Summary of the Opinion of the European Data Protection Supervisor on the Proposal for temporary derogations from Directive 2002/58/EC for the purpose of combatting child sexual abuse online

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2021/C 102/04)

On 10 September 2020, the Commission published a Proposal for a Regulation on a temporary derogation from certain provisions of the ePrivacy Directive 2002/58/EC as regards the use of technologies by number-independent interpersonal communications service providers for the processing of personal and other data for the purpose of combatting child sexual abuse online. The derogation concerns Articles 5(1) and 6 of the ePrivacy Directive in relation to the processing of personal data in connection with the provision of ‘number-independent interpersonal communications services’ necessary for the use of technology for the sole purpose of removing child sexual abuse material and detecting or reporting child sexual abuse online to authorities.

In this Opinion the EDPS provides his recommendations related to the Proposal in response to a formal consultation by the Commission pursuant to Article 42 of Regulation (EU) 2018/1725.

In particular, he notes that the measures envisaged by the Proposal would constitute an interference with the fundamental rights to respect for private life and data protection of all users of very popular electronic communications services, such as instant messaging platforms and applications. Confidentiality of communications is a cornerstone of the fundamental rights to respect for private and family life. Even voluntary measures by private companies constitute an interference with these rights when the measures involve the monitoring and analysis of the content of communications and processing of personal data.

The EDPS wishes to underline that the issues at stake are not specific to the fight against child abuse but to any initiative aiming at collaboration of the private sector for law enforcement purposes. If adopted, the Proposal, will inevitably serve as a precedent for future legislation in this field. The EDPS therefore considers it essential that the Proposal is not adopted, even in the form a temporary derogation, until all the necessary safeguards set out in this Opinion are integrated.

In particular, in the interest of legal certainty, the EDPS considers that it is necessary to clarify whether the Proposal itself is intended to provide a legal basis for the processing within the meaning of the GDPR, or not. If not, the EDPS recommends clarifying explicitly in the Proposal which legal basis under the GDPR would be applicable in this particular case. In this regard, the EDPS stresses that guidance by data protection authorities cannot substitute compliance with the requirement of legality. It is insufficient to provide that the temporary derogation is ‘without prejudice’ to the GDPR and to mandate prior consultation of data protection authorities. The co-legislature must take its responsibility and ensure that the proposed derogation complies with the requirements of Article 15(1), as interpreted by the CJEU.

In order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measures in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse.

Finally, the EDPS is of the view that the five-year period as proposed does not appear proportional given the absence of (a) a prior demonstration of the proportionality of the envisaged measure; and (b) the inclusion of sufficient safeguards within the text of the legislation. He considers that the validity of any transitional measure should not exceed 2 years.

I. INTRODUCTION AND BACKGROUND

1.1 Background

1. On 24 July 2020, the Commission adopted a Communication ‘EU strategy for a more effective fight against child sexual abuse’ ( 1 ) . The Communication notes that as from December 2020, Directive 2002/58/EC of the European Parliament and of the Council (‘the e-Privacy Directive’) ( 2 ) will have an extended scope as a result of the already adopted Electronic Communications Code (‘ECC’) ( 3 ) . The ECC extends the scope of the e-Privacy Directive to over the top (OTT) inter-personal communication services such as messaging services and email. According to the Communication, this would prevent certain companies (in the absence of national legislative measures adopted in accordance with Article 15(1) of the e-Privacy Directive) from continuing their own voluntary measures for detection, removal and reporting of child sexual abuse online ( 4 )

2. On 10 September 2020, the Commission published ( 5 ) a Proposal for an Interim Regulation on the processing of personal and other data for the purpose of combatting child sexual abuse, which provides for a temporary derogation from Article 5(1) and Article 6 of the ePrivacy Directive (‘the Proposal’). The Commission considers that such a derogation is necessary in order to allow current voluntary activities to continue after December 2020. The derogation would concern the processing of personal data in connection with the provision of ‘number-independent interpersonal communications services’ ( 6 ) (e.g., voice over IP, messaging and web-based e-mail services) strictly necessary for the use of technology for the sole purpose of removing child sexual abuse material and detecting or reporting child sexual abuse online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse. The Proposal enumerates a number of conditions for the derogation to be applicable, which will be analysed later in this Opinion.

3. The EDPS was formally consulted by the Commission on 16 September 2020. On 30 September, the Commission launched a public consultation inviting feedback in relation to its Proposal.

1.2 Relationship to Directive 2011/93/EU

4. The EU has previously adopted a comprehensive legal instrument to combat the sexual abuse and sexual exploitation of children and child pornography, namely Directive 2011/93/EU of the European Parliament and of the Council (‘Child Sexual Abuse Directive’) ( 7 )

5. The Child Sexual Abuse Directive establishes minimum rules concerning the definition of criminal offences and sanctions in the area of sexual abuse and sexual exploitation of children and child sexual abuse material. It requires Member States to ensure that inter alia the following intentional conduct, when committed without right ( 8 ) , shall be punishable: — intentionally and knowingly obtaining access, by means of information and communication technology, to child pornography, — distribution, dissemination or transmission of child pornography, — offering, supplying or making available child pornography (9).

6. The Child Sexual Abuse Directive also obliges Member States to take the necessary measures to ensure that certain conduct amounting to solicitation of children for sexual purposes, including by means of information and communication technology, shall be punishable.

