Freedom of expression

The networks and services – provided by us as a telco and a TV & Media provider - give access to information and the exchange of ideas in a way that supports freedom of expression, openness, transparency, and democracy.

Challenges

Issues related to freedom of expression and surveillance privacy pose a high risk to users of telecom services globally. Risks include mass surveillance, network shutdowns, localization of mobile devices and blocking or restriction of certain content. Today, there is an increasing trend of policymakers introducing surveillance measures to fight crime, terrorism, hate speech and more – measures that can potentially limit the freedom of expression and privacy of users.

Our approach

This focus area is governed by the Group Policy – Freedom of Expression & Surveillance Privacy, the GNI Principles on Freedom of Expression and Privacy and the UN Guiding Principles for Business and Human Rights.

Our approach is to have clear rights-respecting policy commitments in place and secure implementation through processes that are regularly reviewed, including through third-party assurance. States define the scope of surveillance privacy and limitations to the free flow of information based on legislation and requests from authorities. We abide by such laws and regulations but challenge requests that have no or unclear legal grounds. When there is a conflict between internationally recognized human rights and local legislation, we seek for ways to raise the issue with relevant authorities or inform consumers and other stakeholders about the issue through public communications.

In our work we differ between two types of requests from governments/ authorities; conventional requests, which are day-to-day requests that are typically of lower risk, and unconventional requests. Unconventional requests are such which may have serious impacts on the freedom of expression and privacy of users. Examples include demands to shut down internet access, blocking of websites or requirements to retain data for surveillance when legislation is unclear.

Our group instruction sets out practical steps regarding assessments and escalation to be performed for unconventional requests. Such requests are to be assessed by the local company and escalated to group level for the final decision regarding which measures to take to mitigate human rights risks. We adhere to local legislation while also implementing measures that respect and support the rights of individuals. In addition, we aim to publicly share as much information as possible about unconventional requests.

We periodically publish a Law Enforcement Disclosure Report which covers statistics on requests from the police and other authorities (‘transparency reporting’), links to national laws that provide governments with direct access to information about our customers and their communication without having to request information from Telia Company as well as  laws on mandatory data retention for law enforcement purposes, and also further context on ‘unconventional requests’.

More information can be found on pages 97-98 in the 2021 Annual and Sustainability Report.

Steps taken by Telia Company related to Russian originated content (TV and internet sites)

(Originally published March 4th, 2022. Updated April 25, 2022.)

Telia Company closely follows and acts upon decisions from national and international authorities and monitors the overall developments in all local contexts to adjust removing Russian TV channels from Telia TV services and blocking of Russian originated content on the Internet. We continue encouraging clear and timely guidance from national governments and regulators when such are not yet in place with the aim to uphold to the extent possible the principle of letting governments and regulators, not private entities, make decisions on limitations to freedom of expression. We are closely monitoring developments, which are changing by the day, including EU and government decision-making relating to distribution of TV channels and blocking of content on the Internet.

The Russian invasion of Ukraine – which Telia condemns in the strongest terms – has led to turbulent times marked by uncertainties both in terms of what will come next and consequences of decision making. The EU as well as governments in Telia’s markets have acted within their individual contexts including related to content with Russian origin. Telia closely follows and acts upon the EU and local government decision making and we monitor the overall developments in all local contexts to adjust our legal compliance. Given ongoing and unprecedented developments we may, in our overall assessments of how best to respect and protect human rights, need to take measures against Russian originated content also when lacking explicit decisions by authorities.

Telia Company’s general policy and starting-point is to not close TV-channels and block Internet sites based on content itself. Such decisions are for authorities to make based on constitutional and other laws regulating content including instances when freedom of expression can be limited. We encourage clear and timely guidance from the EU and from governments and regulators when such is not yet in place with the aim to uphold the principle of letting governments, not private entities, make decisions on limitations to freedom of expression. In addition, in the current situation, sanctions legislation applies. Given the above, we swiftly comply with EU and governments and regulators’ requests or demands when and to the extent required by law, including binding regulations and license requirements, where the authorities have duly assessed the necessity and proportionality of such steps. We apply the principles for freedom of expression and privacy established by the Global Network Initiative and are in ongoing dialogues with peers and human rights experts to understand, verify and act upon our responsibilities.

