Council of theEuropean Union
Brussels, 26 April 2023
(OR. en)8787/23
LIMITEJUR 291
ENFOPOL 201
JAI 510OPINION OF THE LEGAL SERVICE1
From:
To:

Legal Service
Law Enforcement Working Party

Subject:

Proposal for a Regulation laying down rules to prevent and combat childsexual abuse – detection orders in interpersonal communications – Articles
7 and 8 of the Charter of Fundamental Rights – Right to privacy andprotection of personal data – proportionality

I.

INTRODUCTION

1.

On 11 May 2022, the Commission submitted a Proposal for a Regulation laying down rules toprevent and combat child sexual abuse (“the proposed Regulation”)2. The objective of the
proposed Regulation is to establish uniform rules to address the use of information society
services for online child sexual abuse in the internal market3. The legal basis for the proposed
Regulation is Article 114 TFEU.

1

2
3

This document contains legal advice protected under Article 4(2) of Regulation (EC)No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding
public access to European Parliament, Council and Commission documents, and notreleased by the Council of the European Union to the public. The Council reserves all its
rights in law as regards any unauthorised publication.
COM(2022) 209 final.
Article 1(1) of the proposed Regulation.

8787/23

1JUR

LIMITEEN2.

The proposed Regulation establishes obligations on providers of information society servicesi) to assess the risk that their services are used for online child sexual abuse; ii) to detect andreport online child sexual abuse and iii) to remove or disable access to child sexual abusematerial on their services. It also establishes rules as regards the designation and functioningof the competent authorities of the Member States in charge of fighting online child sexual
abuse and the cooperation between them. Finally, it sets up a new EU Agency, the EU Centre
on Child Sexual Abuse.

3.

During the discussions in the Law enforcement Working Party (LEWP) serious legal concerns
were raised as regards, in particular, the detection orders applied to interpersonalcommunication services.4

4.

The Council Legal Service (CLS) was requested to provide a written opinion on this matter.
This opinion provides a legal analysis of the conformity of the detection order applied tointerpersonal communication services with Article 7 and 8 of the Charter ofFundamental Rights (the Charter) as interpreted by the relevant case law of the CJEU.
It is based on the oral interventions already made by the CLS representative in LEWP and
focuses on the problematic aspects of the proposed Regulation in this respect. It is without
prejudice to the legal analysis of other aspects of the proposed Regulation, including, inparticular, the detection order obligations with regard to publicly available material on theinternet.

II.

LEGAL FRAMEWORK

5.

Detection obligations and the procedure concerning the issuing of detection orders areprovided for in Section 2, Articles 7 to 11, of the proposed Regulation. Its Article 44 on therole of the EU Centre (the new agency) in creating, maintaining and operating “Databases ofindicators” is also relevant for the present analysis. The aspects of these provisions that are
relevant for the purposes of the present analysis can be summarised as follows.

4

The detection orders applied to material publicly available on the web as well as theremoval, blocking and delisting orders were considered less problematic than the detection
orders applied to interpersonal communications.

8787/232
JUR

LIMITEEN6.

A detection order may be issued by a national judicial or independent administrative
authority following a request of a Coordinating Authority (the authority designated by aMember State for the application and enforcement of the proposed Regulation), in order torequire a service provider to detect online child sexual abuse. The detection order should
include the specific service in respect of which the detection order is issued and, whereapplicable, the part or component of the service that would be affected (Article 8(1)(d)).

7.

Information society services to which the proposed Regulation apply include interpersonalcommunications services5.

8.

The service providers to which a detection order is addressed would be required to detectalready known child sexual abuse material (CSAM), unknown CSAM and solicitation ofchildren. The detection orders concerning the solicitation of children would apply tointerpersonal communications where one of the users is a child user (Article 7(8)).

9.

A detection order can be issued when the issuing authority considers that the conditions
referred to in Article 7(4) of the proposed Regulation are met. It would be directed at a
specific service where “there is evidence of a significant risk of the service being used for the
purpose of online child sexual abuse” and where such an order would be considered
proportionate6. It would concern the communications of all the users of that service. The
ultimate assessment of the “evidence”, the “significant risk” and the proportionality of anorder would lie with the competent national judicial authority or independent administrative
authority issuing the order.

5
6

Article 2 of the proposed Regulation.
Article 7(4) of the proposed Regulation.

8787/23

3
JUR

LIMITEEN10.

The CSAM would have to be detected by the service provider by installing and operating
technologies to detect the dissemination of known or new child sexual abuse material or thesolicitation of children, which would be based on the corresponding indicators provided by
the EU Centre. Detection would imply, therefore, that content of all communications must beaccessed and scanned, and be performed by means of available automated tools, the exact
nature of which is not specified in the proposal, as the proposal’s ambition is to remaintechnologically neutral.7

11.

The proposed Regulation specifies that the technologies would have to be i) effective in
detecting the dissemination of such material, ii) not be able to extract any other informationfrom the relevant communications than the information strictly necessary to detect suchmaterial, iii) based on the use of the indicators in accordance with the state of the art in theindustry and the least intrusive in terms of the impact on the users’ rights to privacy and dataprotection, and iv) sufficiently reliable (limiting to the maximum extent possible the rate oferrors). The technologies would have to be made available (but not conceived) by the
EU Centre. Nevertheless, service providers would not be required to use any specifictechnology, including those made available by the EU Centre, as long as the requirements set
out in the Regulation are met. Furthermore, the responsibility to comply with thoserequirements and for any decisions to be taken in connection to or as a result of the use of thetechnologies made available by the EU Centre would rest on the service providers.8

12.

