United Kingdom Journals

---

You are here: BAILII >> Databases >> United Kingdom Journals >> Network Neutrality and Privacy According to Art. 8 ECHR | Koops | European Journal of Law and Technology
URL: http://www.bailii.org/uk/other/journals/EJLT/2012/03-2/90.html
Cite as: Network Neutrality and Privacy According to Art 8 ECHR , Koops , European Journal of Law and Technology

---

[New search] [Printable PDF version] [Help]

---

Network Neutrality and Privacy According to Art. 8 ECHR

Bert-Jaap Koops [1], Jasper Paul Sluijs [2]

Cite as: Koops, B-J, Sluijs, JP ‘Network Neutrality and Privacy According to Art. 8 ECHR’, European Journal for Law and Technology, Vol. 3, No. 2, 2012

This article presents a structured approach to studying the privacy implications of the network neutrality debate according to art. 8 of the European Convention of Human Rights (ECHR). Network neutrality is a topic discussed in telecommunications policy circles, on how actively Internet Service providers (ISPs) may manage the traffic of content on their networks. While more active network management may lead to more efficient bandwidth allocation, it also strengthens the gate-keeping position of ISPs—with possible negative effects in terms of fairness. It is often alleged in European public interest circles that network management that goes beyond ‘neutral’ handling of traffic violates the privacy of Internet users. However, such claims are mostly rhetorical in character and are typically not supported by legal research. We attempt to fill this lacuna by comparing network neutrality related privacy claims to art. 8 ECHR case law. Our findings suggest that an art. 8 ECHR violation due to network management is not as straightforward as sometimes assumed, and mainly depends on the form and technique of network management, and the level of State involvement in network management.

1. Introduction

Network neutrality is a contentious topic in telecommunications policy. In short, the debate on network neutrality concerns the amount of ‘network management’ that Internet Service Providers (ISPs) should be allowed to perform on their networks. With the advent of broadband has come a demand to manage Internet traffic in a differentiated, non-neutral manner, depending on the content of traffic. For instance, in order for YouTube videos to buffer faster, some less time-sensitive traffic may have to be slowed down. More active network management by ISPs may indeed allow for more streamlined Internet usage by consumers, however, it also reinforces the gate-keeping position that ISPs have vis-à-vis content providers and end-users on the Internet, with possible adverse effects for competition and civil rights.

Network neutrality has originated as a discussion in the US, but has also become relevant in a European context. European policymakers have approached network neutrality mainly from an economic perspective, and the European regulatory response to the network neutrality discussion has therefore mainly been aimed at enhancing competition by a light-touch transparency policy. This regulatory approach fits within the broader scheme of European telecommunications regulation, which is heavily premised on economic principles. Ever since the progressive liberalization and privatization of the telecommunications sector, European telecommunications policy has been progressing towards the (ideal) situation in which telecoms are only subject to competition law, without any sector-specific regulation being necessary.

However, European civil-society pressure groups have made attempts to reject the economic approach to network neutrality regulation, and focus on the effects that non-neutral network management by ISPs has on fundamental rights such as freedom of expression and privacy. [3] With ISPs in a stronger gate-keeping position, the freedom of citizens to receive and impart information and the secrecy with which they can communicate are negatively affected, according to this rationale. This fundamental rights approach to network neutrality has made inroads in European policy circles, particularly the European Parliament, and has even been included in revised European telecommunications regulation. [4] [5] In contrast to the US, however, there has nevertheless been little, if any, significant legal research into how valid the claims that non-neutral network management undermines European fundamental rights really are.

With this article, we have made an attempt to offer a structured approach to assessing the merits of European fundamental rights claims in relation to network neutrality. The present research asks if and to what extent network management that departs from ‘neutral’ principles violates European privacy rights according to art. 8 of the European Convention of Human Rights (ECHR), which guarantees the respect for family and private life. We suggest answers to this question by providing an extensive analysis of art. 8 ECHR case law, which we relate to different kinds of network management. The Convention is the major European legal document on Human Rights, and the Court enforcing these rights has developed a sizable case-law on privacy matters. This makes ECHR jurisprudence the logical starting point to discuss the merits of European fundamental rights claims concerning network neutrality. It should be stressed, however, that art. 8 ECHR is by no means the only or most important source of European privacy law. This article will therefore not draw conclusions regarding ‘the’ European privacy implications of the network neutrality debate, but merely focus on the impact of privacy according to the Convention on network neutrality.

In terms of methodology, we distinguish between what the literature on network neutrality has defined as the three most common types of network management—blocking, degrading and prioritising of traffic—and furthermore whether or not such network management is premised on Deep Packet Inspection (DPI) technology. Then, where possible, we test these forms of network management against the two paragraphs of art. 8 ECHR: assessing first whether different forms of network management constitute an interference with privacy according to art. 8(1), and second whether this interference, once established, is in accordance with the law; carries a legitimate aim; and is necessary in a democratic society according to art. 8(2).

The remainder of this Article will be structured in the following way. We will start off with a short literature review on the topic of network neutrality, identify various forms of network management, and relate the network neutrality debate to the European regulatory response thereto. This will lead into a description of what prompted the present research: the attempts of European public interest groups to frame network neutrality in terms of fundamental rights rather than the law and economics framework through which policymakers have approached the issue. We will then proceed to focus on one European fundamental right in particular, the right to privacy as enshrined in art. 8 ECHR. What follows is an extensive analysis of whether, and to what extent, art. 8 is of relevance for the network neutrality debate. We shall analyze if and how three common forms of network management—blocking, degrading and prioritising of traffic—could constitute a violation of privacy by following the legal test that the European Court of Human Rights (ECtHR) has developed in art. 8 proceedings.

