European Commission Wants Coronavirus Tracing Apps To Build In Strong Protections For Privacy -- Unlike The French Government

from the essential-requirements dept

Techdirt has just written about France's incredibly hypocritical attitude to privacy when it comes to contact tracing apps for COVID-19. The European Commission seems to be rather more consistent in this area. As well as pushing privacy legislation like the GDPR and ePrivacy Directive, it has released a series of documents designed to help EU Member States create tracing apps without compromising on citizens' privacy. For example, on April 8, it adopted a "Recommendation to support exit strategies through mobile data and apps", which called for "a joint toolbox towards a common coordinated approach for the use of smartphone apps that fully respect EU data protection standards". Details followed a week later, when the European Commission announced a pan-EU toolbox for "efficient contact tracing apps to support gradual lifting of confinement measures". A 44-page document spelled out in some detail (pdf) the "essential requirements" for national apps deployed in the region -- that they should be:

voluntary;

approved by the national health authority;

privacy-preserving -- personal data is securely encrypted; and

dismantled as soon as no longer needed.

Finally, as if to underline the importance of respecting citizens' privacy yet further, the European Commission released another communication (pdf) providing "Guidance on Apps supporting the fight against COVID 19 pandemic in relation to data protection". The whole section on security is worth reading in full, since it offers a good summary of the current thinking on the best ways to preserve privacy with these apps:

The Commission recommends that the data should be stored on the terminal device of the individual in an encrypted form using state-of-the art cryptographic techniques. In the case that the data is stored in a central server, the access, including the administrative access, should be logged.

Proximity data should only be generated and stored on the terminal device of the individual in encrypted and pseudonymised format. In order to ensure that tracking by third parties is excluded the activation of Bluetooth should be possible without having to activate other location services.

During the collection of proximity data via [Bluetooth Low Energy communications between devices] it is preferable to create and store temporary user IDs that change regularly rather than storing the actual device ID. This measure provides additional protection against eavesdropping and tracking by hackers and therefore makes it more difficult to identify individuals.

The Commission recommends that the source code of the app should be made public and available for review.

Additional measures to secure the data processed can be envisaged notably with automatic deletion or anonymisation of the data after a certain point in time. In general, the degree of the security should match the amount and sensitivity of personal data processed.

All transmissions from the personal device to the national health authorities should be encrypted.

The contrast between this rigorous and comprehensive approach to safeguarding the rights of citizens and France's cavalier disregard for the same, is stark. Unfortunately the Commission's guidance is not legally binding and is likely to be ignored by the French government, which often insists on going its way, as with its terrible implementation of Article 17 of the EU Copyright Directive.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: contact tracing, covid-19, eprivacy directive, eu, france, gdpr, privacy

EU Data Protection Official Says Revised Privacy Laws Should Ban Backdooring Encryption

from the sounds-like-a-plan dept

The EU's "Cookie Law" is a complete joke and waste of time. An attempt to regulate privacy in the EU, all it's really served to do is annoy millions of internet users with little pop up notices about cookie practices that everyone just clicks through to get to the content they want to read. The EU at least recognizes some of the problems with the law and is working on a rewrite... and apparently there's an interesting element that may be included in it: banning encryption backdoors. That's via a new report from European Data Protection Supervisor (EDPS) Giovanni Buttarelli, who was put in charge of reviewing the EU's ePrivacy Directive to make it comply with the new General Data Protection Regulation (GDPR) that is set to go into effect in May of 2018. The key bit:

The new rules should also clearly allow users to use end-to-end encryption (without 'backdoors') to protect their electronic communications.

Decryption, reverse engineering or monitoring of communications protected by encryption should be prohibited.

In addition, the use of end-to-end encryption should also be encouraged and when necessary, mandated, in accordance with the principle of data protection by design.

