EDPB TECH ESG
13/11/2020
EDPS Opinion 7/2020
on the Proposal for temporary
derogations from Directive
2002/58/EC for the purpose of
combatting child sexual abuse
online
Background
• Extended scope ECC as from December 2020
– e-PD will become applicable to OTT inter-personal
communication services
Article 5 Confidentiality of the communications
Article 6 Traffic data
• EU strategy for a more effective fight against child
sexual abuse
– Voluntary measures for detection, removal and
reporting of child sexual abuse online ...
“would lack
legal basis” short-term: temporary derogation
– Long-term: legislation to make detection, removal &
reporting mandatory
Relationship Child Sexual
Abuse Directive (2011/93/EU)
• Requires following intentional conduct to be punishable:
–
intentional y and knowingly obtaining access, by means of ICT, to
child pornography;
–
distribution, dissemination or transmission of child pornography;
–
offering, supplying or making available child pornography
• Requires MS measures to ensure
prompt removal of webpages
containing or disseminating child pornography
• Allows MS measures to
block access to web pages containing
or disseminating child pornography
Main recommendations
• Issues not specific to fight against CSAM online
• Voluntary measures also constitute interference
• Not relevant that merely seeks to allow « continuation » of
existing voluntary practices
• Must comply with Article 52 CFEU
=> Need for comprehensive legal framework
Specific recommendations
1. Legal basis
• make explicit whether derogation is intended to provide
GDPR legal basis or not
• legitimate interest ?
2. Necessity and proportionality
• Cf.
La QDN a.o, ECLI:EU:C:2020:791, at para 121 et seq + EDPS
Guidelines on assessing proportionality
• « PhotoDNA » vs. grooming detection based on keyword analysis
• IA (?)
Specific recommendations
3. Scope and extent of derogation
• « NIICS » includes variety of services (e.g. messaging,
VOIP, web-based e-mail) – all of them?
• Types of detection measures and « well-established »
technologies?
• Extent of the proposed derogation – why art. 6 ePD?
4. Purpose and storage limitation
• Categories of data to be collected/retained/reported?
• Which recipients (« other relevant public authorities »)?
• When to report? What is confirmation process?
• How long to retain?
Specific recommendations
5. Reporting to relevant authorities
• Variety of DS: content providers, users, « suspects »,
victims
• Who manages/oversees relevant databases?
6. Transparency and data subject rights
• Any restrictions should comply with A23(1)-(2) GDPR
• Compare Proposal for Regulation on Terrorist Content
7. Keeping up with SotA
• « Well-established » vs. further development of PETs
Specific recommendations
8. DPIA – prior consultation
• « without prejudice » does not suffice
• regulatory guidance is not a substitute for legality
9. Duration of the derogation
• temporary derogation should not exceed 2 years
CONCLUSION:
Proposal should not be adopted w/out further safeguards
For more information:
Full text of Opinion 7/2020
Contacts at EDPS
