Changes from report parliamentary committee draft to plenary report

The Rapporteur welcomes the European Commission’s legislative proposal laying down rules to prevent and combat child sexual abuse. It is urgent to establish a long-term regulatory framework capable of giving an answer according to the magnitude of the problem: internet service providers in Europe are the largest hosts of child sexual abuse material in the world.

The rapporteur shares the need to migrate from a voluntary system to detect, report and take down child sexual abuse material to a mandatory one. The current Interim Regulation (Regulation (EU) 2021/1232) meant a remarkable progress in the legislative approach on tacking child sexual abuse online but it has been proven insufficient due to an uneven commitment or engagement on the side of the relevant information society services.

Likewise, he supports the approach based on the assessment conducted by each provider of the risks of their services being misused for the purpose of child sexual abuse. Previously introduced by the Digital Service Act (Regulation (EU) 2022/2065), the risk assessment should be the basis for reporting those risks and implementing the necessary measures to mitigate them.

The rapporteur also agrees that these rules should be laid down in a technology-neutral and a future-proof manner. Thus, providers will not be required to use any specific technology and, consequently, will not be asked to do what is not legally feasible or technologically viable according to the state of the art. This approach will definitely contribute and encourage innovation. It is crucial for the legislative framework to keep the pace of technological progress which will deliver new tools to prevent and combat online child sexual abuse.

A key guiding principle of the rapporteur’s report, aligned with the Proposal, is the compliance with the prohibition of a general monitoring obligation enshrined in European legislation and case-law of the European Court of Justice. The rapporteur welcomes the set of safeguards introduced in the proposal and the EDPB-EDPS Joint Opinion 04/2022 as a major contribution which has been taken into account in the drafting of this report.

The rapporteur considers that end-to-end encryption is an important tool to guarantee the security and confidentiality of the communications of users, including those of children. Consequently, nothing in this Regulation should be interpreted as prohibiting or weakening end-to-end encryption, while the Regulation remains open, where applicable, to existing and future technological developments.

To the extent strictly necessary and proportionate to mitigate the risk of misuse of their services for the purpose of online child sexual abuse, providers should be authorised by the competent judicial authority or another independent administrative authority to process metadata that can detect suspicious patterns of behaviour without having access to the content of the encrypted communication.

Having stated the guiding principles of the rapporteur’s report, the specific proposals of the rapporteur are listed below:

Regarding the scope of application, the rapporteur considers that it should cover online search engines and any other artificial intelligence systems, both of which will be subject to delisting orders.

Concerning detection orders and its consequent detection obligations, the rapporteur is of the view that they should cover not only the dissemination of material previously detected and confirmed as constituting child sexual abuse material (known material), but also material not previously detected that is likely to constitute child sexual abuse material but has not yet been confirmed as such (new material), as well as activities constituting the solicitation of children (grooming). The Interim Regulation already covers the three instances of online child sexual abuse material. Limiting the scope of the child sexual abuse material covered by the Regulation would undoubtedly mean a setback in the fight against sexual abuse of minors.

The rapporteur is of the opinion that detection orders have to be a mechanism of last resort that might entail a negative reputational component for those providers who do not comply with the obligations established in the Regulation.

In order to stress detection orders as a mechanism of last resort, the rapporteur proposes reinforcing prevention as part of the mitigation measures to be taken by relevant society communication services. Mitigation measures may include targeted measures to protect the rights of the child, including safety and security design for children by default, functionalities enabling age assurance and age scoring, age-appropriate parental control tools, allowing flagging and/or notifying mechanisms, self-reporting functionalities, or participating in codes of conduct for protecting children.

The rapporteur puts forward the establishment of a complementary mechanism: voluntary detection orders. The voluntary detection orders will not only contribute to make mandatory detection orders a measure of last resort, but will also cover a possible gap between the entry into force and the effective application of the new Regulation.

Moreover, it needs to be taken into account that the Interim Regulation, which currently enables providers to continue lawful detection, reporting and removal of online child sexual abuse from their services on a voluntary basis, lapses on the 3rd of August 2024.

Consequently, the rapporteur proposes that, where applicable, providers should assess in their risk assessment, in a separate section, the voluntary use of specific technologies for the processing of personal data and other data to the extent strictly necessary to detect, report and remove online child sexual abuse on their services. Based on this separated assessment, providers may request to the competent Coordinating Authority the need of continuing, as part of their mitigation measures, using specific technologies for the processing of persona data and other data for this purposes. Following this request of the provider, the competent Coordinating Authority shall have the power to request the competent judicial authority of the Member State that designated it or another independent administrative authority of that Member State to issue an order that authorizes the provider to maintain or implement mitigation measures that consist of using specific technologies for the processing of personal and other data to the extent strictly necessary to detect, report and remove online child sexual abuse on their services.

The rapporteur welcomes and expresses his strong support for the creation of a European Union Agency to prevent and combat child sexual abuse, the EU Centre on Child Sexual Abuse. He considers that a greater role has to be given to victims/survivors. Accordingly, the report proposes setting up a Victims' Consultative Forum. The rapporteur highlights the importance of the cooperation between authorities and civil society organizations acting in the public interest, including hotlines, whose contribution to the fight against child sexual abuse has to be acknowledge.

Regarding the seat of the EU Center, the rapporteur considers that it is necessary to align the provisions of the proposal with the recent case-law of the European Court of Justice. Additionally, the rapporteur has introduced some changes in the proposal to rebalance the tasks assigned to the Excusive Director and the Management Board of the EU Centre.