(C) What to improve(1) The report should further strengthen the problem analysis. It should elaborate exactly how ‘the continued
presence and dissemination of child sexual abuse material [...] hampers growth on the Internal Market (i.e.
single market for digital services)’.
x

Clarifications added in section 1 (Introduction): “In the absence of harmonised rules at EU level, providersof social media platforms, gaming services, and other hosting and online communications services findthemselves faced with divergent rules across the internal market. The proliferation of rules is increasing,with recent legislative changes in the Netherlands and Germany, and at the same time there is evidence
that current efforts at national level are insufficient to successfully address the underlying problem.”xThe internal market aspect has also been reinforced in the definition of the problem, section 2.1.1. For
example: “The Member States have sought to address this growing phenomenon through rules at thenational level, reinforcing existing legislation or adopting new rules to improve the detection and followup on online child sexual abuse. This has inadvertently created a fragmentation of the internal market
which negatively impacts the provision of certain online services, while at the same time failing to stem
the proliferation of this particularly harmful content.”

xClarifications have also been added to section 2.1.2. on “Why is it a problem?” to highlight that the ‘thecontinued presence and dissemination of child sexual abuse material [...] hampers growth on the InternalMarket (i.e. single market for digital services) due to the fragmentation created by divergent national
approaches trying to address the problem of CSA online.

xSection 2.2.2. and annex 5 further elaborate on the legal fragmentation.

(2) The report should explain better the role of the proposed EU centre. The options description should clarify
the centre’s role in the area of prevention and whether the centre will coordinate Member States’ victim
support efforts including health, legal, child protection, education and employment.
Clarifications added in section 5.2.1.:
xOn prevention: “The Centre would facilitate Member States’ action on prevention by serving as a hub ofexpertise at the service of Member States, notably to help avoid duplication of efforts and to foster anevidence-based approach to prevention policies.” And: “The Centre will not have any power to impose
any initiative on prevention to Member States, i.e. it will not coordinate in the sense of determining “which
Member State is obliged to do what”.

xOn assistance to victims: “Also, the Centre would serve as a facilitator at the service of Member States,
including by sharing best practices and existing initiatives across the Union. In that sense, it would
facilitate the coordination of Member States’ efforts to increase effectiveness and efficiency. Similarly toprevention, the Centre will not have any power to impose any initiative to Member States on assistanceto victims, including on issues concerning health, legal, child protection, education and employment.”

It should explain:x

how the centre will perform proactive search:

Clarifications added in section 5.2.2., specifying that the Centre would use the databases of indicators to
conduct proactive searches of CSAM. Footnote added to further clarify how this could be done, e.g. using acrawler similar to the one used in Project Arachnid in Canada.
x

how the coordination of this task with the detection done by the service providers themselves will beassured

Clarifications added in section 5.2.2., specifying that the Centre would ensure coordination of the material
found in proactive searches and the one found by the providers through the detection obligations, through thenecessary data management systems.
xand how it will support SMEs by verifying the illegality of reported material.

2Clarifications added in sections 5.2.3., 5.2.4. and 5.2.5. that SMEs would not be obliged to verify the illegalityof the content before submitting it to the Centre. As specified in sections 5.2.3., 5.2.4. and 5.2.5., the Centrewould not confirm the illegality of the reported material, as this would need to be done by the competent
national authorities. The Centre would flag possible new CSAM and grooming to national authorities forconfirmation.
xIt should also provide the analysis of the cost of the centre under each policy option.

