\n<\/p>\n
The European Commission has again been urged to more fully disclose its dealings with private technology companies and other stakeholders, in relation to a controversial piece of tech policy<\/a> that could see a law mandate the scanning of European Union citizens\u2019 private messages in a bid to detect child sexual abuse material (CSAM).<\/p>\n The issue is of note as concerns have been raised about lobbying by the tech industry influencing the Commission\u2019s drafting of the controversial CSAM-scanning proposal. Some of the information withheld relates to correspondence between the EU and private firms that could be potential suppliers of CSAM-scanning technology \u2014 meaning they stand to gain commercially from any pan-EU law mandating message scanning.<\/p>\n The preliminary finding of maladministration by the EU\u2019s ombudsman, Emily O\u2019Reilly, was reached on Friday and made public on its website<\/a> yesterday. Back in January<\/a>, the ombudsman came to a similar conclusion \u2014 inviting the Commission to respond to its concerns. Its latest findings factor in the EU executive\u2019s responses and invite the Commission to respond to its recommendations with a \u201cdetailed opinion\u201d by July 26 \u2014 so the saga isn\u2019t over yet.<\/p>\n The draft CSAM-scanning legislation, meanwhile, remains on the table with EU co-legislators \u2014 despite a warning from the Council\u2019s own legal service that the proposed approach is unlawful<\/a>. The European Data Protection Supervisor and civil society groups have also warned the proposal represents a tipping point for democratic rights<\/a> in the EU. While, back in October<\/a>, lawmakers in the European Parliament who are also opposed to the Commission\u2019s direction of travel proposed a substantially revised draft that aims to put limits on the scope of the scanning. But the ball is in the Council\u2019s court as Member States\u2019 governments have yet to settle on their own negotiating position for the file.<\/p>\n In spite of growing alarm and opposition across a number of EU institutions, the Commission has continued to stand behind the controversial CSAM detection orders \u2014 ignoring warnings from critics the law could force platforms to deploy client-side scanning, with dire implications for European web users\u2019 privacy and security.<\/p>\n An ongoing lack of transparency vis-\u00e0-vis the EU executive\u2019s decision-making process when it drafted the contentious legislation hardly helps \u2014 fueling concerns that certain self-interested commercial interests may have had a role in shaping the original proposal.<\/p>\n Since December, the EU\u2019s ombudsman has been considering a complaint by a journalist who sought access to documents pertaining to the CSAM regulation and the EU\u2019s \u201cassociated decision-making process\u201d.<\/p>\n After reviewing information the Commission withheld, along with its defence for the non-disclosure, the ombudsman remains largely unimpressed with the level of transparency on show.<\/p>\n The Commission released some data following the journalist\u2019s request for public access but withheld 28 documents entirely and, in the case of a further five, partially redacted the information \u2014 citing a range of exemptions to deny disclosure, including public interest as regards public security; the need to protect personal data; the need to protect commercial interests; the need to protect legal advice; and the need to protect its decision-making.<\/p>\n According to information released by the ombudsman, five of the documents linked to the complaint pertain to \u201cexchanges with interest representatives from the technology industry\u201d. It does not list which companies were corresponding with the Commission, but U.S.-based Thorn, a maker of AI-based child safety tech, was linked to lobbying on the file in an investigative report by BalkanInsights<\/a> last September.<\/p>\n Other documents in the bundle that were either withheld or redacted by the Commission include drafts of its impact assessment when preparing the legislation; and comments from its legal service.<\/p>\n When it comes to info pertaining to the EU\u2019s correspondence with tech companies, the ombudsman questions many of the Commission\u2019s justifications for withholding the data \u2014 finding, for example in the case of one of these documents, that while the EU\u2019s decision to redact details of the information exchanged between law enforcement and a number of unnamed companies may be justified on public security grounds there is no clear reason for it to withhold the names of companies themselves.<\/p>\n \u201cIt is not readily clear how disclosure of the names of the companies concerned could possibly undermine public security, if the information exchanged between the companies and law enforcement has been redacted,\u201d wrote the ombudsman.<\/p>\n In another instance, the ombudsman takes issue with apparently selective info releases by the Commission pertaining to input from tech industry reps, writing that: \u201cFrom the very general reasons for non-disclosure the Commission provided in its confirmatory decision, it is not clear why it considered the withheld \u2018preliminary options\u2019<\/em> to be more sensitive than those that it had decided to disclose to the complainant.\u201d<\/p>\n The ombudsman\u2019s conclusion at this point of the investigation repeats its earlier finding of maladministration on the Commission for refusal to give \u201cwide public access\u201d to the 33 documents. In her recommendation, O\u2019Reilly also writes: \u201cThe European Commission should re-consider its position on the access request with a view to providing significantly increased access, taking into account the Ombudsman\u2019s considerations shared in this recommendation.\u201d<\/p>\n The Commission was contacted about the ombudsman\u2019s latest findings on the complaint but at press time it had not provided a response.<\/p>\n<\/p><\/div>\n