The European Commission is taking legal action against the UK government over its failure to fully protect personal electronic information.
The Commission says it has now moved to the second phase of infringement proceedings over the UK's failure to provide its citizens with the full protection of EU rules on privacy and personal data protection when using electronic communications.
European laws state that EU countries must ensure the confidentiality of people's electronic communications like email or internet browsing by prohibiting their unlawful interception and surveillance without the user's consent.
The Commission says these rules have not been fully put in place in the national law of the UK. "People's privacy and the integrity of their personal data in the digital world is not only an important matter, it is a fundamental right, protected by European law. That is why the Commission is vigilant in ensuring that EU rules and rights are put in place," said EU telecoms commissioner Viviane Reding.
She said, "Ensuring digital privacy is a key for building trust in the internet. I therefore call on the UK authorities to change their national laws to ensure that British citizens fully benefit from the safeguards set out in EU law concerning confidentiality of electronic communications."
The Commission maintains the UK is failing to comply with EU rules protecting the confidentiality of electronic communications like email or surfing the internet, which are provided in the ePrivacy Directive 2002/58/EC and the Data Protection Directive 95/46/EC .
This follows an analysis of the UK authorities' response to a letter of formal notice the first phase in any infringement proceedings sent to them by the Commission on 14 April 2009. The Commission launched this legal action following its inquiry into the response given by the UK authorities to UK citizens' complaints about the use of behavioural advertising by internet service providers.
The complaints focused on the controversial PHORM system trialled by BT and other firms. PHORM tracks an ISP subscriber's web use and sends tailored ads to them. PHORM was trialled without subscribers first giving their permission for their personal web use to being tracked.
Whilst PHORM triggered the investigation, the Commission has now identified three wider gaps in the existing UK rules governing the confidentiality of electronic communications:
*There is no independent national authority to supervise interception of communications, although the establishment of such an authority is required under the ePrivacy and Data Protection Directives, in particular to hear complaints regarding interception of communications.
*The UK's widely used Regulation of Investigatory Powers Act 2000 (RIPA) law authorises interception of communications not only where the persons concerned have consented to interception, but also when the person intercepting the communications has "reasonable grounds for believing" that consent to do so has been given. This provision does not comply with EU rules defining consent.
*The RIPA provisions prohibiting and providing sanctions in case of unlawful interception are limited to "intentional" interception only, whereas EU law requires members states to prohibit and to ensure sanctions against any unlawful interception, regardless of whether committed intentionally or not.
The UK has two months to reply to the Commision's second stage infringement proceedings. If the UK's response is not deemed adequate the Commission may refer the case to the European Court of Justice.
More information on the Commission's electronic data enforcement framework
