EDPS Opinion 8/2024 on the Proposal for a Regulation amending Regulation (EU) 2021/1232 on a temporary derogation from certain ePrivacy provisions for combating CSAM

24 January 2024

Opinion 8/2024

on the Proposal for a Regulation amending Regulation (EU) 2021/1232 on a temporary derogation from certain ePrivacy provisions for combating CSAM

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

Executive Summary

On 30 November 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/1232 on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse. The objective of the Proposal is to introduce a limited time extension to Regulation (EU) 2021/1232 (“Interim Regulation”) to enable providers of certain numberindependent interpersonal communications services to use specific technologies for the processing of personal and other data to detect online child sexual abuse on their services, while interinstitutional negotiations on a long-term Regulation continue.

The EDPS does not consider the proposed extension of validity of the Interim Regulation a formality. Already in his 2020 Opinion, the EDPS considered that the proposal should not be adopted, even in the form a temporary derogation, until the recommendations included in that Opinion were addressed.

The mere fact that providers of electronic communication services apply detection technologies on a voluntary basis does not dispense the co-legislature from its responsibility of establishing a comprehensive legal framework which meets the requirements of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

The EDPS notes that the concerns and recommendations expressed in his 2020 Opinion have not been fully addressed by the co-legislators when adopting the Interim Regulation. In particular, the Interim Regulation does not contain effective safeguards against general and indiscriminate monitoring of private commuincations. In this regard, the EDPS remains particularly concerned by the relatively high error rates of current detection technologies, especially those for detecting new child sexual abuse materials or child solicitation (‘grooming’). The EDPS also wishes to draw attention to the significant risk that technologies to detect CSAM may flag consensually produced and shared imagery.

Given the significant outstanding concerns, the EDPS recommends not to adopt the Proposal until the necessary safeguards are integrated.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 30 November 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse (‘the Proposal’).

2. The objective of the Proposal is to introduce a limited time extension to Regulation (EU) 2021/1232 (“Interim Regulation”) to enable providers of certain number-independent interpersonal communications services to use specific technologies for the processing of personal and other data to detect online child sexual abuse on their services, while inter- 5 6 institutional negotiations on the proposal for a long-term Regulation continue .

3. On 10 November 2020, the EDPS provided his Opinion on the Proposal for temporary derogations from Directive 2002/58/EC for the purpose of combatting child sexual abuse online (which later became the Interim Regulation). On 28 July 2022, the EDPS has, together with the European Data Protection Board (EDPB), issued Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse ( the long-term Regulation Proposal). Both Opinions remain relevant in the context of the current Proposal.

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 30 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS notes that no reference to this consultation has been made in a Recital, and recommends inserting such reference in accordance with the established practice .

2. General remarks

5. According to the explanatory memorandum , it is uncertain that the inter-institutional negotiations on the Proposal for a long-term Regulation will conclude for the long-term Regulation to enter into force and to apply before the Interim Regulation is set to expire. The proposed extension, until August 2026, would ensure that child sexual abuse online can be effectively and lawfully combated without interruptions until the long-term regime created by the proposed Regulation is agreed.

6. The EDPS does not consider the proposed extension of validity of the Interim Regulation a formality. Already in his 2020 Opinion, the EDPS considered that the mere fact that providers of electronic communication services would apply the detection technologies on a voluntary basis does not dispense the co-legislature from its responsibility of establishing a comprehensive legal framework which meets the requirements of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. The EDPS also noted that the general, indiscriminate and automated analysis of all text-based communications transmitted through number-independent interpersonal communications services with a view of identifying new potential infringements did not respect the principle of necessity and proportionality. Even if the technology used was limited to the use of “relevant key indicators”, the deployment of such general and indiscriminate analysis would be excessive. The EDPS therefore considered that the proposal should not be adopted, even in the form a temporary derogation, until the recommendations included in that Opinion were addressed.

7. These EDPS takes note that his concerns and recommendations have not been fully addressed by the co-legislators when adopting the Interim Regulation. In particular, the Interim Regulation does not contain safeguards against general and indiscriminate monitoring, and also the question of a valid legal basis under the GDPR remains unsolved. The EDPS underlines that these issues should be taken into account when considering the proposed extension.

