Internet users should be given the right to use digital services anonymously, i.e. without having their personal data collected. According to a representative opinion poll conducted by YouGov among 10,064 EU citizens in December 2021 64% of respondents are in favour of such a right (with 21% opposed).

Next week, Members of the European Parliament will vote on their final position on the Digital Services Act. At the request of the Civil Liberties Committee (LIBE), an amendment on introducing a right to use digital services anonymously will be voted.

For the opinion poll, citizens from the Netherlands, Germany, Italy, France, Austria, the Czech Republic, Spain, Sweden and Belgium were asked whether they think that internet users should have the right to use digital services anonymously (i.e. as much as possible without their personal data being collected) or not.

The poll was commissioned by Pirate Party MEP Dr Patrick Breyer (Pirate Party), who participates in the Digital Services Act negotiations as rapporteur for the Committee on Civil Liberties, Justice and Home Affairs (LIBE). The research was financed by his group, the Greens/European Free Alliance. Commenting on the survey result, Breyer explains:

“The European Parliament must respond to the constant data scandals and data crime online to better protect our citizens. Only uncollected data is secure data! This was recently demonstrated by the leak of unnecessarily collected mobile phone numbers of 500 million Facebook users. A right to anonymity also protects vulnerable groups from discrimination online. Next week, the European Parliament needs to seize the opportunity to meet citizens’ demand for protecting their digital privacy better.”

Background:

The Digital Services Act (DSA) provides Europe with the chance to set global standards for digital rights.

In recent years, numerous data breaches have seen users’ personal data, such as home numbers and location data, being leaked to criminals. In 2021, for example, the private phone numbers of 533 million Meta/Facebook users were published on a hacker forum. Meta/Facebook had collected these numbers unnecessarily. The data facilitates crimes and exposes users to risks such as SIM swapping, phishing attacks and stalking.

Such data scandals could be avoided if user data were not collected unnecessarily. The LIBE Committee wants to introduce in the Digital Services Act the right to use and pay for digital services anonymously wherever reasonably possible. The current survey results now show broad support for this demand.

Overview page on the Digital Services Act

patrick-breyer.de/en/survey-on…

Following a complaint by six MEPs, including Patrick Breyer of the Pirate Party, the European Data Protection Supervisor (EDPS) has confirmed that the European Parliament‘s COVID test website violated data protection rules. The EDPS highlights that the use of Google Analytics and the payment provider Stripe (both US companies) violated the European Court of Justice’s (CJEU) “Schrems II” ruling on data transfers between the EU and the US. The ruling is one of the first decisions to implement “Schrems II” in practice and could be groundbreaking for many other cases currently being considered by regulators.

On behalf of six MEPs, the data protection organisation noyb filed a data protection complaint against the European Parliament in January 2021. The main issues raised are the deceptive cookies banners of an internal corona testing website, the vague and unclear data protection notice, and the illegal transfer of data to the US. The EDPS investigated the matter and issued a reprimand on the Parliament for violation of the “GDPR for EU institutions” (Regulation (EU) 2018/1725 applicable only to EU institutions).

Illegal data transfers to the U.S.

In the so-called “Schrems II” case, the CJEU stressed that the transfer of personal data from the EU to the US is subject to very strict conditions. Websites must refrain from transferring personal data to the US where an adequate level of protection for the personal data cannot be ensured. The EDPS confirmed that the website actually transferred data to the US without ensuring an adequate level of protection for the data and highlighted: “the Parliament provided no documentation, evidence or other information regarding the contractual, technical or organisational measures in place to ensure an essentially equivalent level of protection to the personal data transferred to the US in the context of the use of cookies on the website.”

Co-complainant and MEP Patrick Breyer (Pirate Party) comments:

“The Schrems II ruling was a great victory for the protection of our privacy and the confidentiality of our communications and internet use. Unfortunately, this case shows that our data is still being illegally transferred to the US in large numbers. With his decision, the EDPS makes it clear that this must end. There must be no more unnecessary disclosing of our personal data to the US without our consent, not even on the basis of the so-called standard contractual clauses, which do not protect us against the NSA mass surveillance schemes.”

No fine, but a reprimand and a compliance order

The EDPS issued a reprimand to the Parliament for the various breaches of the data protection regulation applicable to EU institutions. Unlike national data protection authorities under the GDPR, the EDPS can only impose a fine in certain circumstances, which were not met in this case. In addition, the EDPS gave the Parliament one month to update its data protection notice and resolve the remaining transparency issues.

patrick-breyer.de/en/edps-sanc…

For years, the EU police authority Europol has been collecting massive amounts of data without any legal basis. Now Europe’s top data protection official Wojciech Wiewiórowski is taking action against the police agency, according to an order published today.

As a substitute member of Europol’s supervisory body JPSG, MEP Patrick Breyer (Pirate Party) comments:

“According to the European Data Protection Supervisor, Europol has been illegally storing for years data on non-suspects transmitted by national intervention authorities. These are vast amounts of data (cell-mast data, and passenger lists) on people who are in no way connected to criminal activities. As a consequence, innocent citizens run the risk of being wrongfully suspected of having committed a crime. The six-month retention period imposed by the authority limits this risk. However, the new Europol regulation seeks to simply legalise these illegal practices, which is scandalous.”

patrick-breyer.de/en/stop-euro…