Ieee bulletin ~ June-July-August-September 2015

1. 
   Digital Strategy: European Council establishes digital road map
   
2. 
   Digital Strategy: Luxembourgish Presidency priorities
   
3. 
   Net Neutrality: Deal on roaming and net neutrality, but with conditions
   
4. 
   Telecoms Package: Greens threaten to block agreement on telecoms package
   
5. 
   Cybersecurity: Agreement on “principles” for cyber security of networks
   
6. 
   Data Protection: EU watchdog launches transparency app for data privacy talks
   
7. 
   Data Protection: Germany to set up 'Bundescloud'
   
8. 
   Data Protection: Big data ‘here forever and in all sectors’
   
9. 
   Events
   

Overshadowed by the Greek and migration crises, the debate on the future digital single market was reduced to bare bones at the 26 June European Council. The conclusions adopted by the heads of state and government nonetheless call for the conclusion of negotiations on data protection "by the end of the year" and for "early" conclusion of the telecoms package talks. At the request of the United Kingdom, the wording "including on roaming" was added. Future priorities are expected to include the end of "unjustified" geo-blocking and the portability of copyright-protected content, “while assuring a high level of protection of intellectual property rights and taking account of cultural diversity". The conclusions, echoing the letter co-signed by eight Member States (IE,SE,CZ,EE,FI,NL,PL,UK) call for "effective" instruments to encourage investment and innovation, “targeting SMEs and start-ups”.  "The United Kingdom pushed for more ambition," notably through investments in infrastructure, commented British Prime Minister David Cameron. Dutch Premier Mark Rutte highlighted the role of SMEs, "important for an innovative country like the Netherlands". Reflecting French concerns, the conclusions also call for an evaluation of the "role of online platforms and intermediaries".

"And good luck to the Luxembourg Presidency." Pronouncing these words as he closed his final Justice and Home Affairs Council, Latvian Minister Dzintars Rasnacs seemed relieved to hand over the negotiations on data protection to his successor, Luxembourg's Felix Braz. The European Council encouraged the negotiators in the three-way legislative talks once again, on 25 June, to wrap up, by the end of 2015, adoption of the regulation and directive on data protection, critical to development of the digital economy. According to Braz, it is "optimistic but not impossible" to aim for an agreement at the October JHA Council.

Now that a deal has been worked out in three-way talks on roaming and net neutrality, the Council will have to proceed with formal adoption of the telecoms package. The heads of state also called for "rapid" adoption of the directive on network cyber security. These are expected to be brought to conclusion under the presidency of Xavier Bettel, Luxembourg prime minister and minister for the media.

Luxembourg will be breaking new ground by initiating work on the first elements of the Commission's new digital strategy. Copyright, online consumer protection, cross-border access to digital content and the end of geo-blocking are expected to be on the agenda by the end of 2015. This far-reaching strategy will involve several Council configurations and the presidency has announced in its work programme for the digital economy that it will make every effort to ensure a "coordinated approach".

Luxembourg will be at the helm for the Union on the international scene if the Member States leave it enough leeway. November will see negotiations in Geneva (WRV-15) on the allocation of radio frequencies, important not only for the expansion of mobile internet but also for connected cars and drones. Negotiations to transfer the IANA (Internet Assigned Numbers Authority) process from the US administration to a multipartite structure are in principle set to conclude by the end of the year as well. This process of assigning domain names (.eu, .be, etc) plays the role of internet control tower and consequently arouses keen interest. The Italian Presidency failed to produce results and the Latvians kept a low profile. Luxembourg seems to be following suit.

3. Deal on roaming and net neutrality, but with conditions

After hundreds of hours of technical discussions and a final 12-hour negotiating marathon (that ended at 2:00 on 30 June), Parliament, the Council and the European Commission struck a deal on roaming and net neutrality. In practice, the discussions still have to continue on the exact wording of the recitals of the net neutrality text. These will be decisive for the legal interpretation of the EU provisions on this extremely complex subject. The abolition of roaming charges is also conditional on a revision of current wholesale prices billed between operators. So it is an agreement with a few holes that the Presidency presented to the permanent representatives in the morning of 30 June. It still has to be formally approved by the Committee of Permanent Representatives (Coreper) during the Luxembourg Presidency.