 

Our local companies inform our customers about the decisions by authorities to close down channels by providing a message on the TV-screen that the take-down is based on legislation and, when applicable, activated due to Russia’s invasion of Ukraine and applicable sanctions relating to the latter. For example, in Estonia, in case of ban based on sanctions regime, the text on the TV-screen reads: “Retransmission of this channel is stopped due to legal reasons and is needed to follow the sanctions in place in connection to Russia´s invasion of Ukraine.”

 

For further information on Telia Company’s work in relation to challenges in the context of freedom of expression, see here.

Read more

Freedom of expression and the right to privacy in times of COVID-19

(Originally published April 30th, 2020. The information has been updated regularly, and here now as of Dec 1st, 2020)

The disruptions caused by the Covid-19 crisis have highlighted Telia Company’s special role and responsibility as part of the backbone of society. Keeping the networks up and running remains of utmost importance as many fundamental services, including health care, rely on our networks. In addition, governments continue to turn to Telia Company for assistance in the fight against the pandemic. Since the start of the pandemic Telia Company has provided information about Covid-19 related initiatives and government requests.

Covid-19 related requests to Telia from governments and authorities from March 2020 and onwards have concerned topics such as the provision of data to monitor the spread of the virus, blocking of sites with e.g. fraudulent information, the sending of mass-sms, and initiatives for new legislation. Telia Company is committed to respect the privacy and freedom of expression of users, and therefore assesses each request and legislative developments affecting our users. We are also committed to be transparent about how we act and respond.

In this process, we continue to work closely with peers and other stakeholders, through the multi-stakeholder Global Network Initiative (GNI) and our industry organization, the GSMA.

In late April 2020 Telia Company also published a position paper on the use of data to help fight Covid-19, available here.

Covid-19 related initiatives and requests up until December 1st 2020, and how Telia Company decided to handle them:

Denmark – Legislation about blocking of sites taking fraudulent advantage of the pandemic was introduced in April 2020 and will expire on March 1st, 2021. According to this law, police orders to block must be confirmed, or rejected, by the Courts. The legislation only covers sites relating directly to the Covid-19 crisis. (Link to applicable legislation here.)

Status update December 1st: Telia Denmark is blocking 33 sites based on court orders (or police orders awaiting court orders).

Estonia (new) – The Estonian state in August launched a Covid-19 prevention mobile app ‘Hoia mobile’(more information is available here). The app is based on Bluetooth, not location data tracking. Privacy and security aspects of this app have been reviewed and validated by the Data Protection Authority. Estonian telecom operators have been asked by the State to help communicate regarding the app to support and promote usage. To support Covid-19 prevention, Telia Eesti has actively shared information about this app through its social media channels and webpage.

European Commission – Before the summer, the European Commission (EC) asked operators throughout the EU to provide fully anonymous and aggregated data to fight the pandemic. Telia Company’s intention is to assist in the fight against Covid-19, while ensuring highest quality and compliance with GDPR and privacy laws, providing our crowd insights service to governments in the Nordics and Baltics, and also to the EC. Telia Company is continuously working with peers via the industry organization GSMA to coordinate interactions with the EC, including ensuring timely reporting from the EC on how the data is used.

Telia is continuously providing our crowd insights to the EC, i.e. fully anonymous and aggregated data, solely for the purposes of fighting Covid-19 as defined by the EC in writing. The data cannot be shared with any third party without Telia Company’s prior written consent. In December 2020, the collaboration is planned to be legally formalized by a Letter of Intent (LoI) which will be followed by a cooperation agreement as further described below.

In practice, Telia Company delivers to the Joint Research Centre of the EC fully anonymous and aggregated data from Sweden, Finland, Norway, Denmark starting from February 4th, 2020 and from Estonia starting from February 14th, 2020. The data is only being used to deliver insights to help fight Covid-19, necessary security and confidentiality measures are applied, and the anonymous nature of the data is maintained throughout this process. During the duration of this initiative, Telia will continue to seek reassurances from the EC about safeguards and results.

The first delivery of anonymous and aggregated data was sent to the EC on May 4th, and we are providing weekly updates since. On July 14th the EC published first findings from the initiative, including three reports, explaining the relationship between human mobility and the spread of coronavirus, as well as the effectiveness of mobility restriction measures to contain the pandemic. More detailed information about the initiative from the EC and the reports are available here: https://ec.europa.eu/jrc/en/news/coronavirus-mobility-data-provides-insights-virus-spread-and-containment-help-inform-future

Status up-date December 1st: A Letter of Intent is being negotiated between the EC and the operators to establish; purpose, content and scope of cooperation; contribution of the parties; transparency and non-exclusivity; findings and benefits; duration of data retention; and term and termination of cooperation.

