Feeds

Busting net neutrality may amount to spying, says EU

Eurocrat warns of 'massive, real-time inspection of comms'

Remote control for virtualized desktops

New EU laws on net neutrality may be necessary to stop internet service providers (ISPs) from infringing individuals' data protection and privacy rights, the European Data Protection Supervisor (EDPS) has said.

The traffic inspection required to operate systems that breach net neutrality principles and prioritise some content over other content could violate privacy and data protection rights, he said.

Peter Hustinx said that EU telecoms regulators should monitor whether ISPs are complying with EU data protection and privacy laws when managing communications across their networks. Net neutrality is the principle that an ISP will deliver all content requested by a customer equally, not allowing content producers which pay it to have preferential access to its subscribers.

Hustinx called on the European Commission to establish an expert group, comprised of regulators and privacy watchdogs, which would "develop guidance" on applying the principles of data protection and privacy to net neutrality "in order to ensure solid and harmonised approaches and the same playing field" across the EU.

He said the guidance was necessary because of "the relative novelty of the possibility of massive, real-time inspection of communications" by ISPs in delivering services. Findings of the group and regulators could determine whether further EU regulation of net neutrality is needed, Hustinx said.

ISPs sometimes block or slow down users' access to some content during busy periods on their networks, but can also benefit from this kind of "traffic management" by charging content providers who are willing to pay for preferential access to their subscribers or by charging users more for fewer restrictions. To decide which content to "throttle" or block access to, ISPs sometimes inspect personal data contained in communications. Hustinx said that this activity can be legitimate providing it complies with EU law.

"The concept of net neutrality builds on the view that information on the internet should be transmitted impartially, without regard to content, destination or source," Hustinx said in a statement. "By looking into users' internet communications, ISPs may breach the existing rules on the confidentiality of communications, which is a fundamental right that must be carefully preserved. A serious policy debate on net neutrality must make sure that users' confidentiality of communications is effectively protected."

EU rules around net neutrality have not been explicitly written into EU-wide Directives, but recent changes to the Framework for Electronic Communications Directive set out certain requirements for national regulators to promote the concept.

Under the Directive, EU member states must ensure that national regulatory authorities "take all reasonable measures" proportionate to "promote the interests of the citizens of the European Union by ... promoting the ability of end-users to access and distribute information or run applications and services of their choice".

Other rules set out in the Universal Services Directive force ISPs to maintain a minimum quality of service and provide transparent information to customers about the services they provide. The Body of European Regulators of Electronic Communications, which is made up of representatives of telecoms regulators in the 27 EU countries, recently said that ISPs must provide consumers with accessible, understandable, meaningful, comparable and accurate information in order to allow them to make "informed choices" about services.

In a formal opinion (20-page/193KB PDF) Hustinx explained that some of the practices employed by ISPs to manage traffic on their networks may be contrary to EU data protection and privacy laws. He said that ISPs may breach the laws when accessing users' personal data, such as account details, to determine how to manage their communications traffic.

"ISPs' increasing reliance on monitoring and inspection techniques impinges upon the neutrality of the Internet and the confidentiality of communications," Hustinx said. "This raises serious issues relating to the protection of users’ privacy and personal data."

Under the EU's Privacy and Electronic Communications Directive ISPs can process personal data "for the purpose of the transmission of a communication" subject to some conditions. The Directive states that providers are prohibited from "listening, taping, storage or other kinds of interception or surveillance of communications" without consent from users concerned, other than when obliged to do, such as for national security purposes.

Under the Directive providers also must "take appropriate technical and organisational measures to safeguard security of its services".

Intelligent flash storage arrays

More from The Register

next story
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
Broadband sellers in the UK are UP TO no good, says Which?
Speedy network claims only apply to 10% of customers
Virgin Media struck dumb by NATIONWIDE packet loss balls-up
Turning it off and on again fixes glitch 12 HOURS LATER
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Fujitsu CTO: We'll be 3D-printing tech execs in 15 years
Fleshy techie disses network neutrality, helmet-less motorcyclists
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
Soz, web devs: Google snatches its Wallet off the table
Killing off web service in 3 months... but app-happy bonkers are fine
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.