============================================================
EDRI-gram
biweekly newsletter about digital civil rights in Europe
Number 5.13, 4 July 2007
============================================================
Contents
============================================================
1. EDRI signs "Keep The Core Neutral" petition
2. Final agreements between EU and USA on PNR and SWIFT
3. OECD pushes for privacy co-operation
4. The Austrian government has postponed the law for data retention
5. Italian officials prepare the law for a DNA database
6. French Internet users are not properly informed on DRM
7. German legislation troubles the big Internet companies
8. ENDitorial : The End of Multilateral Broadcast Treaty
9. Recommended Reading
10. Agenda
11. About
============================================================
1. EDRI signs "Keep The Core Neutral" petition
============================================================
European Digital Rights Initiative (EDRI) has joined more than 100
individuals and organizations from around the world in signing the
petition "Keep The Core Neutral" urging ICANN (Internet Corporation for
Assigned Names and Numbers ) to resist efforts to evaluate applications for
new generic top-level domains (gTLDs) based on non-technical criteria such
as ideas about morality and competing national political objectives.
The "Keep the Core Neutral" coalition is concerned that ICANN's draft policy
includes evaluation criteria that go well beyond technical considerations of
operational stability and security and exceeds the organization's mandate of
technical coordination.
In particular, ICANN is considering policy that would reject applications
for new gTLDs if they violate globally fixed standards on "morality" or
"public order". But the lack of global standards on morality and policy
objectives invites nations with restrictions on free expression to impose
censorship on the entire world by blocking the creation of certain domains.
There is also concern that religious institutions and business competitors
will be allowed to object to new domain name applications based on
non-technical and non-legal criteria.
Creating a precedent for generalized public governance would be
dangerous, as the private corporation does not have a democratic governance
structure that is accountable to the public or that includes protections for
the rights of Internet users.
The proposed policy also threatens to extend unrelated concepts derived from
commercial trademark law onto non-commercial expression, but domain names
are distinct from trademarks in significant ways. Trademark rights only
regulate a particular type of commercial speech, while ICANN policy could
expand trademark restrictions onto non-commercial expression and prevent
online criticism of companies and products.
In a 27 June 2007 workshop at the San Juan ICANN meeting, a distinguished
panel of legal and technical experts addressed these issues including former
ICANN Board Member and attorney Michael Palage, who co-authored a 2006 essay
"Please, Keep the Core Neutral", which served as inspiration for the
coalition's global petition.
Keep The Core Neutral : Global Petition Urges ICANN to Protect Free
Expression and Innovation in Domain Name Policy (30.06.2007)
http://www.keep-the-core-neutral.org/node/26
Global Petition to ICANN Board of Directors: "Keep the Core Neutral"
(11.06.2007)
http://www.keep-the-core-neutral.org/petition
Transcript of Keep the Core Neutral Workshop (27.06.2007)
http://sanjuan2007.icann.org/files/sanjuan/SanJuan-NCUCALACWorkshop-27June07...
============================================================
2. Final agreements between EU and USA on PNR and SWIFT
============================================================
After a long and difficult period of negotiations, on 28-29 June 2007, final
agreements were reached between EU and USA on the data regarding European
financial transactions operated by Belgian consortium SWIFT and on the
passenger name records (PNR) issue respectively.
Regarding the access to financial data from SWIFT, the US has committed to
use any data received from SWIFT exclusively for counter-terrorism purposes,
the data retention period being of 5 years.
SWIFT is also bound to "adequately" protect the privacy of data according to
EU principles as laid out in 2000 and further more, from now on, all banks
using SWIFT will have to inform their customers about any transfers of their
data.
According to a spokesman for Commission Vice-President Franco
Frattini, an "agreement had been reached on the substance of the new
Passenger Name Records (PNR) system, with only technical details and EU
national parliaments' opinion still to be resolved". The agreement will
replace the interim agreement due to expire at the end of July 2007.
Both sets of negotiations resulted in the EU having obtained the power to
inspect US investigators' use of European data. The EU has insisted on this,
considering that US privacy laws would not protect European citizens' data
from being abused. However, according to Gus Hosein from Privacy
International, the EU won only limited oversight over the US use of PNR
data.
