Tech Brief: e-Evidence quasi agreement, Google account complaint, marketplace scenarios

The Tech Brief is EURACTIV's weekly tech newsletter.

Welcome to EURACTIV’s Tech Brief, your weekly update on all things digital in the EU. You can subscribe to the newsletter here

 

“The provisional agreement reached today represents a major paradigm shift in police and judicial cooperation with service providers in the EU.”

-MEP Birgit Sippel, European Parliament’s rapporteur on the e-Evidence Regulation.

 

Story of the week: The EU co-legislators have (almost) reached a final political agreement on the e-Evidence package on Tuesday, which is intended to put in place a judicial cooperation mechanism for accessing electronic evidence from another member state. The most significant progress concerns the notification mechanism, which determines under which conditions the law enforcement authority of the country receiving an access order should be informed. The Parliament accepted the residence criterion, namely that even if the data is stored in another EU country if the person concerned resides in the member state that is issuing the order, no notification will be needed when the order is sent to the service provider.

In turn, MEPs obtained that when a notification is sent, it has a suspensive order as the executing member states will need to assess whether there are ‘grounds for refusal’, including that the crime investigated is recognised by its own jurisdiction- the principle of dual criminality. The point of contention remains if the executing country might or must raise a ground of refusal when there is one, with the member states pushing to have discretion on the matter. The common European exchange system is also still largely undefined.

As the trilogue ended, the French Presidency displayed signs that they were under political pressure directly from their minister to reach an agreement before the end of the semester. They proposed a new political trilogue on the last day of the presidency, supported by conservative and liberal lawmakers who also look forward to closing the controversial file. However, for rapporteur Sippel, it was a too-tight timeframe to iron down the technical details. The solution was that the French Presidency presented the agreement as if the political negotiations were concluded, whereas lawmakers think one more trilogue is needed.

 

Don’t miss: By failing to allow users to protect their privacy, Google is engaging in an unfair commercial practice, a group of ten consumer organisations said on Thursday. The consumer associations, coordinated by the European Consumer Organisation (BEUC), accused the tech giant of going against the GDPR’s principle that privacy is offered by design and default. In particular, the complaint states that when signing up on a Google account, which is very difficult not to do for Android users, the personalised option is provided with a simple click. In contrast, the more data protection-friendly option takes many more steps, provides confusing information and implies that some functionalities might be reduced. Google accounts are fundamental to how Google operates, as they track users across services such as Chrome, Gmail and Maps. Read more.

 

Also this week

  • The French Presidency presented three scenarios for regulating online marketplaces in the product safety rulebook.
  • Russia did not interfere in the French elections as it was too busy with Ukraine.
  • The discussion on the ENISA cloud certification scheme was postponed to September as Germany was under pressure from its industry.
  • The French public media have been on strike as they fear for their independence.
  • The European Parliament has decided who will do what on the Chips and Data Acts.

 

Before we start: The Ukraine war is also being fought in cyberspace. We discussed the key takeaways that can be drawn from the conflict so far with Ginny Badanes, Microsoft’s senior director of Democracy Forward.

Cyber warfare in Ukraine: lessons learned

The war in Ukraine is being fought also in the cyber space. We discussed the key takeaways that can be drawn from the conflict so far with Ginny Badanes, Microsoft’s senior director of the Democracy Forward.

 

Artificial Intelligence

Tick the (sand)box. Spain launched its pilot Regulatory Sandbox on AI in Brussels this week, the first step in a plan to prepare companies and authorities for future regulation of the emerging technology. The Sandbox, developed in consultation with the Commission and financed by 2025 via Spain’s RRF budget, is set to clarify requirements in AI systems development, lay the ground for a National Supervisory Authority and test solutions compliance. The framework is also intended to spur similar efforts in the other Member States with an eye to the broader development of harmonised AI standards under the upcoming AI Act.

Competition

Job search competition. Google is facing yet another potential antitrust investigation after Jobindex, a Danish job-search site, filed a complaint with the Commission over what it alleges is the tech giant’s self-preferencing of its own job portal. This is not the first time the service, Google for Jobs, has been subject to a competition dispute. Following its 2018 launch, rivals argued that it had hit their market share hard, and the publisher Axel Springer’s equivalent initiated a complaint similar to the one now headed for EU competition chief Margrethe Vestager’s desk.

Cybersecurity

Cybersecurity certification. The European Cybersecurity Certification Group (ECCG) met on 28 June, but no substantial discussion was made regarding the latest European Cybersecurity Certification Scheme for Cloud Services draft by ENISA. The discussion was postponed to September, as the German government was under pressure from influential sectors of its industry to oppose the scheme. However, insiders informed EURACTIV that even if the ECCG opined against the draft, the Commission would go ahead anyway. Member states such as the Netherlands, Sweden and Ireland and tech industry representatives have been leading the charge against including sovereignty requirements in the certificate and complained about the lack of significant consultations throughout the drafting process.