The detection technologies would have to be based on the “indicators” of known CSAM,
unknown CSAM and solicitation of children provided by the EU Centre. Two types of tools
would need to be used. For any detection, the relevant providers would be compelled to
implement content verification tools in order to analyse all content for the presence ofknown and unknown CSAM or for solicitation of children. Additionally, for detecting
solicitation of children, they would have to use (unspecified) age verification tools to
distinguish between adult and child users.9789Articles 10 and 46 of the proposed Regulation.
Articles 10(2), (3), and 50 of the proposed Regulation.
Articles 7, 10 and 44 of the proposed Regulation.

8787/23

4JUR

LIMITEEN13.

The period of application of detection orders would be “limited to what is strictly necessary”
but should not exceed 24 months for the dissemination of known or new CSAM and
12 months for the solicitation of children.10

III. LEGAL ANALYSIS
14.

Article 52(1) of the Charter states, regarding the scope and interpretation of the rights
guaranteed by it, that any limitation on the exercise of the rights and freedoms recognised by
the Charter must be provided for by law and respect the essence of those rights and freedoms.
In observance of the principle of proportionality, limitations are only possible if they arenecessary and genuinely meet objectives of general interest recognised by the European
Union or the need to protect the rights and freedoms of others.

15.

As will be further explained in subsections 2 and 3 below, there is no doubt that, on the one
hand, the detection order for interpersonal communications pursues an objective of generalinterest and, on the other hand, that it introduces significant limitations to the rights to privacy
and personal data protection. The main legal concerns as to the compliance with the Charteras interpreted by the case law of the Court of Justice arise on the question whether thoselimitations are sufficiently regulated by law, compromise the essence of those fundamental
rights, and are proportionate to the objective pursued. Subsections 1, 4 and 5 below willfurther elaborate on these aspects.

10

Article 7(8)(c) and (9) of the proposed Regulation.

8787/235JUR

LIMITE

EN

1.
16.

The limitations to the fundamental rights must be provided for by law

According to well-established case law of both the ECtHR and the Court11, the requirementthat any limitation on the exercise of a fundamental right must be provided for by law implies
that the act which permits the interference with those rights must itself define the scope of thelimitation on the exercise of the right concerned. Therefore, such requirement not only refers
to the fact that the interference must have a basis “in law” – which is not at issue in thepresent case – but also implies that the legal act permitting the interference with those rights
must itself define clearly and precisely the scope of the limitation. The measure at issue mustbe accessible and foreseeable and, as a result, allow for meaningful judicial control, eventhough it can be formulated in terms which are sufficiently open to be able to adapt todifferent scenarios and keep pace with changing circumstances12.

17.

Requirements of clarity, precision and completeness are all the more relevant with regard to
the proposed Regulation, given the extent and seriousness of the interference with thefundamental rights that would be caused by the regime of detection orders in interpersonalcommunications. Indeed, given the significance of the interference with fundamental rights,
the judicial review by the Court would be strict and not limited to manifest error, thereby
reducing scope of discretion of the Union legislature.13 This intensity of judicial review
increases the importance of having clear, precise and complete legal provisions for the
purposes of ensuring a legally sound approach.

11

12
13

See, ECtHR judgment of 25 May 2021, Big Brother Watch and Others v. United Kingdom,
CE:ECHR:2021:0525JUD005817013, paragraph 333, and the case law cited. See, among
others, judgment of 16 July 2020, Facebook Ireland and Schrems, C-311/18,
EU:C:2020:559, paragraph 175, and the case law cited.
See judgment of 21 July 2022, Ligue des droits humains, C-817/19, EU:C:2022:491,
paragraph 114.
See judgments of 8 April 2014, Digital Rights Ireland and Others, C-293/12 and C-594/12,
EU:C:2014:238, paragraphs 47 and 48 and case law cited therein.

8787/23

6JUR

LIMITEEN18.

In addition, this measure is a regulation “directly applicable in all the Member States”14 and,unlike a directive, will not, in principle, require the adoption of any transposition measure of
the detection order obligations applied to interpersonal communications in the national legal
orders. This implies that, in case of judicial review, compliance with fundamental rights of theregime of detection orders would have to be assessed on the basis of its own merits, clarityand precision, as defined by the Union legislature. Therefore, in applying the principle ofconform interpretation with those rights, it would not be possible to rely on the margin of
discretion of Member States in transposing a directive.15

19.

In the light of the above, it must be noted, first of all, that the proposed Regulation provides
for a comprehensive set of rules concerning, in particular, the risk assessment, the risk
mitigation, the risk reporting and the issuing of detection orders by judicial authorities or
independent administrative authorities, which are significant elements supporting aconclusion that the first requirement of Article 52 of the Charter is complied with.

20.

However, this conclusion is undermined in two important respects concerning, on the one
hand, the key role and impact of the technology on the limitation of the fundamental rights atstake and, on the other hand, the lack of qualification of the substantive conditions concerning
the issuance of a detection order.

21.

On the first aspect, concerning technology, on a combined reading of Articles 7(1) and 10(1)of the proposed Regulation the detection order consists, in substance, of imposing on a
specific service provider the obligation to install and operate a technology enabling thedetection of CSAM. Nevertheless, in its Articles 7(1), (3)(a) and (8), 10(2) and (3), and 44,
the proposed Regulation does not specify in sufficient detail the nature and the features of thetechnologies to be made available for this purpose.