Finland (new) - Telia Finland has supported the distribution of the Finnish Corona app by means of customer communications and advice at sales points. The app has been designed on the basis of Apple and Google reference implementations and DP-3T. The app does not gather personal data and was audited by the local cyber security authority before release. More information is available here.

Latvia – Latvia (see press-release here) became the first country to launch a contact tracing app using the newly-available exposure notification APIs by Apple and Google. The ‘Apturi Covid’ (Stop Covid) application, which is voluntary, decentralized and GDPR-compliant, was developed by representatives of the Latvian ICT sector and launched on May 29th. The aim is for the app to be used by 400,000 people. A voluntary MoU, available here, to develop and support the implementation of the app was signed by the private initiative group, and is supported by Telia Latvia and many more.

Status up-date December 1st: More than 155.000 users have downloaded the app to date.

Latvia (new) – LMT cooperates with the University of Latvia analysing anonymous network data, in compliance with the GDPR. More information (in Latvian) here.  

Lithuania (new) – From March 20th to date Telia Lietuva provided a number of crisis-related emergency numbers free of charge in order to help society tackle consequences of Covid-19. A specialized call centre (1808) that citizens could turn to when in need of assistance regarding Covid-19 related questions, was developed free of charge to support the government.

Lithuania (new) – In order to strengthen the technological resources of the National Center for Public Health, Telia Lietuva has set up an automated calling system free of charge that informs thousands of people about the need for mandatory self-isolation. A specially programmed interactive voice answering and intelligent call system solution calls the addressees and informs them about the logic behind self-isolation, provides other necessary information and instructs them to check the exact date of self-isolation on the phone. It is estimated that around 95% of the contacts are reached.

Lithuania (new) – In the beginning of November the mobile app Korona Stop LT was launched. The app records the distance between people who have downloaded it (anonymously). In case of possible contact, the app provides recommendations on how to proceed. No location data is saved or provided to third parties. The operation of the app is coordinated by the National Center for Public Health (NVSC).

Norway – Telia Norway has offered Telia’s Crowd Insights service to local authorities that needed updated information on movements across municipalities and knowledge about the number of visitors present within each geographical area.

Status update December 1st: Telia Norway has provided the Crowd Insights service to a number of municipalities and authorities, including the Norwegian Institute of Public Health, from April onwards, and also to Norwegian media, such as NRK and local newspapers.

Sweden - Telia reached out to the Swedish National Health Authority (Folkhälsomyndigheten, FHM) to present the Crowd Insights commercial service for consideration by the authority, given the interest observed in other countries. Since early April, Telia has been providing a version of the existing Telia Crowd Insights that visualizes the anonymized and aggregated volume of trips and general movement patterns of the population. FHM is able to use this to observe changes in population movement at national, municipal and local levels, in particular in relation to travel guidance.

Status up-date December 1st: Telia continues to provide the Crowd Insights service until the end of 2020 when the agreement expires.

Sweden - The Minister of Digitalization requested the main operators in Sweden to prepare for a mass-SMS to all its respective subscribers with a message from the authorities in relation to Covid-19. Telia Company responded positively but asked for legal assessments by the Swedish NRA (Post- och telestyrelsen, PTS) and the national Data Inspection Board (Datainspektionen). (The request was not based on legislation.)

Status up-date December 15th - The mass-SMS, with the Swedish National Health Authority (Folkhälsomyndigheten, Fohm) and the Swedish Civil Contingencies Agency (Myndigheten för Samhällsskydd och Beredskap, MSB) as senders, was sent on December 14th. Telia Sweden has highlighted, to our regulator PTS, that we presume that the responsible authorities have checked the mass-SMS with the Swedish Data Protection Authority (Datainspektionen), and also that future similar requests for mass-SMS’s - for faster and smoother handling in accordance with the rule of law - will be based on legislation.

Issues closed between March and December 2020:

Denmark – In March Telia assisted the Police in sending out an SMS to all customers, reminding everyone to keep social distancing. The SMS was clearly marked as being from the Police.

Denmark – An executive order for data collection, updating the Danish legislation in cases of epidemics, was passed by Parliament without an ordinary hearing, and the executive order was also issued without a hearing. Some weeks later, however, the executive order was repealed.