The PNR agreement reduced the number of pieces of data that can be collected
by the US authorities from 34 pieces to 19, including name, contact
information, payment details, travel agency, itinerary and baggage
information, but excluding sensitive data such as ethnicity.
The US will be allowed to store the data for a seven year period under an
"active" or "operational" regime and can extend this period by 8 years for
"dormant" data which would be accessible under stricter rules. This means a
15 year storage period in total as compared to three years as previously
agreed. The EU officials however state that the agreement has more
safeguards than before.
In a letter to the German interior minister Wolfgang Schauble, the European
Data Protection Supervisor Peter Hustinx has still shown concern believing
that the privacy rights of air passengers between the EU and US will be
threatened by the agreement struck on 29 June.
A good point is that, for the first time, EU citizens will also be covered
by the US Privacy Act which means they can enforce their rights in US
courts. The new PNR system deal must be ratified by national parliaments
before taking effect as expected at the end of July 2007.
But the PNR data started to look interesting also for the European
officials. Just a few days after the car bomb attack in Glasgow and London,
the commissioner Franco Frattini announced that he would propose in October
a new draft containing anti-terrorism measures, including creating a
European PNR system. In this way, the airlines flying to the EU would be
obliged to share passengers private data with Europe's secret services. It
is not clear yet if the scheme will cover intra-European flights.
Draft text - PNR Agreement (28.06.2007)
http://www.statewatch.org/news/2007/jul/eu-usa-pnr-agreement-2007.pdf
EU-US data-sharing deals renew privacy concerns (29.06.2007)
http://www.euractiv.com/en/security/eu-us-data-sharing-deals-renew-privacy-c...
EU legitimises US travel and bank data snoops (28.06.2007)
http://euobserver.com/22/24384
US gives in to EU demands over data (29.06.2007)
http://www.theregister.co.uk/2007/06/29/us_eu_data_use/
Europe's banks must inform customers of US snooping (27.06.2007)
http://www.theregister.co.uk/2007/06/27/swift-disclosure_rules_for-european_...
New PNR Agreement with the United States of America - Peter Hustinx letter
to the German Minister of Interior (27.06.2007)
http://www.statewatch.org/news/2007/jun/eu-us-pnr-hustinx-letter.pdf
Air passengers to face EU anti-terror screening (4.07.2007)
http://www.euractiv.com/en/transport/air-passengers-face-eu-anti-terror-scre...
EU plans air passenger data exchange system (3.07.2007)
http://euobserver.com/9/24416
============================================================
3. OECD pushes for privacy co-operation
============================================================
A new framework has been agreed by the 30 members of OECD (Organisation for
Economic Co-operation and Development) regarding the co-operation in the
enforcement of privacy laws, updating a 27 year old statement (OECD
Guidelines on the Protection of Privacy and Transborder Flows of Personal
Data).
The large volume of the data being exchanged across borders and the changes
in the character of these exchanges having increased the risks to privacy
for individuals have brought up the need for a better co-operation between
authorities in charge with data protection.
The framework, included in the new OECD Recommendation on Cross-Border
Co-operation in the Enforcement of Laws Protecting Privacy, developed by the
OECD Committee for Information, Computer and Communications Policy (ICCP),
through its Working Party on Information Security and Privacy (WPISP), shows
the commitment of the governments to improve their national privacy
legislation to allow co-operation and mutual assistance among each other for
an efficient enforcement of privacy laws.
"A consensus has emerged on the need to promote closer co-operation among
privacy law enforcement authorities to help them exchange information and
carry out investigations with their foreign counterparts," says the
recommendation which also reads: "Globalisation, the emergence of 'follow
the sun' business models, the growth of the internet and falling
communication costs dramatically increase the amount of personal information
flowing across borders. This increase in transborder information flows
benefits both organisations and individuals by lowering costs, increasing
efficiency and improving customer convenience. At the same time, these
personal information flows elevate concerns about privacy, and present new
challenges with respect to protecting individuals' personal information."
OECD has developed two model forms to facilitate the co-operation: one to
assist in the creation of a list of contact points in each country to
co-ordinate requests for assistance and another one to be used by an
authority in requesting assistance.
The recommendation will be introduced at regional events and at the 29th
International Conference of Data Protection and Privacy Commissioners that
will be hosted in September 2007 in Montreal by Commissioner Jennifer
Stoddart Privacy Commissioner of Canada who also conducted the work on the
development of the framework.