Our findings suggest that only in a minority of cases it is likely that extended network management by ISPs will lead to a violation of art. 8 ECHR. A violation is mainly dependent on whether or not Deep Packet Inspection is utilized by ISPs as a network management technique, and whether or not traffic is blocked. Another key relevant factor is the role public authorities have in (mainly) blocking of network traffic—increased public involvement, for instance mandated filtering of copyright infringing or indecent material, will make a violation more probable. However, we acknowledge that our conclusions are speculative, and based on analogies with alleged privacy violations relating to older media of the art. 8 case law—such as telephony or written correspondence. Our findings are therefore not intended to be definitive, but rather meant as part of a broader research agenda on network neutrality and European privacy law. As stated above, the study of network neutrality from the perspective of European fundamental rights is an underdeveloped field in legal academia. Our aim with this article has been to initiate a constructive methodology to researching the impact of art. 8 ECHR on network neutrality, and we invite others to build upon this endeavour by applying our methodology to other sources of European privacy law.

2. On Network Neutrality

Over the last decade the network neutrality debate has shaken up the traditionally technical and specialist field of telecommunications policy into a more polarized policy area than ever before. In short, the network neutrality debate concerns the trade-off between allowing Internet Service Providers (ISPs) to differentiate their traffic and manage their networks more actively, and the possible exploitation by ISPs of their gate-keeping position. [6] After all, ISPs function as the platform between end-users and content and service providers such as Google and Facebook, and could exploit this position for anticompetitive purposes. [7] At the same time, with the advent of broadband Internet services has come a legitimate demand for not all traffic to be treated equally. Some traffic—say, HD live video streaming—is more sensitive to jitter and delay than other traffic, such as e-mail. This in contrast to the original architecture of narrowband Internet, where all traffic was of approximately the same ‘weight’ and could therefore be treated in a more egalitarian manner. [8]

Network neutrality thus touches upon the common debate between fairness and efficiency, [9] and as such has become a polarized debate between proponents and opponents. [10] Unsurprisingly, there is little academic consensus on the topic, which has prompted academics to publish a surge of literature on network neutrality, both in the fields of law, economics [11] and engineering. [12] [13] [14] A key point in the network neutrality debate is how much ‘network management’ ISPs should be allowed to perform, and whether a balance of appropriate network management should be obtained through market forces or by regulation. The literature highlights three specific forms of network management that are considered problematic: blocking, degrading and prioritising of Internet traffic. [15]

Blocking of traffic is rather self-explanatory: an ISP would completely prevent certain traffic from reaching end-users by for instance dropping packets or inserting reset packets within traffic. In some cases this is desirable, for example in battling spam or malware, while in other cases blocking can be regarded as undesirable—for instance when telecom operators block skype on mobile broadband. [16] Degrading of traffic can be interpreted as partial blocking: the ISP deliberately slows down packets of certain content and service providers so that end-users have trouble receiving this content as originally intended. ISPs could for instance slow down BitTorrent or other P2P traffic because this protocol consumes too much bandwidth. In case of filesharing of copyright infringing material this may be warranted, however, the P2P protocol is also widely used for legal purposes. Finally, ISPs can resort to prioritising certain traffic over others. As alluded to above not all traffic is equally prone to delay, which would only make it logical to prioritise time-sensitive applications such as streaming video or telemedicine services over less time-sensitive applications such as e-mail. [17] However, especially in situations of vertical integration—say, an ISP that is also active as a content provider—ISPs may be incentivized to prioritise their own vertically integrated subsidiaries over competing downstream services, which qualifies as foreclosure. [18]

The debate on the legitimacy of blocking, degrading and prioritising of traffic initially took place in US policy circles, but has gradually extended to Europe and other parts of the world. [19] [20] In fact, the network neutrality debate reached Europe right at the time when the EU institutions were in the process of revising European telecommunications law, which is a highly harmonized field of EU law. [21] Ever since the progressive liberalization and privatization of the sector, telecommunications regulation has become heavily premised on an economic approach to policymaking. This has led to a system in which telecommunications preferably are subject to ex-post antitrust oversight only, with the ambition to completely phase out all ex-ante regulation in competitive markets. [22] Only in case of so-called Significant Market Power (SMP) of a telecommunications provider is the aforementioned broad suite of telecommunications directives available to mitigate this SMP, however, such regulation should be rolled back as soon as the market in question becomes competitive again. [23]

This mechanism of ‘ex-post triggered ex-ante regulation’ was devised to intervene as little as possible in dynamic telecommunications markets, and as such also seems an appropriate approach to emerging markets such as broadband. [24] The European institutions have therefore considered regulation on the topic of network neutrality with due prudence, and have eventually settled for a light-touch approach of transparency regulation. [25] [26] While it goes beyond the scope of this paper to evaluate whether or not this transparency policy is appropriate in dealing with network neutrality concerns, in any case transparency fits within the overall economic approach to telecommunications regulation that the EU has fostered. [27] However, while policymakers have advanced an economic approach to network neutrality, the European public interest community has consistently approached the topic in terms of fundamental rights. Activist groups throughout Europe have mainly interpreted increased network management by ISPs as potential threats to fundamental rights such as freedom of expression and privacy. [28] [29] In the following section we will go deeper into these assumptions and relate this to European fundamental rights law.

2.1 Network Neutrality and European Fundamental Rights

Interestingly—and notwithstanding the traditional economic approach to telecommunications regulation—particularly the European Parliament has been receptive to this fundamental rights approach to network neutrality brought forward by the public interest community. [30] Given the European Parliament’s traditional interest in human rights matters related to online technology—particularly privacy [31] — this is not surprising. This focus of the Parliament on fundamental rights eventually resulted in an unusually explicit reference to the European Convention of Human Rights in the Framework Directive. [32] At the same time, the National Regulatory Authorities (NRAs) who are essential in enforcing European telecommunications regulation have in turn indicated they lack the competence to adjudicate network neutrality disputes related to fundamental rights. [33] This prompts questions as to what status referrals to fundamental rights within the Framework really have, and how provisions like the following will work in practice:

Member States wishing to implement measures regarding end-users’ access to and/or use of services and applications must respect the fundamental rights of citizens, including in relation to privacy and due process. [34]

Therefore, even though bold statements on how some forms of network management affect fundamental rights are quite common in public interest circles, [35] it is not altogether clear how network neutrality and European fundamental rights law relate to each other. American constitutional law scholars have developed a sizable literature on network neutrality in relation to US fundamental rights. [36] However, such a literature is lacking altogether in European legal academia. [37]

It must be acknowledged nevertheless that in an Internet context fundamental rights carry a strong rhetorical meaning. The Internet is widely regarded as a medium affording interaction and communication on an unprecedented scale, with far-reaching implications for traditional interpretations of basic human rights and public values such as privacy, freedom of speech, secrecy of communication and data protection. [38] There thus seems to be a demand for more thorough legal research into the merits of fundamental rights claims in a network neutrality context. At the same time European telecommunications policy, which includes Internet policy, has arguably been subject to economic determinism in which the supposed relevance of fundamental rights has received little attention—both by policymakers and by academics. The present article explores only one angle of the unexplored field of European fundamental rights and network neutrality: privacy according to art. 8 ECHR. The relevance of this angle shall be motivated in the following section.

