Commission highlights data shortfall in interim child sexual abuse regulation

A European Commission report on the implementation of the interim regulation on online child sexual abuse material called for improved standardisation and reporting of data submitted by member states on their actions under the temporary rules.

The draft law seeks to create a permanent solution for detecting and reporting online child sexual abuse material (CSAM). It has attracted criticism as in its original form, it would empower judicial authorities to ask intercommunication services like WhatsApp or Gmail to scan users’ private messages to find suspected content.

Currently in place is an interim regulation, a temporary measure meant to allow companies to continue to voluntarily detect and report online child sexual abuse material (CSAM), originally set to expire on 3 August 2024.

The new interim rules are to bridge the legislative gap until the permanent ones take effect. However, due to the difficulties in reaching an agreement, the European Commission extended the interim regulation until 3 August 2027.

As reported by Euractiv, a document by the Permanent Representatives Committee (COREPER), dated 14 December and seen by Euractiv, confirmed this longer timeframe.

Euractiv understands that this new extension will be adopted Wednesday (20 December) by COREPER II.

Implementation report

On Tuesday (19 December), the Commission published an implementation report on the temporary regulation.

According to the report, measures taken by providers include “carrying out detection and reporting” of CSAM “using a variety of detection technologies and processes”.

The document says that all providers said they reported these to the National Center for Missing and Exploited Children (NCMEC).

Providers in the report refer to those of number-independent interpersonal communications services. Facebook’s Messenger and WhatsApp are examples of number-independent communication services because they enable instant messaging without being a part of a numbering plan.

However, providers “did not submit the number and ratios of errors (false positives) of the different technologies used broken down by technology employed, indicating that they use a layered approach to detection of online CSA complemented by human review”.

False positives are material that is being detected as CSAM but, upon reviewing them, turns out that they were mistakenly detected as such. For example, in 2021, a New York Times article reported that a naked photo sent by a father of his toddler to a doctor about an infection was flagged as CSAM.

The text adds that providers “put in place a wide range of measures and safeguards to limit and reduce the error rate in their detection”.

EU countries want to extend temporary child sexual abuse regulation to 2027

Member states want the interim regulation on online child sexual abuse material to be extended until 3 August 2027, according to a document shared with EU ambassadors, seen by Euractiv.

Member states’ measures

The document highlights member states’ obligations under the interim regulation to “provide key statistics on cases of online child sexual abuse detected and reported to their law enforcement authorities, the number of children victims identified, and the number of perpetrators convicted”.

However, the data provided were from different periods, so “it was not possible to calculate from the data submitted the total number of reports of detected online child sexual abuse received at EU level”. Providers, on whose services CSAM was detected, were also rarely mentioned by member states when sharing the data. The number of perpetrators is fragmented as well.

The Commission concluded that “greater standardisation of available data and the reporting thereof”, such as those provided in the proposed permanent CSAM regulation, “would contribute to obtaining a better picture as regards relevant activities in the fight against this crime”.

About data processing, “no information was provided” about “whether the deployment of the technologies was in accordance with the state of the art and in the least privacy-intrusive way”.

The report described the available data as “insufficient to draw definitive conclusions” about the proportionality of the regulation, such as combating crime while protecting the rights of children and users, especially when it comes to data protection.

Finally, according to the document, “despite the shortcomings of the available data”, the Commission found the interim regulation effective because “voluntary reporting contributed significantly to the protection of a large number of children, including from ongoing abuse”.

EU Parliament nails down agreement on child sexual abuse regulation

The main political groups of the EU Parliament reached an agreement on the draft law to prevent the dissemination of online child sexual abuse material (CSAM) on Tuesday (24 October).

Progress report

A progress report about the CSAM draft law, seen by Euractiv and dated 15 December, was sent by the Spanish Presidency of the European Council to the COREPER.

Progress reports can present the main achievements taken in the direction of adopting a file.

The document goes over the steps taken by the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE), which leads the file, and the Council’s technical body, the Law Enforcement Working Party dedicated to Police affairs (LEWP-P), as well as the Council Legal Service, which also issued an opinion.

The text mentioned that LIBE also adopted its report, and then its position, in November.

The document concludes that “although the Presidency was able to gather support on a large part of the proposal, more work is needed to reach an agreement for a mandate for negotiations with the European Parliament”.

COREPER “is invited to take note of the progress made during the Spanish Presidency”, the progress report also reads.

Meanwhile, the proposed permanent regulation is still languishing in the EU Council of Ministers and it is extremely unlikely that a political deal on it will be found before the end of this mandate.

[Edited by Nathalie Weatherald]

Read more with Euractiv

UN Cybercrime Convention calls EU values into question, civil society warns

With the last negotiating session approaching next month, the private sector and civil society are increasingly questioning the compatibility of the UN Cybercrime Convention draft text with EU values and human rights standards.