============================================================ EDRi-gram biweekly newsletter about digital civil rights in Europe Number 9.15, 27 July 2011 ============================================================ Contents ============================================================ 1. Draft Council conclusions on Net Neutrality 2. EU countries to explain lack of implementation of the Telecoms Package 3. Germany's salaries database bites the dust 4. Slovakia: Court asks website to filter public procurement open data 5. Voluntary agreements on blocking are interfering with human rights 6. Belgium: Francophone press goes out and back in Google Search 7. Britain: Government reneges on DNA privacy promise 8. ENDitorial: Phone hacking and self regulation 9. Recommended Action 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. Draft Council conclusions on Net Neutrality ============================================================ On 15 July 2011, the Council (of the EU Member States) published Draft "Conclusions" (a policy statement) on Net Neutrality. In the document, the Council underlined the need to preserve the open and neutral character of the Internet and established net neutrality as "a policy objective." While this seems - and is - positive at first reading, the document also refers to "affordable and secure high bandwidth communications and rich and diverse content and services" as "an important policy objective" - apparently establishing net neutrality as a somewhat secondary priority. In summary, therefore, the Council indicates its willingness to embrace the concept of "net neutrality" in further regulatory activities without being entirely clear on what status this "policy objective" has in the hierarchy of its communications policy. Nonetheless, the importance of net neutrality for the economy is spelled out in some detail, with the document pointing to the fundamental role of telecommunications and broadband development for investment, job creation and economic recovery. The document points to "the need to maintain the openness of Internet while ensuring that it can continue to provide high-quality services in a framework that promotes and respects fundamental rights such as freedom of expression and freedom to conduct business." This appears to diverge very positively from more extremist and populist views expressed recently about "civilising" the Internet and, in the US environment, experimenting with the fundamental building blocks of the Internet in order to protect the perceived needs of a narrow range of stakeholders. The draft Conclusions take a further step away from this approach when it refers to "the importance of ensuring that users can create, distribute and access content and services of their choice," moving away from the implicit support for policing of content by Internet intermediaries in the OECD Communiqui on Principles for Internet Policy-Making which made repeated references to the right to access "legitimate" content and "legitimate" sharing of information. The biggest challenge facing the Council when seeking to defend this positive approach is the range of demands for Internet intermediaries to interfere with traffic to protect narrow vested interests such as intellectual property owners and the willingness of certain intermediaries to "voluntarily" engage in such interferences as an underhand means of "normalising" interferences by access providers in citizens' communications. It will be increasingly difficult for Member States (as indeed it is already beginning to be the case for the European Commission) to demand that Internet intermediaries meddle with citizens' communications for the perceived benefit of certain vested interests and, simultaneously, demand that the same intermediaries not meddle with citizens' communications for their own business interests. Draft Council conclusions on Net Neutrality (15.07.2011) http://register.consilium.europa.eu/pdf/en/11/st12/st12950.en11.pdf Consolidated EU telecoms regulatory framework (12.2009) http://ec.europa.eu/information_society/policy/ecomm/doc/library/regframefor... OECD Communiqui on Principles for Internet Policy-Making (28-29.06.2011) http://www.oecd.org/dataoecd/40/21/48289796.pdf (Contribution by Joe McNamee and Daniel Dimov - EDRi) ============================================================ 2. EU countries to explain lack of implementation of the Telecoms Package ============================================================ The European Commission has sent letters of formal notice requesting information from 20 EU countries regarding the reasons why they have not yet fully implemented the EU Telecoms Package. The EU member states were supposed to produce national legislation that would implement, by 25 May 2011, the EU Telecoms Package, adopted late 2009, but only seven states have fully complied until now. The Telecoms Package includes amendments to the EU's Privacy and Electronic Communications Directive providing a new requirement for website owners to obtain consent from