OECD Recommendation on Cross-border Co-operation in the Enforcement of Laws
Protecting Privacy - Press release
http://www.oecd.org/document/60/0,3343,en_2649_34223_38771516_1_1_1_1,00.htm...
OECD Recommendation on Cross-border Co-operation in the Enforcement of Laws
Protecting Privacy - full text
http://www.oecd.org/dataoecd/43/28/38770483.pdf
Net growth prompts privacy update (30.06.2007)
http://news.bbc.co.uk/2/hi/technology/6254650.stm
International effort on privacy protection is launched (26.06.2007)
http://www.out-law.com//default.aspx?page=8182
============================================================
4. The Austrian government has postponed the law for data retention
============================================================
A spokesman of the Federal Ministry of Transport, Innovation and
Technology has confirmed that due to the flood of responses to the law
proposal there is no way to have data retention ready before the
deadline set by the directive.
The ministry received a total of 90 statements from various organisations.
Most of them voiced severe concerns about the suggested implementation of
data retention. The supporters were various bodies of the entertainment
industry, demanding longer retention periods and a lower threshold. They
demanded extending access to retained data for violations of copyright, by a
law that is being implemented to help fight terrorism.
The ministry needs to process all those statements in a diligent way and
it will do so, even if the EU issues a caution against the Republic of
Austria. Furthermore there have been talks with the Ministry of Justice
to embed data retention in the criminal law concerning the degree of penalty
and periods. The criminal law has already exemptions for lawyers,
physicians, journalists and other groups of society handling highly
sensitive personal data. The retention period of six months both for
telephone and Internet traffic data was not questioned. More results of
these talks will be due in Autumn after the summer break.
The background to this turnaround is that a general aversion against data
retention has been growing in Austria, and the resistance is pretty
broad. Hardly anybody turns up in Austrian public to express support for
this measure. The Austrian Chambers of Commerce and Labour both oppose
data retention. Those bodies, called "social partnership", are the
pillars of real political life representing small and middle businesses
(Conservatives) and Labour. Even the federal Chancellor's office
expressed concerns about a possible violation of Austria's constitution.
Various academic institutions stepped in as well. All quoted bodies are
more or less closely related to one of the two big political parties.
The discussion here started very late, as it took print and TV media
journalists quite a long time to understand what data retention of
network traffic data could mean for their jobs in general. During the month
of June the topic was covered by all Austrian media - late, but better than
never.
AT: Data Retention gets delayed until Autumn (only in German, 28.06.2007)
http://www.quintessenz.org/d/000100003888
Quintessenz doqubase about data retention
http://quintessenz.org/data_retention
The Truth about the Costs for Data Retention (only in German, 29.06.2007)
http://futurezone.orf.at/it/stories/203760/
Data Retention Delayed (only in German, 28.06.2007)
http://futurezone.orf.at/it/stories/203295/
Data Retention in Austria arrives later (only in German, 28.06.2007)
http://www.heise.de/newsticker/result.xhtml?url=/newsticker/meldung/91913
(Contribution by EDRI-member quintessenz.org - Austria)
============================================================
5. German legislation troubles the big Internet companies
============================================================
Yahoo and Google seems to have problems adapting their business to the tough
requirements of the German law regarding content harmful to minors and the
implementation of the data retention directive, respectively.
Yahoo has recently changed the way the content filter setting for its
photo-sharing service Flickr works for German members so that they can't
view photos labelled as "moderate" or "restricted" via the search function.
This caused a lot of complaints from German users, that created special
groups on the platform such as Against Censorship! Also they started
uploading anti-Flickr pictures in the Yahoo photo sharing service and tag
them as "thinkflickrthink".
In the end Flickr allowed the German users to turn SafeSearch off to allow
photos flagged as 'moderate' and tried to explain the situation.
"Flickr's intent is never to censor content, but rather to comply with
local legal restrictions. In Germany, local law (Jugendmedien-Staatsvertrag
JMStV) requires stringent age verification in order to display online
content that could be considered harmful to minors." explained Flickr's
co-founder Stewart Butterfield.
