The European Commission is facing renewed pressure to disclose its interactions with private technology companies regarding a contentious tech policy. The policy in question involves the scanning of private messages of European Union citizens to detect child sexual abuse material (CSAM). Concerns have been raised about potential lobbying by the tech industry, which could influence the drafting of the CSAM-scanning proposal. The issue of transparency is particularly relevant as it relates to correspondence between the EU and private firms that stand to gain commercially from any pan-EU law mandating message scanning.
The EU’s ombudsman, Emily O’Reilly, has reached a preliminary finding of maladministration, highlighting the lack of disclosure by the European Commission. This finding comes after a similar conclusion was reached in January, inviting the Commission to respond. The latest findings take into account the Commission’s responses and call for a “detailed opinion” in response to the recommendations made by July 26. Despite warnings from various sources, including the Council’s own legal service, the draft CSAM-scanning legislation is still being considered by EU co-legislators. The European Data Protection Supervisor and civil society groups have cautioned that this proposal could jeopardize democratic rights in the EU. Additionally, lawmakers in the European Parliament proposed a revised draft to limit the scope of the scanning. However, Member States’ governments have yet to settle on their negotiating position for the file.
Despite growing opposition and concerns across EU institutions, the Commission continues to support the controversial CSAM detection orders. Critics argue that such laws could force platforms to implement client-side scanning, posing risks to the privacy and security of European web users. The lack of transparency surrounding the Commission’s decision-making process during the drafting of the legislation further fuels concerns that self-interested commercial influences may have shaped the original proposal.
Since December, the EU ombudsman has been reviewing a complaint from a journalist seeking access to documents related to the CSAM regulation and the EU’s decision-making process. After assessing the information withheld by the Commission and its defense for non-disclosure, the ombudsman remains unimpressed with the level of transparency exhibited. While some data was released, 28 documents were entirely withheld, and five were partially redacted, citing exemptions such as public interest in public security, protection of personal data, commercial interests, legal advice, and decision-making protection.
According to the ombudsman’s released information, five documents pertain to exchanges between the EU and the technology industry’s interest representatives. The names of the companies involved were not disclosed, but investigative reports have linked US-based Thorn, an AI-based child safety tech maker, to lobbying on the file. Other documents that were either withheld or redacted include impact assessment drafts and comments from the Commission’s legal service.
Regarding the correspondence between the EU and tech companies, the ombudsman questions the Commission’s justifications for non-disclosure. For example, while redacting details of information exchanged between law enforcement and unnamed companies may be justified on public security grounds, there is no clear reason to withhold the names of the companies themselves. The ombudsman also highlights selective information releases by the Commission regarding input from tech industry representatives.
In conclusion, the ombudsman reiterates its finding of maladministration by the Commission for refusing to provide wide public access to the 33 documents. The ombudsman recommends that the Commission reconsider its position and provide significantly increased access. At the time of publication, the Commission had not responded to the ombudsman’s latest findings on the complaint.