2.2 Legal Framework of Fundamental Rights in Europe

The alleged economic determinism of European telecommunications policy calls for more systematic research into the relevance of European fundamental rights law for the European network neutrality debate, beyond the rhetoric of the public interest movement and the European Parliament. The first and obvious step would be to identify exactly which European fundamental rights are at stake in the network neutrality debate, and according to what legal framework. To start with the latter, both the phrasing of the new Framework Directive [39] and the of the public interest community [40] as it turns out seem to rely on the wording of the European Convention on Human Rights (ECHR) by using terns like ‘necessary in a democratic society’ and ‘public interference.’ The Convention and the case law that comes with it thus seem like a logical starting point to assess the merits of European fundamental rights claims in relation to network neutrality. Indeed, the ECHR is the central document for European Fundamental Rights, [41] and the EU Fundamental Rights Charter is based on it. [42] Moreover, with the adoption of Lisbon Treaty it was decided that the EU will accede into the ECHR, and in general the EU treaties testify of a high regard for European fundamental rights such as the Convention. [43] [44]

The natural next question would be which ECHR articles have a potential effect on the network neutrality debate. Considering the public interest position papers freedom of expression (art. 10 ECHR) and the right to privacy (art. 8 ECHR) come to mind rather intuitively. [45] [46] This would imply that increased or decreased network management by ISPs somehow has an effect on how citizens are able to receive or impart information, and the privacy with which they can communicate. A less intuitive ECHR right at stake with the network neutrality would be the freedom of assembly and association. Here, ISP network management would have an effect on the ways in which citizens are able to organize themselves and protest on the Internet, [47] which according to anecdotal evidence is by no means a hypothetical concern. [48] We find that at this point particularly privacy and freedom of expression warrant further research, as these fundamental rights seem to lead to most concern in the European network neutrality debate. In the present paper we wish to focus on privacy according to the Convention, while freedom of expression will be addressed by one of the authors in a separate paper. [49]

Before we start our art. 8 ECHR analysis, it should be stressed at the outset that fundamental rights offers a specific angle to disputes that concern network neutrality, alongside European or national telecommunications regulation and general competition law. All these legal regimes are in principle relevant for the network neutrality debate, and no perspective prevents stakeholders from invoking any of the others in a policy-making process or a legal procedure. As such, by no means do we argue in this article that network neutrality is or should be a matter of fundamental rights exclusively. By the same token, there are many more European sources of privacy law beyond the ECHR, such as the Data Protection Directive; the Electronic Privacy Directive; the Data Retention Directive; [50] [51] [52] and the Charter of Fundamental Rights of the EU, to mention only a few. [53] As this research focuses on the ECHR, its conclusions will also only concern the validity of privacy claims according to the ECHR related to network neutrality. The scope of this research project does not allow us to draw conclusions on the effects that European privacy law in general have on network neutrality, and this article is therefore also not intended as such.

3. Analysis

3.1 Privacy

Art. 8 ECHR guarantees the right to respect for privacy, formulated as follows:

1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

The structure of art. 8 is the same as that of arts. 9-11 ECHR: paragraph one provides a general description of the right, whilst paragraph two lists conditions under which an interference with the right is allowed. Since the notion of private life is a broad concept that includes relationships with the outside world, and since correspondence also covers Internet communications, it is clear that privacy is potentially an issue when Internet Service Providers actively manage Internet traffic. [54] [55]

Given the aforementioned claims of public-interest organizations, our analysis will mainly focus on alleged art. 8 violations of natural persons. However, given that art. 8 has ‘by far the widest scope’ of the Convention, to some extent art. 8 ECHR also covers legal persons. [56] According to art. 8 ECHR jurisprudence a privacy violation stricto sensu can only be brought by a natural person, not by legal persons—this in contrast to, for instance, art. 10 on freedom of expression. At the same time, legal persons do enjoy protection under the Convention regarding the privacy of their home and correspondence, although ‘such protections may be strictly confined to company premises.’ [57] [58] [59] This seems to suggest that art. 8 ECHR may be difficult to apply to content and service providers such as Facebook and Google. [60] We shall therefore assume for the remainder of this article that complaints have been brought by individuals. To determine whether and to what extent network management violates the Convention’s right to privacy, the steps of art. 8 ECHR have to be analysed. First, is there an interference with the right to privacy (paragraph 1), and second, if this is the case, is the interference legitimated by fulfilling the criteria of paragraph 2 of art. 8? For this we will draw analogies between network management practices and existing art. 8 case law, to compare this jurisprudence to (hypothetical) network neutrality matters.

3.1.1. Paragraph 1: Interference

According to art. 8(1), the exercise of the right to privacy shall not be interfered with by a public authority—unless the criteria of art. 8(2) are met. For an infringement of the right to privacy under the ECHR, two questions therefore have to be answered: when does network management constitute an interference with people’s exercise of their right to privacy, and is this interference done by a public authority?

When does network management constitute an interference?

Despite the claims made by some public interest groups that deviations from network neutrality are a threat to privacy, [61] it is far from evident that privacy according to the ECHR is an issue in network management. Most concerns are raised by Deep Packet Inspection (DPI), which is said to be a useful, perhaps necessary, tool to perform network management.