The analysis of the costs of the Centre under each policy option is included in Annex 4, section 4.2.
(3) The implementation options for the centre should be presented in a more open, balanced and completemanner in the main text. The preferred implementation option should not be identified upfront, but emerge
as result of an analytical assessment and comparison process.
Section 5.2.2. has been restructured to have first the analytical assessment and comparison process, leading
to the preferred implementation option.
In this respect, the report should be clearer on the relevance and functioning of the externalisation sub-option
on prevention and assistance to victims functions via non-EU staff and covered by calls for proposal or grants.
It should clarify whether this sub-option would in practice remove the need for a separate entity under theEuropol implementation option. It should be clear on the related impacts on infrastructure and operational
expenditure costs as well as organisational efficiency.
Clarifications added in section 5.2.2:“As indicated above, 28 posts corresponding to the prevention and assistance to victims functions in all
options could be non-EU staff and be covered by a call for proposals/grant. In particular, in the case of option
2, Europol + separate entity, the possibility to cover these posts through a call for proposals/grant would notremove the need for a separate entity, as the envisaged prevention and assistance functions are currently not
carried out by any organisation. Even if an existing entity applied for the potential call for proposals/grant, it
would need to expand to accommodate the 28 posts, with the estimated infrastructure costs of e.g. rental ofbuildings, IT systems and audits, and the operational expenditure costs of e.g. support to expert networks,translation and interpretation, dissemination of knowledge and communication (see Annex 10, section 4.2.).
Furthermore, a single separate entity should deal with both the prevention and assistance to victims functions
to ensure organisational efficiency, given the strong interlinkages between both functions.”(4) The report is clearer about the limitations of available technologies that exist for the use in encrypted
communications and acknowledges that they have not yet been deployed at large scale. In view of thisassertion, the report should be clearer about the practical feasibility of the policy options and providereassurance about the effective application. The report should be clear how legal uncertainty for obliged
service providers and risks of unintended consequences on privacy and security will be avoided.
Clarifications added in section 5.2.3.:“In particular, the competent national authorities would take into account the availability of the technologies
in their decision to impose a detection order, ensuring the effective application of the obligation to detect. In
the cases in which the technology to detect CSA online was not yet available to be deployed at scale, thelegislation could foresee for the competent authorities the possibility to consider this circumstance whendeciding the start date of application of the detection order on a case by case basis. The EU Centre and theCommission could facilitate the exchange of best practices and cooperation among providers in the
deployment efforts of new technologies.”
In addition: “Also, some providers have already deployed tools that perform content-based detection in thecontext of end-to-end encrypted communications, demonstrating the swift development of technologies inthis area.
The legislative proposal should remain technology-neutral also when it comes to possible solutions to thechallenge of preventing and detecting online child sexual abuse.”3(5) The report should clarify how the options that include an obligation to detect new child sexual abusematerial or grooming would respect privacy requirements, in particular the prohibition of general monitoring
obligations. It should more explicitly explain how the risk-assessment process could identify specific highrisks groups that would be at the basis of more targeted searches.
xReference added in the introduction to section 5.2. on the need to comply with the prohibition of generalmonitoring obligation for all policy options, in particular the legislative ones.