14
15

Article 288 TFEU.
See, judgment of 21 July 2022, Ligue des droits humains, C-817/19, paragraphs 87 to 89,
where in order to assess the legality of the Directive (EU) 2016/681 of the European
Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR)
data for the prevention, detection, investigation and prosecution of terrorist offences andserious crime (OJ 2016 L 119, p. 132) the Court in applying the principle of conformity
relied also on the implementation of the directive by the Member States.

8787/23

7JUR

LIMITEEN

22.

In particular, it is not specified what “sufficiently reliable detection technologies” means, andwhat would be the “rate of errors” regarding the detection that would be considered
acceptable in terms of balance between “effectiveness” and the need to take the “least
intrusive measures”. Furthermore, the “indicators” to be used to detect known CSAM,
unknown CSAM and solicitation of children are to be elaborated and provided by the EU
Centre at a later stage. The same goes for the unspecified tools needed to distinguish between
adult and child users in the case of detection of solicitation of children (age verification tools).
In these respects, the requirement of compliance with fundamental rights is not defined in theact itself but is left to a very large extent to the service provider, which remains responsible
for the choice of the technology and the consequences linked to its operation.16

23.

To provide one example, the choice of age verification technology (mass profiling and/or
biometric identification and/or digital identity certificates) could greatly impact the degree of
intrusiveness of the system, and therefore influence the further assessment of the conformity
with the Charter of the detection orders regime as a whole.

24.

On the second aspect, concerning the conditions for the issuance of a detection order,
although its Article 7 sets out certain detailed requirements in this regard, the proposed
Regulation does not set out the methodology by which the risk of use of the specific service
for the purpose of child sexual abuse should be assessed, or specify a meaningful threshold of
the level of risk that would justify the introduction of the detection order. Article 7(4) to (7)refer to the concepts of “significant risk”, “negative consequences for the rights andlegitimate interests” of the users, “fair balance between fundamental rights”, “mitigation
measures” or “potential consequences” for all the parties affected. Depending on whether thedetection order concerns known, unknown CSAM, or solicitation of children, those concepts
are, in turn, further defined by referring to other insufficiently precise concepts like the use“to an appreciable extent” of services or comparable services for the purposes of thedissemination of any CSAM and a“significant number of reports” available in this respect.

16

See judgment of 5 September 2012, Parliament v Council, C‑ 355/10, EU:C:2012:516,
paragraph 77.

8787/23

8JUR

LIMITE

EN25.

The terms used – for instance the reference to the need for a measure to be “effective” –combined with the fact that the responsibility for the choice of “effective” technology lies
ultimately with the service providers, raise serious doubts as to the foreseeability of the
impact of these measures on the fundamental rights at stake.

26.

In conclusion, the concepts used in the proposed Regulation to determine the limitations to thefundamental rights at stake that would derive from the use of detection orders, as well as thefact that those limitations would depend, in essence, on technologies and methodologies
which are yet to be established, makes it challenging to assess the degree of interference with
fundamental rights. In substance, the duty to further determine the extent of such interference
would ultimately be upon those in charge of conceiving the relevant technology, theparameters for the indicators-based screenings and implementing the detection order on acase-by-case basis (EU Centre, national authorities, judges, service providers). The extent of
discretion involved could give rise to a very broad range of possible different interpretations
and concerns as regards compliance with fundamental rights.

27.

In light of the above, the regime of detection orders, as currently provided for by the proposed
Regulation, entails the risk of not being sufficiently clear, precise and complete, and thereforeof not being in compliance with the requirement that limitations to fundamental rights must be
provided for by law. The proposed Regulation should provide more detailed elements both on
the limits to fundamental rights that the specific type and features of the technology to be used
would entail and related possible safeguard measures.

8787/239JUR

LIMITE

EN

2.
28.

Combating child sexual abuse as an objective of general interest

As to the question whether the detection orders established by the proposed Regulation
pursue an objective of general interest recognised by the Union or the need to protect therights and freedoms of others, the Court has affirmed that the fight against serious crime inorder to ensure public security constitutes an objective of general interest.17 Furthermore, theCourt explicitly enumerates “the sexual exploitation of children and child pornography”
among the offences that “are inherently and indisputably extremely serious”.18 This is also
reflected in the EU relevant legislation concerning child sexual abuse.19

29.

The Court affirms that “[…]as regards, in particular, effective action to combat criminal
offences committed against, inter alia, minors and other vulnerable persons, it should beborne in mind that positive obligations of the public authorities may result from Article 7 of
the Charter, requiring them to adopt legal measures to protect private and family life. Suchobligations may also arise from Article 7, concerning the protection of an individual’s homeand communications, and Articles 3 and 4, as regards the protection of an individual’s
physical and mental integrity and the prohibition of torture and inhuman and degrading
treatment.”

17

18
19

See judgments of 8 April 2014, Digital Rights Ireland and Others, C-293/12 and C-594/12,
paragraph 42, of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18
and C-520/18, 125, EU:C:2020:79, paragraph 126. The Court notes, in this respect, that
Article 6 of the Charter lays down the right of any person not only to liberty, but also tosecurity. However, the Court specifies that since that provision applies to deprivations ofliberty by a public authority, Article 6 of the Charter cannot be interpreted as imposing an
obligation on public authorities to take specific measures to prevent and punish certain
criminal offences.
See, judgment of 21 July 2022, Ligue des droits humains, C-817/19, paragraph 149.
Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011
on combating the sexual abuse and sexual exploitation of children and child pornography,
and replacing Council Framework Decision 2004/68/JHA (OJ 2011 L 335, p. 1, andcorrigendum OJ 2012 L 18, p. 7).