Community Manager, Heather Champ added : "The central problem is that
Germany has much more stringent age verification laws than its neighbouring
countries," she said. She described the risks of breaking these laws as
being punished with "much harsher penalties, including jail time, for those
with direct responsibility."
The German draft law for the implementation of the data retention directive
also raises problems with the online service providers. The draft foresees
that providers of e-mail services will basically have to keep records of the
following: the user's IP address for each e-mail sent and for each access to
the inbox as well as the sender's network ID for every e-mail received.
According to an interview to the German economics magazine Wirtschaftswoche,
Peter Fleischer, Google privacy counsellor considered the draft law as "a
severe blow to privacy " and praised the possibility to have anonymous email
accounts.
According to Heise he also declared that : "If need be we will simply switch
off Google Mail in Germany", but this was later considered as a
misinterpreted quote, and the correct statement was :
"We think that this law is bad for users and bad for privacy on the
Internet. Google believes that users should have the right to create an
email account without going through the hassle of having to prove exactly
who they are. Anonymous email is particularly important for political
dissidents, for example." Google also hoped that the German federal
government will change its plans in this respect.
User protests against and Yahoo's justification for filters at Flickr
(18.06.2007)
http://www.heise.de/english/newsticker/news/91279
Against Censorship! at Flickr
http://www.flickr.com/groups/againstcensorship/
(Official Topic) German SafeSearch settings (20.06.2007)
http://www.flickr.com/help/forum/en-us/43626/
Google threatens to shut down e-mail service in Germany (25.06.2007)
http://www.heise.de/english/newsticker/news/91681
Lost In Translation: German Gmail Stays Put (27.06.2007)
http://blog.wired.com/business/2007/06/lost-in-transla.html
EDRI-gram: Data retention and increased surveillance in Germany (25.04.2007)
http://www.edri.org/edrigram/number5.8/germany-data-retention
============================================================
6. French Internet users are not properly informed on DRM
============================================================
The UFC- Que Choisir association has revealed the results of an online study
performed in February 2007 regarding the use of DRM (Digital Rights
Management) systems imposing third-party restrictions on the users of a
reading device.
The poll has shown that most French Internet users have not been properly
informed on the restrictions that DRM systems involve and that they
definitely would like these technical protections out.
The poll covered about 800 Internet users that had already bought music
online. Out of these, 51% stated they had never been informed on the usage
restrictions that DRM imposes and 65% of them thought they could listen to
the music they had legally bought on any device without any constraints. 72%
of the iPod users had no idea they could listen on their devices only music
bought on iTunes.
According to the study, 20% of the respondents have already experienced the
situation of buying music online that they could not listen to on the
devices they had. Most respondents (about 90%) consider it is very important
to be able to use any kind of device to read the music they buy.
UFC-Que Choisir association asks from the French Government to revise the
so-called DADVSI law in order "to refuse the producers the unilateral
freedom to impose DRM contrary to the basic consumers' rights".
UFC-Que Choisir's main preoccupation is interoperability for the consumers.
"The musical world can very well live without the DRM. Even better" said
Edouard Barreiro, in charge with new technologies within the association.
"If the legislator cannot interdict the use of DRM, the industry should at
least be imposed to use at least a unique DRM format to provide the
interoperability".
Some of the music distribution companies such as EMI group or Universal have
already started having initiatives of providing DRM free music online. As
Denis Olivennes, owner of Fnac commercial website, stated: A non-restricted
title is sold twice a DRM bound one.
The Internet users do not know DRM well (only in French, 26.06.2007)
http://www.01net.com/editorial/352653/les-internautes-connaissent-mal-les-dr...
Music : the consumer does not want DRM (only in French, 28.06.2007)
http://www.clubic.com/actualite-75858-musique-consommateur-drm.html
DRM: the consumers do not want restrictions (only in French, 27.06.2007)
http://www.ecrans.fr/spip.php?article1656
EDRI-gram:France establishes the DRM-regulation authority (12.04.2007)
http://www.edri.org/edrigram/number5.7/drm-authority-france
============================================================
7. Italian officials prepare the law for a DNA database
============================================================
Italy is preparing its DNA database law, claiming that it needs
harmonization with the other European states situation, but forgetting about
the privacy concerns. According to col. Luciano Garofano from RIS (Reparti
Investigazioni Scientifiche), it is not very long until the law allowing
archiving DNA data will be in place.
