WRITTEN QUESTION E-0718/02

by Erik Meijer (GUE/NGL) to the Commission

(15 March 2002)

Subject: Obligatory collection of information on users by Microsoft.NET Passport and measures to protect their privacy

1. Is the Commission aware of Microsoft's free NET Passport service, which, while consumers are engaged in a purchase, a game, a request or a bank transaction on line, is designed continually to collect their personal information via for instance, an e-mail address (Hotmail), a chat programme (MSN Messenger), a shop (Expedia.com), an auction site (QXL), a community (MSN Communities) or a hotel chain (Hilton.com) and that, as a result, a vast quantity of personal information is surreptitiously passed on to unknown parties by, in particular, Hotmail address owners without their noticing it?

2. Is the Commission also aware that failure to register with NET Passport results in exclusion from many sites' services, that unsubscribing is not possible, that periodically only out-of-date information is removed and that the passwords to be given (minimum of six characters only) are easily accessible, to some extent, to others posing as system administrators or possessing considerable knowledge of dictionaries?

3. Does the Commission regard it as acceptable that users of public terminals in universities, libraries or Internet cafes who fail to log off correctly may pass on their confidential information to the next user, that to hire software via the Internet (using Microsoft servers instead of a personal hard disk) access is possible only via NET Passport, and that, because of a de facto monopoly, Microsoft may shortly charge a high price for what are still for the time being free services?

4. Is it lawful for a dominant firm to build up a very extensive database of personal information? Is NET Passport registered with national agencies supervising the application of privacy legislation? Is registration mandatory in every Member State? Does such a requirement also apply where the database is not located on the territory of an EU Member State?

5. Can national or European criminal investigators make use of the information collected without prior consent of the individuals concerned or the courts?

6. According to the Commission, is there any call for further regulation in order to make abuses by interested parties or subversion of current privacy rules impossible?

Answer given by Mr Bolkestein on behalf of the Commission

(7 May 2002)

1. to 3. The Commission is indeed aware of Microsoft's NET Passport system and of its alleged capabilities and shares some of the Honourable Member's concerns. It is looking into this as a matter of priority, in concertation with national data protection authorities, as regards the system's compatibility (or not) with EU data protection law.

4. A company operating in the Union is subject to Community law and may build up a database of personal information, provided the obligations laid down in Directive 95/46/EC of the Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(1) are respected. These include having a specific, legitimate purpose, informing the individual of identity of the controller of the data, of the purpose of collection and the rights individual has, such as the right to access his/hers own personal data. In cases where consent for processing is required, the Directive requires that it be unambiguous and freely given. The Directive also lays down the obligation to notify such processing operations to national data protection authorities. But the directive also provides for some exemptions from the notification obligation. The Commission is not at present in a position to say whether this processing operation has been notified within the Community.

The question of whether and to what extent the Directive applies to a data base (or in the terms of the Directive a data controller) located outside the Union, especially where data is collected directly from data subjects via the Internet, is a complex one which the Commission and national data protection authorities are at present examining carefully. Article 4.1(c) of the Directive provides for its application where a controller makes use of equipment, automated or otherwise, situated on the territory of a Member State, which means that the Directive does at least in some cases apply to controllers outside the Community. Furthermore specific national rules concerning a third country in which the controller is established may also apply and be enforceable within that jurisdiction. In this respect, Microsoft has notified the US Department of Commerce that it adheres to a privacy policy that meets the Safe Harbor framework(2).

5. On the basis of legislative measures, criminal investigators can make use of information collected without the prior consent of the individuals concerned or the courts, provided that the rights of defence of the individuals concerned are respected and that the restriction to the right to privacy is strictly necessary for the purpose of the criminal investigation. The information collected during the investigation may moreover only be used to the extent necessary for those purposes.

6. In accordance with Article 33 of the Directive, the Commission is examining the application of Directive 95/46/EC and expects to make a report before the end of the year. The subversion of current rules will be looked into in that context.

(1) OJ L 281, 23.11.1995.

(2) See Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46/EC of the Parliament and of the Council on the adequacy of the protection provided by the Safe Harbor privacy principles and related frequently asked questions issued by the US Department of Commerce, OJ L 215, 25.8.2000.