8787/2310JUR

LIMITEEN30.

The Court concludes, in this respect, that “Articles 4 and 7 of the Charter, require, inparticular, the adoption of substantive and procedural provisions as well as practicalmeasures enabling effective action to combat crimes against the person through effective
investigation and prosecution, that obligation being all the more important when a child’s
physical and moral well-being is at risk.”.20

31.

It is noted that, on the one hand under its Article 1 (subject matter and scope), the objective of
the proposed Regulation is “to address the misuse of relevant information society services foronline child sexual abuse in the internal market”. On the other hand, in Article 2 (l) to (n)(definitions), the proposed Regulation refers to the definitions of CSAM included in Directive
2011/93/EU on combating children sexual abuse and sexual exploitation of children and childpornography, and not to the definition of the related criminal offences concerning sexual
abuse provided for by that Directive. Therefore, the scope of the detection order provided forby the proposed Regulation is not limited to detecting criminal conduct.

32.

In the light of the above, there is no doubt that the detection orders are meant to pursue theimportant objective of general interest of preventing, detecting, investigating and prosecuting
child sexual abuse offences. Nevertheless, the scope of such detection, as defined by the
proposed Regulation, is broader than the detection of criminal conduct. This is an aspect thatneeds to be taken into account in assessing the requirements referred to in Article 52 of theCharter as interpreted by the Court.

20

See judgments of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18
and C-520/18, paragraph 128, of 20 September 2022, SpaceNet AG, C-793/19 andC-794/19, EU:C:2022:702, paragraphs 63 to 65.

8787/23

11JUR

LIMITE

EN

3.
33.

The limitation on the rights to privacy and the protection of personal data

The screening of interpersonal communications as a result of the issuance of a detection orderundeniably affects the fundamental right to respect for private life, guaranteed in Article 7 of
the Charter, because it provides access to and affects the confidentiality of interpersonalcommunications (text messages, e-mails, audio conversations, pictures or any other kind of
exchanged personal information). It is also likely to have a deterrent effect on the exercise of
freedom of expression, which is enshrined in Article 11 of the Charter21. It does not matter inthis respect whether the information in question relating to private life is sensitive or whether
the persons concerned have been inconvenienced in any way on account of that interference.22

34.

Furthermore, such screening constitutes the processing of personal data within the meaning of
Article 8 of the Charter and affects the right to protection of personal data provided by thatprovision.23

35.

It must be noted, in this respect, that under settled case law the fact that the automatedanalysis based on predefined indicators would not, as such, allow all the users whose data is
being analysed to be identified, does not prevent such data from being considered personaldata, in so far as the automated analysis would allow the person or persons concerned by thedata to be identified at a later stage. According to the definition of personal data in
Article 4(1) of the General Data Protection Regulation (GDPR), information relating,inter alia, to an identifiable person constitutes personal data.24 Therefore, screening of allcommunications in a given service, with the assistance of an automated operation,
presupposes systematic access to and processing of all information and constitutes aninterference with the right to data protection, regardless of how that data is used subsequently.
In particular, the question whether that information is subsequently accessed by the competentauthorities is irrelevant.

21
22
23
24

See judgment of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18 andC-520/18, paragraph 173.
See judgment of 21 July 2022, Ligue des droits humains, C-817/19, paragraph 96.
See, by analogy, judgment of 21 July 2022, Ligue des droits humains, C-817/19,
paragraphs 93 and 94.
See judgment of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18 andC-520/18, paragraph 171.

8787/23

12JUR

LIMITEEN

36.

As to the seriousness of the interference that the use of a detection order in interpersonalcommunications would entail, in La Quadrature du Net25, the Court analysed the national
legislation which, for the purpose of safeguarding national security including terrorism,
required providers of electronic communications services to implement, on their networks,
measures allowing for the automated analysis of traffic and location data.

37.

In La Quadrature du Net, the Court considered that an automated analysis corresponding,“[…] in essence, to a screening of all the traffic and location data retained by providers ofelectronic communications services, which is carried out by those providers at the request of
the competent national authorities applying the parameters set by the latter” as being aparticularly serious interference since it covers, generally and indiscriminately, the data of
persons using electronic communication systems, is likely to reveal the nature of theinformation consulted online and applies also to persons with respect to whom there is noevidence capable of suggesting that their conduct might have a link, even an indirect orremote one, with terrorist activities.26

38.

The national measure assessed by the Court in paragraphs 171 to 180 of the judgement
La Quadrature du Net is similar to the detection orders in the proposed Regulation. In bothcases the providers are required to automatically screen the communication data. In bothcases, the screening is based on the “indicators” provided by the public authorities. Bothmeasures concern electronic communications services and are likely to reveal the nature of
the information exchanged online. Furthermore, both measures apply also to persons withrespect to whom there is no evidence capable of suggesting that their conduct might have alink, even an indirect or remote one, with the criminal activities concerned.

25
26

See, judgment of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18
and C-520/18, paragraphs 172 to 180.
See, judgment of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18
and C-520/18, paragraph 174.

8787/23

13
JUR

LIMITEEN39.

Nevertheless, for the purpose of assessing whether a detection order in interpersonalcommunication would entail a particularly serious interference in the light of this case law, it
must be assessed, first, whether the detection order would cover generally andindiscriminately the data of persons using electronic communication systems within themeaning of that case law and, second, the type of data concerned.

40.

