Opinion of the European Data Protection Supervisor, April 24, 2012
Read full text of opinion:
Opinion of the European Data Protection Supervisor
Conclusions
-
While the EDPS acknowledges the legitimate concern of ensuring the enforcement of IP rights in an international context, a right balance must be struck between demands for the protection of IP rights and the rights to privacy and data protection.
-
The EDPS emphasizes that the means envisaged for strengthening enforcement of IP rights must not come at the expense of the fundamental rights and freedoms of individuals to privacy, data protection and freedom of expression, and other rights such as presumption of innocence and effective judicial protection.
- Many of the measures envisaged in the Agreement in the context of enforcement of IP rights in the digital environment would involve the monitoring of users' behaviour and of their electronic communications on the Internet. These measures are highly intrusive to
the private sphere of individuals and, if not implemented properly, may
therefore interfere with their rights and freedoms to, inter alia, privacy, data protection and the confidentiality of their communications.
- The EDPS has furthermore specific concerns in relation to several provisions of the Agreement, in particular:
- the Agreement is unclear about the scope of enforcement measures in the
digital environment envisaged in Article 27, and whether they only
target large-scale infringements of IP rights. The notion of 'commercial
scale' in Article 23 of the Agreement is not defined with sufficient
precision, and acts carried out by private users for a personal and
not-for profit purpose are not expressly excluded from the scope of the
Agreement;
- the
notion of 'competent authorities' entrusted with the injunction power
under Article 27(4) of the Agreement is too vague and does not provide
sufficient certainty that the disclosure of personal data of alleged
infringers would only take place under the control of judicial
authorities. Furthermore, the conditions to be fulfilled by right
holders to be granted such an injunction are also not satisfactory.
These uncertainties may have a particular impact in cases of requests
from foreign 'competent authorities' to EU-based ISPs;
- many
of the voluntary enforcement cooperation measures that could be
implemented under Article 27(3) of the Agreement would entail a
processing of personal by ISPs which goes beyond what is allowed under
EU law;
- the
Agreement does not contain sufficient limitations and safeguards in
respect of the implementation of measures that entail the monitoring of
electronic communications networks on a large-scale. In particular, it
does not lay out safeguards such as the respect of the rights to privacy
and data protection, effective judicial protection, due process, and
the respect of the principle of the presumption of innocence.