Derechos Digitales, the leading digital rights organization in Chile, has launched a new report in collaboration with EFF that evaluates the privacy practices of Chilean Internet Service Providers (ISPs). This project is part of a series across Latin America, adapted from EFF’s annual Who Has Your Back? report. The reports are intended to evaluate mobile and fixed ISPs to see which stand with their users when responding to government requests for personal information. While there’s definitely room for improvement, the first edition of the Chilean ¿Quién Defiende Tus Datos? (Who Defends Your Data?) report has some hopeful indicators.
Chileans go online more than any other nationality in Latin America. When Chileans use the Internet, they put their most private data, including their online relationships, political, artistic and personal discussions, and even their minute-by-minute movements online. And all of that data necessarily has to go through one of a handful of ISPs. That means that Chileans are more likely to be putting their trust in their providers to defend their data than anyone else in Central or South America.
Derechos Digitales’ report set out to examine which Chilean ISPs and telephone companies best defend their customers. Which are transparent about their policies regarding requests for data? Which require a judicial warrant before handing over personal information? Do any challenge surveillance laws or individual demands for their users’ data? Do any of the companies notify their users when complying with judicial requests? Derechos Digitales examined publicly posted information, including the privacy policies and codes of practice, from five of the biggest Chilean telecommunications access providers: Movistar, VTR, Claro, Entel, and GTD Manquehue. Between them, these providers cover the vast majority of mobile, fixed line and broadband markets.
Each company was given the opportunity to answer a questionnaire, to take part in a private interview and to send any additional information they felt appropriate, all of which was incorporated into the final report. This approach is based on EFF’s earlier work with Who Has Your Back? in the United States, although the specific questions in Derechos Digitales’ study were adapted to match Chile’s legal environment. Customized investigations using similar methodologies are being worked on by digital rights groups across Latin America. The Karisma Foundation in Colombia and R3D in Mexico are about to publish their third-annual reports. InternetLab in Brazil is about to publish its second-annual report, and ADC in Argentina and TEDIC in Paraguay are all working on similar studies.
Derechos Digitales’ rankings for Chilean ISPs and phone companies are below; the full report, which includes details about each company, is available at: https://www.derechosdigitales.org/qdtd/
Evaluation Criteria for ¿Quién Defiende tus Datos?
- Data Protection: An ISP earned a complete star in this category if they published their Internet service agreement—for all types of plans—and their data protection policies on their website in a clear and accessible way to users. The data protection policies must be aligned with national regulations. Partial compliance was rewarded with half a star.
- Transparency: To earn a star, ISPs must have published a transparency report on how they manage their users’ data and handle government requests for data. The transparency report must have included useful information about the specific number of data requests the ISP has approved and rejected; a summary of the requests by investigation authority, type, and purpose; the specific number of individuals over the last year who have been affected by each request; and whether third-parties managing user data do so in a privacy-protective manner. A half star was awarded to ISPs that published transparency reports, but did not specifically refer to data protection and the monitoring of communications. If the provider has not published a transparency report, no star was awarded.
- User Notification: To earn a star in this category, ISPs must, if legally permitted, notify their users in a timely manner when authorities request access to their personal information so users may seek remedy or appeal as necessary. A half star was awarded to ISPs that notify their customers when authorities make a request for user data, but do not do so in a timely manner, making it difficult for the users to seek remedy. If there was no evidence that an ISP notifies its users when an authority requests user data, the company was not awarded a star.
- Data Privacy Guidelines: An ISP earned a star in this category if, on their website, it explains how it handles user data—and specifically outlines the requirements and legal obligations requesting authorities must comply with when requesting user data from the company. The explanation must be easy to understand; it must specify the procedures the company uses to respond to data requests from authorities; and it must indicate how long it retains user data. An ISP earned a half star if it published information about how it handles user data, but did not specify the obligations and procedures it requires of authorities who request user data.
- Commitment to Privacy: To earn a star, an ISP must have actively defended the privacy of their users in the courts, or in front of Congress to challenge broad legislation that is detrimental to the privacy of their users. An ISP could earn a half star if it has defended its users in one of the two areas listed above (in the courts, or in front of Congress).
Results
Conclusion
Companies in Chile are off to a good start but still have a ways to go to fully protect their customers’ personal data and be transparent about who has access to it. Derechos Digitales and EFF expect to release this report annually to incentivize companies to improve transparency and protect user data. This way, all Chileans will have access to information about how their personal data is used and how it is controlled by ISPs so they can make smarter consumer decisions. We hope the report will shine with more stars next year.