April 28th – Actual requests for data based on the executive order never materialized.

Denmark –The Danish health authority, ‘Statens Serum Institut’, contacted mobile operators through the telecommunications industry association with a request for anonymized, aggregated data about movement patterns and location of customers. Telia Denmark, from April until end of June, provided the Crowd Insights service to the health authority Statens Serum Institut.

July 1st – By June 30th the authority stopped asking for data, and Telia discontinued providing data.

Denmark - Telia Denmark was requested by the DCIS (‘Telesektorens DCIS’, the security cooperation unit between the cyber security authority and the telecoms industry) to voluntarily block a handful of sites that were fraudulently taking advantage of the pandemic. Telia Company supports and promotes the general principle that a court order is required for blocking. However, due to the urgency of the situation, an exception was decided upon and we blocked the sites according to the request.

August 21st – The Police provided a court order based on current legislation for one site and confirmed the rest of the blockings could be discontinued.

Estonia – Estonian governmental agencies requested anonymized or pseudonymized traffic data, instead of data insights, from the mobile networks operators in Estonia and based on the Electronic Communications Act. Telia Eesti offered an alternative approach and proposed to the authorities to solve the request based on the Telia Company Crowd Insights platform and to use Telia’s existing service for providing anonymous and aggregated mobility insights.

June 1st – This proposal was accepted by the authorities and relevant cooperation for provision of mobility insights delivered by Telia Company Crowd platform continued until the end of the emergency situation in Estonia (May 17th, 2020).

Finland – The Finnish Prime Minister’s Office asked Telia Finland to provide anonymized and aggregated mobility insight data via Telia’s Crowd Insights service. Telia agreed to provide the service from April 3rd onwards. On April 28th, The Finnish Chancellor of Justice concluded, after requesting clarification from the Prime Minister’s Office regarding the Government’s use of Telia’s Crowd Insights service, that the use does not violate anyone’s right for privacy. Telia Finland provided the Crowd Insights service to the Finnish Prime Minister’s office from April 3rd to the end of June.

July 1st – The contract with the Prime Minister’s Office elapsed end of June according to the agreement.

Lithuania – On August 7th, the Minister of Foreign Affairs requested all operators in Lithuania to send ‘welcome-back’ SMS’s, including a form to fill in, to citizens returning to the country from abroad. Telia Lietuva informed the authorities that it does not have the technical capabilities for sending of such messages. No further such requests have been received.

Lithuania – A draft law was proposed introducing a requirement for operators to disclose mobile location data on individual level to competent authorities in explicitly defined cases. Telia Company advocated the importance of transparency and the protection of human rights. (Link to the legislative proposal - here.)

December 1st – Telia Company’s assumption is that this question will not be raised again.

Sweden – The Swedish Embassy in Washington, USA, submitted a request to Telia through the Swedish NRA (Post- och telestyrelsen, PTS) to deliver to the Embassy statistics on the number of Telia customers roaming in the US. PTS approved the request. (The request was not based on legislation.) Requested statistics were delivered on a weekly basis from the end of March 2020. The information did not include personal data.

June 1st – On May 12th the Embassy informed Telia that they no longer needed the information and delivery of statistics was discontinued.

Sweden – The Swedish Civil Contingencies Agency (MSB) requested the main operators in Sweden to prepare for a mass-SMS to all its respective subscribers with a message from the authorities in relation to Covid-19. Telia Company responded positively but asked the Authorities to confirm the legality of the full set-up, including checking with the national Data Inspection Board. (The request was not based on legislation.) End of April, MSB had not yet requested the operators to send an SMS.

June 1st– The issue was not to be pursued by the authority.

Sweden – The Swedish Civil Contingencies Agency (MSB) on May 28th asked Telia Sweden to consider adding to the standard ‘welcome-to-Sweden-SMS’ received by tourists arriving to Sweden and onto Telia’s network a sentence with wording along the lines of: Follow the latest updates from Swedish authorities regarding covid-19: krisinformation.se/en. (It was noted that the proposal was not based on legislation.)

July 1st - Telia declined the request at this time due to uncertainties around the legal basis for the activity.

More information about Telia Company’s work within this area

As outlined in Telia Company’s statement of materiality we are committed to a number of international guidelines on human rights, including the UN Guiding Principles on Business and Human Rights. Accordingly, we are to ‘Know and Show’ that we respect human rights, including individuals’ right to freedom of expression and surveillance privacy. Therefore, we seek to know our human rights impacts, risks and opportunities, and we seek to show how we address them. It is in this context that we publish information on requests or demands from governments during the covid-19 crisis, and how we have handled them.

