Written submission: Civil society shows evidence gaps in “Going Dark” group proposal for access to data for law enforcement

This contribution follows from EDRi’s participation in a public consultation organised by the European Commission, which in no way constituted a genuine and meaningful engagement with civil society. We already pointed out that the HLG process does not meet the European Union (EU) standards of transparency, fairness and accountability, given its work behind closed doors and the persistent secrecy kept around its members and participants. In that regard, we still have not received any official reply from the HLG co-chairs to the letter we sent on 15 January 2024 calling for greater transparency and participation of all stakeholders. 

EDRi’s written contribution does not amount to a tacit agreement with the objectives of the HLG. What it does instead is to point to the narrow political agenda of the HLG which focuses on law enforcement interests solely. In particular, how law enforcement can get more access to data, without proper regard for the fundamental rights implications of the suggested solutions.

This one-sided approach might lead to poorly designed and non-future-proof legislation, such as the Data Retention Directive annulled by the Court of Justice in 2014 and the Commission’s current CSA Regulation proposal. That’s why EDRi called for the dismantling of the HLG.

What will you (not) find in the written submission?

The submission generally addresses fundamental rights at stake and other issues (e.g. technological aspects), while concretely focusing on the specific topics chosen by the HLG for its three working groups and the sessions of the public consultation meeting on 20 February 2024:

• data at rest in a user’s device
• data at rest in a provider’s system
• data in transit
  

It should be noted that these topics are narrowly focused on law enforcement investigative interests and generally fail to consider security in the online sphere from a broader societal perspective. This is problematic as it restricts the scope of analysis in relation to security online. For example, encryption plays an indispensable role in protecting individuals and organisations, including governments and their services, against a number of threats like cyberattacks and espionage.

What are the main points made in the written submission? 

The lack of evidence for data access is a significant challenge to law enforcement and affects the validity of the HLG’s assumptions, objectives, and recommendations.

In EU Member States, there is no measurable effect of data retention on crime rates or crime clearance rates. Therefore, there is no proof that the absence of general and indiscriminate data retention (mass surveillance) negatively impacts law enforcement’s ability to combat crime.

EDRi has repeatedly pointed out that this failure by EU institutions and Member States’ authorities to provide evidence about the marginal benefits of access to electronic data compared to less intrusive alternatives leads to legislative proposals which do not satisfy the test of necessity.

In the current landscape of widespread online services, smartphones, and the business model of surveillance capitalism, law enforcement has unprecedented access to vast amounts of data about European citizens. EU institutions should question proposals advocating for general data retention or encryption restrictions, as such measures seriously infringe upon fundamental rights, without necessarily meeting legal requirements of necessity and proportionality. Instead, lawmakers should invest resources in advancing and promoting people’s privacy to build safer digital spaces for all.