Council of theEuropean Union
Brussels, 24 November 2020
(OR. en)13084/1/20
REV 1
LIMITEJAI 999
COSI 216
CATS 90
ENFOPOL 314
COPEN 329
DATAPROTECT 131
CYBER 239
IXIM 122
NOTE
From:
To:

Presidency
Delegations

No. prev. doc.:

12863/20

Subject:

Council Resolution on Encryption- Security through encryption and security despite encryption

Delegations will find in attachment the Council Resolution on Encryption.

13084/1/20 REV 1

MH/MP/dk
JAI.1

LIMITE

1ENANNEX
Council Resolution on Encryption
Security through encryption and security despite encryption1.

Preamble: Security through encryption and security despite encryption

The European Union fully supports the development, implementation and use of strong encryption.
The European Union underlines the need to ensure full respect for fundamental and human rights
and the rule of law in all actions relating to this resolution, online as well as offline. Encryption is anecessary means of protecting fundamental rights and the digital security of governments, industry
and society. At the same time, the European Union needs to ensure the ability of competentauthorities in the area of security and criminal justice, e.g. law enforcement and judicial authorities,
to exercise their lawful powers, both online and offline protecting our societies and citizens.
According to the European Council conclusions of 1-2 October 2020 (EUCO 13/20), the EU willleverage its tools and regulatory powers to help shape global rules and standards. It was agreed
that funds under the Recovery and Resilience Facility would be used to advance objectives such asenhancing the EUʼs ability to protect itself against cyber threats, to provide for a securecommunication environment, especially through quantum encryption, and to ensure access to datafor judicial and law enforcement purposes.

13084/1/20 REV 1
ANNEX

MH/MP/dkJAI.1

LIMITE2EN2.

Current use/state of encryption

In today’s world, encryption technology is increasingly used in all areas of public and private life. It
is a means to protect individuals, civil society, critical infrastructures, media and journalists,industry and governments by ensuring the privacy, confidentiality, data integrity and availability ofcommunications and personal data: it is evident that all parties benefit from encryption technology.
Encryption has been identified by EU data protection and cybersecurity authorities as an important
tool contributing for instance to the protection of personal data transferred outside the EU but
subject to the requirement of an essentially equivalent level of protection, which according to theCourt of Justice is a legal requirement for data transfers1. Not only are electronic devices andapplications increasingly programmed to encrypt stored user data by default, but more and morecommunication channels and data storage services are also secured by end-to-end (E2E) encryption.
This is positively reflected in an increasing response by the communication and applicationindustry, where the majority of instant messaging apps and other online platforms have also
implemented end-to-end encryption.
3.

Challenges for ensuring security"Digital life’" and cyberspace not only present great opportunities, but also considerable challenges:
the digitalisation of modern societies brings with it certain vulnerabilities and the potential for
exploitation for criminal purposes. Thus criminals can include readily available, off-the-shelfencryption solutions designed for legitimate purposes in their modi operandi2.
At the same time law enforcement is increasingly dependent on access to electronic evidence toeffectively fight terrorism, organised crime, child sexual abuse (particularly its online aspects), as
well as a variety of other cybercrime and cyber-enabled crimes. For competent authorities, access toelectronic evidence can be essential, not only to conduct successful investigations and thereby bringcriminals to justice, but also to protect victims and help ensure security.

12Judgment of 16 July 2020 in Case C-311/18, Data Protection Commissioner v Facebook
Ireland Ltd, Maximillian Schrems, ECLI:EU:C:2020:559:
iOCTA 2020, p. 25

13084/1/20 REV 1
ANNEX

MH/MP/dk
JAI.1

LIMITE3EN

However, there are instances where encryption renders access to and analysis of the content ofcommunications in the framework of access to electronic evidence extremely challenging orpractically impossible despite the fact that the access to such data would be lawful. Independentlyof the technological environment of the day, it is therefore essential to preserve the powers ofcompetent authorities in the area of security and criminal justice through lawful access to carry out
their tasks, as prescribed and authorised by law. Such laws providing for the enforcement powers
must always fully respect due process and other safeguards, as well as fundamental rights, inparticular the right to respect for private life and communications and the right to the protection of
personal data.
4.

Striking a right balance

The principle of security through encryption and security despite encryption must be upheld in its
entirety. The European Union continues to support strong encryption. Encryption is an anchor ofconfidence in digitalisation and in protection of fundamental rights and should be promoted anddeveloped.
Protecting the privacy and security of communications through encryption and at the same time
upholding the possibility for competent authorities in the area of security and criminal justice tolawfully access relevant data for legitimate, clearly defined purposes in fighting serious and/ororganized crimes and terrorism, including in the digital world, and upholding the rule of law, areextremely important. Any actions taken have to balance these interests carefully against theprinciples of necessity, proportionality and subsidiarity.
5.

Joining forces with the tech industry

Moving forward, the European Union strives to establish an active discussion with the technology
industry, while associating research and academia, to ensure the continued implementation and useof strong encryption technology. Competent authorities must be able to access data in a lawful andtargeted manner, in full respect of fundamental rights and the relevant data protection laws, while
upholding cybersecurity. Technical solutions for gaining access to encrypted data must comply withthe principles of legality, transparency, necessity and proportionality including protection ofpersonal data by design and by default.

13084/1/20 REV 1
ANNEX

MH/MP/dk
JAI.1

LIMITE

4EN

Since there is no single way of achieving the set goals, governments, industry, research andacademia need to work transparently together to strategically create this balance.
6.

Regulatory framework

The need to develop a regulatory framework across the EU that would allow competent authorities
to carry out their operational tasks effectively while protecting privacy, fundamental rights and thesecurity of communication could be further assessed.
Potential technical solutions will have to enable authorities to use their investigative powers which
are subject to proportionality, necessity and judicial oversight under their domestic legislation,
while respecting common European values and upholding fundamental rights and preserving theadvantages of encryption. Possible solutions should be developed in a transparent manner incooperation with national and international communication service providers and other relevant
stakeholders. Such technical solutions and standards – and the fast development of technology in
general – would also require continually improving the technical and operational skills andexpertise of competent authorities to effectively address the challenges of digitalisation in theirwork on a global scale.
7.

Innovative investigative capabilities

Finally, it is of paramount importance to improve the coordination at EU level aimed at:1) combining the efforts of all Member States and EU institutions and bodies;
2) defining and establishing innovative approaches in view of new technologies;
3) analysing appropriate technical and operational solutions; and4) providing tailored high quality training.
Technical and operational solutions anchored in a regulatory framework built on the principles oflegality, necessity and proportionality should be developed in close consultation with service
providers, other relevant stakeholders and all relevant competent authorities, although there should
be no single prescribed technical solution to provide access to encrypted data.
____________________

13084/1/20 REV 1
ANNEX

MH/MP/dk
JAI.1

LIMITE

5EN