users to track their online behaviour through "cookies". According to the EU Directive, storing and accessing information on users' computers was lawful provided "the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information about the purposes of the processing". The 20 member states have begun the process of drawing up new laws and some have even implemented some of the new telecoms laws requirements but not the entire Telecoms Package. In June, EU Commissioner Neelie Kroes warned the member states that the Commission would use its "full powers" against those countries that would not comply with the Directive. Yet, Peter Hustinx, the European Data Protection Supervisor (EDPS), stated that the Commission has not offered consistent guidance on how the EU states should comply with the new legislation. Hustinx also criticised Kroes for supporting self-regulatory methods undertaken by the online advertising industry and for her support for the US "do not track" measures allowing users to request websites not to monitor their activity, as the system relies on websites reacting to the users' requests. The formal letter sent by the Commission to the 20 countries represent a first legal stage in the identification of infringements from countries that have not enacted EU laws and could be referred to the European courts. The 20 state members are supposed to reply to the letters within two months. "If they fail to reply or if it is not satisfied with the answer, the Commission can send the member states concerned a formal request to implement the legislation, and ultimately refer them to the European Court of Justice (ECJ)," the Commission said. The ECJ can order EU member countries to implement EU Directives and fine them if they do not. European Commission begins legal action against countries that have still to implement telecoms laws (20.07.2011) http://www.out-law.com/page-12098 Digital Agenda: Commission starts legal action against 20 Member States on late implementation of telecoms rules (19.07.2011) http://europa.eu/rapid/pressReleasesAction.do?reference=IP/11/905&format=HTML&aged=0&language=EN&guiLanguage=en ============================================================ 3. Germany's salaries database bites the dust ============================================================ The German government announced, in a press release on 18 July 2011, that it was going to abandon its central database and registration procedure for salaries, ELENA ("Elektronischer Entgeltnachweis"/ "electronic salary record"), as soon as possible. With this decision, German civil rights group and EDRi-member FoeBuD can celebrate the successful outcome of a complaint they had handed in at Germany's Federal Constitutional Court even before the court came to consider its ruling. The complaint has been signed by more than 22 000 petitioners. In FoeBuD's analysis, the government finally had to pull the plug on this ill-fated project after more than a year of procrastination. A joint press statement by the Federal Ministries of Economics and of Labour points to an insufficient uptake of the "qualified electronic signature" as the reason to abandon the project. FoeBuD and their lawyers call it regrettable that technical issues were highlighted and no mention was made of the doubtful constitutional legality of the procedure, which required all employers to transmit data on all salaries to a central database operated by Germany's state pension insurance. More than 400 million records of employee salaries have already been collected, although most of this data was not even required for the intended electronic records. The press release gives reason to suspect that the government has by no means given up on their idea to establish an electronic register of employee data. As the statement says, "the Federal Ministry for Labour and Social Affairs will formulate a concept on how the infrastructure and know-how established through ELENA can be used for a simpler and less bureaucratic procedure to record social security data." As the intention to collect all German citizens' sensitive data in central databases lingers on, there is reason to stay alert after the current success regarding ELENA. FoeBuD will continue to monitor future developments to guard against a replacement for this disproportionate procedure being introduced through the back door. Press statement by the Federal Ministry of Economics and Technology and the Federal Ministry of Labour and Social Affairs (only in German, 18.07.2011) http://www.bmwi.de/BMWi/Navigation/Presse/pressemitteilungen,did=424742.html In-depth response by one of the lawyers in FoeBuD's Constitutional Complaint, Meinhard Starostik (only in German, 19.07.2011) https://www.foebud.org/datenschutz-buergerrechte/arbeitnehmerdatenschutz/ele... (Contribution by Sebastian Lisken, EDRi member FoeBuD / redacted translation of FoeBuD's German press release) ============================================================ 4. Slovakia: Court asks website to filter public procurement open data ============================================================ Fair-Play Alliance (AFP), a Slovak non-governmental organization operating znasichdani.sk site, was required by a Bratislava District Court to take down from the website information related to certain public procurement contracts. The website was created in March 2011 in order to provide "a tool that would enable journalists and watchdogs to cross-check information about companies successful in public procurements with influential persons in these companies". The basic idea was to connect the information on the Public Procurement bulletin with that in the database of Business register of the Slovak republic "in a way that would match persons with the names of companies in which these persons are or once were active, and with financial volume of the companies' state contracts," stated Eva Vozarova from AFP. Recently, the District Court of Bratislava II has issued a preliminary injunction, ordering Fair-Play Alliance to withdraw from the website any information related to a particular private individual, the statutory representative of the large construction company Strabag which had won good contracts paid with public money. The decision of the court is that AFP must remove the financial totals of public procurement orders won by Strabag, and all other companies in which this person was involved. This preliminary ruling had no detailed explanation on why this was necessary. AFP considers the decision of the court inappropriate, unconstitutional and threatens the right to freedom of speech. Moreover, the website only puts together already publicly available data. It contains a register of people known to be behind companies that have benefited from state orders. When searching for a particular person, the site lists the companies to which the name of the respective person is or was related to and the state orders those companies have won, as well as the amounts received from public funds. The court's decision is also unclear as, normally, it should instruct on how to perform the action required. AFP was supposed to refrain from publishing the persons' name, surname and title from the website znasichdani.sk which could directly connect the claimant's person with the financial value gained from public procurement. The site however makes no connections of financial values to the claimant's name but only filters information showing the results side by side. The total of occurrences of the claimant's name can hardly be technically erased without compromising the rest of the service. "The alliance has done nothing else but make possible simultaneous searches in two publicly accessible databases," stated lawyer Vladimmr Sarnik who added that the preliminary decision of the court contains both formal and factual mistakes. The court decision was issued even before the plaintiff had submitted her complaint (as the Slovak legal system makes this possible), which could lead to a paradoxical situation when the preliminary decision may remain in place for an indefinite period without a formal complaint being submitted. Ironically, a few days ahead, on 17 June 2011, the Znasichdani.sk site was awarded first prize at Open Data Challenge, a European competition sponsored by the Open Knowledge Foundation and backed by the European Commission. AFP has immediately appealed the court's preliminary decision. Court orders removal of public procurement data (4.07.2011) http://spectator.sme.sk/articles/view/43180/2/court_orders_removal_of_public... Why censoring Slovak spending app means bad news for open data (18.07.2011) http://blog.okfn.org/2011/07/18/why-censoring-slovak-spending-app-means-bad-... Fair-play Watchdog Angered by Court ruling (29.06.2011) http://www.thedaily.sk/2011/06/29/top-news/fair-play-watchdog-angered-by-cou... ============================================================ 5. Voluntary agreements on blocking are interfering with human rights ============================================================ Following the agreement of the EU institutions on a web blocking compromise text which fails to adequately address the lawless blocking which is undertaken in several EU countries, a careful reading of recent research on the legality of this approach is called for. Last month, Professor Yaman Akdeniz (Istanbul Bilgi University, Turkey) prepared a report on Freedom of Expression on the Internet for the Organisation for Security and Cooperation in Europe (OSCE). The report contained an investigation on legal provisions and practices related to freedom of expression, the free flow of information and media pluralism on the Internet in OSCE participating States. In his study, Professor Yaman Akdeniz observed that blocking measures in the OSCE region are not always provided for by law nor were they always subject to due process principles. In particular, he noted that blocking decisions were not necessarily taken by the courts of law, but by administrative bodies or Internet hotlines run by the private sector. They decided which