数字信件保密争议在欧盟即将进入暑期休会前升级至新阶段。由于欧盟议会持续抵制导致"聊天控制2.0"(即强制无嫌疑扫描加密通信)谈判陷入僵局后,欧盟部长理事会正通过法律手段推进议程。
各成员国拟通过快速程序重启已于4月3日到期的技术集团自愿监控信息过渡条例。理事会于周四通过书面程序就"新"条例达成立场,旨在填补即将出现的法律漏洞并加大对欧洲议会议员的施压。
此举的缘由在于:自2020年底起,即时通讯应用、网页邮件及网络电话等基于互联网的非号码相关通信服务须遵守《欧洲电子隐私指令》严格规定。该指令保护通信保密的基本权利,禁止未经授权拦截或评估通信内容及流量数据。为使技术提供商仍能通过AI与哈希匹配技术自愿搜索私人聊天中的已知虐待材料或诱骗模式,欧盟立法者于2021年设立临时豁免条款。这项被称为"聊天控制1.0"的条例于今春到期,因理事会与议会未能就延期达成一致。
儿童保护与通信保密
对理事会而言,条例到期是难以接受的情况。提供商的主动检测措施是早期识别受害儿童、解救受虐者、遏制非法图像视频材料在线失控传播的关键工具。此外,尽管过期规范仍持续产生举报信息,该程序仍为在线执法作出重要贡献。新条例旨在防止各国单边行动导致监管碎片化。
然而,批评者认为,所选择的程序是试图规避民主监督机构并让议会措手不及。由于一项已经到期的法规在形式上无法简单延长,欧盟各国政府正在采取一种变通手段:他们不是提出延期,而是提交了一份内容基本一致但形式不同的立法提案。
夏季休会前的战术性时机选择
该草案最早将于周二作为紧急程序被列入议会议程——恰好在夏季休会开始之前。如果全体会议批准加速程序,那么投票将可能安排在假期前的最后一个会议日,而历史上许多欧洲议会议员在那时往往已经离开。更复杂的是,该程序已进入二读阶段。在此阶段,除非有绝对多数的代表投票反对,否则理事会的立场只能通过修正案来阻止或修改。在夏季休会前夕,这一门槛在实践中被认为几乎无法逾越。
尽管理事会强调,扫描将严格限制在绝对必要的范围内,并且不会进行普遍的、不加区别的监控,但对所有用户隐私的侵犯仍然十分严重。该法规规定,处理过的内容和流量数据必须在检测到后十二个月内不可撤销地删除,除非有具体的嫌疑得到确认。与此同时,一个永久性的、长期的防止滥用法律框架却渐行渐远。
(kbe)
The dispute over digital letter secrecy in the EU is reaching a new level of escalation shortly before the summer break. After negotiations on Chat Control 2.0 – i.e., the mandatory, suspicionless scanning of encrypted communication – stalled due to persistent resistance in the EU Parliament, the Council of Ministers is now pushing forward with a legal maneuver.
The member states want to reactivate the transitional regulation for voluntary monitoring of messages by technology groups, which expired on April 3, in an expedited procedure. The Council adopted a corresponding position for a “new” regulation on Thursday via written procedure to close a looming legal loophole and increase pressure on MEPs.
The reason for the trick: Since the end of 2020, internet-based, number-independent communication services such as messenger apps, webmail, and VoIP telephony have been subject to the strict provisions of the European E-Privacy Directive. This protects the fundamental right to confidentiality of communication and prohibits unauthorized interception or evaluation of content and traffic data. To still allow technology providers to voluntarily search private chats using AI and hash matching for known abuse material or grooming patterns, the EU lawmakers created a temporary exemption in 2021. This regulation, referred to as Chat Control 1.0, expired in the spring, as the Council and Parliament could not agree on an extension.
Child Protection and Letter Secrecy
For the Council, the expiry of the deadline is an untenable situation. The providers' voluntary detection measures are an indispensable tool for identifying affected children early, rescuing victims from abuse situations, and curbing the uncontrolled further dissemination of illegal image and video material online. Furthermore, the procedure makes an important contribution to online law enforcement, even though reports continue to flow despite the expired norm. The new regulation aims to prevent fragmentation through national unilateral actions.
Critics, however, see the chosen procedure as an attempt to circumvent democratic control bodies and to surprise Parliament. Since an already expired regulation cannot simply be extended in formal terms, the EU governments are resorting to a trick: Instead of an extension, they have put forward a legislative proposal that is largely identical in content but different in form.
Tactical Timing Before the Summer Break
The draft is to be put on Parliament's agenda as early as Tuesday as part of an urgent procedure – immediately before the start of the summer break. Should the plenary session approve the accelerated procedure, a vote threatens on the last day of session before the holidays, when many MEPs have historically already departed. Compounding the issue, the procedure is already in its 2nd reading. At this stage, the Council's position can only be stopped or modified by amendments if an absolute majority of the representatives vote against it. A hurdle that, in practice, is considered almost insurmountable shortly before the summer break.
Although the Council emphasizes that the scans will be limited to the absolutely necessary extent and that no general, indiscriminate surveillance will take place, the intrusion into the privacy of all users remains significant. The regulation stipulates that the processed content and traffic data must be irrevocably deleted no later than twelve months after detection, unless a concrete suspicion is confirmed. A permanent, long-term legal framework for abuse prevention, meanwhile, moves further into the distance.
(kbe)