DPI-based network management

DPI is a powerful network engineering technique with a potentially endless number of applications. Traditional, ‘shallow’ packet inspection systems can identify and monitor traffic only based on the headers of Internet traffic, which is analogous to the envelope of a letter. DPI however can go all the way down to the deepest (application) level of Internet packets according to the OSI model, so that program, software or protocols being used can be identified in real time, and crucially, to determine what these applications are being used for. [62] [63] This implies that DPI technology allows for the screening of content by third parties, including web browsing, email, and VoIP calls. [64]

DPI enables ISPs to ensure network security, perform network management, and to achieve price discrimination, behavioural advertising or content filtering. [65] [66] [67] In general, DPI seems a more refined tool for network management, regardless of the specific purpose, as it enables ISPs to better distinguish between packets. It should be borne in mind, however, that, although helpful, DPI does not seem necessary for many typical network management purposes. [68] The many ways in which DPI can be applied for network management and other functions does however not lead away from the fact that in many instances the actual content of communication is being monitored by a third party, the ISP. [69] The possibility to communicate without being intercepted is a fundamental element of privacy, specifically mentioned in art. 8(1) as respect for correspondence. [70] If DPI is used and thus correspondence is intercepted by the ISP, there is a clear interference with users’ right to privacy.

Non-DPI-based degrading or prioritising traffic

The situation is less clear, however, when network management does not involve DPI. Let us suppose network management is based on shallow packet inspection. We will analyze first network management in the form of degradation or prioritisation, and subsequently network management in the form of blocking. When asking whether degrading or prioritising traffic touches upon the right to privacy, we can look at three possible arguments. The first is that managing traffic involves processing of personal data. If prioritising or degrading traffic is based on sender or receiver, then IP addresses will be processed, which, according to the Article 29 Working Party, are to be considered personal data. [71] [72] Personal data are included in the scope of art. 8(1) ECHR, and data protection is increasingly being considered part and parcel of the right to privacy by the ECtHR. [73] If network management is based on type of traffic, however, such as streaming audio or video or instant messaging, this as such does not involve processing address information or content, and hence does not involve processing of personal data.

The second argument is that managing traffic involves processing of traffic data, i.e., any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof. The processing of traffic data may touch upon the right to respect for correspondence and hence falls within the scope of art. 8(1) ECHR. [74] Some types of data processing are not an interference, for example, the provider’s processing of traffic data for billing purposes. [75] In Malone, the Court found an infringement of art. 8(1) because the traffic data were provided by the telecom operator to the police. [76] In Copland, the Court noted that processing traffic data can also constitute an interference when they are not disclosed or used against the person in disciplinary proceedings. [77] What is relevant is how the traffic data are used, which in this case—with storage of traffic data over an extensive period of time by the employer who suspected Copland of excessive use of communication facilities—constituted an interference. [78] From this case-law, we can infer a criterion for interference being that traffic data are processed in another way or for other purposes than for their primary purposes of routing traffic and billing.

Is it possible to distinguish systematically between network management of traffic data primarily for billing and routing, and other forms of network management? The issue is whether network management involves processing of packets for a primary purpose (the conveyance of a communication or billing) or rather for a derivative purpose (the manner of conveyance of a communication). Existing research distinguishes between traffic data and communication content, where traffic data concerns the three essential functional tasks of ISPs, and three types of services that ISPs perform. [79] The functional tasks of ISPs are:

• service performance—processing of data as part of the service agreement with a consumer;
• service management—processing of data for the purpose of traffic management and maintenance of the network; and
• service accounting—processing of data for billing purposes,

while the service types are: [80]

• mere conduit—facilitating transmission on, or access to a communications network;
• caching—automatic, temporary and transient storage of data to streamline transmission; and
• hosting—facilitating the storage of data by consumers on the ISPs premises.

The crucial difference between traffic data and communications content is that when at least one of the functional tasks is performed by an ISP for the purpose of at least one of the service types, the ISP is involved in handling traffic data. When this is not the case, the ISP will handle communications content instead. [81]

This typology provides a useful heuristic for assessing whether traffic management involves data processed for a primary purpose (i.e., processing traffic data that are essential for the service) or for a derivative purpose (processing communications content), which allows us to apply the Copland rationale to ISPs’ network management practices. Network management for the purpose of degrading or prioritising of traffic is done for the service type of mere conduit, and performs the function of service management (‘data processing for traffic management and network maintenance’) and perhaps also the function of service performance (‘data processing to perform the service agreement with the user’), if the contract contains for example performance levels. Hence, such network management involves processing of traffic data for their primary purpose. [82] This would imply that network management uses traffic data in a way that may not infringe art. 8(1) according to the Copland standard.

An alternative argument would be that traffic degradation or prioritisation does not infringe privacy because personal or traffic data are processed, but rather because of some more general privacy concern. After all, art. 8 has been interpreted in a dynamic way by the Court taking into account current scientific and social developments, and the notion of private life is a broad concept not susceptible to exhaustive definition. [83] [84]

One approach would be that degrading network traffic hampers the delivery of correspondence. There is a significant body of art. 8 case law on correspondence of prisoners; although initially the ECtHR did not consider delay of correspondence an interference under art. 8(1), later on the Court came to the conclusion that more types of restriction on correspondence of prisoners fell within the scope of art. 8(1). [85] [86] Nevertheless, we do not think that the case-specific circumstances of these restrictions—preventing a prisoner from writing a petition; supervising correspondence of prisoners [87] —can be fully compared to degrading network traffic with shallow packet inspection, which seems much less of an interference with correspondence—unless email, chat or IM are degraded specifically. Altogether, however broad and flexible the notion of private life may be in art. 8(1), we conclude that slowing down or speeding up communication packets does not generally touch upon people’s right to privacy. It seems that only when degrading or prioritising traffic is based on sender or recipient information—IP addresses—or when the management goes beyond what is reasonable for routing and billing traffic, that art. 8(1) can be invoked.

Non-DPI-based blocking

Deviations from network neutrality in the form of blocking traffic are much more likely than degradation or prioritisation to infringe upon the right to privacy. The three arguments discussed in the previous section carry more weight here, since blocking is a much more significant interference with correspondence than delay or supervision. [88] Blocking traffic is also less likely to fall under normal service management or service performance, so that the data on which the blocking is based are not processed as normal traffic data; the secondary use of traffic data for the purpose of blocking is more likely to be considered an interference with correspondence. [89] Finally, blocking will often be performed on the basis of content (e.g., unlawful material) or on the basis of sender or recipient information (e.g., copyright-violating file-sharing), both of which can count on the protection of art. 8(1). It should be stressed at this point that there may indeed be cases—think of spam or other malware—in which blocking behaviour may be considered as not violating privacy according to art. 8 ECHR, based on the proportionality test of art. 8(2). This will be discussed below.

