EU to beef-up or water-down online privacy and security? Depends on how you look at it

• OTT Players will have to abide by the same security and confidentiality rules as telcos
• However, the consequence could be a weakening of security already in place
• Facebook, Google and Microsoft likely to resist enforced changes
• Highlights the differences between EU and US regulation of the Web

The European Union is to extend the scope of existing telecoms regulations that deal with  encryption, security and the confidentiality of text, mobile and landline calls to include web companies that provide voice calls and instant messaging services over the Internet. Among those that will be affected are Skype and WhatsApp. The proposed changes will once again throw a spotlight onto the differing attitudes taken in Europe and the US to the regulation of the Internet.

In Europe, 'proper' telcos such as Orange and Vodafone are subject to the regulations and the established operators have long complained that Facebook, Google and others of that OTT ilk are gaining unfair competitive advantage because they are much less regulated than the orthodox telecoms provider community. Their arguments are compelling, particularly in regard to the use (and bags and bags of money) OTT players can make from customer data in ways that are forbidden to the telcos.

In a written submission to the European Commission (EC), Orange complains, "“Unlike telcos, OTT (Web-based) are global players that are allowed to commercially exploit the traffic data and the location data they collect." Telcos can't do that - and it's costing them.

Under the the terms of the EU's “ePrivacy Directive,” telcos are legally bound to protect the confidentiality of their subscribers' calls and messages, may not retain user location data and must ensure that their networks are properly secure.

German MEP Jan Philipp Albrecht who is a leading campaigner on data privacy said, "It's obvious there needs to be an adjustment. Telecoms providers are being replaced and those companies seeking to replace them must be treated in the same way."

The new regulations will ensure that OTT providers meet the same "security and confidentiality provisions" that apply to telcos and will also have to comply with "requests" from security services and other government law enforcement agencies for access to their user data.

It is expected that the likes of Facebook and Microsoft will fight these proposals, not least because many OTT companies routinely provide end-to-end encryption on their messaging and email services. Thus, they argue, with some justification, that there is no need to extend the telco regulations to web-based and that EU apparatchiks should not determine how Facebook, Google and Microsoft et al protect user communications and data.

In a submission to the EC, Facebook comments that extending telco regulation to Internet-based voice and messaging communications would mean that it would "no longer be able to guarantee the security and confidentiality of the communication through encryption”. It adds. "Any expansion of the current ePrivacy Directive should not have the undesired consequence of undermining the very privacy it is seeking to protect.”

Interestingly, and potentially very importantly, the new regulations also provide for the requirement of telcos and OTT players alike to allow subscribers to take with them all their archived content, such as emails and messages, when they switch service providers.

The Commission could also force the companies to allow with users to take with them a copy of their content, such as e-mails and messages, when they switch providers.

Meanwhile, despite the fact that the initial draft proposal on the new regulations is due in September, the  EC is still "looking into" whether or not OTT services are "functional substitutes for services provided by traditional telecoms operators." But it is August, most of Europe is on vacation and the mills of the EC, with sand and sun oil in their gears, are grinding even more slowly than usual.