content, website or platform should be blocked. In many cases, such "voluntary" blocking procedures lacked transparency and accountability. In addition, the appeal in such procedures were either not in place or, where they were in place, they were often not efficient. That is why the compatibility of blocking with the fundamental right of freedom of expression must be questioned. In particular, in the absence of a legal basis for blocking access to online content, the compatibility of "voluntary" blocking agreements and systems with OSCE commitments, Article 19 of the Universal Declaration and Article 10 of the European Convention on Human Rights was problematic. Also, such a "voluntary interference" might be contradictory to the conclusions of the Final Document of the Moscow Meeting of the Conference on the Human Dimension of the CSCE. With regard to the compatibility of blocking with the fundamental right of freedom of expression, Professor Akdeniz also pointed out that both the 1994 Budapest OSCE Summit Document and the European Court of Human Rights reiterated the importance of freedom of expression as one of the preconditions for a functioning democracy. In Budapest, "(t)he participating States reaffirm(ed) that freedom of expression is a fundamental human right and a basic component of a democratic society. In this respect, independent and pluralistic media were essential to a free and open society and accountable systems of government." According to Akdeniz, an "effective" exercise of this freedom does not depend merely on the state's duty not to interfere, but might require positive measures to protect this fundamental freedom. Consequently, a blocking system relying exclusively on self-regulation or "voluntary agreements" could be in a non-legitimate interference with fundamental rights. Yaman A.: Report on Freedom of Expression on the Internet http://www.osce.org/fom/80723 The Final Document of the Moscow Meeting of the Conference on the Human Dimension of the CSCE http://www.osce.org/odihr/elections/14310 1994 Budapest OSCE Summit Document http://www.osce.org/mc/39554 The Universal Declaration of Human Rights http://www.un.org/en/documents/udhr/ The European Convention on Human Rights http://www.hri.org/docs/ECHR50.html EDRi-gram: OSCE: Access to the Internet should be a human right (13.07.2011) http://www.edri.org/edrigram/number9.14/oecd-study-internet-freedom (Contribution by Daniel Dimov - EDRi) ============================================================ 6. Belgium: Francophone press goes out and back in Google Search ============================================================ As a result of Google's conflict with Copiepresse, the search engine announced on 15 July 2011 that it would not index titles from the Belgium francophone press. Google stated that in doing so, it only complied with the decision of the Appeal Court of 5 May 2011 that backed a court decision of February 2011 forbidding Google to publish Belgium press articles on Google News and Google Search, with a fine reaching 25 000 euro in case of non-compliance. Google's reaction looked like a punishment that would put some pressure on Belgium's francophone press as the measure actually went beyond the court's decision which only asked for the removal of Copiepresse articles and not their complete erasing from the search engine. The measure was however successful. "We would be happy to re-include Copiepresse if they would indicate their desire to appear in Google Search and waive the potential penalties," said Google spokesman William Echikson. Which, Copiepress did on 18 July 2011. Le Soir and La Libre Belgique stated on their sites that an agreement had been reached with Google that would re-index the excluded sites. "It is necessary to distinguish the Google search engine from the Google news service," said an article on La Libre website adding: "The news editors do not oppose having their content referenced by the Google search engine, they refuse on the other hand for their informational content to be included in Google News." Google censures the Francophone press (only in French, 15.07.2011) http://www.lecho.be/actualite/entreprises_technologie/Google_censure_la_pres... Google re-indexes the Belgium press on its engine (up-date) (only in French, 18.07.2011) http://www.01net.com/editorial/536000/google-supprime-la-presse-belge-de-son... Google will re-index the francophone press (only in French, 18.07.2011) http://www.lecho.be/actualite/entreprises_media/Google_va_reindexer_la_press... EDRi-gram: Google found guilty in Belgium for newspapers' copyright infringement (18.05.2011) http://www.edri.org/edrigram/number9.10/google-looses-copiepresse-case ============================================================ 7. Britain: Government reneges on DNA privacy promise ============================================================ In Britain, the Conservative-Liberal Democrat coalition government has announced that it will not delete the DNA records of suspects who were arrested but subsequently acquitted