First, the fact that a detection order would be addressed to a specific service provider and not
to all interpersonal communications services does not seem, as such, a relevant argument toconsider that the measure would not be of general and indiscriminate nature.

41.

It must be noted that in assessing targeted versus general and indiscriminate measures, theCourt takes into account the specific nature of the measure.27 In particular, the relevant factor
that is taken into account by the Court in its case law concerning retention of communicationof metadata is whether the automated processing of data is limited on the basis of objective
and non-discriminatory factors, according to the categories of persons concerned or using ageographical criterion, or whether other objective and non-discriminatory criteria may beconsidered in order to establish a connection, at least indirectly, between serious criminal acts
and the persons whose data are processed.28 The need for such connection, established by the
Court in the context of the retention of metadata (traffic and location data) should beappreciated differently in relation to access to content data (content of interpersonalcommunications), which constitutes a more significant interference with fundamental rights.

27
28

See, for example, judgment of 26 January 2023, Ministerstvo na vatreshnite raboti,
C-205/21, EU:C:2023:49, paragraph 129.
See judgment of 20 September 2022, SpaceNet AG, C-793/19 and C-794/19, paragraphs 75,
83 to 84, 112 and 113.

8787/23

14JUR

LIMITEEN42.

The obligations in the detection orders provided for by the proposed Regulation, while
addressed to a specific service provider, would imply that content of all interpersonalcommunications concerning that service (or the affected part or component whereapplicable)29 must be accessed and scanned by means of automated tools. Therefore, suchprocessing of data would not be limited to the interpersonal communications of persons in
respect of whom there are reasonable grounds to believe that these persons are in any way
involved in committing, or have committed a child sexual abuse offence, or presenting aconnection, at least indirectly, with sexual abuse offences.

43.

The proposed legislation requires the general screening of the data processed by a specificservice provider without any further distinction in terms of persons using that specific service.
The fact that the detection orders would be directed at specific services where there isevidence of a significant risk of the service being used for the purpose of online child sexual
abuse would be based on a connection between that service and the crimes of child sexual
abuse, and not, even indirectly, on the connection between serious criminal acts and thepersons whose data are scanned. The data of all the persons using that specific service would
be scanned without those persons being, even indirectly, in a situation liable to give rise tocriminal prosecutions, the use of that specific service being the only relevant factor in thisrespect.

44.

With this regard, it must be taken into consideration that interpersonal communication
services are used by almost the entire population and may also be used for the disseminationof CSAM and/or for solicitation of children. Detection orders addressed to those services
would entail a variable but in almost all cases very broad scope of automated analysis of
personal data and access to personal and confidential information concerning a very large
number of persons that are not involved, even indirectly, in child sexual abuse offences.

29

See Article 8(1)(d) of the proposed Regulation.

8787/23

15JUR

LIMITEEN45.

This concern is further confirmed by the fact that the proposed Regulation does not provide
any substantive safeguards to avoid the risk that the accumulated effect of application of thedetection orders by national authorities in different Member States could lead to covering allinterpersonal communication services active in the Union.

46.

Furthermore, since issuing a detection order with regard to a specific provider of interpersonalcommunication services would entail the risk of encouraging the use of other services forchild sexual abuse purposes, there is a clear risk that, in order to be effective, detection orders
would have to be extended to other providers and lead de facto to a permanent surveillance of
all interpersonal communications.

47.

In the light of the above, even though the detection order is addressed to a single service
provider with regard to a specific interpersonal communication service or a part or componentof it, it is highly probable that in case of judicial review, a data screening obligation such asthat provided by the obligations in the detection orders would be considered as general andindiscriminate, and therefore not targeted processing of data.

48.

Given its general and indiscriminate nature, such screening obligation would, therefore, entail
a particularly serious interference with fundamental rights in the light of the case law
referred to above in paragraphs 36 and 37.

49.

Second, such conclusion is further confirmed by the significance of the interference, which ismore acute in the detection order than in La Quadrature du Net in view of the categories ofdata concerned. In La Quadrature du Net, the generalised screening concerned the metadata(traffic and location data), while the detection order would concern screening of the content ofcommunications. The processing of metadata is less intrusive than similar processing ofcontent data.

8787/23

16
JUR

LIMITE

EN

50.

Moreover, the screening of content of communications would need to be effective also in an
encrypted environment, which is currently widely implemented in the interpersonalcommunication environment. That would imply that the providers would have to consider(i) abandoning effective end-to-end encryption or (ii) introducing some form of “back-door”
to access encrypted content or (iii) accessing the content on the device of the user before it isencrypted (so-called “client-side scanning”).30

51.

Therefore, it appears that the generalised screening of content of communications to detectany kind of CSAM would require de facto prohibiting, weakening or otherwise circumventing
cybersecurity measures (in particular end-to-end encryption), to make such screening
possible. The corresponding impact on cybersecurity measures, in so far as they are provided
by economic operators on the market, even under the control of competent authorities, would
create a stronger interference with the fundamental rights concerned and could cause anadditional interference with other fundamental rights and legitimate objectives such as
safeguarding data security.

52.

Furthermore, the screening of audio or written communications in order to detect solicitationof children would necessarily require age assessment/verification generalised to all users of
the service concerned. In fact, without establishing the precise age of all users, it would not be
possible to know that the alleged solicitation is directed towards a child. Such process would
have to be done either by (i) mass profiling of the users or by (ii) biometric analysis of theuser’s face and/or voice or by (iii) digital identification/certification system. Implementationof any of these measures by the providers of communication services would necessarily add
another layer of interference with the rights and freedoms of the users.

