Friday

27th May 2022

Brussels Bytes

EU e-privacy proposal risks breaking 'Internet of Things'

  • The 'Internet of Things' is linking traditional online devices - such as computers and smartphones - to everyday items such as fridges, thermostats and music systems. (Photo: Marcus JH Brown/Flickr)

The 'Internet of Things' - smart devices that transmit data over a network - offer myriad benefits to European society, from helping people keep track of their fitness and providing drivers with live traffic information, to monitoring air quality and automating homes and factories.

But the forthcoming ePrivacy Regulation (ePR) could throw sand in the gears of such progress by unnecessarily regulating Internet of Things (IoT) devices.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

  • Items within your own household could 'talk' to each other - in the way that email connected the world (Photo: internetfestival.it)

To fix the problem, EU policymakers need to clarify that the ePR should not apply to most IoT devices.

In contrast to the General Data Protection Regulation (GDPR), which imposes strict limits on how companies can use personal data in general, the ePR proposes even stricter rules to protect the secrecy of electronic communications, like emails and voice calls.

The ePR would prohibit all data processing not necessary to provide a service and require explicit user consent in all cases, while the GDPR is more flexible.

Smartwatches and baby monitors

The European Commission's latest draft of the ePR stresses that it applies to machine-to-machine (M2M) transmissions, which would include all the data flowing between IoT devices, but the proposal makes no distinction between M2M transmissions that contain human communications, like smartwatches and baby monitors, and those that do not, like internet-connected air and water quality sensors.

For example, the ePR proposal could require drivers using live traffic information services to consent to data processing each time their car enters the range of a new sensor network and tries to exchange data with road sensors.

This is not practical.

Drivers cannot safely study a privacy agreement and truthfully confirm having read, understood, and agreed while navigating traffic.

The GDPR, on the other hand, would allow pre-existing contracts with the driver as a substitute for direct consent, and even that would only be necessary if the transmission carries personal data.

Not feasible

Clearly not all M2M transmissions involve interpersonal communications, and treating them as if they do would render many services that rely on this data inconvenient at best, and unfeasible at worst.

The GDPR already provides adequate protection for the privacy of personal information transmitted by IoT devices, while devices that transmit neither personal information nor private communications between people, like air quality monitors, need not be subject to either law.

The heart of the problem is that the ePR does not clearly specify which types of M2M transmissions the regulation would apply to.

Before the ePR becomes law, EU policymakers should clarify the regulation so that it only covers services that enable communications between people.

Indeed, there is a proposal before the Council of the European Union to exclude M2M services from the ePR, except where they enable "interpersonal and interactive communication."

Such a change would mean the ePR protects communications that rely on M2M transmissions, like voice conversations, while M2M services that carry personal data but are not for communications between people, like fitness tracking, would fall under the general provisions of the GDPR.

Transmissions that contain neither communications between people nor personal data need not be subject to any privacy rules at all.

EU policymakers have already created major problems for Europe's digital economy with the GDPR, which imposes several unnecessary restrictions—particularly on the use of artificial intelligence—that will undermine technological innovation in Europe, often without increasing consumer protection.

By adding even tighter restrictions, the ePR is likely to further limit EU digital innovation.

But unlike the GDPR, the ePR is not yet finalised, and policymakers can still easily change it. The scope of the ePR is needlessly broad, and policymakers should narrow it down while they still have the opportunity.

Nick Wallace is a Brussels-based senior policy analyst at the Centre for Data Innovation. His Brussels Bytes column deals with the digital single market and data-related policy issues in the European Union

Brussels Bytes

ECJ should rule against Austrian online censorship lawsuit

EU judges have an opportunity to make clear that no member state can decide what the rest of the world reads online, now that Austria's Supreme Court has referred the Glawischnig case to the European Court of Justice.

France 'got its way' as Portugal ends e-Privacy deadlock

EU ambassadors reached a compromise on the e-Privacy reform after four years of deadlock, paving the way for trialogue negotiations. But the text was slammed for allowing "mass surveillance" under national data-retention laws, a crucial win for France.

EU reaches deal on flagship cybersecurity law

The European Parliament and EU member states have reached an agreement over new rules intended to protect Europe's public and private critical entities from cyberattacks.

Stakeholder

The CPDP conference wants multidisciplinary digital future

During the Computers, Privacy and Data Protection (CPDP) conference, many high-level discussions will touch upon the dynamics of decision-making in the design of new technologies, including the importance of inclusion, diversity, and ethics perspectives within these processes.

EU Commission won't probe 'Pegasus' spyware abuse

The European Commission says people should file their complaints with national authorities in countries whose governments are suspected of using an Israeli-made Pegasus spyware against them.

News in Brief

  1. Dutch journalists sue EU over banned Russia TV channels
  2. EU holding €23bn of Russian bank reserves
  3. Russia speeds up passport process in occupied Ukraine
  4. Palestinian civil society denounce Metsola's Israel visit
  5. Johnson refuses to resign after Downing Street parties report
  6. EU border police has over 2,000 agents deployed
  7. Dutch tax authorities to admit to institutional racism
  8. Rutte calls for EU pension and labour reforms

Stakeholders' Highlights

  1. Nordic Council of MinistersNordic delegation visits Nordic Bridges in Canada
  2. Nordic Council of MinistersClear to proceed - green shipping corridors in the Nordic Region
  3. Nordic Council of MinistersNordic ministers agree on international climate commitments
  4. UNESDA - SOFT DRINKS EUROPEEfficient waste collection schemes, closed-loop recycling and access to recycled content are crucial to transition to a circular economy in Europe
  5. UiPathNo digital future for the EU without Intelligent Automation? Online briefing Link

Latest News

  1. EU summit will be 'unwavering' on arms for Ukraine
  2. Orbán's new state of emergency under fire
  3. EU parliament prevaricates on barring Russian lobbyists
  4. Ukraine lawyer enlists EU watchdog against Russian oil
  5. Right of Reply: Hungarian government
  6. When Reagan met Gorbachev — a history lesson for Putin
  7. Orbán oil veto to deface EU summit on Ukraine
  8. France aims for EU minimum-tax deal in June

Join EUobserver

Support quality EU news

Join us