STE WILLIAMS

New EU laws on net neutrality may be necessary to stop internet service providers (ISPs) from infringing individuals’ data protection and privacy rights, the European Data Protection Supervisor (EDPS) has said.

The traffic inspection required to operate systems that breach net neutrality principles and prioritise some content over other content could violate privacy and data protection rights, he said.

Peter Hustinx said that EU telecoms regulators should monitor whether ISPs are complying with EU data protection and privacy laws when managing communications across their networks. Net neutrality is the principle that an ISP will deliver all content requested by a customer equally, not allowing content producers which pay it to have preferential access to its subscribers.

Hustinx called on the European Commission to establish an expert group, comprised of regulators and privacy watchdogs, which would “develop guidance” on applying the principles of data protection and privacy to net neutrality “in order to ensure solid and harmonised approaches and the same playing field” across the EU.

He said the guidance was necessary because of “the relative novelty of the possibility of massive, real-time inspection of communications” by ISPs in delivering services. Findings of the group and regulators could determine whether further EU regulation of net neutrality is needed, Hustinx said.

ISPs sometimes block or slow down users’ access to some content during busy periods on their networks, but can also benefit from this kind of “traffic management” by charging content providers who are willing to pay for preferential access to their subscribers or by charging users more for fewer restrictions. To decide which content to “throttle” or block access to, ISPs sometimes inspect personal data contained in communications. Hustinx said that this activity can be legitimate providing it complies with EU law.

“The concept of net neutrality builds on the view that information on the internet should be transmitted impartially, without regard to content, destination or source,” Hustinx said in a statement. “By looking into users’ internet communications, ISPs may breach the existing rules on the confidentiality of communications, which is a fundamental right that must be carefully preserved. A serious policy debate on net neutrality must make sure that users’ confidentiality of communications is effectively protected.”

EU rules around net neutrality have not been explicitly written into EU-wide Directives, but recent changes to the Framework for Electronic Communications Directive set out certain requirements for national regulators to promote the concept.

Under the Directive, EU member states must ensure that national regulatory authorities “take all reasonable measures” proportionate to “promote the interests of the citizens of the European Union by … promoting the ability of end-users to access and distribute information or run applications and services of their choice”.

Other rules set out in the Universal Services Directive force ISPs to maintain a minimum quality of service and provide transparent information to customers about the services they provide. The Body of European Regulators of Electronic Communications, which is made up of representatives of telecoms regulators in the 27 EU countries, recently said that ISPs must provide consumers with accessible, understandable, meaningful, comparable and accurate information in order to allow them to make “informed choices” about services.

In a formal opinion (20-page/193KB PDF) Hustinx explained that some of the practices employed by ISPs to manage traffic on their networks may be contrary to EU data protection and privacy laws. He said that ISPs may breach the laws when accessing users’ personal data, such as account details, to determine how to manage their communications traffic.

“ISPs’ increasing reliance on monitoring and inspection techniques impinges upon the neutrality of the Internet and the confidentiality of communications,” Hustinx said. “This raises serious issues relating to the protection of users’ privacy and personal data.”

Under the EU’s Privacy and Electronic Communications Directive ISPs can process personal data “for the purpose of the transmission of a communication” subject to some conditions. The Directive states that providers are prohibited from “listening, taping, storage or other kinds of interception or surveillance of communications” without consent from users concerned, other than when obliged to do, such as for national security purposes.

Under the Directive providers also must “take appropriate technical and organisational measures to safeguard security of its services”.

Next page: Gather data only for ‘explicit and legitimate’ purposes

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/10/13/isps_traffic_managemnet_may_breach_european_net_neutrality_rules/