30

See also, in this respect, request for a preliminary ruling from the Landgericht Berlin(Germany) lodged on 24 October 2022 – Criminal proceedings against M.N., in pending
Case C-670/22, concerning the use of evidence obtained from the interception of enabled
end-to-end encrypted communication telecommunications, including content ofcommunications, covering all the users subscribed to a communications service, without
concrete evidence of the commission of serious criminal offences by those individual users.

8787/23

17
JUR

LIMITEEN

53.

It follows from the above that the application of detection orders to interpersonalcommunications, as proposed, would entail a particularly serious interference with
fundamental rights.
4.

54.

The essence of the right to privacy and protection of personal data

In this context the question could also arise whether, in the light of the case law theinterference entailed by the proposed detection orders applied to interpersonal communication
could even compromise the essence of the right31 to the respect for private and family life aswell as the right to the protection of personal data.

55.

Indeed, the Court has ruled that, “legislation permitting the public authorities to have accesson a generalised basis to the content of electronic communications must be regarded ascompromising the essence of the fundamental right to respect for private life, as guaranteedby Article 7 of the Charter”.32 Furthermore, it can be inferred from the case law that theinterference entailed by such legislation in the fundamental rights enshrined in Articles 7
and 8 of the Charter is considered as being very far-reaching, particularly serious and likely tocause the persons concerned to feel that their private lives are the subject of constantsurveillance.33

31

32
33

The obligation to respect the essence of the rights concerned is one of the conditions
foreseen by Article 52(1) of the Charter for the lawfulness of a limitation on the exercise of
the rights and freedoms recognised by the Charter.
See judgment of 6 October 2015, Schrems, C-362/14, EU:C:2015:650, paragraph 94.
See judgments of 8 April 2014, Digital Rights Ireland and Others, C-293/12 and C-594/12,
paragraph 39; of 6 October 2015, Schrems, C-362/14, paragraph 94; of 21 December
2016, Tele2 Sverige and Watson and Others, C-203/15 and C-698/15, EU:C:2016:970,
paragraphs 100 and 101.

8787/23

18
JUR

LIMITEEN

56.

In so far as the detection which may be authorised would entail generalised access to andfurther processing of the content of interpersonal communications, the right to confidentialityof correspondence would become ineffective and devoid of content, since it would not impose
any limitation in terms of either content or persons concerned to be complied with by aservice provider. In the light of the above-mentioned case law, such interference entails,
therefore, the serious risk even of compromising the essence of the fundamental right torespect for private life.

57.

It is true that, under Article 10(3)(b) of the proposed Regulation, the technology to be madeavailable and used by the services provider “shall not be able to extract any other informationfrom the relevant communications than the information strictly necessary to detect [CSAM]”,and “shall be in accordance with the state of the art in the industry and the least intrusive interms of the impact on the users’ rights to privacy and family live as well as data protection”.
Nevertheless, it must be recalled in this respect that not extracting irrelevant communication
does not exclude, per se, the need to screen, through an automated analysis, all theinterpersonal communication data of every user of the specific communication service towhich the order is addressed, including to persons with respect to whom there would be no
evidence capable of suggesting that their conduct might have a link, even an indirect orremote one, with child sexual abuse offences.

58.

In the light of the above, it can be concluded that the detection order regime provided for by
the proposed Regulation as regards interpersonal communications entails a serious risk that it
would be found to compromise the essence of the rights to privacy and data protection
enshrined in Article 7 and 8 of the Charter, in so far as it would seek to authorise access on a
generalised basis, through automated and systemic screening surveillance, to the content ofelectronic communications and personal data of all users of a specific service, irrespective of
their direct or indirect link with child sexual abuse criminal activities.34

34

See by analogy, judgment of 21 July 2022, Ligue des droits humains, C-817/19,
paragraphs 92 to 111.

8787/23

19
JUR

LIMITE

EN

5.
59.

Compliance with the principle of proportionality

Notwithstanding the foregoing, in the event that the measures at stake are considered torespect the essence of fundamental rights, their compliance with the Charter would have to beassessed from the perspective of proportionality in so far as they entail, in any case,particularly serious limitations of/interferences with those rights, as outlined in paragraphs 33
to 53 above.

60.

Under settled case law, the principle of proportionality requires that the limitations whichmay, in particular, be imposed by acts of EU law on rights and freedoms enshrined in theCharter do not exceed the limits of what is appropriate and necessary in order to meet thelegitimate objectives pursued or the need to protect the rights and freedoms of others; where
there is a choice between several appropriate measures, recourse must be had to the least
onerous, and the disadvantages caused must not be disproportionate to the aims pursued.
Moreover, where several fundamental rights and principles enshrined in the Treaties are atissue, the assessment of observance of the principle of proportionality must be carried out inaccordance with the need to reconcile the requirements of the protection of those various
rights and principles at issue, striking a fair balance between them.35

61.

The need to ensure that the interference to privacy and data protection is limited to what isstrictly necessary is all the greater where personal data are subjected to automated processing,particularly where there is a significant risk of unlawful access to those data. Thisconsideration would apply especially where the protection of the category of personal data
concerns sensitive data.36 This is clearly the case for the data contained in the content ofinterpersonal communications.

35
36

See judgment of 17 December 2020, Centraal Israëlitisch Consistorie van België and Others,
C‑ 336/19, EU:C:2020:1031, paragraph 64.
See judgment of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18 andC-520/18, cited, paragraph 132.

8787/2320JUR

LIMITEEN

62.