Is the interference executed by a public authority?

The second element necessary for invoking art. 8(1) protection is that an interference is done by a public authority. Like the interference as such, this is not evidently the case in many types of network management, since ISPs are usually not a public authority—with the exception of some European countries where ISPs are (partially) State-owned, such as Sweden and Finland. [90] Art. 10 ECHR jurisprudence suggests that the bar for public interference with Convention rights is relatively low however, [91] and in art. 8 jurisprudence particularly the Court has Stated that public interference and positive obligations of the State—discussed below—blend into each other. [92]

If there is no ownership link between an ISP and the State, the interference can still be performed by a public authority in some cases. If a State puts an explicit legal obligation on ISPs to conduct network management, there is a clear form of State interference, but such laws are relatively rare. [93] There is no obvious legal obligation as such for degrading or prioritising traffic. [94] However, art.

13a (1) of the Framework Directive stipulates that service providers must

take appropriate technical and organisational measures to appropriately manage the risks posed to security of networks and services. Having regard to the State of the art, these measures shall ensure a level of security appropriate to the risk presented. [95]

Since (information) security comprises both confidentiality, integrity, and availability, ISPs apparently have to take measures to ensure an adequate level of service availability. [96] One could argue that this comprises monitoring bandwidth availability and intervening when traffic throughput is threatened, in which case they could degrade high-bandwidth traffic (such as spam or excessive peer-to-peer file-sharing traffic) or prioritise time-critical traffic (such as voice-over-IP). However, the provision does not constitute a direct obligation to prioritise or degrade traffic, and it provides a legal obligation only for some types of network management in this respect.

For blocking, there are some clearer examples of legal obligations. Some (controversial) laws have been enacted to oblige ISPs to block access to child-pornographic websites, [97] while some courts have ordered ISPs to block access to unlawful content, such as copyright-infringing file-sharing sites. [98] Such court injunctions are, however, relatively rare. [99] More frequent are forms of Internet blocking, notably of child-abuse images, through public-private partnerships in which ISPs voluntarily block access to blacklisted websites. [100] In these cases, a blacklist is often provided by the police, and this seems to be a sufficient connection to speak of interference by a public authority. In M.M. v The Netherlands, the police suggested a citizen to record a conversation with the suspect and connected a tape recorder to her phone; the Court determined this to constitute State interference:

‘Acting as they did, with the permission of the public prosecutor, the police ‘made a crucial contribution to the execution of the scheme’, as well as being responsible for its inception’. [101]

These considerations apply analogously to voluntary child-pornography blocking schemes, in which the police often makes a crucial contribution to the scheme of blocking (such as a blacklist and the text of a ‘STOP’ page shown to users trying to access a site), and ISPs seldom embark on these schemes out of their own initiative. [102] Thus, in case of ISP blocking there seems a considerable likelihood that this is an interference by a public authority, both in mandatory and in voluntary forms of blocking, except when the ISP takes the initiative and has no dealing with the police in the execution of the blocking.

Not all types of blocking reach the threshold of State involvement, however. An increasingly prevalent type of network management comprises blocking to prevent access to services that the user has not paid for, e.g., blocking Skype or streaming video for users of a basic mobile Internet subscription. This is the playing field of market forces and freedom of contract where there seems to be no State involvement outside the boundaries of the Regulatory Framework for Electronic Communications. [103] Therefore, these types of network management cannot be considered to be an interference by a public authority. [104]

Positive obligations

Even if there is no interference by the State as such, art. 8 can still be at issue, namely when the State does not take sufficient responsibility for safeguarding that citizens can enjoy the right to privacy. As mentioned above, the Court does not advance a sharp distinction between direct State interference and positive obligations of States to prevent interferences. [105] The positive obligations of the State under art. 8 have been developed in case-law. [106] Most of these cases deal with private and family life, with environmental protection related to the home, or, occasionally, the privacy of correspondence. [107] [108] [109]

In some sense, the respect for private or family life could perhaps be at issue in network management. In K.U. v Finland, the Court assumed a positive obligation for the State to ensure an effective system for legal redress for a victim of sexual harassment, which should include the legal possibility to request an injunction to order an ISP to provide address information of the sender of the harassing message. [110] One might argue that, in a similar vein, a victim of child-abuse images must have the legal possibility of going to court to request an order for ISPs to block access to websites containing images of her/him. Thus, there may be a positive obligation on the State to have a possibility in the legal system for filtering and blocking unlawful content or for notice-and-takedown regimes. However, the analogy might stretch only so far as that K.U. requested information about a particular IP address, implying that a child-abuse victim should be able to request blocking of websites containing his own images, which is substantially different from a generic legal duty to block child-abuse images. Note that following this rationale, positive obligations on States under art. 8 ECHR to protect citizens’ privacy would lead to the blocking of data.

The reverse situation seems more likely to invoke positive obligations, i.e., when ISPs block content of their own accord. Unless the filtering and blocking is very targeted—and consequently very limited, as filtering systems are usually coarse instruments—false positives (‘overblocking’) are likely to occur with users being denied access to lawful content or file-sharing websites. [111] If the filtering is based on keywords, or on blacklisted domain names that host both unlawful (child-abuse images) and lawful (adult pornography) material, following ECHR jurisprudence the blocking might touch upon the intimate or family life of web users, since they are being restricted in the right to develop their sexuality. After all, ECHR case law suggests that the blocking must be of such an extent that users’ private (lawful) sexual life be systematically and directly affected. [112] One could thus argue that, while State-mandated or State-triggered blocking is likely to constitute State interference, also voluntary but systematic and sweeping ISP-initiated blocking might trigger art. 8(1) through the positive obligations on the State to prevent ISPs from systematically curbing the sexual, private, or family life of web users, if the blocking system is so crude that it continuously and directly affects users’ exercise of sexual freedom on the net.