Under the three-way deal, roaming charges would be abolished with effect from 15 June 2017. In the meantime, during a transitional period beginning on 30 April 2016, travellers will pay a surcharge of €0.05 per minute for calls from abroad, €0.02 for text messages and €0.05 per MB of data. The thresholds are currently €0.19 per minute for calls, €0.06 per text message and €0.20 per MB of data (excluding VAT). The idea of a free allowance for data and calls was dropped. On the other hand, the text contains a 'reasonable use' clause, but its detailed content still has to be clarified by the European Commission. Commercially, the aim is to prevent an operator without its own network (MVNO, or mobile virtual network operator) from offering a service based on roaming. To prevent 'dumping' between operators on roaming, the draft text establishes that national regulators will have to assure that operators effectively recover roaming costs. At the same time, regulators are given a large measure of discretion to permit operators to increase their prices in order to recover their costs when their balance is threatened. There is a 'but' in these provisions, though: the cessation of roaming charges is conditional on a framework being put in place for wholesale prices. In 2016, the Commission will present an act – probably an implementing act – detailing how to regulate the rates paid between operators for call transfers. These wholesale prices are not regulated at present and are particularly high in Germany, one of the leading consumers of roaming.

The deal reached in three-way talks also creates the first pan-European rules to guarantee access for all, without discrimination, to all internet content and services. The text will prohibit access providers from blocking, slowing or degrading internet content. All traffic will have to be treated "equally". In their day-to-day traffic management, operators would be able to block content only in a few defined exceptional cases such as for security reasons. Here too, there is a 'but': operators may offer specialised services that will be more expensive for certain types of content, provided they ensure that there is sufficient capacity on the network for all other traffic. This "general quality" must still be defined, however. 'Zero-rating', allowing an operator to offer free access (outside a data package) to a certain service, is not formally prohibited. In a concession to Parliament, transparency measures will require operators to indicate an 'available' flow in contracts with consumers. This concept takes account of the fact that access speed can be degraded by other factors such as wifi quality or the device being used, for example.

Following adoption of this telecoms package, the European Commission will be able to prepare the next step: revision of the telecoms framework directive. The drawing board included: rules to allow economies of scale for operators, better coordination of frequency allocation, a reform of rules encouraging investment and a level playing field for players providing similar online services.

New-born and already under threat: the Greens group at the European Parliament “will now work on building a majority in time for its vote in plenary” against the compromise on roaming and net neutrality, warns a press release by Michel Reimon (Greens, Austria) just a few hours after the end of the three-way meeting, which resulted in an agreement on the telecoms package. According to the shadow rapporteur for the Greens, the agreement contains major “loopholes,” which will entitle suppliers to offset losses on roaming by increasing national prices and Parliament has already sold off net neutrality “in a few minutes” after 13 hours of negotiation. For Monique Goyens, director-general of the European Consumer Organisation (BEUC), the devil is in the detail.

According to her, the safeguards against the impact of “specialised services” on the internet are not strong enough. For Parliament’s negotiator, Pilar del Castillo (EPP, Spain), on the other hand, it is a question of an agreement “in the interest of all parties” which, like any compromise, does not fully suit everyone. A big winner emerges in all cases: the British government, which wanted to be able to “sell” the abolition of roaming before its referendum. In fact, Prime Minister David Cameron welcomed “this fantastic deal,” which shows that "the UK, working with its partners, can deliver real change in Europe”. For Sébastien Soriano, chairman of Arcep, the French telecoms regulator, the future legislation on net neutrality will also have two advantages: it will imply a directly applicable legislation, which is not the case for the provisions adopted by the FCC in the US, he explained and it will give greater power to national regulators to control and sanction operators. “And our statutes allow us to impose sanctions representing up to 5% of company turnover,” he underlined.

5. Agreement on “principles” for cyber security of networks

And that makes two: after the telecoms package, the passed Latvian EU Presidency reached a political agreement with the European Parliament on the cyber security of networks during the evening of 29 June. They agreed on general principles, which will then need to be refined into concrete wording during the forthcoming three-way meetings under the Luxembourg Presidency of the Council. According to these principles, and as desired by the Council, internet services will be included in the “networks” that must report computer-related incidents to which they fall victim. The regime applying to these services will, however, be lighter than that which will apply to networks considered as “critical”. On the other hand, if this regime is eased, it will also be more harmonised. The underlying idea is that “critical” networks fall under national security, an area that is beyond the limits of EU law for many Member States. The states will therefore be free to define the networks that they consider to be “critical” or not, but according to criteria set at European level. For the Commission, it is now “essential that there are clear common criteria to identify the critical infrastructures, for example energy, transport, financial services and health,” indicate its services. It is also highlighted that discussions on cooperation mechanisms are “on the right track”: Council and Parliament agreed on setting up cooperation groups and networks to improve the fight against risks and incidents.