x

Further clarifications added in section 5.2.3. on the risk assessment process (applicable to the detectionof known material, new material and grooming), in particular:“Only a subgroup of the providers required to submit a risk assessment would receive a detection order, basedon the outcome of the risk assessment after proposing mitigating measures. The legislation would list possible
risk factors that the providers should take into account when conducting the risk assessment. In addition, theEU Centre or the Commission could issue non-binding guidelines to support the risk assessment process,after having conducted the necessary public consultations”.
(6) Given the significant differences of options in terms of costs and benefits, the report should better argue
the choice of the preferred option in terms of efficiency and proportionality. It should better substantiate andjustify why it prefers an option that neither provides the highest net benefits nor delivers the anticipated levelof benefits in the most efficient way.
Clarifications added in section 8.3. (trade-offs):“Specifically, the detection of grooming included in option E adds a significant prevention aspect to thisoption, which determines its highest score on effectiveness compared to the other options. Child sexual abusematerial depicts scenes of crimes already committed, and, whereas its detection contains an important
prevention aspect as described in box 1, the detection of grooming focuses on preventing crimes such as
hands-on abuse or sexual extortion. This avoids the short-term and long-term consequences for victims, allof which cannot be numerically quantified.”(7) Differing stakeholder views, including from targeted consultation, should be presented in a moretransparent way throughout the report and especially in the analysis of impacts and the selection of thepreferred option. It should be clear who has said what, and how concerns have been taken into account, inparticular where views by category of stakeholders differ. The focus should not be on majority views, as theconsultations are not a representative survey.
The stakeholder consultation boxes have been reviewed throughout the report, in particular to ensure that they
do not explicitly refer to majority views.
(8)
The report elaborates some mitigation measures for SMEs e.g. access to training and to free detection
technologies, and the support from the centre for the verification of illegality of the reported material.
However, the impacts section should better outline the measures from which SMEs will not be exempted,
quantify their costs and elaborate on possible barriers to entry.
Annex 11 on the SME test in section 3 has been revised to highlight the above:“SMEs will be subject to the same obligations as larger providers. As the report indicates, they are particularly
vulnerable to exploitation of illegal activities, including CSA, not least since they tend to have limited
capacity to deploy state-of-the-art technological solutions to detect CSAM or specialised staff. Even thoughcompanies may have unequal resources to integrate technologies for the detection of CSAM into theirproducts, this negative effect is outweighed by the fact that excluding them from this obligation would createa safe space for child sexual abuse and therefore defeat the purpose of the proposal.
The implementation of technologies for the detection of such abuse may create new barriers and present aburden to SMEs. While the EU Centre would make technologies available to SMEs without charge, thecontinuous operation of those technologies could also lead to increased costs. SMEs would also experience4

an increased burden in relation to ensuring the appropriate human resources for the process of detection,
reporting and removal of CSA online, including responding to follow-up requests from law enforcement
authorities. The additional costs would imply that SMEs might have less funds at their disposal for researchand innovation, increasing their competitive disadvantage towards large companies.
It is not possible to quantify exactly these costs since they would depend on the level of abuse that they would
be exposed to. And this depends on the services they offer, and whether the degree to which they can besubject to effective and efficient mitigation measures, rather than the size of the company. For example, aSME with a small number of employees may offer a service with millions of users, which is particularly prone
to be misused for CSA online, whereas a larger company may offer relatively niche services where thepossibilities of misuse to commit CSA online are very limited.”(9)
The report should explain better its approach to the ‘one in, one out’ principle. It should clarify what
exact costs and savings are included in quantification for one in, one out purposes, making sure that only
administrative cost savings are taken into account for offsetting and that administrative costs are identified.
It should also further elaborate on how the estimates were calculated. It should be more explicit on theexpected significant adjustment costs for business under the preferred option in the section on the applicationof the one in, one out approach.
Clarifications have been added to section 8.4., including on the adjustment costs for businesses under thepreferred option. Also, administrative costs have been identified: “The preferred option also creates
administrative costs for service providers and administrations. These are costs that result of administrative
activities performed to comply with the administrative obligations included in the proposed legislation. They
concern costs for providing information, notably on the preparation of annual transparency reports.”
Annex 3 has been reviewed accordingly, including the table with the overview of costs under the preferred
option (also updated with highlights below). The administrative costs have been estimated at 5% of the totalcosts, with the rest being adjustment costs. Only the administrative costs savings have been taken foroffsetting (estimated at 5% of the total costs under measure 4 on voluntary detection, as described in Annex
3).
(10) Annex 1 of the Impact Assessment should be further elaborated to indicate how the recommendations
made by the Regulatory Scrutiny Board in both opinions have been treated and considered.
Annex 1 has been reviewed accordingly, notably adding a dedicated table to detail how the report and annexes
have been updated to incorporate the comments from the second opinion.

The Board notes the estimated costs and benefits of the preferred option(s) in this initiative, as summarisedin the attached quantification tables.