or never charged. It had promised to delete them following the Marper judgement, where the European Court of Human Rights found it was unlawful to keep the DNA of acquitted people indefinitely; this promise was enshrined in the Coalition Agreement that set up the Government after the indecisive 2010 election. But the Government now says it will rely on "anonymisation". The DNA records of innocent people will be retained by the forensic service without the suspect's names and addresses. When a match is found with crime-scene DNA in the future, the innocent former suspect can be identified by matching the sample bar code with the records of the police force that arrested him last time. The Government may argue that this complies with UK data protection law, which is a defective implementation of the Data Protection Directive. However it fails to satisfy European and human-rights law. The announcement was made quietly on Monday, 25 July 2011, while the press's focus was on the killings in Norway. Innocent people's DNA profiles won't be deleted after all, minister admits (26.07.2011) http://www.telegraph.co.uk/news/uknews/law-and-order/8660821/Innocent-people... Database State (2009) http://www.cl.cam.ac.uk/~rja14/Papers/database-state.pdf (Contribution by Ross Anderson - EDRi-member FIPR - UK) ============================================================ 8. ENDitorial: Phone hacking and self regulation ============================================================ The self-regulatory authority for the British press, the Press Complaints Commission (PCC), has itself become one of the victims of the "phone hacking" scandal, as self-regulation failed to not alone prevent but even identify problems now believed to be endemic among UK newspapers. Phone hacking - guessing or brute-force attacking voicemail accounts to access messages - is a criminal offence in the UK. Cases at the News of the World (NoW) were prosecuted under the Regulation of Investigatory Powers Act (RIPA), and could also be offences under the Computers Misuse Act. In 2007, private investigator Glen Mulcaire and NoW royal editor Clive Goodman were convicted and imprisoned for RIPA interception offences. Thus to date, the prosecutions have focused on reporters and investigators, rather than their employers at News International. In May 2007, the PCC found that there was no evidence of widespread phone hacking at News of the World. Since that date, further allegations, investigations by Parliamentary committees and threats of private legal action have put pressure on the police to re-open the investigations. Allegations of the excessively close relationships between the police and News International and NoW, including possible payments, have meant that senior police officials at the Metropolitan (London) Police have now resigned. One question that needs to be addressed is the extent to which "self regulation" has failed in this arena. With strong motivations from their members not to look at the behaviour of those same being regulated, the PCC might well be expected to fail. But this wasn't obvious when the PCC was set up. The reasoning behind press self-regulation was at least more principled than that behind Internet "self regulation". The press, it was argued, needs to be strong and free. The methodology is also more coherent - it is, to a large extent, "self-"regulation, unlike much Internet "self-regulation", which is actually regulation of content or consumers by the Internet industry. Thus it was thought better for the press to impose their own rules, rather than relying on legislation and politicians, who have an inbuilt desire to control and limit their activities. Yet, it has comprehensively failed. A combination of high pressure for more sales in a declining market, an unsafe technology and malleable or inattentive enforcement let citizens' interests be ignored. As it is often stated, but rarely politically accepted, once privacy is stripped away, the ability of those threatened with privacy abuses to speak out is vastly reduced. Thus, it was those who had already suffered exposure by the News of the World who had to be brave enough to speak out. The UK's political leadership was frequently too frightened to comment. We may well ask why, if the PCC cannot balance the public interest, free speech, privacy and business interests, the behavioural advertisers and Internet Service Providers should be expected to do a better job. Purely pragmatically, self-regulation may be expected to work where the interests of end users are well-aligned with those doing the regulation: but where those are strongly divergent, they are unlikely to. Unfortunately, as the PCC has shown, the balance of interests can quickly shift with technology. Thus we are left to conclude that, in the absence of procedures and structures that are fit to cope with such shifts, legal protections and official regulators are in fact the more important part of public protection. A second lesson just how politicians completely misunderstand the