European Data Protection Supervisor Giovanni Buttarelli published his recommended version of the data protection regulation today (27 July) and launched a mobile app that compares his suggestions to the three proposals from the European Parliament, Commission and the Council.   

The three proposals currently at the centre of negotiations are "not the ideal reform," Buttarelli said. His proposal for the data protection regulation is significantly shorter than the proposals from the Parliament, Commission and Council. He has criticised the institutions for including details he says won’t be flexible enough in practice or open to future changes in technology. The three institutions started informal “trialogue” talks in June and are expected to conclude with a compromise draft law by the end of the year. If negotiators reach an agreement by early 2016, a two-year transition period will follow before the data protection regulation goes into effect in all EU Member States. The European Data Protection Supervisor is not involved in drafting legislation but advises EU institutions and publishes opinions on privacy issues. Buttarelli said, “If it takes four years to discuss a piece of legislation, technology changes. The kind of internet we know today will be entirely different five years from now because of the internet of things.” One of the articles Buttarelli said needed attention addresses companies’ ability to collect data for purposes other than the ones their customers first agreed to.

According to Buttarelli, that shouldn’t be allowed. “Purpose limitation is one of the pillars of data protection around the world. We cannot minimise or alter it. It should stay, full stop,” Buttarelli said. The Council’s proposal suggested data can be processed for other purposes if the data controller has a “legitimate interest.” Biometric data, which can identify a person’s appearance or behaviour, will also need to be redefined a few years from now, according to Buttarelli. Because companies headquartered outside Europe will still have to comply with European data protection rules if they process Europeans’ data, Buttarelli said the new reform package is drawing a lot of attention from other countries. “An increasing number of countries around the world have difficulties understanding what the trialogue is,” Buttarelli said. “There’s one text from the Commission and one from the Council, and they don't understand what the outcome is, what the process is, or what the deadlines are.

Buttarelli said the app his office launched today will be good for the transparency of the trialogue meetings, which have attracted criticism for being secretive. Trialogue meetings are informal, closed-door negotiating sessions during which the Parliament and Council agree to a compromise draft law. The app lines up the institutions’ proposals, as well as the Supervisor’s recommended version, in columns next to each other and highlights differences between the texts. Users can search for terms and add comments. The app does not require special permissions to access users’ data.

A spokesperson for the supervisor said the version for Apple does not connect to users’ iClouds. “It is a test for the institutions to better communicate in terms of transparency by using modern tools, particularly in this case where these texts only appear together, the three, on one website of an NGO,” Buttarelli said. EurActiv previously reported that the European Ombudsman, who investigates maladministration in EU institutions, had opened an inquiry into the transparency of trialogue meetings. Her office asked the Commission, Council and Parliament to respond to questions by September. Ombudsman spokeswoman Gundi Gadesmann said of the Data Protection Supervisor’s new app, “Every effort to make it easier for citizens to follow trialogues and to enable them to compare different positions that emerge during the law-making process is very welcome indeed.” The app will update when trialogue meetings on the data protection reform resume in September. “Perhaps it will be a benchmark. Can you imagine the same app applied to Brexit discussion?” Buttarelli said. It can be downloaded here.

New German rules for government cloud computing means official data can only be processed in Germany. The restrictions are a strike against US-based cloud providers such as Amazon and Google. German IT officials agreed on terms for public sector cloud use on Tuesday (18 August). “Cloud providers have to sign a non-disclosure agreement, according to which these data aren't allowed to end up in foreign disclosure obligations and access abilities that can be used against cloud providers outside the Federal Republic of Germany,” the rules specify. The caveat about cloud providers that are beholden to foreign disclosure obligations alludes to the American tech companies that have been legally required to share client information with US intelligence agencies. The document also limits German government offices to only using clouds certified by the government's IT security office BSI, or by equally strict standards. Germany is planning a “Bundescloud” to host government data as part of a larger move to slim down several government ministry IT services. The new rules on government cloud use only affect national agencies, but the Federal Ministry of the Interior is nudging the private sector to follow its lead.

The government called the measures “a signal that others can orient themselves around, like for example the IT industry with its cloud services.” A number of other EU Member States have issued guidelines for consumer and government use of cloud computing that generally outline concerns for data protection and other considerations, primarily focused on security. But Germany's new rules get to the heart of the cloud industry's achilles heel: Almost 40% of European companies using clouds named security as the main factor limiting their use, according to Eurostat's most recent reading of attitudes towards clouds. The European Commission will start consulting with businesses, government regulators and others on cloud use this fall ahead of proposals anticipated for next year as part of its digital single market plans. The inquiry will focus on cloud company certification, contracts and setting up a European cloud for research. Despite broad reluctance about security concerns, the Commission talked up the potential of clouds in its May digital single market announcement, citing a potential €450 billion clouds could add to the EU's GDP over the next five years.

For consumers who are wary of cloud security, plans to build up cloud use between EU Member States might not ease concerns. Various studies have showed German companies are warming up to clouds, though 57% of those polled said they'd prefer their company data be processed within Germany. Cloud providers can qualify for the 'German cloud' certification if their servers and company headquarters are in Germany. Veerle Türling, spokesperson for Cloud Ecosystem, the organisation that approves German cloud and other certification, said about 85% of the small and mid-sized cloud providers certified by Cloud Ecosystem process data only in Germany. The Commission wants to dispel reluctance towards data processing in other EU countries, as its inquiry over cloud use approaches next month. According to the Commission's digital single market strategy, “Data localisation requirements can in fact limit the benefits offered by digital services such as cloud computing as they create barriers to EU cross-border data transfers, limiting the competitive choice between providers and raising costs by forcing organisations and companies to store data on servers physically located inside a particular Member State.” Commission spokesperson Nathalie Vandystadt said of Germany's new rules on cloud use, “The European Commission supports such individual initiatives from Member States that aim to build trust in cloud computing.  However, common solutions at European level are necessary to avoid the fragmentation of the market and to create jobs and growth for the digital economy in Europe.”

The data revolution is so pervasive that it’s hard to predict which sectors of the economy are going to be hit first, said Robert Madelin in an interview with the online news portal EurActiv. The senior EU official warned lawmakers against being too restrictive on privacy protection, saying it was “utopian” to believe that citizens should always be “enabled to hide”.

“I think data and the free flow of data, which is the goal of the Digital Single Market, is a big new vision,” he told EurActiv. “Big data is going to come everywhere,” he said, adding it was hard to predict which sectors will grow fastest – whether in energy, health or other industrial sectors. “We are at a time of such pervasive disruption and accelerated change thanks to digital, that anything might be the next big winner.” “But I don't think that anyone would dispute that the notion of data and data analytics taken together is here forever and in all sectors.

Asked whether privacy issues risked hindering the digital economy, he said he did not believe so. “Everyone would agree that getting data right is crucial for the digital age,” he said, adding the General Data Protection Regulation (GDPR) will be part of that. He admitted nonetheless that digital privacy was a serious concern for society at large. “At the moment we are living through a phase of transition, where part of the moral panic is related to the profound disruption of the data age.” But to him, privacy issues may have been overstated. Data protection rules only apply in case of personal information but the vast majority of the data generated in the digital age is of a completely different nature, he said. “The biggest data at the moment is from things like the Pluto fly-by and the Large Hadron Collider,” which are not personal, he said. “So we shouldn't assume that all the instances of big data that matter will be B2C and therefore have a personal data component.” “We probably underestimate today the proportion of data available in a decades time that will not be personal data; that will either be anonymised or be a-personal,” he continued, citing as examples the data generated by sensors on a road bridge or from the next generation of Eiffel towers. And when the data does become personal, Madelin said it will fall under the General Data Protection Regulation, which is currently being negotiated by the EU institutions. And this, he said, means that individuals will have to give their consent – “effectively, explicitly, case-by-case”.

But he strongly rejected suggestions that personal data should be treated differently, for example when dealing with sensitive information such as people’s health records. “We should absolutely not go sectoral, but implement horizontal, principle-based regulation at the highest possible level,” Madelin contended, saying sector-agnostic rules are “far easier for innovation to accommodate than very specific stuff.” He even turned the question around, wondering whether it was ethical to refuse sharing personal data in areas such as medical research. Taking the genome as an extreme example, he asked: “If big data plus my genome plus everybody else’s genome can save lives, do I have the right to say ‘no I don’t want to share my genome with society’?” According to Madelin, this is “a social problem that cannot be fixed by putting more and more effort into hiding”. For example, limits could be placed on insurance premium variation, he said. Or social provisions could be increased to help cover the extra insurance cost that the market will not provide for certain individuals.