In its case law to date, the Court has not directly discussed the proportionality of a mandatory
screening of content of interpersonal communications for law enforcement purposes such theone provided for by the proposed Regulation, for the obvious reason that no such measure has
yet been enacted by the Union or by any of its Member States. Comparative law is also of
limited assistance.37 The outcome of the proportionality test may however be inferred from anumber of rulings concerning, in particular, internal market legislation (Article 15 of thee-Privacy Directive38), where the proportionality of measures related to communication data
was at stake. This case law is all the more relevant here as the proposed Regulation, like theabove-mentioned directive, is based on Article 114 TFEU.

63.

The methodology developed by the Court to assess the proportionality of particularly serious
interferences to fundamental rights in the context of data retention or access to metadata isrelevant for the purposes of assessing the measures at stake.

64.

In this context, with regard to Articles 7, 8, 11 and Article 52(1) of the Charter, the Court
stated, first of all, that those provisions do not preclude legislative measures that, for the
purposes of combating serous crime and preventing serious threats to public security, provide
for the targeted retention of traffic and location data which is limited, on the basis of objective
and non-discriminatory factors, according to the categories of persons concerned or using ageographical criterion, for a period that is limited in time to what is strictly necessary.39

37

38

39

However, see the discussion on the scanning of communication data under the US
legislation (judgments of 6 October 2015, Schrems, C-362/14, cited and of 16 July 2020,
Facebook Ireland and Schrems, C‑ 311/18, cited). Regarding different, but connected issueof bulk interception of communications by intelligence services for national security
purposes see ECtHR judgment of 25 May 2021, Big Brother Watch and Others v. United
Kingdom, CE:ECHR:2021:0525JUD005817013 and Centrum för Rättvisa v. Sweden,
CE:ECHR:2021:0525JUD003525208.
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002
concerning the processing of personal data and the protection of privacy in the electronic
communications sector (Directive on privacy and electronic communications); OJ L 201,
31.7.2002.
See judgment of 20 September 2022, SpaceNet AG, C-793/19 and C-794/19, cited,paragraph 75.

8787/23

21
JUR

LIMITE

EN

65.

However, the Court specified that even the positive obligations which may arise, dependingon the circumstances, from Articles 3, 4 and 7 of the Charter and which relate to theestablishment of rules to facilitate effective action to combat criminal offences, cannot havethe effect of justifying interference that is as serious as that entailed by legislation providing
for the retention of traffic and location data with the fundamental rights to privacy andpersonal data protection, in circumstances where the data of the persons concerned are notliable to disclose a link, at least an indirect one, between those data and the objective
pursued.40

66.

In the light of this case law, and taking into account the considerations referred to inparagraphs 39 to 47 above, there is a serious risk of non-compliance with the principle ofproportionality in so far as the detection orders would require the general and indiscriminate
access to the content of personal communications by a specific service provider, and would
apply without any distinction to all the persons using that specific service, without those
persons being, even indirectly, in a situation liable to give rise to criminal prosecution.

40

See judgments of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18
and C-520/18, cited, paragraph 145, and of 20 September 2022, SpaceNet AG, C-793/19
and C-794/19, cited, paragraph 24. It must be noted, in this respect, that the Court accepted
the conformity with the Charter of provisions that make it possible, with regard to a person
in respect of whom there are reasonable grounds to believe that is involved in serious
criminal offences, to secure the effective and rapid collection of data in the context of acriminal procedure and following an individual assessment of their necessity andproportionality (see, judgments of 15 December 2015, WebMindLicenses, C-419/14,
EU:C:2015:832, paragraph 69, and of 16 February 2023, HYA e.a., C-349/21,
EU:C:2023:102, paragraph 49).

8787/23

22
JUR

LIMITEEN

67.

It must be noted, in this respect, that establishing a link, at least an indirect one, between thecontent of interpersonal communications and the objective pursued by the measures at stake isfurther affected by the fact that, in the light of paragraph 31 above, the detection orders are
not limited to criminal content. Directive 2011/93/EU on combating children sexual abuse andsexual exploitation of children and child pornography establishes minimum rules concerning
the definition of the relevant offences and leaves the Member States the task of defining
several elements constituting the relevant criminal offences in national law (see, in particularthe “age of sexual consent” below which it is prohibited to engage in sexual activities with achild). As a result, the screening at EU level may cover material which would not always
constitute or lead to child sexual abuse offences in all the Member States.

68.

Moreover, the risk of non-compliance with the principle of proportionality would be further
aggravated by the fact that the detection order, unlike the measures addressed in the case law
referred to in paragraph 64, would concern the content of interpersonal communications andnot the traffic and location data.

69.

Second, the Court stated that EU law does not preclude, for the purposes of combating crimein general, the generalised retention of data relating to civil identity and IP addresses.41

41

Data related to civil identity concern purchase of a means of electronic communication,such as a pre-paid SIM card being subject to a check of official documents establishing thepurchaser’s identity and the registration, by the seller, of that information, with the seller
being required, should the case arise, to give access to that information to the competent
national authorities. IP addresses are part of traffic data, they are generated independently of
any particular communication and mainly serve to identify, through providers of electronic
communications services, the natural person who owns the terminal equipment from whichan Internet communication is made. See judgment of 20 September 2022, SpaceNet AG,
C-793/19 and C-794/19, cited, paragraph 99.

8787/23

23
JUR

LIMITEEN70.