Key to the ECtHR’s approach to positive obligations in art. 8 procedures seems to be the ‘direct and immediate’ link that the Court requires between the measures sought by an applicant and her private or family life. [113] [114] In any event the Court has refrained from advancing a broad interpretation of positive obligations in art. 8 matters and States enjoy a relatively wide margin of appreciation. [115] This inevitably leads to a case-by-case approach to positive obligations, depending on specific facts and circumstances. In case of blocking of content by ISPs this link between remedy and privacy must also be established therefore, which does not allow for strong predictions as to how the Court would approach positive obligations in the case of Internet filtering.

Summary

Deviations from neutral network management do not always constitute an interference of the right to privacy by a public authority. On the contrary, the most common types of network management in the form of prioritising or degrading traffic will seldom be an art. 8 issue. Only when the degrading or prioritising is based on sender or recipient information—IP addresses—or when the management goes beyond what is reasonable for routing and billing traffic, is art. 8(1) interfered with. But unless the ISP is (partly) State-owned, the interference is not done by a public authority, and moreover the slowing down or speeding up of packets does not seem a sufficiently severe infringement of the right to privacy that positive obligations can be assumed.

Network management does become an art. 8 issue when it takes the form of blocking. If the blocking is based on DPI, then correspondence is intercepted by the ISP, which is a clear interference with users’ right to privacy. Also non-DPI-based blocking is likely to interfere with the right to privacy, as it will usually deviate from normal service management or service performance, and hence processes traffic data for non-primary purposes, which constitutes an interference. Moreover, with blocking there will also usually be a State responsibility, also if the ISP is non-State-owned, because both in mandatory and in voluntary forms of blocking there is often considerable State involvement. If the blocking is not aided by public authorities and taken on the ISP’s own initiative, the ISP’s interference with users’ privacy can invoke positive obligations if the blocking system is crude and systematically hampers users’ use of the Internet to develop their sexual life.

3.1.2 Paragraph 2: Justifications

If network management interferes with the right to privacy, the interference is only allowed if it meets the requirements of art. 8(2) ECHR: it must be a) in accordance with the law, b) pursue a legitimate aim, and c) being necessary in a democratic society. In this section, we will mainly focus on blocking network traffic and not so much on prioritising and degrading traffic. As we concluded in the previous section, prioritising and degrading will probably not constitute State interference, except in the case of a State-owned ISP performing this type of network management based on user address information or in a way that goes beyond what is reasonable for routing or billing. Moreover, since many instances of degrading and prioritising of traffic are unlikely to be considered interferences with user privacy according to art. 8(1) of the Convention to begin with, an extensive 8(2) analysis becomes less relevant in this context. The main exception to this is when degrading or blocking is premised on DPI, but here there is little difference to DPI-based blocking anyway. Therefore, here we will discuss predominantly whether ISP blocking of traffic passes the test of art. 8(2), both in cases of direct State interference and in cases of positive obligations—the Court does not substantially distinguish between these two types of interference, generally performing a similar test under 8(2). [116] In what follows, we will address the three prongs of the art. 8(2) test.

Is the interference in accordance with the law?

If ISPs block traffic because a law obliges them to do so, then there is a clear enough legal basis. [117] If a court orders an ISP to block certain traffic, this will also normally constitute a clear legal basis. [118] The same goes for prioritising and degrading—assuming this network management constitutes an interference according to 8(1)—even though in practice it seems more unlikely to occur. However, having a basis in law is not enough. The interference must be sufficiently accessible to citizens, and this implies that the legal basis has to comply with qualitative criteria: the scope and manner of exercise of the interference must be explained with sufficient precision, [119] and must be made accessible to the public rather than be laid down in internal guidelines. [120] The Court stresses the importance of clarity in light of technological dynamics:

‘Tapping and other forms of interception of telephone conversations represent a serious interference with private life and correspondence and must accordingly be based on a ‘law’ that is particularly precise. It is essential to have clear, detailed rules on the subject, especially as the technology available for use is continually becoming more sophisticated.’ [121]

Kruslin and Huvig’s stress on the quality of the law is relevant for network management, as this practice is more sophisticated and less understandable to citizens than interception of telephony. A difference may be that communications interception is a more severe infringement than blocking, degrading or prioritising even if it is DPI-based, since the content of communications are not heard or read by law enforcement in criminal investigations, but are automatically scanned for routing or blocking traffic. Nevertheless, DPI infringes the secrecy of correspondence and—following Kruslin and Huvig—will therefore require a reasonable level of clarity for citizens to be able to know how the secrecy of their communication can be interfered with by ISPs based on certain legal provisions.

In laws or court cases mandating blocking, the level of clarity may not be particularly great. The exact type of network management will be detailed in lower regulations or internal instructions, or will be left to the discretion of the ISP. In the Danish case where Telenor was ordered by a lower court to block users from accessing The Pirate Bay, the Supreme Court stressed the discretionary power for the ISP to determine its network management:

‘Even if it is left to Telenor to choose between different ways of blocking or obstructing the access to the website, the Supreme Court finds that the prohibition and injunction is formulated in a sufficiently clear and precise way. Telenor has chosen to comply with the prohibition and injunction by blocking access to the website at DNS level [i.e., based on routing information]. The defendant [i.e., IFPI, a music-rights organisation] has Stated that the blocking mentioned is sufficient to comply with the prohibition, and that if the defendant should wish to oblige Telenor to deploy another form of blocking, they can start a new injunction-prohibition procedure, in which a new proportionality assessment is to be made.’ [122] [123]

It is questionable, however, whether the Danish court’s conclusion in a case about the administrative burden rather than the privacy of blocking—Telenor contested the proportionality of the injunction in terms of compliance costs—can extend to the article 8(2) test of clarity and foreseeability of the law. In Herczegvalvy, the Court determined that a law allowing a psychiatric hospital to send letters of its inmates to a curator for selection of which letters would be actively sent out, was accessible but too vague for subjects to foresee the consequences:

‘These very vaguely worded provisions do not specify the scope or conditions of exercise of the discretionary power which was at the origin of the measures complained of. (…) Admittedly, as the Court has previously Stated, it would scarcely be possible to formulate a law to cover every eventuality (…). For all that, in the absence of any detail at all as to the kind of restrictions permitted or their purpose, duration and extent or the arrangements for their review, the above provisions do not offer the minimum degree of protection against arbitrariness required by the rule of law in a democratic society.’ [124]

In a similar vein, one can argue that a law or court order mandating for instance ISPs to block certain traffic needs to sufficiently delineate the purpose, duration, and scope of blocking, in order to curb the discretionary power conferred on the ISP. Consequently, if it is left to an ISP whether to conduct blocking at the DNS (based on domain names) or IP level (based on numerical addresses) or by using Deep Packet Inspection, then the scope and manner of the exercise of blocking can hardly be considered sufficiently clear for users. At the least, a court injunction or statutory obligation should make clear whether network management is to be conducted based on routing information—domain names or IP addresses—or on Deep Packet Inspection, as the person concerned ‘must moreover be able to foresee its consequences for him.’ [125]

With voluntary blocking schemes or other non-public authority ordered prioritising or degrading, it will be harder than with statutory or court-ordered blocking to determine whether the interference is in accordance with the law, as there is no clear legal basis for this. The Electronic Commerce Directive for instance can hardly serve as a legal basis. [126] It provides that member States may not impose a general obligation to monitor (art. 15), but allows courts or administrative authorities to require service providers to terminate or prevent unlawful activities (art. 12(3)). This is too far removed from typical public-private partnerships that block unlawful content to be able to serve as a legal basis. Perhaps, in case of voluntary blocking, a basis should be sought in the law criminalizing forms of content. The national criminal provision on child pornography, for instance, would then serve as the legal basis for public-private partnerships that filter child-abuse images. However, having illegal content blocked by one’s ISP is considerably removed from the legal provision criminalizing that content. It is questionable whether citizens can foresee the consequences of Internet filtering and blocking on this basis, particularly since a large discretionary power is involved in the decisions what and how to filter. The ‘scope or conditions of exercise of the discretionary power’ of blocking child-abuse images are not in any way explained in the legal provisions that criminalize child abuse—which is logical, as these are substantive provisions that are not meant to serve as criminal-procedural provisions in the first place. [127]

As a result, we tend to conclude that voluntary network management practices that constitute an interference according to 8(1) ECHR will often not be in accordance with the law, as they lack a sufficiently clear legal basis. Only if some legal provision or lower regulation exists that illegal content must or can be filtered will citizens be able to foresee the consequences of Internet filtering for them. We add a caveat, however, in that there may be a trade-off between the extent of government involvement and the demands made on the quality of the legal basis: the more a public authority is actively involved in blocking illegal content, the more explicit the legal basis will have to be.

And conversely, if the public authority only plays a minor role in voluntary filtering, the legal basis for this may more easily be found in indirect provisions such as criminal sanctioning of child pornography in combination with a general provision in a Police Act that the police has the task of enforcing the law.

An alternative legal basis for blocking, degrading or prioritising of content could be found in legal provisions requiring network operators to safeguard the security or integrity of their networks, such as is formulated in the EU Framework Directive concerning electronic communications networks. [128] Such requirements in Directives must be implemented in national legislation. [129] If the basis for blocking, degrading or prioritising content is based on these network integrity provisions, the implementation provision must of course comply with the foreseeability and clarity requirements that the Court has set out, implying that the text should establish a sufficiently clear link between security or integrity threats and the content that is being blocked, degraded or prioritised. For malware and other security threats, such a link will be relatively clear, but for content-related offences, such as child pornography or hate speech, it seems a long shot to argue that such content can be blocked because it threatens network security or integrity.

Does the interference serve a legitimate aim?

Network management can serve different purposes. One frequently occurring purpose—particularly in relation to State interference, such as laws or courts mandating filtering—is to prevent unlawful content from being spread. That is in the interest of the prevention of crime, and hence constitutes a relevant interest for complying with the second prong of the art. 8(2) test. Blocking of harmful but not unlawful material, such as pornographic or violent images that can be harmful to children does not serve the prevention of crime, but it is presumably done in the interest of the protection of morals or protecting the rights and freedoms of children—or of parents who may want to restrict online content for their young children.

Another purpose of network management, as alluded to above, can be network integrity or security, if the management is focused on either filtering out malware or bulk traffic (e.g., spam or super-high-volume peer-to-peer traffic) that threatens the continuity of service provision. In that case, blocking can be said to serve the interest of the country’s economic well-being—the Internet being a critical infrastructure for the economy in the information society—or otherwise for protecting the rights and freedoms of other net users.

Altogether, the second prong of the 8(2) test can fairly easily be accommodated, and in general the Court attaches little weight to this prong anyway. [130] There is, perhaps, one proviso, in that art. 18 States that the ‘restrictions permitted under this Convention to the said rights and freedoms shall not be applied for any purpose other than those for which they have been prescribed.’ In principle, art. 18 can be violated even if art. 8 itself is not violated. [131] Since ‘function creep’ is a frequently occurring phenomenon in technological systems and policy, it should be monitored whether network management systems introduced for crime prevention or protecting children are not, gradually over time, used for other purposes in practice, in which case art. 18 might perhaps enter into the equation. [132]

Is the interference proportional?

In most art. 8 assessments, the third prong of art. 8(2) is the million dollar question: is the interference necessary in a democratic society? This is always a case-specific question. As the Court often stresses, the proportionality assessment is made in light of all circumstances of the case, and not meant to provide general assessments on classes of cases. [133] Of course, analogies can be drawn between proportionality assessments of established art. 8 case law and the proportionality of certain types of network management. However, in the absence of cases that specifically address network management, the difficulty of determining whether blocking, degrading or prioritising as forms of network management are necessary in a democratic society is compounded by the fact that most analogies are set in quite different contexts and hence cannot allow us to draw strong conclusions on proportionality. Our conclusions on the necessity of network management are therefore necessarily speculative.