In Garofano's opinion, Italy is actually one of the last to have a
legislation in the domain and the problem is that although Italy has signed
the Pr|m treaty to exchange data, it has no data to exchange.
The colonel believes that Italy needs this database that would be efficient
in identifying criminals as well as innocent people. Experts however fear
that there is a risk of theft of genetic data that could be used abusively
as well as of the possibility of relying too much on this database ignoring
checks of various typologies and sources.
Garofano believes advantage should be taken of the new technologies and data
privacy issues should not stand in the way of security. He thinks privacy
should not be a justification not to draft a law that would be for the
security of the Italian citizens.
A draft law has already been made by the National Committee for Biosecurity,
Biotechnology and Life Science (Comitato Nazionale per la Biosicurezza, le
Biotecnologie e le Scienze della Vita), a draft that stipulates the
gathering of data from those that have infringed the law and might face more
than 3 years of imprisonment as well of those that are imprisoned.
"A law is absolutely necessary but it must be evaluated with extreme
caution. It is a good think that the gathered data is based on
alphanumerical sequence and not on biological samples" said Francesco
Pizzetti, the president Italian Data Protection Authority (Garante per la
protezione dei dati personali). He also expressed the hope that the
authority's experience would be taken into consideration and that the
Parliament would listen to the opinions of the Authority.
Italy - ready for the Big Genetic Database (only in Italian, 29.06.2007)
http://punto-informatico.it/p.aspx?i=2029006
============================================================
8. ENDitorial : The End of Multilateral Broadcast Treaty
============================================================
The summer special session of United Nation's World Intellectual
Property Organization's (WIPO) Standing Committee on Copyright and
Related rights (SCCR) ended with an outcome that effectively killed the
proposed treaty for protection of broadcast organisations (Broadcast
Treaty). The committee called off the Diplomatic Conference that was
supposed to take place in November to approve the treaty. Even if the
treaty remains on the agenda of SCCR, it is unlikely that there will be
any serious push to overcome the vastly different positions on key
issues relating to objectives, scope and object of protection.
There were several reasons for this outcome. The treaty was unwanted by
many countries. The United States lost interest after webcasting was
removed from the scope of the treaty and - perhaps more importantly -
after the US technology and telecommunication industries made their
opposing position loudly known. There was also disagreement within the
North American Broadcasters' Association. This left the EU and Japan in
a much weaker position against the countries known as "Friends of
Development", who saw little use in new property rights for broadcasters
but instead considered the treaty as an opportunity to inject new
elements such as competition, access to knowledge and cultural diversity
into the global copyright regime.
The second reason was spirited opposition by the rest of the
stakeholders (i.e. other than broadcasters) against the treaty. In
particular the organizations representing civil society constantly asked
questions about the rationale of the treaty and brought transparency to
the process by transcribing the discussions during the plenary sessions.
This exposed in almost real-time the lack of any real substance to the
proponents' arguments.
One can also speculate on the role of the long-time chairman of the
committee, Jukka Liedes, in the demise of the treaty. It became widely
known that he and Mr. Tilman L|der (who represents the European
Commission) did not agree on a strategy (or much else for that matter).
Mr. Liedes also took many times positions that were seen as detached
from the reality of the committee as he tried to push the treaty to the
Diplomatic Conference. Still, the outcome of the negotiations was always
likely to be a failure because of the divergent political situation on
global IP policy.
The big question now is what the outcome will mean for WIPO and SCCR. A
rather direct hint could be found from this comment by Tom Rivers, external
legal adviser to the Association of Commercial Television in Europe (ACT):
"If Wipo is not the right forum for this issue to be addressed then
broadcasters will need to raise (their) concerns at regional or bilateral
level instead".
So, in practice the broadcasters will try to use the sympathy of European
Commission civil servants to advance their agenda by forcing the
developing countries to accept extensive "investment protection clauses"
to their bi-lateral trade agreements. This will be a key issue for EDRI.
Finally, a more fundamental question must asked. Why are these kinds of
investment protection schemes, which have nothing to do with creativity
or culture, dealt with under the copyright system in the first place? It
unfortunately seems that the so-called related rights have become a
sweet spot for blatant corporate rent seeking. The European Commission
seems to accept all kinds of demands from the stakeholders without the
merest hint of economic justification. Even when their own studies find
clear evidence that these types of protection are harmful (such as with
the sui generis database right), there is no reaction on their part.