Telia Company’s transparency commitment has been further defined in our Group Policy on Freedom of Expression & Surveillance Privacy. We provide additional context and statistics in our Annual and Sustainability reports, most recently in the Telia Company Annual and Sustainability report 2019, page 51. Telia Company’s full Law Enforcement Disclosure Report 2019 published in March 2020 with more detailed context, definitions, etc., is available here.

Read more

Global Network Initiative (GNI)

All over the world companies in the ICT-sector face increasing government pressure to comply with domestic laws and policies in ways that may conflict with the internationally recognized human rights of freedom of expression and privacy.

In response, a multi-stakeholder group of companies, civil society organizations (including human rights and press freedom groups), investors and academics – together some 80 entities - have joined together in a collaborative approach to protect and advance freedom of expression and privacy in the ICT sector, and formed the Global Network Initiative (GNI). More information about the GNI is available here.

 

To understand our impacts and successfully mitigate risks, we depend on input from stakeholders and experts within this field. Therefore, Telia is an active member of the GNI. Shared learnings and joint leverage when governments act in ways that risk violating freedom of expression and privacy, are at the core of its work. Telia is a member of the board and participates in various committees and task forces.




Read more

Telia work to uphold customer’s freedom of expression & privacy

(Originally published July 4th, 2022.)

Five years ago, Telia Company joined the Global Network Initiative (the GNI), a collaborative platform with a shared commitment to promote and advance freedom of expression and protect users’ privacy in circumstances of state surveillance, worldwide. Since then, Telia’s work has continuously been strengthened many times thanks to the insights and recommendations gained from GNI’s multitude of voices, views and ample shared learnings. In this blog, Patrik Hiselius, Telia Company’s Senior Advisor on Human & Digital Rights, describes what the GNI provides and why collaboration is key to respect and protect the rights of our customers.

The GNI is a multi-stakeholder initiative, meaning that it consists of ICT companies, civil society organizations, academics, and investors. For a company, joining the GNI means committing to a set of principles and implementation guidelines, based on the UN Guiding Principles on Business and Human Rights, to respect and support freedom of expression and privacy.  GNI companies’ measures to implement the principles must be scrutinized by external auditors — in Telia’s case Deloitte — and ultimately, the multi-stakeholder GNI Board, which must determine whether the company has met their obligations under the GNI Principles. This assessment work is one way for GNI members, such as Telia, to get feedback on its work and exchange with a network of experts within organizations and companies sharing experiences, challenges, and learnings.

Stakeholder expectations upon Telia Company are often contradictory, e.g., ‘Block / Don’t block!’ or ‘Delete user data / Retain user data’. Some call for transparency, others for confidentiality. Some call for more surveillance, others for less. Etcetera. Membership in the GNI provides Telia with opportunities to discuss with experts, within the limits of confidentiality and antitrust, such often complex issues and where the law doesn’t always provide the clarity it should.

Since the last GNI assessment of Telia, our societies are experiencing some real challenges, including the Corona pandemic, the Russian aggression towards Ukraine, and AI used for surveillance and for disinformation. These examples show that the issues are often global rather than local. Both opportunities and risks are difficult to solve single-handedly. Within the GNI we jointly struggle with areas such as the relationship between sanctions and free communications, use of mobility data to fight the pandemic, laws on data retention for surveillance, laws on state direct access to operator networks, transparent reporting, and more.

The GNI’s latest assessment of Telia was completed in May of 2022. The GNI Board concluded the assessment of Telia Company’s work by determining that Telia Company is making ‘good faith efforts to implement the GNI Principles, with improvement over time’. Implementation of the GNI Principles is an evolving process designed to promote meaningful accountability while providing a framework to support collaborative learning and improvement over time. As such, the GNI assessment process recognizes that companies have to grapple with new and evolving freedom of expression and privacy challenges, and seeks to identify good practices, points of learning and opportunities for improvement in the fast-changing world of digitalization.

Telia Company sees great benefits in its GNI membership, including the assessment process, as part of an experience of both company specific and shared learnings. We welcome additional companies to take a seat at the table and tackle complex issues in relation to which no company can ever fully progress by working on their own. Our work to respect and promote the rights of users continues and we look forward to the next round of GNI assessments.

Read more