Confidentiality of communications and
the fight against child sexual abuse
online
19 January 2021
Background
• Extended scope EECC as from December 2020
Messaging, VOIP, web-based email service become
subject to ePrivacy Directive, incl. rules on confidentiality
(art. 5) and traffic data (art. 6)
PhotoDNA
COM(2020) 568
Child Sexual Abuse Directive
(2011/93/EU)
• Requires following intentional conduct to be punishable:
–
intentionally and knowingly obtaining access, by means of ICT, to
child pornography;
–
distribution, dissemination or transmission of child pornography;
–
offering, supplying or making available child pornography
• Requires MS measures to ensure
prompt removal of webpages
containing or disseminating child pornography
• Allows MS measures to
block access to web pages containing
or disseminating child pornography
Main recommendations
• Issues
not specific to fight against CSAM online
•
Voluntary measures also constitute interference
• Not relevant that merely seeks to allow « continuation »
of existing voluntary practices
• Must comply with
Article 52 CFEU
Specific recommendations
Lawfulness of processing
• make explicit whether derogation is intended to provide
GDPR legal basis or not
Necessity and proportionality
•
Cf. La QDN a.o, ECLI:EU:C:2020:791, at para 121 et seq + EDPS
Guidelines on assessing proportionality
• « PhotoDNA » vs. grooming detection based on keyword analysis
Specific recommendations
Scope and extent of derogation
• « NIICS » includes variety of services – all of them?
• Types of detection measures - « well-established »
technologies?
Purpose and storage limitation
• Categories of data to be collected/retained/reported?
• Which recipients (« other relevant public authorities »)?
• When to report? How long to retain?
Specific recommendations
Reporting to relevant authorities
• Variety of DS: content providers, users, « suspects »,
victims
• What is confirmation process?
• Who manages/oversees relevant databases?
Transparency and data subject rights
• Any restrictions should comply with A23(1)-(2) GDPR
• Compare Proposal for Regulation on Terrorist Content
Specific recommendations
DPIA – prior consultation
• « without prejudice » does not suffice
• regulatory guidance is not a substitute for legality
Duration of the derogation
• temporary derogation should not exceed 2 years
CONCLUSION:
Proposal requires additional safeguards
Looking ahead
Thank you for your attention!
For more information:
Full text of Opinion 7/2020
www.edps.europa.eu
xxxx@xxxx.xxxxxx.xx
@EU_EDPS
