Anti-Counterfeiting Trade Agreement: EDPS warns about its potential incompatibility with EU data protection regime

Today, the European Data Protection Supervisor (EDPS) adopted an opinion on current negotiations by the European Union aimed at adopting a new multilateral agreement to strengthen the enforcement of intellectual property rights and to combat counterfeiting and piracy (Anti-Counterfeiting Trade Agreement - ACTA).

The EDPS regrets that he was not consulted by the European Commission on the content of an agreement which raises significant issues as regards individuals' fundamental rights, and in particular their right to privacy and data protection. In this context, he views with concern the fact that little information is publicly made available about current negotiations. From what has been reported about the content of ACTA, he is concerned as regards a potential incompatibility between envisaged measures and data protection requirements. This would apply in particular to the legal framework that would be put in place to fight piracy on the Internet and which could include large scale monitoring of Internet users and the imposition of obligations on Internet Services Providers to adopt "three strikes Internet disconnection policies" - also referred to as "graduated response" schemes ^(*).

Peter Hustinx, EDPS, says: "Whereas intellectual property is important to society and must be protected, it should not be placed above individuals' fundamental rights to privacy and data protection. A right balance between protection of intellectual property rights and the right to privacy and data protection should be ensured. It is also particularly crucial that data protection requirements are taken into account from the very beginning of the negotiations so as not later on having to find alternative privacy compliant solutions."

The EDPS main recommendations include the following:

• to investigate less intrusive means to fight piracy on the Internet: the EDPS takes the view that three strikes approach policies are not necessary to achieve the purpose of enforcing intellectual property rights. Alternatively, less intrusive solutions should be considered or, at least, envisaged policies should be performed at a more limited scope, notably through targeted ad hoc monitoring;
• to apply appropriate safeguards to all data transfers in the context of ACTA: as far as ACTA involves international exchanges of personal data between authorities and/or private organisations located in the signatory countries, the EDPS calls on the EU to implement appropriate safeguards to all data transfers made in the context of ACTA. Such safeguards should take the form of binding agreements between EU senders and third country recipients;
• to establish a public and transparent dialogue on ACTA, possibly by means of a public consultation, which would also help ensuring that the measures to be adopted are compliant with EU privacy and data protection law requirements.

^(*) These policies would typically involve disconnection of Internet access after prior warnings for illegal sharing or downloading of copyright protected material.