8. In addition, the EDPS wishes to draw attention to important developments subsequent to the adoption of the Interim Regulation. For example, the impact assessment accompanying the Proposal for a long-term Regulation , which provided industry information on current technical solutions, has shed additional light on the legal and technical issues that emerge in practice. On 23 October 2023, the EDPS organised a seminar dedicated to the ongoing legislative works on the Proposal for a long-term regulation, which yielded further insights on the unintended consequences of the deployment of CSAM detection technologies . This Opinion also builds on this increased knowledge when assessing the Proposal.

3. Legal basis and necessity and proportionality

9. In his 2020 Opinion, the EDPS recommended clarifying which legal basis of the GDPR would be applicable . The Interim Regulation does not contain such clarification, resulting in different legal application practices among providers, according to the implementation report . The EDPS reiterates his previous recommendation to clarify which legal basis of the GDPR would be applicable to the voluntary processing of content or traffic data for the purpose of detecting child sexual abuse online.

10. The EDPS remains of the opinion that the general, indiscriminate and automated analysis of all text-based communications transmitted through number-independent interpersonal communications services with a view of identifying new potential infringements did not respect the principle of necessity and proportionality. Even if the technology used was limited to the use of “relevant key indicators”, the EDPS considers the deployment of such general and indiscriminate analysis excessive.

11. The EDPS notes that the Interim Regulation, while generally referring to strict necessity and proportionality , in reality does not provide for specific and effective safeguards against general and indiscriminate monitoring.

12. In his 2020 Opinion, the EDPS considered that the Proposal should clarify whether the detection technologies would be applied to all communications exchanged by all users or to a subset of them. In the latter case, according to the Opinion, it would be necessary to clarify the criteria by which the technologies would be applied to a specific subset of communications .

13. The EDPS notes that the Interim Regulation does not explicitly require providers to limit the deployment of detection technologies to a subset of communications, and also does not provide the criteria according to which the providers could do so voluntarily.

14. The EDPS in his 2020 Opinion encouraged the co-legislature to spell out, in the text of the Proposal, which categories of data would amount to “relevant data” in relation to each of the processing purposes . The EDPS notes that the Interim Regulation refers to “content data and related traffic data” in very general terms and does not specify which data categories may be processed for which purpose.

15. The EDPS had further expressed concerns that the reporting of individuals and blocking of the concerned user’s account might not be strictly necessary and proportionate in all instances, for example in the case of unsolicited receipt of CSAM. He also expressed concern that the procedure within the provider was not addressed. These concerns remain equally valid with regard to the Interim Regulation.

4. Transparency and data subject rights

16. With regard to transparency and data subject rights, the EDPS had recommended the introduction of additional measures to ensure transparency and exercise of data subject rights, subject, where strictly necessary, to narrowly defined restrictions (e.g., where necessary to protect the confidentiality of an ongoing investigation). The EDPS notes that the Interim Regulation provides for the information of all users in Article 3(1)(g)(v) and of those affected by removal, suspension or blocking in point (vi).

17. The EDPS also urged the co-legislators to provide further clarity as to when the right to human review would become applicable and which entity would be in charge of carrying out this review . Art. 3(1)(f) of the Interim Regulation does not provide such clarification, however, leading to seemingly different practices by providers . The EDPS recalls that, depending on the circumstances under which human review is required, the use of detection technologies could result in automated decision making within the meaning of Article 22 GDPR.

5. Duration of the temporary derogation

18. With regard to duration, the EDPS had expressed the view that a five-year period as initially proposed was too long and did not seem proportional given the absence of (a) a prior demonstration of the proportionality of the envisaged measure and (b) the inclusion of sufficient safeguards within the text of the legislation. He recommended that the validity of any transitional measure should not exceed 2 years.

