The Assembly recommends that all member and observer States
ensure the effective implementation of the following principles:
6.1 everyone’s private life, correspondence
and personal data must be protected online; users shall always have
the possibility to withdraw data, content and information; interception,
surveillance, profiling or storage of user data by public authorities,
commercial entities or private persons is only permissible where
allowed by law in accordance with Article 8 of the European Convention
on Human Rights (ETS No. 5); member States have a positive obligation
to ensure adequate legal protection against the interception, surveillance,
profiling and storage of user data; personal data archives must
be subject to precautionary measures to protect them from data theft
and fraud;
6.2 collection, storage and processing of so-called metadata
(data that describes other data, for example information on senders,
recipients, timing, key words, movements or contacts) shall be subject, in
principle, to the same rules as the collection, storage and processing
of any other personal data;
6.3 producers of access devices and online service providers
should automatically apply encryption and conditional access technologies
as well as tools against online viruses and automatic signs (“cookies”);
the duration of the latter should be time-limited; special protection
should be afforded by providers of wireless access points (“hotspots”)
as well as for personal data produced through the “Internet of things”;
ISO (International Organization for Standardization) standards should
be developed in this respect; it is necessary to provide Internet
users with transparent and accessible information about security
measures and mechanisms applied;
6.4 criminal activities on or through online services must
be combated effectively by the competent State authorities in accordance
with Article 8 of the European Convention on Human Rights; law-abiding users
have the right to remain anonymous, while law-infringing users must
be identifiable and criminals must be identifiable by law-enforcement
bodies subject to the legal safeguards required under the European
Convention on Human Rights; in order to combat online identity theft,
there should be provision for the use of real identification, either
by electronic signature, using authentication tools or by a trusted
third party;
6.5 hotlines or other online help systems for children and
people with special needs should be established by public authorities
and online service providers, in particular as regards cyber-mobbing and
online child abuse;
6.6 the protection of property must be respected online; online
service providers should offer the possibility to attach electronic
signatures or apply electronic authentication tools to online content
and services; providers of “cloud computing” services should automatically
apply special protection measures for property stored with them,
including conditional access tools and regular back-up filing;
6.7 providers of cloud computing services must not lower their
users’ rights and protection by delocalising their “data cloud”
outside the jurisdiction applicable to their company; the legal
and fiscal system applicable to online services should be that of
the end consumer, and the consumer rights that apply should be those
that are most favourable between the country of origin and the country
of service;
6.8 member States should set up an adequate regulatory framework
for online gambling services, irrespective of whether such gambling
services are offered by public or private companies; online gambling
services registered in one country, which are accessible for, and
targeted at, users in another country, should fall under the jurisdiction
of the latter;
6.9 commercial or institutional service providers must have
the legal obligation to inform their users of their name, legal
seat and legal representative or director as well as their policies
concerning user protection and security, in particular as regards
their protection of a user’s private life, correspondence, personal
data and property;
6.10 users of online services must be adequately informed of
their rights by their service providers, irrespective of whether
such services are provided by a public authority or a private entity;
the waiver of any rights by users in favour of service providers
must require the prior, informed and express consent of those users;
6.11 users of online services must have an effective legal
remedy before a national authority against violations of their rights,
having regard to Articles 6 and 13 of the European Convention on
Human Rights as well as Article 2 of the United Nations International
Covenant on Civil and Political Rights;
6.12 commercial or institutional service providers should offer
their users the possibility to submit complaints and settle disputes
voluntarily out of court, for instance through national or European consumer
protection centres or bodies for online dispute resolution, and
an easily accessible ombudsman with an obligation to respond should
be appointed by each Internet service provider or their national
association;
6.13 the secrecy of employees’ private correspondence through
their employer’s communication devices is protected by Article 8
of the European Convention on Human Rights; employment contracts should
prohibit any interference in accordance with Committee of Ministers
Recommendation No. R (89) 2 on the protection of personal data used
for employment purposes.