5EUROPEAN COMMISSION
Regulatory Scrutiny BoardBrussels,
RSBOpinionTitle: Impact assessment / Regulation on detection, removal and reporting of childsexual abuse online, and establishing the EU centre to prevent and counter childsexual abuse
Overall opinion: NEGATIVE(A) Policy context
Child sexual abuse (CSA) is a particularly serious crime that has serious life-longconsequences for victims. The exponential development of the digital world makes this crimea truly global one.
The aim of this initiative is to establish an obligation for relevant online service providers todetect child sexual abuse online, to report this to the public authorities and to remove therelevant content. It also explores the option of creating a European centre to prevent andcounter child sexual abuse.
This initiative follows up on the CSA strategy adopted in July 2020.

(B) Summary of findings
The Board notes the additional information provided in advance of the meeting and thecommitments to make changes to the report.
However, the Board gives a negative opinion, because the report contains the following
significant shortcomings:(1) The internal market dimension and the necessity for EU action in the area ofprevention and victim support is not always clear.
(2) The report does not fully describe all the available policy choices and leaves anumber of questions open. It does not discuss in a transparent and balancedmanner the alternative implementation forms for a European centre.
(3) The report does not clearly establish how safeguards will ensure fundamental
rights, in particular regarding technologies to detect CSA in encryptedcommunications.
(4) The comparison of policy options does not comply with the standard assessment
criteria and is not based on a clear and consistent ranking methodology.

9(C) What to improve(1) The context section does not present clearly enough how the initiative builds on andinteracts with related policy instruments (e.g. CSA Directive, Prevention Network, Digital
Services Act, interim derogation), and how the CSA responsibilities are distributed between
the EU and the Member States. The baseline should fully integrate what these other instruments
can achieve for the detection, removal and reporting of CSA material as well as for prevention
and victim support.
(2) The report should further elaborate the internal market dimension of this initiative andprovide clear evidence of fragmentation and conflicts of law. It should better explain why theseissues cannot be adequately tackled on the basis of existing policy instruments. It should better
argue why EU action is needed for prevention and support of victims in addition to theresponsibilities already established at Member State level and to existing coordination
mechanisms.
(3) The report should clearly identify the key issues for which policy choices need to be made.
It should provide in its main part a full and open discussion of the main implementation options
identified for the European centre, including those relying on existing structures (e.g. Europol).
It should assess in a balanced and evidence-based manner their strengths and weaknesses,
including in terms of accountability, independence, transparency, governance andorganisational synergies. As regards non-EU body options (e.g. foundation) the independence
and governance discussion should take into account the fact that part of its funding could
depend on third parties and that its legal status will depend on national provisions of theMember State in which it will be established.
(4) The report should be more precise regarding the nature of safeguards for fundamentalrights. It should also discuss how the proposed obligations to detect CSA material and grooming
would be compatible with the criteria indicated by the Court of Justice for permissible
preventive monitoring.
(5) The report should be more specific and analytical regarding the treatment of technologies
to detect CSA in encrypted communications. The report should assess the coherence with thehorizontal approach on encryption. It should indicate whether and how political oversight on
the use of detection technology will operate, including a discussion of the relevance ofcertification and implementing measures. As technological solutions are not yet available forencryption, the report should be clear how legal uncertainty for obliged service providers andrisks of unintended consequences on privacy and security will be avoided.
(6) The report foresees certain exemptions and mitigation measures for SMEs under thevarious options. These measures should be explained upfront in the options section andthoroughly assessed in the impacts analysis, including how they will affect the operation andthe financing of the centre as well as the competitiveness of SMEs. The report should also
further develop the impact analysis of the measures from which SMEs will not be exempt. It
should quantify their costs and elaborate on possible barriers to entry.
(7) The impact analysis should be clear about the analytical methods and the categories ofcosts and benefits. It should explain data sources, underlying assumptions as well asuncertainties and limitations of the analysis. In particular, it should explain how theextrapolation of a US study to the EU context has been done, how robust its results are for theEU and whether it has been peer reviewed. It should indicate which part of the overall benefits
is due to mandatory obligations and which is due to the centre.
(8) The policy options (both for the EU centre and the service providers) should be comparedon the basis of the standard assessment criteria effectiveness, efficiency and coherence. Thisshould help to avoid assessing the same impacts under several criteria. The comparison of10