Critical entities agreed. The EU Council and Parliament reached a political agreement this week on the directive on the resilience of critical entities, which is designed to minimise the weaknesses and improve the strength of bodies providing vital services for EU citizens and those at the core of the single market. The text covers several sectors, including energy, health and space, and focuses on resilience against hybrid attacks, natural or health emergencies and terrorist threats. The agreement will require member states to develop national strategies for enhancing and regularly assessing these entities’ resilience and set out how those bodies providing essential services should be identified.

Russian targeting continues. Pro-Russian groups such as Killnet have attacked various private and public Norwegian websites, according to the Norwegian security authority on Wednesday. Some of these DDoS attacks brought down important public websites for hours. Earlier this week, Lithuania was also attacked in retaliation for the dispute over the transit ban on certain goods to the Russian exclave of Kaliningrad. German public authorities’ websites were also targeted some weeks ago by Killnet.

United front. Amidst the rapid rise of cyberattacks since the beginning of the invasion of Russia in Ukraine, the G7 leaders announced on Tuesday that they would work together to strengthen their defences and protect against foreign disinformation and cyber-attacks, including threats posed by Russia. They also reaffirmed their commitment to the framework of responsible state behaviour in cyberspace and said they are working together to develop and implement robust international cyber norms, according to their communiqué.

Fake Klitschko. Russian comedians are said to be behind the fake calls with Kyiv’s mayor Vitali Klitschko, according to the German broadcaster Berlin-Brandenburg’s Kontraste magazine. The duo “Vovan and Lexus” allegedly spoke to several European city leaders via video, including Vienna’s Mayor Michael Ludwig and Berlin’s Mayor Franziska Giffey. One of the comedians denied a political motive, but these actions are often directed against critics of the Kremlin. Initially, it was believed that the video was a deep fake. But the Kontraste analysis suggests that the images were not created by a computer but copied from an interview Klitschko gave to Ukrainian journalist Dmitrij Gordon in early April.

Data & privacy

Europol – sequel? The newly amended Europol Regulation weakens data protection and oversight of the EU law enforcement agency, according to the European Data Protection Supervisor (EDPS), which raised concerns about the measures as they entered into force this week. High up in the data protection authority’s list of worries is that the new regulation, which broadens Europol’s mandate, allows the agency to process large datasets, giving it access to greater volumes of personal data from individuals with and without criminal records. The new measures invalidate a ruling by the EDPS earlier this year that Europol needed to delete such databases. Interviewed by EURACTIV at the EU Digital Summit on Thursday, the Supervisor said that they were considering legal action against the invalidation of its decision.

You shall pay. France’s highest administrative court on Monday upheld a €35 million penalty imposed on Amazon by the country’s privacy watchdog CNIL in 2020. In September 2020, the CNIL fined Amazon for having placed advertising cookies on the computers of users of the Amazon.fr sales site without prior consent or satisfactory information. In addition to siding with the authority on the substance of the case, the French court found that the amount of the fine was not disproportionate to the seriousness of the breaches, the scope of the processing and the company’s financial capacity.

Digital currencies

Anti-money laundering agreed. A provisional deal on tracing crypto transfers has been reached by Council and Parliament negotiators in an EU first for tracking such transactions and flagging suspicious activity. The deal, part of the EU’s new anti-money laundering package, extends an existing rule that currently applies to traditional finance, requiring information on those involved in the transfer to travel with and be stored on both sides of a transaction. This rule will now be applied to crypto-assets, and providers will be required to verify that they are not subject to any sanctions and that there is no risk of money laundering or terrorism financing. The rules are set to cover both hosted and unhosted wallets but will not be applied in the case of person-to-person transfers where a provider is not involved, such as on bitcoin trading platforms.

Price collapse. A new report from PrivacyAffairs shows a price collapse on the Dark Web. “In the past year, the Dark Web data market grew larger in total volume and product variety. Predictably, as supply grew, most prices plummeted,” the authors of the study note. For example, the purchase of credit card details for accounts with balances up to $5,000 has fallen from $240 last year to $120 in 2022. The report also notes that the variety of products offered had expanded, including items such as hacked cryptocurrency accounts and web services such as Uber.

Digital Markets Act

A new obligation pops up. A new version of the DMA has emerged in the European Parliament ahead of the plenary vote next week. The document now includes a new requirement for gatekeepers to set up compliance officers or face fines as high as 1% of their global turnover.

Compliance concerns. Enforcement of the DMA continues to be an area of concern, particularly in terms of gatekeeper compliance, according to the German organisation LobbyControl, which this week released a comparison of the main findings of a legal review of the bill it undertook in February with the post-trilogue text. Despite the continued negotiations, the group concludes that the shortcomings it raised earlier have not been adequately addressed. At the very least, moving towards effective enforcement will require a significant increase in staff at the Commission.

