Our personal data becomes a sort of currency, turning the right to privacy into a luxury, available only to those who can pay in some other way.

It is unacceptable that our fundamental freedoms may be compromised this way according to purely commercial criteria.

What will change

Last year the EU adopted the General Data Protection Regulation (GDPR), which will come into force in May 2018. It will bring about two major changes:

• To be valid, consent will now have to be given through a ‘positive act’: silence will no longer constitute acceptation (article 4§11 of the GDPR).
• Consent given under threat of not accessing a service will no longer be valid (article 7§4 of the GDPR).

These changes deeply challenge the economic model of websites that monetize our privacy against our will. This model is promoted today by several MEPs (see their amendments). They ask two things:

• That the advances made under the GDPR do not apply to websites (in other words, that the law return to its previous state);
• That tracking may be conducted without our prior consent, as simple as that: as with the analysis of communications (see above), invoking a ‘legitimate’ or ‘compatible’ interest should suffice to bypass consent.

The current law

For as long as the EU has forbidden companies from monetizing our communications, European States have had the authority to coerce these same companies into overseeing communications to participate in citizen surveillance (article 15 of Directive 2002/58/CE).

Unfortunately, this authorisation has been particularly permissive.

Mass surveillance

States may require companies to participate to the surveillance of the entire population. Everyone is a suspect to them: as States have no way of knowing exactly who should be monitored, they prefer to watch everyone indiscriminately.

Thus in France, Germany, Spain, Italy and in many other countries, ISPs are required to retain data on all their users for long periods (in France, one year).

Commercial purposes

States may require businesses to take part to this surveillance for reasons other than just anti-terrorism or law enforcement.

For instance, this kind of surveillance is permitted in case of protection of a State’s ‘important economic interests’ (a particularly broad and permissive concept) or to protect individual rights (such as copyright, which leads to surveillance of populations to prevent private sharing of works of art).

The lack of effective oversight

In this legal framework, States do not need a judge’s authorisation to require companies’ cooperation. Member States alone decide who should be monitored, and how.

From a citizen’s perspective, existing legal remedies to contest unjustified or illegal measures are rare and ineffective.

What is changing

In 2014 and 2016, the European Court of Justice clearly held that population-wide surveillance infringes our fundamental liberties (see the Digital Rights Ireland and Tele2 cases). With these decisions, the Court set new limits on State surveillance:

• Only measures targetting individuals for limited periods are permitted.
• In the fight against criminal offenses, the analysis of communications should be limited to most serious crimes.
• Surveillance measures must be subjected to independent and effective oversight.

Despite their clarity, these new limits are not yet reflected in European states’ national laws. The current applicable law in the majority of European States ignores them entirely.

Some MEPs recommend to integrate the Court’s limits directly into the ePrivacy Regulation. This would override the inaction of States to correct their national law.

We must support these MEPs (see their amendments).

What will happen

In January 2017, the European Commission issued a proposal for an ePrivacy Regulation to reform European law applicable to privacy online.

This Regulation proposal will be simultaneously worked on by the European Parliament and the Council of the EU (representing the government of each Member State of the EU).

Once the two institutions have agreed on a common version, the Regulation will be adopted.

The European Parliament

The Regulation proposal must first be approved by the Parliament’s ‘public liberties’ commission (coined the ‘LIBE commission’).

This commission comprises a handful of MEPs who have examined the Regulation in detail over the last months.

On the 19 October, the LIBE commission will adopt its own version of the ePrivacy Regulation in accordance with proposed amendments (see them all). Based on this text, the European Parliament will then negotiate with the Council of the EU.

Thus, this is on this vote we ought to focus our action.

PiPhone

You can call members of the LIBE commission for free using PiPhone, powered by La Quadrature du Net.

You can call MEPs of your country, or of the entire Union.

In any case, let’s be confident: this debate is much less technically complex than certain people like to claim it. Your commitment to fundamental liberties and your political convictions are more than enough to participate effectively.