Tuesday

15th Oct 2019

Column / Brussels Bytes

EU e-privacy proposal risks breaking 'Internet of Things'

  • The 'Internet of Things' is linking traditional online devices - such as computers and smartphones - to everyday items such as fridges, thermostats and music systems. (Photo: Marcus JH Brown/Flickr)

The 'Internet of Things' - smart devices that transmit data over a network - offer myriad benefits to European society, from helping people keep track of their fitness and providing drivers with live traffic information, to monitoring air quality and automating homes and factories.

But the forthcoming ePrivacy Regulation (ePR) could throw sand in the gears of such progress by unnecessarily regulating Internet of Things (IoT) devices.

Read and decide

Join EUobserver today

Support quality EU news

Get instant access to all articles — and 18 year's of archives. 30 days free trial.

... or join as a group

  • Items within your own household could 'talk' to each other - in the way that email connected the world (Photo: internetfestival.it)

To fix the problem, EU policymakers need to clarify that the ePR should not apply to most IoT devices.

In contrast to the General Data Protection Regulation (GDPR), which imposes strict limits on how companies can use personal data in general, the ePR proposes even stricter rules to protect the secrecy of electronic communications, like emails and voice calls.

The ePR would prohibit all data processing not necessary to provide a service and require explicit user consent in all cases, while the GDPR is more flexible.

Smartwatches and baby monitors

The European Commission's latest draft of the ePR stresses that it applies to machine-to-machine (M2M) transmissions, which would include all the data flowing between IoT devices, but the proposal makes no distinction between M2M transmissions that contain human communications, like smartwatches and baby monitors, and those that do not, like internet-connected air and water quality sensors.

For example, the ePR proposal could require drivers using live traffic information services to consent to data processing each time their car enters the range of a new sensor network and tries to exchange data with road sensors.

This is not practical.

Drivers cannot safely study a privacy agreement and truthfully confirm having read, understood, and agreed while navigating traffic.

The GDPR, on the other hand, would allow pre-existing contracts with the driver as a substitute for direct consent, and even that would only be necessary if the transmission carries personal data.

Not feasible

Clearly not all M2M transmissions involve interpersonal communications, and treating them as if they do would render many services that rely on this data inconvenient at best, and unfeasible at worst.

The GDPR already provides adequate protection for the privacy of personal information transmitted by IoT devices, while devices that transmit neither personal information nor private communications between people, like air quality monitors, need not be subject to either law.

The heart of the problem is that the ePR does not clearly specify which types of M2M transmissions the regulation would apply to.

Before the ePR becomes law, EU policymakers should clarify the regulation so that it only covers services that enable communications between people.

Indeed, there is a proposal before the Council of the European Union to exclude M2M services from the ePR, except where they enable "interpersonal and interactive communication."

Such a change would mean the ePR protects communications that rely on M2M transmissions, like voice conversations, while M2M services that carry personal data but are not for communications between people, like fitness tracking, would fall under the general provisions of the GDPR.

Transmissions that contain neither communications between people nor personal data need not be subject to any privacy rules at all.

EU policymakers have already created major problems for Europe's digital economy with the GDPR, which imposes several unnecessary restrictions—particularly on the use of artificial intelligence—that will undermine technological innovation in Europe, often without increasing consumer protection.

By adding even tighter restrictions, the ePR is likely to further limit EU digital innovation.

But unlike the GDPR, the ePR is not yet finalised, and policymakers can still easily change it. The scope of the ePR is needlessly broad, and policymakers should narrow it down while they still have the opportunity.

Nick Wallace is a Brussels-based senior policy analyst at the Centre for Data Innovation. His Brussels Bytes column deals with the digital single market and data-related policy issues in the European Union

Column / Brussels Bytes

ECJ should rule against Austrian online censorship lawsuit

EU judges have an opportunity to make clear that no member state can decide what the rest of the world reads online, now that Austria's Supreme Court has referred the Glawischnig case to the European Court of Justice.

Column / Brussels Bytes

Some EU regulators still don't get internet economics

New EU data protection rules threaten the European digital economy, but recent actions by some national regulators remind us why EU-wide rules cannot come soon enough.

Some EU states face delays in 5G preparation

National governments secured a one-year extension for publishing plans to make radio frequencies available for mobile communications - but some were nevertheless unable to meet the deadline.

Exclusive

EU official proposed covering up wifi portal flaw

Director of Electronic Communications Networks and Services Anthony Whelan says in an internal document that he wanted to eliminate "possible criticisms" and "marginalise questions".

News in Brief

  1. OSCE: Polish elections spoiled by 'homophobic rhetoric'
  2. Barcelona airport clashes after Catalan leaders jailed
  3. US: Erdogan responsible for possible Isis 'resurgence'
  4. Irish foreign minister: Brexit deal 'possible this week'
  5. UK refuses to join EU arms ban on Turkey
  6. Denmark plans to strip foreign fighters of citizenship
  7. Spain issues European arrest warrant for Puigdemont
  8. Possible delay to launch of new EU commission

Are EU data watchdogs staffed for GDPR?

The success of the new general data protection regulation (GDPR) will depend on whether data protection authorities enforce the new rules - which, in turn, will be at least partly determined by how many people they employ.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

Stakeholders' Highlights

  1. Nordic Council of MinistersBrussels welcomes Nordic culture
  2. UNESDAUNESDA appoints Nicholas Hodac as Director General
  3. UNESDASoft drinks industry co-signs Circular Plastics Alliance Declaration
  4. FEANIEngineers Europe Advisory Group: Building the engineers of the future
  5. Nordic Council of MinistersNew programme studies infectious diseases and antibiotic resistance
  6. UNESDAUNESDA reduces added sugars 11.9% between 2015-2017
  7. International Partnership for Human RightsEU-Uzbekistan Human Rights Dialogue: EU to raise key fundamental rights issues
  8. Nordic Council of MinistersNo evidence that social media are harmful to young people
  9. Nordic Council of MinistersCanada to host the joint Nordic cultural initiative 2021
  10. Vote for the EU Sutainable Energy AwardsCast your vote for your favourite EUSEW Award finalist. You choose the winner of 2019 Citizen’s Award.
  11. Nordic Council of MinistersEducation gets refugees into work
  12. Counter BalanceSign the petition to help reform the EU’s Bank

Stakeholders' Highlights

  1. UNICEFChild rights organisations encourage candidates for EU elections to become Child Rights Champions
  2. UNESDAUNESDA Outlines 2019-2024 Aspirations: Sustainability, Responsibility, Competitiveness
  3. Counter BalanceRecord citizens’ input to EU bank’s consultation calls on EIB to abandon fossil fuels
  4. International Partnership for Human RightsAnnual EU-Turkmenistan Human Rights Dialogue takes place in Ashgabat
  5. Nordic Council of MinistersNew campaign: spot, capture and share Traces of North
  6. Nordic Council of MinistersLeading Nordic candidates go head-to-head in EU election debate
  7. Nordic Council of MinistersNew Secretary General: Nordic co-operation must benefit everybody
  8. Platform for Peace and JusticeMEP Kati Piri: “Our red line on Turkey has been crossed”
  9. UNICEF2018 deadliest year yet for children in Syria as war enters 9th year
  10. Nordic Council of MinistersNordic commitment to driving global gender equality
  11. International Partnership for Human RightsMeet your defender: Rasul Jafarov leading human rights defender from Azerbaijan
  12. UNICEFUNICEF Hosts MEPs in Jordan Ahead of Brussels Conference on the Future of Syria

Join EUobserver

Support quality EU news

Join us