19. In view of the shortcomings outlined above, the EDPS maintains this position.

6. Further considerations

20. The EDPS recalls that level of intrusion resulting from the deployment of CSAM detection measures may vary depending on the technology used. In all three types of detectable material, known CSAM, new CSAM and grooming, the technologies currently available rely on the automated processing of content data of all affected users. The technologies used to analyse the content are often complex, typically involving the use of AI. As a result, the behaviour of this technology may not be fully comprehensible for the user of the service. Moreover, the technologies currently available, especially those for detecting new CSAM or grooming, are known to have relatively high error rates. Consequently, there is the risk of significant number of innocent people being reported to the law enforcement authorities (directly or through the National Center for Missing and Exploited Children), based on a detection of ‘potential’ CSAM or grooming .

21. As the EDPB and the EDPS have already stated in their Joint Opinion on the long-term Proposal, performance indicators found in the literature, some of which are highlighted in the Impact Assessment Report that accompanied the long-term Proposal, provide very little information on the conditions that were used for their computation and their adequacy with real life conditions, meaning that their real-world performance could be significantly lower than what is expected, leading to less accuracy and a higher percentage of ‘false positives’.

22. The EDPS stresses that while it seems from the Commission Report on the implementation of the Interim Regulation that providers include the corrective element of human review in their calculation of reliability, it is necessary that the technology used in itself is sufficiently reliable. Human review, while protecting against adverse automated decision-making and indispensable, on its own already constitutes an interference. Therefore, it should not be invoked justify the use of detection technologies that are insufficiently reliable.

23. As indicated in the Impact Assessment Report and in the European Parliamentary Research Service’s study the accuracy rate of technologies for detection of text-based grooming is much lower than the accuracy rate of technologies for the detection of known CSAM. The assumption that artificial intelligence systems are available and working for the detection of unknown CSAM and for the detection of solicitation of children, and could be considered as state-of-the-art, is insufficiently supported by evidence. Even seemingly high levels of accuracy (for instance, the accuracy of certain grooming detection tools is 88%), must be considered in light of the envisaged practical use of the detection tools and the severity of the risks that an incorrect assessment of a given material would entail for the relevant data subjects. Therefore, the EDPB and EDPS had considered in their Joint Opinion that, with such a high risk processing, 12% failure rate presents a high risk to data subjects who have been subject to false positives, even when there are safeguards in place to prevent false reports to law enforcement.

24. Lastly, the EDPS would like to place particular emphasis on findings that were presented by experts at the EDPS seminar on CSAM, which highlight the general problem of automated detection: the technology cannot identify the context in which images are shared. Several participants of the EDPS seminar on the long-term CSAM Proposal warned that technologies to detect CSAM would flag consensually produced and shared imagery, as these technologies cannot properly consider the context in which the exchange takes place. As experts pointed out, platform moderators would not be able to filter (legal) consensual material because they too would not know the context of the exchange. As a result, there would be a risk for criminal prosecutions, but even if law enforcement authorities drop the charges, the investigation alone would be disturbing and constitute a violation of children’s rights.

25. In the same vein, a Member State’s Cybercrime Centre and Contact Point has underlined that there is a significant risk that innocent members of the public would be made subject to official investigations. This is said to be particularly true with regard to the AI-based miscategorisation of cases where the visual material itself is detected accurately, but the situation under criminal law is misjudged. To give an example, this includes cases where children below the age of criminal responsibility have posted material themselves, or communications between young people in consensual contexts.

7. Conclusions

26. In light of the above, the EDPS makes the following recommendations: (1) not to adopt the Proposal, until the necessary safeguards and all the outstanding missing elements, as identified in these specific recommendations, are introduced in the legal framework, notably o to clarify which legal basis of the GDPR would be applicable to the voluntary processing of content or traffic data for the purpose of detecting child sexual abuse online, o to provide for specific and effective safeguards against general and indiscriminate monitoring, o to specify which data categories may be processed for which purpose in Article 3(1)(h) of the Interim Regulation, and o to provide further clarity as to when the right to human review would become applicable and which entity would be in charge of carrying out this review. (2) to take fully into account the concerns and the additional risk stemming from measures to detect CSAM in interpersonal communications, identified during the discussions on the Proposal for a long-term CSAM Regulation. Brussels, 24 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10