CSAR: European Parliament rejects mass scanning of private messages. Here is why

On 22 November, the European Parliament officially adopted its position on the draft ‘Regulation laying down rules to prevent and combat child sexual abuse’ (CSAR). With strong support for this position from all seven European political groups, this marks a positive development for human rights in one of the most controversial draft European Union (EU) laws in recent memory.

EDRi has long advocated against the CSAR’s mass scanning and encryption-breaking measures proposed in 2022 by the EU executive’s unit for home affairs. We are reassured, therefore, that the Parliament has listened to the evidence and the rule of law. At the same time, we are still far from the end of the legislative process. This means that we must stay alert to how the other two law-making institutions – the Council of EU Member States and the European Commission – respond. Will they agree with the Parliament that new EU laws need to respect fundamental rights? Or will they double down on ‘Chat Control’?

The position of the European Parliament

As we explained when this position was provisionally agreed by the Parliament’s Civil Liberties Committee on 14 November, it is a clear political statement that even the most important societal aims do not justify measures at any cost. EU fundamental rights law requires that limitations on people’s rights are necessary for the aim they seek to achieve – including being objectively effective and the least intrusive possible – and proportionate. That means that their broader impact must be reasonable.

On this basis, the Parliament firmly rejected rules which would force companies to scan huge volumes of people’s private messages – instead now requiring there to be reasonable suspicion. Lawyers for the Council of EU Member States had previously made an unprecedented warning that the original proposal would violate the essence of the right to privacy. In EU-speak, this is a damning assessment, because case law from the Court of Justice of the EU has always upheld that while rights can be limited for justifiable reasons, the “essential core” of any human right must never be violated. The Parliament has clearly listened to this warning.

EDRi’s work and coalition

Since before the home affairs unit (DG HOME) first put forward this law, EDRi has been on the front lines urging the EU to ensure that measures to tackle the serious crime of child sexual abuse are in line with human rights rules. Yet our ‘10 principles to defend children in the digital age’ were ignored in the original legislative proposal (so too were concerns from the Commission’s own review board).

Thanks to the EDRi-led Stop Scanning Me campaign, thousands of people across Europe have since sounded the alarm about the draft measures. Scientists and researchers across the world have been unambiguous that as proposed, the measures would undermine encryption, putting everyone’s digital information at risk of harm. And other stakeholders such as journalists, youth activists, lawyers and survivors’ associations have warned how they could be put at risk by the proposal.

What’s next?

As their position has been officially adopted, the European Parliament is ready to enter “trilogues”. This is closed-door negotiations between lead Parliamentarians and the Council of EU Member State governments. However, in this case, the Council does not currently have a negotiating mandate with which to enter the trilogues. In fact, EU Member State governments have been divided on the issue, with some countries refusing to listen to technological and legal reality. Fortunately, many others have stood up against their colleagues, rightly warning that the EU cannot give a carte blanche to the destruction of digital security, privacy and anonymity.

Back in July, EDRi urged Member State governments not to agree to a position which would usher in the mass surveillance of everyone’s digital private lives. People subsequently took to the streets in Germany, Sweden and several other locations to urge their governments not to accept ‘Chat Control’. These efforts paid off, with the governments of Germany, Austria, Poland, Estonia and Slovenia reportedly taking a firm stance against the misguided proposal, and France subsequently raising major concerns.

Without a Council position, the legislative process for the CSAR is currently in limbo. The Spanish Presidency of the Council is reportedly attempting to push through a position before the end of their mandate (end December 2023). But at the time of writing, they do not have a text on the table – let alone political agreement from a sufficient number of Member States.

Even if the Council is able to agree their position soon, it is highly unlikely that they would be able to pass the law during this political mandate. That’s because we are approaching a once-in-five-years event: European elections. In June 2024, a new Parliament will be elected, and subsequently, a new set of European Commissioners will be appointed. According to leaked documents, this means that any negotiations between the legislative institutions must wrap up by early February 2024.

Whilst trilogue negotiations on even simple laws can take months, it would be unprecedented for such a complex and sensitive file as CSAR – with so much at stake – to be pushed through in such a short time. This current limbo also means that the political figurehead for the CSAR, controversial Swedish Commissioner Ylva Johansson, is unlikely to remain in post for this proposal’s life-cycle.

EDRi has consistently advocated that laws to tackle CSA online must be in line with fundamental rights law and with objective evidence of effectiveness. With this latest step, the European Parliament has firmly rebutted DG HOME’s attempt to pass a law which bitterly fails on both of these counts. Whilst the next steps for this law are not clear, this is nevertheless a huge milestone for the protection of digital human rights, and we are counting on the Council not to go backwards.