complexities of industry "self-regulation." If the PCC could fail so badly in the comparatively straightforward task of regulating its own industry, why on earth can politicians feel that they can speak so blithely and simplistically about private internet intermediaries "self-"regulating the key democratic fundamental rights of our society - privacy and freedom of communication? Phone Hacking articles at The Guardian http://www.guardian.co.uk/media/phone-hacking News of the World phone hacking scandal investigations http://en.wikipedia.org/wiki/News_of_the_World_phone_hacking_scandal_investi... The UK phone hacking scandal: there's worse to come - much worse (23.07.2011) https://www.privacyinternational.org/blog/uk-phone-hacking-scandal-theres-wo... The Government still wants to hack your phone (14.07.2011) http://www.openrightsgroup.org/blog/2011/the-government-still-wants-to-hack-... (Contribution by Jim Killock - EDRi-member Open Rights Group - UK) ============================================================ 9. Recommended Action ============================================================ Public consultation on personal data breach notifications under ePrivacy Directive. Deadline: 9 September 2011 http://ec.europa.eu/information_society/policy/ecomm/library/public_consult/... EU - Open access to scientific information - Commission seeks views A public consultation on access to, and preservation of, digital scientific information has been launched by the European Commission. Deadline: 9 September 2011 http://europa.eu/rapid/pressReleasesAction.do?reference=IP/11/890 ============================================================ 10. Recommended Reading ============================================================ Article 29 Data Protection Working Party - Opinion on Consent (14.07.2011) http://ec.europa.eu/justice/policies/privacy/news/docs/press_release%20opini... http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2011/wp187_en.pdf 86 cents for one year without blanket telecommunications data retention (25.07.2011) http://www.vorratsdatenspeicherung.de/content/view/471/79/lang,en/ ============================================================ 11. Agenda ============================================================ 10-14 August 2011, Finowfurt near Berlin, Germany Chaos Communication Camp 2011 http://events.ccc.de/camp/2011 25-27 August 2011, Washington DC, USA Global Congress on Public Interest Intellectual Property Law http://infojustice.org/public-events/global-congress 7 September 2011, Berlin, Germany Balancing the interests in the context of data retention Registration by 15 August 2011 http://www.uni-kassel.de/einrichtungen/iteg/forschung/invodas/invodas-abschl... 10-17 September 2011 Freedom Not Fear - International Action Week http://www.freedomnotfear.org 16-18 September 2011, Warsaw, Poland Creative Commons Global Summit 2011 http://wiki.creativecommons.org/Global_Summit_2011 27-30 September 2011, Nairobi, Kenya Sixth Annual IGF Meeting: Internet as a catalyst for change: access, development, freedoms and innovation http://www.intgovforum.org/cms/nairobipreparatory 11 October 2011, Brussels, Belgium ePractice Workshop: Addressing evolving needs for cross-border eGovernment services http://www.epractice.eu/en/events/epractice-workshop-cross-border-services 13-14 October 2011, Lisbon, Portugal 2nd International Graduate Conference in Communication and Culture: The Culture of Remix http://blogs.nyu.edu/projects/materialworld/2011/05/cfp_the_culture_of_remix... 20-21 October 2011, Warsaw, Poland Open Govrenment Data Camp http://opengovernmentdata.org/camp2011/ 27-30 October 2011, Barcelona, Spain Free Culture Forum 2011 http://fcforum.net/ 9 November 2011, Bucharest, Romania Inet Conference: Access, Trust and Freedom: Coordinates for future Internet http://www.isoc.org/isoc/conferences/inet/11/bucharest-agenda.shtml 11-13 November 2011, Gothenburg, Sweden FSCONS is the Nordic countries' largest gathering for free culture, free software and a free society. http://fscons.org/ 25-27 January 2012, Brussels, Belgium Computers, Privacy and Data Protection 2012 http://www.cpdpconferences.org/ ============================================================ 12. About ============================================================ EDRi-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRi has 28 members based or with offices in 18 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRi-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and are visible on the EDRi website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 3.0 License. See the full text at http://creativecommons.org/licenses/by/3.0/ Newsletter editor: Bogdan Manolea <edrigram@edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request@edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. Unsubscribe by e-mail To: edri-news-request@edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edri/2.html - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram@edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE