EDRI-gram - Number 3.3, 9 February 2005

Rapporteur demands co-decision data retention

The rapporteur from the European Parliament on telecommunication data retention, Alexander Alvaro, has presented his first views on the draft framework decision in a turbulent meeting from the Committee on Civil Liberties, Justice and Home Affairs (LIBE). Alvaro proposed on 1 February 2005 to split the proposal in two, and give the European Parliament full co-decision power on the decision where it affects the internal market, on the costs and the exact list of data. Currently, the European Parliament only has a 'consultation' right on this issue. It cannot veto or amend the proposed decision, since it is considered third pillar legislation (police and judicial cooperation in criminal matters). Only the ministers from the EU member states can decide about these matters, if they reach unanimity. Alvaro doubts whether the proposal can ever meet the demands of proportionality when it comes to the Internet. He finds the proposal lacks proportionality, is in possible violation of the assumption of innocence, and contrary to the spirit of Article 15 of the E-Privacy Directive of 2002, which only allows for specific and temporary legal measures by member states, not for a harmonising decision. Concluding, he demanded a maximum term of 6 months, a limitation to data already processed by companies for business purposes and rules for general cost reimbursement.

The representative from the European Commission expressed some doubts about the legal basis and underlined the high cost for firms. In the following exchange of views a vast majority of LIBE-members agreed the initiative from the Council should be withdrawn and that instead the Commission should come up with a proposal, giving the desired co-decision to Parliament.

Edith Mastenbroek (PES/NL) agreed with Alvaro in her speech. She demanded proof of the proportionality of the proposal to store data about the communication data of all Europeans for a period of 1 to 3 years. She also raised the issue of inherent new security risks by creating giant databases with sensitive personal information.

Mastenbroek's earlier questions to the Council about proportionality and democratic content of the procedure are still unanswered. Amongst others, she wanted to know how democratic it is to force member states to review any derogation from the minimum list of data annually. The Council register shows two recent documents relating to a possible answer to these questions, both not publicly available, one a 'preliminary draft reply' and the other one 'a corrigendum to the preliminary draft reply', both addressed from the Council to the permanent representatives of the Member States (Coreper). Earlier 'draft replies' from the Council, dating back to 28 October and 18 November 2004 have not become public either.

On 3 February 2005, the legal affairs committee of the European Parliament (JURI) decided to ask the Parliament's legal service for advice on the co-decision powers of the Parliament in this matter. The European Parliament is scheduled to vote on the report in June 2005, after formal adoptation by the LIBE committee, scheduled for the session of 25 and 26 April. LIBE will have a formal discussion on the report on 30 and 31 March 2005.

Draft working document Alexander Alvaro (full version in German, 31.01.2005)
http://www.edri.org/issues/dataretention/alvaropaper

Oral question Edith Mastenbroek to the Council (28.10.2004)
http://tinyurl.com/47xu4

Overview of Council documents relating to data retention
http://tinyurl.com/3ks8a

EP committee wants new software patents proposal

On 2 February 2005 the legal affairs committee of the European Parliament (JURI) voted with an overwhelming majority (19-2) to get rid of the current software patent proposal and start all over again with a new proposal. Only 1 MEP voted against the initiative, and 1 MEP was absent.

The former French prime minister Michel Rocard gave an impressive speech in the JURI committee. With all respect for the new Commissioner for the internal market, Charlie McCreevy, he said he and other MEPs felt "mustard was coming through their noses". A first 'inelegance' Rocard noted was the fact that all the EP amendments in the first reading of the proposal had been ignored by Commission and Council. Secondly, the ministers of Germany and The Netherlands had ignored their own parliaments. Thirdly Rocard opposed the repeated attempts to adopt the proposal in the wrong forum of ministers, twice even at a Fishery Council. Rocard concluded his speech by explaining once more why the word 'technical' in the Council proposal couldn't help anybody distinguish between what is patentable and what is not.

According to IDG news service, the day after the JURI vote the Luxembourg deputy foreign minister Nicolas Schmit said as chair of the EU he would ask the Council of External Relations to formally adopt the draft directive on 17 February 2004 anyway. It is unclear if this fourth attempt will succeed. The president of the European Parliament will consult the leaders of the political groups on the outcome of the JURI vote and can decide to formally ask the Commission to respect the will of the parliament and start all over again.

European Parliament JURI Committee votes for restart with massive majority (02.02.2005)
http://kwiki.ffii.org/Restart050202En

Speech Michel Rocard (unofficial English translation, 02.02.2005)
http://wiki.ffii.org/RocardJuri050202En

E.U. ministers, Parliament clash on patent legislation (03.02.2005)
http://www.itworld.com/Man/2687/050203eupatent/

Two Unesco conferences on internet and human rights

In preparation for the second phase of WSIS, in November 2005 in Tunis, Unesco has organised two conferences on the Internet and human rights.

On 3 and 4 February Unesco organised a special meeting on online freedom of expression inside of the Paris headquarters. Attended by over 300 delegates from countries all over the world, the conference addressed the applicability of media-law, the limits to freedom of expression, the right of reply, the right to access government information and models of self-regulation.

The director-general of Unesco, Mr. Koichiro Matsuura, kindly opened the conference with a strong speech in which he reminded everybody of the need to uphold the right to full freedom of expression, even in times of fear of terrorism. He stressed that this right does not distinguish between good or bad information, but is about the free flow of ideas, including for example racist speech, which should be debated in the open.

Thanks to frank questions from delegates about the need to regulate what they considered harmful content, an interesting and sometimes heated debate followed after most of the panels. Should there be any limits to freedom of expression or should speech be completely separated from action, and thus be left free, such as Spiked-journalist Sandy Starr argued? Many representatives from renowned human rights organisations such as Article 19 disagreed, pointing for example to screaming fire in a crowded theatre or threatening to torture somebody. But Gus Hosein from Privacy International pointed out that the case was about 'falsely screaming fire' and secondly, the Supreme Court Justice in the US who came up with that argument to set limits to freedom of speech only a few months later disagreed with it, and called for a protection of all ideas for the marketplace of ideas.

Helen Darbishire, director of the Open Society Justice Initiative presented interesting figures about access to government information. In 2004 she sent out 140 open access requests to government officials in 16 countries. A remarkable outcome was the fact that the new EU member states perform a lot better than the old democracies. In general, local authorities are more open than national ones, oral requests are usually ignored, and journalists, especially if working for a 'neutral' publication, tend to get much more information than citizens or NGOs do. Darbishire recommended strengthening of access to information standards when it comes to cost, to timeframes (preferably answers should be given within 10 to 20 days), and to information held by commercial and supranational bodies and corporations, such as for example the IMF, the World Bank and the United Nations.

In the final panel, on codes of conduct, Hosein warned the audience how far we have drifted from the promise of free speech as enshrined in law and jurisprudence. Free expression is restrained through weakened legal protection (private censorship through ISP codes of practice and international co-operation), chilled through increase surveillance (access to traffic data and retention), and inattentiveness particularly in the WSIS process and calls for 'balance'.

In the end, the Paris organisers were unable to solve the differences in opinion and decided not to produce a general statement or declaration.

The Dutch Unesco Commission also organised a conference on the Internet and human rights on 4 and 5 February, in Oegstgeest in the Netherlands. The Dutch conference addressed privacy as a pivotal human right, enabling freedom of communication.

Rikke Frank Joergensen, from the Danish Institute for Human Rights and EDRI-member Digital Rights Denmark, outlined the principles of positive and negative state obligations in an excellent keynote speech. WSIS should not just focus on the roll-out of technology, but on a positive agenda to promote human rights, starting with the off-line world. Many delegates during the first WSIS meeting in Geneva, she added, were very happy to talk about cables and nifty new technology, but not very keen on actually dealing with fundamental human rights. Joergensen also made it clear that it is crucial to be careful with metaphors to understand the Internet. It is both a medium, a media and a public place and cannot be understood by applying off-line rules from one of these domains.

Peter Noorlander from Article 19 stressed in his keynote speech that access to information is not a woolly concept, but based on hard human rights law. And it shouldn't just address government information, but a much larger heritage of knowledge and ideas, to honour the obligations in the Universal Declaration of Human Rights that all human beings have the right to freely "seek, receive and impart information and ideas through any media and regardless of frontiers."

Finally Hosein (present at both conferences) attacked the assumption of many politicians that there is a need to 'balance' privacy against security rights. By analysing three recent cases (the EU plans for data retention, the introduction of biometrics in passports and the confiscation of servers of Indymedia), he was able to demonstrate some more false assumptions, like the idea that international treaties are good and necessary and that technology means progress. In all, the false assumptions are leading us to a society where democratic checks and balances are removed, and rethoric seems aimed at reducing the democratic process by attacking its very legitimacy.

The Dutch Unesco commission will produce a set of recommendations shortly. These will not only be brought forward to the WSIS, but also presented to the Council of Europe. Initiated by the Netherlands, the Council is working on a new declaration on human rights and the Internet (See EDRI-gram 2.25, item 3). Concluding the conference, the representative from the Dutch ministry of internal affairs promised he would bring the conference recommendations to the table as an essential part of the Dutch viewpoint.

Unesco Paris conference site (03/04.02.2005)
http://portal.unesco.org/ci/en/ev.php-URL_ID=17907&URL_DO=DO_TOPIC...

E-zine Spiked
http://www.spiked-online.com/

Article 19: global campaign for free expression
http://www.article19.org/

Open Society Justice Initiative
http://www.justiceinitiative.org

Privacy International
http://www.privacyinternational.org

Digital Rights Denmark
http://www.digitalrights.dk/

Article 29 consultations on RFID and DRM

The EU Data Protection Working Party is calling for public comments on two working documents on emerging technologies. One document explores the privacy implications of RFID chips, the other document covers digital management of rights systems (DRM).

The RFID document outlines the potential use of RFID technology in various sectors and the need to comply with the basic principles set out in the EU data protection directives whenever personal data are collected using RFID technology. The paper also provides guidance to manufacturers of the technology (RFID tags, readers and applications) as well as RFID standardisation bodies. They have a responsibility to design privacy compliant technology in order to enable deployers of the technology to carry out their obligations under the data protection directives.

The document points out that the privacy implications of RFID chips are not limited to cases where unique serial numbers are linked to an identity. The Working Party concludes that unwanted individual tracking, without a link to the identity of the data subject, also falls within the scope of the data protection Directive. This means that data protection rules will apply to a very broad spectrum of RFID applications.

".. Even if the individual is not immediately and directly identified at the item information level, he can be identified at an associative level because of the possibility of identifying him without difficulty via the large mass of information surrounding him or stored about him. Furthermore, the data collected from him can influence the way in which that person is treated or evaluated. This RFID use also carries serious data protection implications."

The DRM document covers the deployment of on-line services using DRM systems and the processing of personal data to conduct investigations of users suspected of copyright infringement.

The Working Party is concerned about the fact that the legitimate use of technologies to protect works could be detrimental to the protection of personal data of individuals. As for the application of data protection principles to the digital management of rights, it notices an increasing gap between the protection of individuals in the off-line and on-line world, especially considering the generalised tracing and profiling of individuals.

"The Working Party seriously questions the use of identifiers for the purpose of tracing 'a priori' every user, in order to go back to a specific individual in case of a suspected copyright abuse. The tagging of a document should not be linked to an individual except if this link is necessary for the performance of the service or if the individual has been informed and has consented to it."

The working paper also mentions the link between data retention and copyright enforcement. "ISPs can neither be obliged, except in specific cases where there is an injunction of enforcement authorities, to provide for a general 'a priori' storage of all traffic data related to copyright."

As far as the investigation powers are concerned, the Working Party urges that investigations performed by private actors such as copyright holders must be performed in a clear legal framework, especially as to the information that can legally be collected.

Interested parties are invited to submit their comments to both documents before 31 March 2005.

Working document on data protection issues related to RFID technology (19.01.2005)
http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2005/wp1...

Working document on data protection issues related to intellectual property rights (18.01.2005)
http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2005/wp1...

Data Protection Working Party online consultations
http://europa.eu.int/comm/internal_market/privacy/workingroup/consulta...

Microsoft excludes free software from EU ruling

The Free Software Foundation Europe says Microsoft is blocking Linux, Samba and other major open source projects from taking part in a protocol licensing scheme mandated by the European Commission's antitrust ruling.

If developers want to build the protocols into their products, they must agree not to distribute that product in source-code form, or to subject it to licenses that require source-code disclosure, a formula that excludes many open source licenses.

The European Commission gave Microsoft a record fine of 497 million euro after a five-year investigation by the Competition Commissioner into Microsoft's business practice. The Commission ordered Microsoft to offer a version of Windows without a bundled media player and to share more technical information with server rivals.

According to the Commission's ruling Microsoft's illegal conduct has enabled it to acquire a dominant position in the market for work group server operating systems and has significantly weakened competition on the media player market.

Microsoft announced that it will not further challenge the ruling and will release an additional Windows version for the European market that will have the Windows Media Player code removed from it. The company will also inform competitors about how they can license communications protocols from the Windows Server product.

Industry analysts doubt that an unbundled version of the Windows Operating System will have a serious impact as most PC manufacturers will not see any advantage in shipping PCs without Windows media player.

The Microsoft license for server protocols, ordered by the EU, may now block free software projects like Linux and Samba from taking advantage from the EU ruling. The Free Software Foundation Europe says the Microsoft license will prevent free software developers from competing with Microsoft's Windows Server product.

The Free Software Foundation Europe will take its concerns to the Commission, which may negotiate with Microsoft over the licensing terms.

Free Software Foundation Europe
http://fsfeurope.org/

Microsoft Communications Protocol Program
http://members.microsoft.com/consent/info/LicenseOverview.aspx

Romanian Copyright Office sets fixed fee for online music

The Arbitration Commission of the Romanian Copyright Office (ORDA) has published two remarkable decisions on the price for online music and ring-tones. Romanian internet users will have to pay a fixed annual fee for any music they wish to offer on their website (via streaming or for downloading) of approximately 80 euro (3 million Romanian Lei). If the website owner charges a fee for music to be downloaded, they will have to pay 10% of the fee to the collecting society, with a minimum of 8 eurocent per downloaded track, independent of the origin of the music.

The decisions followed after unsuccessful negotiations between the Romanian Musical Performing and Mechanical Rights Society, the Romanian Association of ISPs and the association of ring-tone providers. The decisions were published in the Official Monitor no. 58 of 18 January 2005. Even though the name of the first decision is 'methodology for using musical works on the Internet' the methodology refers only to web-pages. The copyright owner only has the right to opt-out. He can provide the collecting society with a list of musical works that cannot be used on the Internet.

The Commission also decided on the methodology for using musical works as ring-tones, along the same lines. Providers of ring-tones will have to pay 10% of the fee they charged, with a minimum of 8 eurocent. Again the authors can only opt-out, by providing the collecting society with a list of works that should not be turned into ring-tones.

The ISP association has announced they will appeal the decision, because they still find the 10% charge much too high.

ORDA (Romanian Copyright Office)
http://www.orda.ro

UCMR - ADA (Romanian music collecting society)
http://www.ucmr-ada.ro

ANISP (ISP association)
http://www.anisp.ro

Musical works methodology decision (in Romanian, 18.01.2005)
http://www.legi-internet.ro/utilizare_muzica_pe_internet.htm

Ring tones methodology (in Romanian, 18.01.2005)
http://www.legi-internet.ro/utilizare_ringtonuri.htm

(Contribution by Bogdan Manolea, legal advisor, Romania)

Update ISOC Bulgaria

EDRI-member ISOC Bulgaria has published an overview of activities in 2004. From a strong focus on free and open source software, they initiated an important project to use FOSS on the municipal level. The project is steered by the United Nations Development Programme (UNDP) to help municipal governments in South-eastern Europe use the Internet to better respond to citizens' needs. Bulgaria is the first region to use FOSS applications to enhance government transparency and people's access to municipal services. After Bulgaria, the program will expand to Bosnia and Herzegovina, Croatia, Macedonia, Romania, Serbia and Montenegro.

The mayor of Kardjali, the first pilot municipality in Bulgaria, expressed his appreciation for ISOC-BG publicly, in front of the President of the Republic, for the successful efforts to train and increase computer literacy of the employees and to provide grant free e-government solutions. ISOC-BG also began to work on preliminary criteria for the development of a FOSS based on-line documentation system for municipal administrations.

ISOC-BG participated with two representatives in the Round Table Strategic priorities in the development of Bulgarian education, organised by the Open Society Institute in Bulgaria. ISOC-BG chair Veni Markovski strongly advocated the use of free open source software in schools.

Finally, ISOC-BG has been working on a localised Creative Commons license. The text was finalised in December 2004, and will be published soon in Bulgarian, after approval of the Creative Commons Corporation.

FOSS activities ISOC Bulgaria (in Bulgarian)
http://foss.bg

English overview ISOC Bulgaria
http://www.isoc.bg/index_en.html

(Contribution by Ms. Dragoslava Pefeva, EDRI-member ISOC Bulgaria)

Copyright law revision in Switzerland criticised

Civil rights and consumer organisations in Switzerland have severely criticised a proposal to revise the Swiss copyright law. In October 2004 the Swiss Federal Institute of Intellectual Property opened a consultation about the revision of the Swiss copyright law and asked for comments until the end of January 2005. The revision mainly concerns the implementation of the WIPO Internet Treaties.

Civil rights organisations, political parties and special interest groups broadly criticise the proposed revision. In a joint position paper Wilhelm Tux and EDRI-member SIUG state that the revision points in the wrong direction and that the legal protection of technological measures (the ban on circumvention) overly favours copyright holders.

The revision also underestimates problematic developments that can occur with a broad application of digital rights management (DRM). SIUG and Wilhelm Tux call for an extension of the user-protection against abuse of technological measures, and more generally, for a revision of the copyright law that focusses on the real needs of an open information society.

Similar statements were issued by organisations like Openlaw - a platform for law and free software and consumer oriented groups.

Swiss Federal Institute of Intellectual Property, detailed information about the revision and the consultation in many languages
http://www.ige.ch/E/jurinfo/j103.shtm

Position paper SIUG and Wilhelm Tux (31.01.2005)
http://www.siug.ch/positionen/SIUG-Vernehmlassung-URG.pdf

Position paper Open Law (31.01.2005)
http://www.openlaw.ch/wiki/Stellungnahmen_zur_Urheberrechtsrevision

(Contribution by Daniel Boos, EDRI-member SIUG)

3.300 ID fines in the Netherlands in 1 month

In the first month of the new ID obligations in the Netherlands, the Dutch police have issued 3.300 fines to people who could not immediately show a valid ID when asked. According to the Dutch Public Prosecution Service, the ID checks mainly take place in specific circumstances. "ID control mostly occurs in situations of disorder or possible violence, for example at night in entertainment districts. Also in situations with an elevated risk of disorder, such as soccer matches, the police may verify the identity."

In reality, the main result of the new ID obligations is a major increase in fines. People cycling on their bicycle without light for example, will get two fines. The Public Prosecution Service has indicated clearly it wants to make an example. "The main rule is there will be few escapes available for people who can't immediately present their ID. There is no right to an easy-going treatment, because it will in the end undermine the value of mandatory ID for law enforcement."

If the current wave of fines continues, at the end of this year the police will have issued around 40.000 fines, thus creating a large new group of criminal offenders. A debate in the Dutch Lower House about the obligation for mentally handicapped people to carry their ID was ended by Minister Donner with characteristical logic. "It cannot be imagined that a person is in such a condition that his caretakers won't trust him with ID, but will let that person walk on the street unaccompanied." Twisting this logic even further, he said that the ID-obligation would diminish the risk of them getting lost. In case they would have an ID on them, the police could bring them home, if they wouldn't have an ID they would be brought to a police station.

3300 keer geen identificatie op zak (in Dutch, 02.02.2005)
http://www.om.nl/info/nieuws.php?p=pg&id=4358

NL police massively fines citizens without ID
http://www.edri.org/edrigram/number3.1/ID

European countries promise collaboration against spam

The European Commission has issued a press release announcing stronger collaboration between anti-spam enforcement authorities in Europe. "Anti-spam enforcement authorities in 13 European countries have agreed to share information and pursue complaints across borders in a pan-European drive to combat spam. They will co-operate in investigating complaints about cross-border spam from anywhere within the EU, so as to make it easier to identify and prosecute spammers anywhere in Europe."

There are still very few public hotlines in Europe where internet users can report spam. These hotlines usually only accept complaints about unsolicited e-mail originating in their own country. In that light, the promise of closer collaboration between European authorities seems a bit futile, if the final recipients of the mail, the Internet users, are not involved.

European countries launch joint drive to combat spam (07.02.2005)
http://europa.eu.int/rapid/pressReleasesAction.do?reference=IP/05/146&...

Agenda

14-16 February 2005, Geneva, Switzerland
WSIS Working Group on Internet Governance meeting
http://www.wgig.org
http://www.worldsummit2005.org

17-25 February 2005, Geneva, Switzerland
WSIS PrepCom 2
http://www.wsis.org
http://www.worldsummit2005.org

17-18 March 2005, Amsterdam, The Netherlands
First European Creative Commons meeting
http://www.creativecapital.nl

31 March 2005, deadline call for papers on DRM
Special session on Digital Rights Management during the 31st Euromicro conference on Software Engineering and Advanced Applications (SEAA) 2005 in Porto, Portugal. This special session is open to discuss technical, legal and business issues with DRM and the social aspects regarding users understanding and fair use. Papers should be around 6-8 pages (not exceeding 6000 words) and include an abstract.
http://www.idt.mdh.se/euromicro-2005/

6-8 April 2005, Belfast, Ireland, BILETA 2005
Over-Commoditised; Over-Centralised; Over-Observed: the New Digital Legal World?
http://www.law.qub.ac.uk/bileta2005/callforpapers.html

12 April 2005, Deadline funding applications
Civil rights organisations and initiatives are invited to send funding applications to the German foundation 'Bridge - Bürgerrechte in der digitalen Gesellschaft'. A total of 15.000 euro is available for applications that promote civil rights in the digitised society.
http://www.stiftung-bridge.de

12-15 April 2005, Seattle, USA, CFP 2005
The program committee of the annual Computer, Freedom, Privacy Conference is accepting proposals for conference sessions and speakers for CFP2005. The deadline for submissions is 31 December 2004. The conference will be held in the Westin Hotel in Seattle, Washington.
http://www.cfp2005.org

14-16 Aprile 2005, Padova, Italy, FLOSS 2005
http://www.floss2005.org/

6-11 June 2005, Benevento (Naples), Italy
Digital Communities 2005
http://www.ssc.msu.edu/~espace/DC2005.html

11-15 July 2005, Genova, Italy, OSS 2005
http://oss2005.case.unibz.it/index.html

28-31 July 2005, Den Bosch, The Netherlands
What The Hack, major open air hacker / internet lifestyle event
http://www.whatthehack.org/

8-9 September 2005, Brussels, Belgium
EuroSOCAP Workshop on confidentiality and privacy in healthcare. 3 year programme to develop new ethical standards for privacy and patient access to (electronical) files, started on 31 january 2003.
http://www.eurosocap.org