The Court has confirmed, in this respect, that the retention of the IP addresses of all natural
persons who own terminal equipment permitting access to the Internet might be the onlymeans of investigating offences committed online, inter alia, in cases involving particularly
serious child pornography offences, such as the acquisition, dissemination, transmission or
making available online of child pornography, within the meaning of Article 2(c) of Directive
2011/93/EU on combating children sexual abuse and sexual exploitation of children and childpornography. However, the Court specified, on the one hand, that the civil identity of users ofelectronic communications systems, does not provide, apart from the contact details of thoseusers, such as their addresses, any information on the communications sent and, consequently,
on the users’ private lives. Thus, the interference entailed by the retention of that data cannot,
in principle, be considered as serious, On the other hand, concerning IP addresses, although
they are part of traffic data, they do not, as such, disclose any information about third parties
who were in contact with the person who made the communication. That category of data istherefore less sensitive than other traffic data.42

71.

This case law can therefore not serve as a basis to conclude that the particularly serious
interference with privacy and data protection entailed by the detection order obligations ininterpersonal communications would be necessary and proportionate, in so far as they would
impose the screening of information which the Court, contrary to the above-mentioned caselaw, considered as very sensitive (content of interpersonal communications).

42

See judgment of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18 andC-520/18, cited, paragraphs 152 to 158.

8787/23

24
JUR

LIMITE

EN

72.

Third, in La Quadrature du Net, the Court stated that the particularly serious interference thatis constituted by the general and indiscriminate automated analysis of traffic and location data
can meet the requirement of proportionality only in situations in which a Member State isfacing a serious threat to national security which is shown to be genuine and present orforeseeable, and provided that the duration of that retention is limited to what is strictly
necessary. The Court specified that it is only in these circumstances that a general andindiscriminate screening of data which is likely to reveal the nature of the information
consulted online and applies irrespective of a link, even an indirect or remote one, withterrorist activities, may be considered to be justified in the light of the requirements stemmingfrom Articles 7, 8 and 11 and Article 52(1) of the Charter.43

73.

However, it is difficult to see how this case law can serve as a basis to justify a measure
which aims at combating criminal offences, which are indisputably serious, but are not related
to threats to national security.

74.

In this regard, the Court has held that the objective of protecting national security corresponds
to the primary interest in protecting the essential functions of the State and the fundamental
interests of society through the prevention and punishment of activities capable of seriously
destabilising the fundamental constitutional, political, economic or social structures of acountry and, in particular, of directly threatening society, the population or the State itself,such as terrorist activities. Such a threat is therefore distinguishable, by its nature, itsseriousness, and the specific nature of the circumstances of which it is constituted, from thatof serious criminal offences being committed. The Court concludes, in this respect, that crime,
even of a particularly serious nature, cannot be treated in the same way as a threat to national
security.44

43
44

See, judgment of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18
and C-520/18, cited, paragraphs 172 to 180.
See judgments of 5 April 2022, Commissioner of An Garda Síochána and Others,
C‑ 140/20, EU:C:2022:258, paragraphs 61 62, and of 20 September 2022, SpaceNet AG,
C-793/19 and C-794/19, cited, paragraphs 92 to 94.

8787/23

25
JUR

LIMITE

EN75.

Therefore, if the screening of communications metadata was judged by the Court
proportionate only for the purpose of safeguarding national security, it is rather unlikely thatsimilar screening of content of communications for the purpose of combating crime of childsexual abuse would be found proportionate, let alone with regard to the conduct notconstituting criminal offences.

76.

It follows from all of the above that the regime of the detection order with regard tointerpersonal communications entail a serious risk of exceeding the limits of what is
appropriate and necessary in order to meet the legitimate objectives pursued, and therefore of
failing to comply with the principle of proportionality.

IV.

CONCLUSION77.

The CLS concludes that, in the light of the case law of the Court of Justice at this stage, theregime of the detection order, as currently provided for by the proposed Regulation withregard to interpersonal communications, constitutes a particularly serious limitation to therights to privacy and personal data protection enshrined in Article 7 and 8 of the Charter.

78.

Such regime entails a serious risk of:a)not being sufficiently clear, precise and complete, notably in view of the expected
intensity of the judicial review of a measure interfering with fundamental rights, andtherefore as not being in compliance with the requirement that the limitations to thefundamental rights must be provided for by law as regards the points referred to inparagraphs 20 to 26;b)compromising the essence of the above-mentioned fundamental rights in so far as it
would permit generalised access to the content of interpersonal communications, or, in
the alternative;

8787/23

26
JUR

LIMITEENc)

not being in compliance with the proportionality requirement in so far as–

it would require the general and indiscriminate screening of the data processed bya specific service provider, and apply without distinction to all the persons usingthat specific service, without those persons being, even indirectly, in a situation
liable to give rise to criminal prosecution;–

it would not concern traffic and location data, but the content of interpersonalcommunications;–

it would pursue the general objective of fighting child sexual abuse crimes which,although they are serious crimes, do not constitute threats to national security.

79.

If the Council were to decide to maintain interpersonal communications within the scope ofthe regime of the detection order, the regime should be targeted in such a way that it applies topersons in respect of whom there are reasonable grounds to believe that they are in some way
involved in, committing or have committed a child sexual abuse offence, or have aconnection, at least indirectly, with the commission of sexual abuse offences. Furthermore,
the draft Regulation should provide more detailed and substantive elements with respect to thetechnology to be used and the extent of limitations to fundamental rights that it could entail,as well as further precisions concerning the conditions for issuance of a detection order andrelated possible safeguard measures.

8787/23

27
JUR

LIMITE

EN