Now read this. The Commission is looking to relocate around 80 people to the DMA, to be more or less equally split between DG COMP and DG CNCT. While civil society groups urged the Parliament to make its voice heard ahead of the discussion for next year’s budget in October, the Commission is already facing financial constraints as inflation is eating up its resources. EU staff salaries are automatically adjusted to the purchasing power of civil servants in the member states, but the budget is fixed yearly. The extra expenses will therefore need to be covered by freezing new hires, not replacing empty spots and not renewing temporary staff contracts. If things are already bad now, they might get even worst if inflation rises further before the end of the year.

Disinformation

Try again. The French presidential election did not see many attempts at interference this time as the war in Ukraine forced Moscow to redeploy its foreign interference capabilities, says a new report published this week. “The content produced by RT and Sputnik shifted towards narratives designed to justify the invasion”, focusing on the “denazification” of Ukraine or the accusations of Russophobia in the mainstream media, the experts wrote. In addition, the EU-wide ban on state-controlled media from major online platforms has further undermined Moscow’s capacity to interfere. Read more.

eCommerce

Marketplace scenarios. The French Presidency made its final move on online marketplaces in the context of the General Product Safety Regulation. In one of its last days, the presidency shared three different options on how to address what has proved the most controversial issue of the GPSR, a file that has moved little since policymakers were waiting on where the DSA would land first. The first scenario entails an alignment with the DSA, leaving the responsibility on the vendor to verify unsafe products against existing databases. The second option is considered more protective of consumers, obliging marketplaces to check the product they sell even when there is a new entry into the databases. These two alternatives are not the best for the French government, as the former is deemed not to completely address the issue of dangerous goods, and the latter could be considered breaching the ban on general monitoring obligations. The final (and favourite) option includes ‘best efforts’ for the platforms, with targeted checks via automated means. Read more.

eGovernance

More cloud sovereignty to come. The European Commission has announced its (internal) digital transformation strategy this week. The declared objectives aim to foster a digital culture, implement digital-ready policymaking, empower a business-driven transformation and ensure seamless information exchanges and resilient infrastructure. As expected, digital sovereignty features strongly in the document, with explicit references to purchasing sovereign cloud services from private providers. In this sense, the European Commission is working on public procurement guidelines for cloud services to be finalised by the end of the summer, EURACTIV has learned. Although meant for the EU institutions, the guidelines might become a point of reference for public administrations across the bloc. Sovereign solutions might not be limited to data localisation requirements but also to ‘bring your own key’ a technical solution that makes the customer the only one able to decrypt the encrypted data.

Gig economy

Stricter criteria. While welcoming the rebuttable presumption of the employment relationship and the reversal of the burden of proof provided for in the upcoming platform workers directive, the European Committee of the Regions is calling for stricter criteria for verifying employment status, considering them as “too vague” as they now are. “Digital platform companies deliberately use the legal uncertainty in their favour”, said rapporteur for the Committee, Yonnec Polet.

(Gig) workers of the world, unite! The employees of the home shopping delivery platform Gorillas have won their case. After blockading their warehouse on Monday and Tuesday to protest against their working conditions and waves of unfair dismissals, the CGT union announced on Wednesday that the strikers had finally obtained “a commitment from management to respond and examine all the salary regularisations” and, with regard to dismissals, a commitment that management would no longer base its actions “on criteria that are disconnected from work”.

Industrial strategy

Decision taken. The Conference of Presidents decided on the division of competencies on the Chips Act and Data Act. The recommendations of the Conference of Committee Chairs, reported by EURACTIV last week, were largely confirmed with a small but significant change. In the Data Act, the first sentence of Art 4(6) has been turned into a shared ITRE-JURI competence instead of being exclusively in the hands of the legal affairs committee. The sentence specifies that contractual agreements can only provide access to non-personal data. The last-minute modification is not only odd since it concerns only a sentence within a paragraph but was contested mainly by the committee chairs, who criticised the ITRE chair for violating the agreement.

ECON’s Chips Act opinion. Eva Maydell submitted her draft opinion on the Chips Act earlier this week. The Bulgarian MEP is an influential voice on the file as she is also the EPP’s shadow in ITRE and leads the joint undertaking part of the policy package. In her opinion, Maydell proposes to narrow the scope of the crisis mechanism included in the legislation, aligning the definition of crisis-relevant product to that of the Resilience of Critical Entities Directive and introducing a precise definition of crisis that could only be triggered with an assessment report. She also wants Integrated Production Facilities to commit to long-term investments in technological developments and companies to appeal if the European Semiconductor Board and the Commission revoke their IPF status. Moreover, an early warning mechanism would be set up by the Board in consultation with the industry. Maydell also proposed creating a single point of contact for the Commission to exchange with the stakeholders on significant fluctuations in demand.