There is a significant case law on the blocking or obstructing of correspondence. However, this jurisprudence is very context-specific: it concerns prisoners, often situations concerning correspondence with a solicitor or with public authorities. [134] [135] The correspondence in these settings is particularly important for the inmates, with few alternative means of communication. [136] This context can hardly be transposed to blocking Internet traffic, where Internet users usually have many communication channels available and where the blocked Internet traffic will often be less vital for the person’s well-being than prisoners’ correspondence with attorneys. [137]

Having said that, we can offer some remarks about the proportionality of various types of network management, in terms of what is more or less likely to be considered necessary in a democratic society. We can look at several dimensions of the blocking, degrading and prioritising: why, when, how, and by whom this is done—assuming that this form of network management is an interference according to 10(1) ECHR.

First, we have already distinguished between various purposes of network management, blocking in particular: assuring network and service integrity, and blocking illegal or harmful content. The first reason seems relatively non-contentious: ISPs have good reason to filter out Internet traffic containing viruses and malware, and quality-of-service requirements may also imply that bulk spam or high-volume traffic can be blocked. Unless the network management is evidently overdone, we think that this type can often be considered proportional according to 8(2) ECHR. The second reason, blocking unlawful content, may be more contentious, since the dividing line between lawful and unlawful content is much harder to draw than with malware or spam, and automated systems are not particularly precise in only filtering out unlawful content. [138] When it comes to the necessity in a democratic society of network management, we can think of a spectrum ranging from content that is widely and non-controversially regarded as illegal, such as child-abuse images—which will more easily be considered necessary in a democratic society to filter out—to content that is harmful to some user groups but not illegal—which will less easily considered necessary in a democratic society to filter out. [139] [140] Somewhere in between the extremes of this spectrum is copyright-infringing peer-to-peer file-sharing. Although blocking copyright-infringing file uploads is a legitimate aim, this could be considered necessary in a democratic society only if the blocking is very targeted and limited in scope. [141]

This connects to other dimensions, namely when and how the network management takes place. Incidental or short-period forms of blocking or degrading will be more acceptable than generic, continuous blocking systems, as the Scarlet case suggests. [142] Also the granularity of the network management will be a relevant factor. [143] Since filtering systems can never be 100% correct, it will matter whether the system is tuned towards false positives (making sure that most unlawful content is blocked while accepting blocking of lawful content as collateral damage) or towards false negatives (making sure that no lawful content is blocked while accepting that not all unlawful content will be blocked). Obviously, a policy accepting false negatives over false positives is more proportionate for respecting the right to correspondence than the other way around, and as the Court seems to be quite strict when assessing the proportionality of blocking correspondence, this creates a strong presumption that network management systems should tend to false negatives rather than false positives, if they want to be considered necessary in a democratic society. [144]

Finally, it also matters who performs network management, in the sense that the degree of State involvement is likely to influence the proportionality assessment. The more the police, the legislator, or a court for instance is actively involved in blocking illegal content, the stricter the proportionality scrutiny will be. For network management that is done by ISPs with relatively little State involvement (and consequently less privacy interference by a public authority), a larger margin of appreciation is likely to be granted than if the State actively mandates the ISP to block traffic. In short, whether blocking, degrading or prioritising of Internet traffic can be considered proportional in terms of art. 8(2) depends greatly on the circumstances of the case. Relevant factors are the type of content that is ‘managed’ and the reason for managing this; the duration and scope of network management; the type, granularity, and default settings of network management; and the level of State involvement.

4. Conclusion

Network neutrality is a complex issue that has kept scholars and policymakers busy for around a decade now. Because of the economic premises of European telecommunications regulation, network neutrality has predominantly been approached by European policymakers in economic terms as well. At the same time, the public interest community in Europe rather has actively framed the network neutrality debate in terms of fundamental rights such as freedom of expression and privacy, and particularly the European Parliament had been receptive to this idea. In this article we have discussed the merits of claims that departing from ‘neutral’ network management affects the privacy of according to art. 8 of the ECHR. The ECHR is a natural focal point for such a research endeavour, as this is the central European legal document on human rights in Europe, and the Court enforcing the Convention has developed a rich jurisprudence on privacy matters.

In contrast to the sometimes bold claims of public interest position papers, we have come to more nuanced findings. First and foremost, we argue against broad, catch-all conclusions of how network management violates the right to privacy according to the Convention. Whether or not ISPs’ network management violates the right to privacy as enshrined in the ECHR mainly depends on the form of network management, and the (active) role public authorities play in fostering network management. For instance, unless degradation and prioritisation are premised on DPI technology, it will be unlikely for these types of network management to be considered an interference according to art. 8(1) in the first place. After all, applying Copland, it is likely that network management that does not go beyond its primary use—like degrading and prioritising—will not quality for an interference with privacy. [145] Moreover, such network management is very unlikely to be sanctioned by public authorities, and in the absence of a clear interference it also becomes unlikely that the Court would recognize positive obligations here. Blocking of traffic, however, is a different story. Both when premised on DPI and on ‘shallow’ packet inspection techniques can blocking be considered an interference according to 8(1), as blocking may very well go beyond primary network management purposes. This leads to a situation in which positive obligations on Member States are more probable to be identified by the ECtHR. Furthermore, public authorities are more likely to be involved in blocking traffic by ISPs.

However, we can only draw modest conclusions on whether an interference with privacy according to 8(1) due to network management also becomes a violation of 8(2) ECHR and thus a violation of the Right to Privacy of the Convention. While the ‘in accordance with the law’ and ‘legitimate aim’ prongs can fairly easily be dealt with, on the matter of proportionality the case law only allows us to conclude that (not) finding a privacy violation for interfering network management will be a very case-specific affair. The proportionality of privacy-interfering network management depends on matters like the kind of traffic that is managed and the reasons for this; the duration and scope of network management; its (technical) type and the (programmed) granularity of this technique; and the extent to which public authorities have been involved.

Especially this conclusion on proportionality may not seem spectacular, however, it is useful in the sense that it tones down sweeping claims on the supposed ECHR violations of network management, and offers a road map for more precise study on how different forms of network management have different effects on privacy. Indeed, this research project only covers a small part of the field of European privacy law. We argue for a case-by-case approach to network neutrality in European privacy law, factoring into account the exact and case-specific circumstances of an alleged interference with citizens’ privacy. If anything, this article is a call for further and more specific research into assessing network neutrality concerns according to European fundamental rights, and European privacy law.