To be clear, this actually seems like it may go too far. There are plenty of situations where it seems completely reasonable for law enforcement to use other means to figure out ways to decrypt encrypted communications. Arguing that it should be completely outlawed seems a bit extreme. But blocking backdoors does seem like a good idea. The report also says that the use of end-to-end encryption should be encouraged to the point of being mandated in some cases:

In addition, the use of end-to-end encryption should also be encouraged and when necessary, mandated, in accordance with the principle of data protection by design. In this context the EDPS also recommends that the Commission consider measures to encourage development of technical standards on encryption, also in support of the revised security requirements in the GDPR.

The EDPS further recommends that the new legal instrument for ePrivacy specifically prohibit encryption providers, communications service providers and all other organisations (at all levels of the supply chain) from allowing or facilitating 'back-doors'.

Conceptually, this sounds good, but the implementation matters. Mandating encryption seems to be going a bit far. While I tend to think it makes sense for much more widespread use of encryption, it's not clear why the government needs to get involved here at all. And that includes in the development of such standards. In fact, as we've seen in the past, when the government gets involved in creating encryption standards, that seems to be where the intelligence community can slip in their backdoors.

Still, this is certainly an interesting development. Of course, it would also conflict with the UK's Snooper's Charter ("Investigatory Powers Act") which mandates backdoors for encryption. Though, to be fair, by the time the new rules go into practice, perhaps the UK will no longer be a part of the EU.

Filed Under: backdoors, data protection, encryption, eprivacy directive, eu, gdpr, privacy

Guy Argues That Anti-Ad Blocker Systems Violate EU Privacy Laws

from the well,-that's-a-twist dept

We've talked about how ridiculous it is that many news sites (including Wired and Forbes -- and apparently, now, the NY Times) have started using annoying anti-ad blocker software, in which it will block visitors from viewing their content if those sites detect (or think they detect) that you're using an ad blocker. This is ridiculous on any number of levels, but most of all because it is forcing people to put their computers at risk. Plenty of people have tried explaining to publishers that this practice is a bad idea, but to no avail.

However, over in Europe, one privacy activist thinks he may have found another path. Alexander Hanff wrote to the EU Commission with his reasoning, claiming that anti-ad blockers are a form of spyware that illegally violate the EU's ePrivacy Directive by not getting consent. As you may have noticed, not too long ago, when you started visiting EU-based websites, it would always inform you of its policy on storing cookies, and requesting that you "accept" the site's policy. This was because of a new electronic privacy directive, that some have called the Cookie Law. However, as Hanff notes, it's quite possible that using an ad-blocker detector script is basically doing the same sort of thing as a cookie in terms of spying on client-side information within one's web browser, and a letter he received from the EU Commission apparently confirms his assertion.

With client side scripts is a breach of Art 5(3) of 2002/58/EC and thus ILLEGAL in Europe #privacy #adblocker #slamdunk

— Alexander Hanff (@alexanderhanff) April 19, 2016

Since so many people are bugging me for them here are photos of the relevant pages of letter. pic.twitter.com/vcTG0qdhIC

— Alexander Hanff (@alexanderhanff) April 20, 2016

It's unclear from the excerpt of the letter that he's posted if it's quite as slamdunk a case as he's indicated, but it certainly is an interesting read of the law. Either way, Hanff has made it clear that he's going to use this "opinion" from the EU Commission to go after a ton of websites using anti-ad block systems:

This is huge, I am about to launch legal complaints across multiple EU member states & now have formal @EU_Commission opinion to support

— Alexander Hanff (@alexanderhanff) April 19, 2016

To all #publishers currently detecting #adblockers in EU - look out, I am coming for you and I am very well armed. #privacy #spyware

— Alexander Hanff (@alexanderhanff) April 20, 2016

Of course, from the sound of things, if Hanff is correct in his analysis, this could make things trickier for EU sites that want to use anti-ad-block software, as they'd have to first get users' consent, and give them some level of control (possibly allowing them to just bypass the ad blocker check entirely). There are all sorts of reasons why the war on ad blocking is a bad idea, but here's one more possibility, especially for EU sites.

Filed Under: ad blockers, alexander haff, anti ad blocker, cookie law, eprivacy directive, eu, media, privacy, spyware