7. The Child Sexual Abuse Directive requires Member States to take the necessary measures to ensure the prompt removal of web pages containing or disseminating child pornography hosted in their territory and to endeavour to obtain the removal of such pages hosted outside of their territory as well as to seize and confiscate instrumentalities and proceeds from such offences ( 10 ) . In addition, Member States may take measures to block access to web pages containing or disseminating child pornography towards the Internet users within their territory ( 11 )

8. In 2010, the EDPS issued an own-initiative Opinion on the proposal for a Directive on combating the sexual abuse, sexual exploitation of children and child pornography ( 12 ) . This Opinion contains considerations and recommendations that are also relevant to the Proposal for an Interim Regulation. Where appropriate, the EDPS shall reiterate and/or make reference to his 2010 Opinion.

III. CONCLUSIONS

52. The measures envisaged by the Proposal would constitute an interference with the fundamental rights to respect for private life and data protection of all users of very popular electronic communications services, such as instant messaging platforms and applications. Even voluntary measures by private companies constitute an interference with these rights when the measures involve the monitoring and analysis of the content of communications and processing of personal data.

53. The issues at stake are not specific to the fight against child abuse but to any initiative aiming at collaboration of the private sector for law enforcement purposes. If adopted, the Proposal will inevitably serve as a precedent for future legislation in this field. The EDPS therefore considers it essential that the Proposal is not adopted, even in the form a temporary derogation, until all the necessary safeguards set out in this Opinion are integrated.

54. In the interest of legal certainty, the EDPS considers that it is necessary to clarify whether the Proposal itself is intended to provide a legal basis for the processing within the meaning of the GDPR, or not. If not, the EDPS recommends clarifying explicitly in the Proposal which legal basis under the GDPR would be applicable in this particular case. In this regard, the EDPS stresses that guidance by data protection authorities cannot substitute compliance with the requirement of legality. It is insufficient to provide that the temporary derogation is ‘without prejudice’ to the GDPR and to mandate prior consultation of data protection authorities. The co-legislature must take its responsibility and ensure that the proposed derogation complies with the requirements of Article 15(1), as interpreted by the CJEU.

55. In order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measures in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse.

56. The lack of precise identification of the measures subject to the derogation is likely to undermine legal certainty.

57. Finally, the EDPS is of the view that the five-year period as proposed does not appear proportional given the absence of (a) a prior demonstration of the proportionality of the envisaged measure; and (b) the inclusion of sufficient safeguards within the text of the legislation. He considers that the validity of any transitional measure should not exceed 2 years.

Brussels, 10 November 2020. Wojciech WIEWIOROWSKI

(1) COM(2020) 607 final, https://ec.europa.eu/home-affairs/sites/homeaffairs/files/what-we-do/policies/european-agenda-security/20200724_com-2020-607-commission-communication_en.pdf

(2) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37).

(3) Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast) (OJ L 321, 17.12.2018, p. 36).

(4) COM(2020) 607 final, p. 4. The Communication notes that because the ePrivacy Directive does not contain a legal basis for voluntary processing of content and traffic data for the purpose of detecting child sexual abuse, providers can only apply such measures if based on a national legislative measure, that meets the requirements of Article 15 of the ePrivacy Directive for restricting the right to confidentiality. In the absence of such legislative measures, measures to detect child sexual abuse undertaken by these providers, which process content or traffic data, would lack a legal basis.

(5) COM(2020) 568 final, 2020/0259 (COD), Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC of the European Parliament and of the Council as regards the use of technologies by number-independent interpersonal communications service providers for the processing of personal and other data for the purpose of combatting child sexual abuse online, https://ec.europa.eu/digital-single-market/en/news/interim-regulation-processing-personal-and-other-data-purpose-combatting-child-sexual-abuse

(6) Article 2 (5) EECC defines an ‘interpersonal communications service’ as ‘a service normally provided for remuneration that enables direct interpersonal and interactive exchange of information via electronic communications networks between a finite number of persons, whereby the persons initiating or participating in the communication determine its recipient(s) and does not include services which enable interpersonal and interactive communication merely as a minor ancillary feature that is intrinsically linked to another service’. A ‘number-independent interpersonal communications service’ means an interpersonal communications service which does not connect with publicly assigned numbering resources, namely, a number or numbers in national or international numbering plans, or which does not enable communication with a number or numbers in national or international numbering plans (Article 2(7) ECC).

(7) Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA (OJ L 335, 17.12.2011, p. 1).

(8) The term ‘without right’ allows Member States to provide a defence in respect of conduct relating to pornographic material having for example, a medical, scientific or similar purpose. It also allows activities carried out under domestic legal powers, such as the legitimate possession of child pornography by the authorities in order to conduct criminal proceedings or to prevent, detect or investigate crime. Furthermore, it does not exclude legal defences or similar relevant principles that relieve a person of responsibility under specific circumstances, for example where telephone or Internet hotlines carry out activities to report those cases. Recital (25) of Directive 2011/93/EU.

(9) Article 5(3), 5(4) and 5(5) of Directive 2011/93/EU.

(10) Articles 11 and 25(1) of Directive 2011/93/EU.

(11) Article 25(2) of Directive 2011/93/EU.

(12) Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council on combating the sexual abuse, sexual exploitation of children and child pornography, repealing Framework Decision 2004/68/JHA, 10 May 2010, https://edps.europa.eu/sites/edp/files/publication/10-05-10_child_abuse_en.pdf