Rome Consensus. French cloud company OVHcloud organised a conference in Rome on Monday to bring together private and public players to discuss how to take European digital sovereignty to the next level on the eve of the handover between France and the Czech Republic at the head of the EU Council. Michel Paulin, its CEO, took the opportunity to present the “Rome Consensus“, a roadmap for the industry which calls for a focus on four pillars; regulation, research and development, financing and public procurement and training, and includes concrete short, medium and long term priorities. “We all want to unleash Europe’s digital potential, and the Rome Consensus must be able to serve as a starting point”, and “we will call on our European partners to take ownership of the conclusions of this initiative so that together we can take the next step”, said Paulin.

Chips for quantum. Experts from politics, industry and science urged at the European Innovation Area Summit in Brussels on Tuesday (28 June) that quantum technology should be included in the Chips Act. Foundries and pilot lines should help ensure that the EU leads in this new technology while it lags in semiconductors. Although the Chips Act also aims to make the EU competitive in semiconductor supply chains, the main driving force is to become “strategically autonomous”, Dutch MEP Tom Berendsen said.

Media

Striking independence. The French public broadcasting sector went on strike on Tuesday against the government’s plan to move from a licence fee paid by French households to a new line in the country’s budget. They see this new method of financing as a threat to their independence. “Abolishing the licence fee, an allocated revenue means making public broadcasting more precarious and impoverished by transferring it to the government budget and making it dependent on constant political choices and pressures”, the unions argued in a joint press release. Read more.

Race to the bottom. The concern is growing amongst Romanian independent media over press freedom backsliding and Reporters Without Borders (RSF) this week added its voice to the mix over a coordinated harassment campaign against the investigative journalist who revealed that the country’s Prime Minister had plagiarised his doctoral dissertation. In a letter to Romanian political and legal leaders, RSF described law enforcement as having seemingly failed to make any progress in its investigation into the intimidation of Emilia Sercan, which involved the leaking of personal photos of her online. Read more.

Platforms

Prime’s (un)subscription. Amazon Prime has altered its cancellation policy to align with EU consumer rules in response to a dialogue with the Commission and national authorities. Users in the European Economic Area will now be able to unsubscribe from the service via a much simpler process, adaptations designed to ensure compliance with the EU’s Unfair commercial practices Directive. Discussions were initiated last year following a complaint from the European Consumer Organisation, the Norwegian Consumer Council and the Transatlantic Consumer Dialogue, and Amazon’s commitment to the change will continue to be monitored.

Telecom

Secure connectivity mandate. The member states have agreed on a mandate for negotiations with the European Parliament on the Union secure connectivity programme, which seeks to set up a sovereign secure space-based connectivity system for satellite communication services. The system is meant to provide a sovereign and secure space-based connectivity system, reinforcing the resilience of critical infrastructure and crisis management. The Council’s mandate includes a clear distinction between government or commercial infrastructure services. Moreover, the EU countries will retain ownership of the radio frequencies used for this programme, as spectrum is always jealously defended by member states. Other changes concern the functioning of the public-private partnership, the role of the EU space agencies and the budget allocation.

Roaming extended. From 1 July, a new version of the Roaming Regulation will come into force. Consumers will not only be able to make phone calls, send text messages and use the internet abroad in the EU without incurring additional charges, as was already the case, but they will also be able to do so in the same quality as they are used to at home. The same mobile technology is thus to be made available when travelling in the European Union as well as Iceland, Liechtenstein and Norway if it is available in the country visited.

Twin transitions

Strategic transitions. Current geopolitical instability confirms the EU’s need to accelerate the twin green and digital transitions and reduce strategic dependencies, according to the 2022 Strategic Foresight Report released this week. While most 2030 reductions will be made with already-available technologies, the report says, new development across crucial areas such as energy, construction and agriculture will be needed to achieve 2050 climate targets. Achieving the twin transitions will also require ensuring that the EU’s economic model centres on principles of wellbeing, sustainability and circularity, the Commission says, proposing action in areas including heightened green and digital diplomacy, expanding future-proof investment into R&I and developing a global approach to standard-setting.

 

Mathieu Pollet and Laura Kabelka contributed to the reporting.

 

What else we’re reading this week:

China lured graduate jobseekers into digital espionage (FT)

I saw first-hand how US tech giants seduced the EU – and undermined democracy (The Guardian)

All Sci-Fi Movies will Come to Reality if LaMDA Escapes from Google (Global Tech Outlook)

[Edited by Alice Taylor]

Read more with Euractiv

Subscribe to our newsletters

Subscribe