EU privacy regulators are concerned about a law requiring a child abuse scan

The European privacy regulators warn about a European bill that obliges tech companies to scan internet traffic for child abuse. The law in its current form would be “more dangerous for the rights of citizens than for criminals.”

The letter originates from the European Data Protection Board, the association of national supervisors, and from the European Data Protection Supervisor, the supervisor of European politics. The EDPB and EDPS warn of the consequences that a bill from the European Parliament can have. This law obliges companies to detect and remove child sexual abuse material or CSAM. The law applies to a wide range of companies, such as telecom providers, hosting providers and communication services. The bill is deliberately vague about the methods by which companies should detect CSAM. That is exactly what the privacy regulators denounce. “The lack of detail, clarity, and accuracy for CSAM detection does not ensure only targeted CSAM detection,” they write. There would be a risk that the proposal could easily be expanded and generalized, forcing companies to scan for other content as well. This would put the law at odds with the privacy law. This states that a goal must be clearly formulated in advance for which data is collected.

The EDPB and EDPS also say that various proposals in the law are likely to cause false positives. For example, the law prescribes that ‘artificial intelligence’ must be used to find CSAM, but that would, according to the regulators, ‘probably lead to errors and ensure a high degree of intrusion into the lives of citizens’.

The regulators are also concerned that the law will undermine end-to-end encryption. This undermines other fundamental freedoms, such as freedom of communication and freedom of expression, but also ‘innovation and growth in the digital economy’.

With such steps, the law would end up posing more danger to the rights of Europeans than to criminals, the regulators say. They are not calling on the European Commission to take the law off the table, but to amend it on many points.