EU data protection authority confirms privacy threat in “Telecoms Package”

Paris, January 19th. The European Data Protection Supervisor (EDPS) released his opinion on the current state of the Telecoms Package. His views on the ePrivacy directive confirms La Quadrature’s analysis: If nothing is done, article 6.6(a) will allow any company to collect and process traffic data from any Internet user, for an undetermined period of time. This disposition is harmful and unacceptable. MEPs must react by strongly reaffirming citizens’ right to privacy and the interests of society as a whole during the second reading of the package.

In his recently published opinion, The EDPS explains (paragraphs 76 to 86) about article 6.6(a) of the ePrivacy directive that :

“83. The Council’s redrafted version of the amendment contains elements to be praised, such as retaining the term “strictly necessary” which underscores the limited scope of application of this Article. However, the Council version eliminates the data protection and privacy safeguards referred to above. While in principle general data protection provisions apply, irrespective if specific reference is made in every case, Council’s version of Article 6.6(a) may nevertheless be interpreted as giving full discretionary powers to process traffic data without being subject to any data protection and privacy safeguards that apply whenever traffic data is processed. Therefore, it might be argued that traffic data may be collected, stored, and further used without having to comply with data protection principles and specific obligations that otherwise apply to responsible parties, such as the quality principle or the obligation of fair and lawful processing and to keep the data confidential and secure. Furthermore, because no reference is made to applicable data protection principles that impose time limits for storage of the information or to specific time limits within the article, the Council version may be interpreted as enabling the collection and processing of traffic data for security purposes for an unspecified period of time. (…)

86. Taking into account on the one hand the risks that Article 6.6(a) poses to the fundamental right to data protection and privacy of individuals, and on the other hand the fact that, as explained in this Opinion, from a legal point of view, this Article is unnecessary, the EDPS has come to the conclusion that the best outcome would be for the proposed Article 6.6(a) to be deleted altogether.”

This analysis confirms the position sent by La Quadrature to MEPs on December 8th. In this letter, we asked to :

* Replace the Council’s version of this article 6.6 of ePrivacy directive by EP amendment 181. The EDPS goes even further by asking for the deletion of the whole article. La Quadrature supports this position.

* Remove all remaining mentions to “lawful content” in the Telecoms Package. Everyone agreed that Telecoms Package is not the proper place for discussing about content.

* Reintroduce amendment 138 recalling fundamental safeguards for citizens essentials rights and freedom. This is especially when the right to privacy and to a fair trial are being torn away in France with the imbecilic “graduated response” law (“HADOPI”), which propagation attempt to the whole European Union hopefully failed.

La Quadrature calls all MEPs to continue their work towards protecting their voters’ rights and freedom, and will be watchful to any attempt to favour private interests before the general interest during the “Telecoms Package” second reading.