Feeds

Busting net neutrality may amount to spying, says EU

Eurocrat warns of 'massive, real-time inspection of comms'

Top three mobile application threats

New EU laws on net neutrality may be necessary to stop internet service providers (ISPs) from infringing individuals' data protection and privacy rights, the European Data Protection Supervisor (EDPS) has said.

The traffic inspection required to operate systems that breach net neutrality principles and prioritise some content over other content could violate privacy and data protection rights, he said.

Peter Hustinx said that EU telecoms regulators should monitor whether ISPs are complying with EU data protection and privacy laws when managing communications across their networks. Net neutrality is the principle that an ISP will deliver all content requested by a customer equally, not allowing content producers which pay it to have preferential access to its subscribers.

Hustinx called on the European Commission to establish an expert group, comprised of regulators and privacy watchdogs, which would "develop guidance" on applying the principles of data protection and privacy to net neutrality "in order to ensure solid and harmonised approaches and the same playing field" across the EU.

He said the guidance was necessary because of "the relative novelty of the possibility of massive, real-time inspection of communications" by ISPs in delivering services. Findings of the group and regulators could determine whether further EU regulation of net neutrality is needed, Hustinx said.

ISPs sometimes block or slow down users' access to some content during busy periods on their networks, but can also benefit from this kind of "traffic management" by charging content providers who are willing to pay for preferential access to their subscribers or by charging users more for fewer restrictions. To decide which content to "throttle" or block access to, ISPs sometimes inspect personal data contained in communications. Hustinx said that this activity can be legitimate providing it complies with EU law.

"The concept of net neutrality builds on the view that information on the internet should be transmitted impartially, without regard to content, destination or source," Hustinx said in a statement. "By looking into users' internet communications, ISPs may breach the existing rules on the confidentiality of communications, which is a fundamental right that must be carefully preserved. A serious policy debate on net neutrality must make sure that users' confidentiality of communications is effectively protected."

EU rules around net neutrality have not been explicitly written into EU-wide Directives, but recent changes to the Framework for Electronic Communications Directive set out certain requirements for national regulators to promote the concept.

Under the Directive, EU member states must ensure that national regulatory authorities "take all reasonable measures" proportionate to "promote the interests of the citizens of the European Union by ... promoting the ability of end-users to access and distribute information or run applications and services of their choice".

Other rules set out in the Universal Services Directive force ISPs to maintain a minimum quality of service and provide transparent information to customers about the services they provide. The Body of European Regulators of Electronic Communications, which is made up of representatives of telecoms regulators in the 27 EU countries, recently said that ISPs must provide consumers with accessible, understandable, meaningful, comparable and accurate information in order to allow them to make "informed choices" about services.

In a formal opinion (20-page/193KB PDF) Hustinx explained that some of the practices employed by ISPs to manage traffic on their networks may be contrary to EU data protection and privacy laws. He said that ISPs may breach the laws when accessing users' personal data, such as account details, to determine how to manage their communications traffic.

"ISPs' increasing reliance on monitoring and inspection techniques impinges upon the neutrality of the Internet and the confidentiality of communications," Hustinx said. "This raises serious issues relating to the protection of users’ privacy and personal data."

Under the EU's Privacy and Electronic Communications Directive ISPs can process personal data "for the purpose of the transmission of a communication" subject to some conditions. The Directive states that providers are prohibited from "listening, taping, storage or other kinds of interception or surveillance of communications" without consent from users concerned, other than when obliged to do, such as for national security purposes.

Under the Directive providers also must "take appropriate technical and organisational measures to safeguard security of its services".

Securing Web Applications Made Simple and Scalable

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Major problems beset UK ISP filth filters: But it's OK, nobody uses them
It's almost as though pr0n was actually rather popular
Microsoft unsheathes cheap Android-killer: Behold, the Lumia 530
Say it with us: I'm King of the Landfill-ill-ill-ill
All those new '5G standards'? Here's the science they rely on
Radio professor tells us how wireless will get faster in the real world
Apple orders huge MOUNTAIN of 80 MILLION 'Air' iPhone 6s
Bigger, harder trouser bulges foretold for fanbois
US freemium mobile network eyes up Europe
FreedomPop touts 'free' calls, texts and data
'Two-speed internet' storm turns FCC.gov into zero-speed website
Deadline for comments on net neutrality shake-up extended to Friday
Oh girl, you jus' didn't: Level 3 slaps Verizon in Netflix throttle blowup
Just hook us up to more 10Gbps ports, backbone biz yells in tit-for-tat spat
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.