Feeds

Busting net neutrality may amount to spying, says EU

Eurocrat warns of 'massive, real-time inspection of comms'

Next gen security for virtualised datacentres

New EU laws on net neutrality may be necessary to stop internet service providers (ISPs) from infringing individuals' data protection and privacy rights, the European Data Protection Supervisor (EDPS) has said.

The traffic inspection required to operate systems that breach net neutrality principles and prioritise some content over other content could violate privacy and data protection rights, he said.

Peter Hustinx said that EU telecoms regulators should monitor whether ISPs are complying with EU data protection and privacy laws when managing communications across their networks. Net neutrality is the principle that an ISP will deliver all content requested by a customer equally, not allowing content producers which pay it to have preferential access to its subscribers.

Hustinx called on the European Commission to establish an expert group, comprised of regulators and privacy watchdogs, which would "develop guidance" on applying the principles of data protection and privacy to net neutrality "in order to ensure solid and harmonised approaches and the same playing field" across the EU.

He said the guidance was necessary because of "the relative novelty of the possibility of massive, real-time inspection of communications" by ISPs in delivering services. Findings of the group and regulators could determine whether further EU regulation of net neutrality is needed, Hustinx said.

ISPs sometimes block or slow down users' access to some content during busy periods on their networks, but can also benefit from this kind of "traffic management" by charging content providers who are willing to pay for preferential access to their subscribers or by charging users more for fewer restrictions. To decide which content to "throttle" or block access to, ISPs sometimes inspect personal data contained in communications. Hustinx said that this activity can be legitimate providing it complies with EU law.

"The concept of net neutrality builds on the view that information on the internet should be transmitted impartially, without regard to content, destination or source," Hustinx said in a statement. "By looking into users' internet communications, ISPs may breach the existing rules on the confidentiality of communications, which is a fundamental right that must be carefully preserved. A serious policy debate on net neutrality must make sure that users' confidentiality of communications is effectively protected."

EU rules around net neutrality have not been explicitly written into EU-wide Directives, but recent changes to the Framework for Electronic Communications Directive set out certain requirements for national regulators to promote the concept.

Under the Directive, EU member states must ensure that national regulatory authorities "take all reasonable measures" proportionate to "promote the interests of the citizens of the European Union by ... promoting the ability of end-users to access and distribute information or run applications and services of their choice".

Other rules set out in the Universal Services Directive force ISPs to maintain a minimum quality of service and provide transparent information to customers about the services they provide. The Body of European Regulators of Electronic Communications, which is made up of representatives of telecoms regulators in the 27 EU countries, recently said that ISPs must provide consumers with accessible, understandable, meaningful, comparable and accurate information in order to allow them to make "informed choices" about services.

In a formal opinion (20-page/193KB PDF) Hustinx explained that some of the practices employed by ISPs to manage traffic on their networks may be contrary to EU data protection and privacy laws. He said that ISPs may breach the laws when accessing users' personal data, such as account details, to determine how to manage their communications traffic.

"ISPs' increasing reliance on monitoring and inspection techniques impinges upon the neutrality of the Internet and the confidentiality of communications," Hustinx said. "This raises serious issues relating to the protection of users’ privacy and personal data."

Under the EU's Privacy and Electronic Communications Directive ISPs can process personal data "for the purpose of the transmission of a communication" subject to some conditions. The Directive states that providers are prohibited from "listening, taping, storage or other kinds of interception or surveillance of communications" without consent from users concerned, other than when obliged to do, such as for national security purposes.

Under the Directive providers also must "take appropriate technical and organisational measures to safeguard security of its services".

The essential guide to IT transformation

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
So, Apple won't sell cheap kit? Prepare the iOS garden wall WRECKING BALL
It can throw the low cost race if it looks to the cloud
EE fails to apologise for HUGE T-Mobile outage that hit Brits on Friday
Customer: 'Please change your name to occasionally somewhere'
Time Warner Cable customers SQUEAL as US network goes offline
A rude awakening: North Americans greeted with outage drama
We need less U.S. in our WWW – Euro digital chief Steelie Neelie
EC moves to shift status quo at Internet Governance Forum
BT customers face broadband and landline price hikes
Poor punters won't be affected, telecoms giant claims
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.