Isn't it time that European IP policy was based on economic evidence
rather than the interests of a small number of large right holders?
Second Special Session of the Standing Committee on Copyright and Related
Rights (SCCR) (18-22.06.2007)
http://www.wipo.int/meetings/en/details.jsp?meeting_id=12744
Piracy collapses broadcasting treaty (24.06.2007)
http://uk.biz.yahoo.com/24062007/399/piracy-collapses-broadcasting-treaty.ht...
EDRI-gram: Results of the WIPO's SCCR Special Session 1 (31.01.2007)
http://www.edri.org/edrigram/number5.2/wipo_sccr1
EFF's resource page on the WIPO Broadcasting Treaty
http://www.eff.org/IP/WIPO/broadcasting_treaty/
Some NABA (North American BroadcastersAssociation) members opposed the
treaty (20.06.2007)
http://lists.essential.org/pipermail/a2k/2007-June/002418.html
(Contribution by Ville Oksanen - EDRI-member Electronic Frontier Finland)
============================================================
9. Recommended Reading
============================================================
Findings of the Open Rights Group Election Observation Mission in Scotland
and England
The Open Rights Group (ORG) believes that the problems observed at the
English and Scottish elections in May 2007 raise serious concerns regarding
the suitability of e-voting and e-counting technologies for statutory
elections. E-voting is a 'black box system', where the mechanisms for
recording and tabulating the vote are hidden from the voter. This makes
public scrutiny impossible, and leaves statutory elections open to error and
fraud.
http://www.openrightsgroup.org/e-voting-main/
http://media.ito.com/kevinmarks/org_election_report.pdf
Article 29 Working Party Opinion 4/2007 on the concept of personal data
(20.06.2007)
http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2007/wp136_en.pdf
============================================================
10. Agenda
============================================================
6 July 2007, EU
Two years anniversary of the rejection of the software patents directive
http://www.free765.eu/
8 May - 22 July 2007, Austria
Annual decentralized community event around free software lectures,
panel discussions, workshops, fairs and socialising
http://www.linuxwochen.at
8-12 August 2007, near Berlin, Germany
Chaos Communication Camp 2007
"In Fairy Dust We Trust!"
http://events.ccc.de/camp/2007/
5-11 September 2007, Linz, Austria
Ars Electronica Festival - Festival for Art, Technology and Society
http://www.aec.at/en/festival2007/index.asp
21 September 2007, Amsterdam, Netherlands
Bits of Freedom organizes the 5th Dutch Big Brother Awards
Nominations can be sent to info at bigbrotherawards.nl until the end of
August.
http://www.bigbrotherawards.nl/
25 September 2007, Montreal, Canada
Civil Society Workshop: Privacy Rights In A World Under Surveillance
A one-day workshop organized by the International Civil Liberties Monitoring
Group (ICLMG) in cooperation with Canadian and international civil rights
and privacy organizations ahead of the 29th International Conference of Data
Protection and Privacy Commissioners in Montreal.
http://www.thepublicvoice.org/events/montreal07/default.html
25-28 September 2007, Montreal, Canada
29th International Conference of Data Protection and Privacy Commissioners
http://www.privacyconference2007.gc.ca/Terra_Incognita_home_E.html
12-15 November 2007, Rio de Janeiro, Brazil
The Government of Brazil will host the second Internet Governance Forum
meeting.
http://www.intgovforum.org/
http://cgi.br/igf/
============================================================
11. About
============================================================
EDRI-gram is a biweekly newsletter about digital civil rights in Europe.
Currently EDRI has 25 members from 16 European countries.
European Digital Rights takes an active interest in developments in the EU
accession countries and wants to share knowledge and awareness through the
EDRI-grams. All contributions, suggestions for content, corrections or
agenda-tips are most welcome. Errors are corrected as soon as possible and
visibly on the EDRI website.
Except where otherwise noted, this newsletter is licensed under the
Creative Commons Attribution 2.0 License. See the full text at
http://creativecommons.org/licenses/by/2.0/
Newsletter editor: Bogdan Manolea