Article 3, Paragraph 1. · Regulation (EU) 2026/1881

Contents

1.Article 5(1) and Article 6(1) of Directive 2002/58/EC shall not apply to the confidentiality of communications involving the processing by providers of personal and other data in connection with the provision of number-independent interpersonal communications services provided that:

(a)the processing is:

(i)strictly necessary for the use of specific technology for the sole purpose of detecting and removing online child sexual abuse material and reporting it to law enforcement authorities and to organisations acting in the public interest against child sexual abuse and of detecting solicitation of children and reporting it to law enforcement authorities or organisations acting in the public interest against child sexual abuse;

(ii)not applied to interpersonal communications to which end-to-end encryption is, has been or will be applied;

(iii)proportionate and limited to technologies used by providers for the purposes set out in point (i);

(iv)limited to content data and related traffic data that are strictly necessary for the purposes set out in point (i);

(v)limited to what is strictly necessary for the purposes set out in point (i);

(b)the technologies used for the purposes set out in point (a)(i) of this paragraph are in accordance with the state of the art in the industry and are the least privacy-intrusive, including with regard to the principle of data protection by design and by default laid down in Article 25 of Regulation (EU) 2016/679 and, to the extent that they are used to scan text in communications, they are not able to deduce the substance of the content of the communications but are solely able to detect patterns which point to possible online child sexual abuse;

(c)in respect of any specific technology used for the purposes set out in point (a)(i) of this paragraph, a prior data protection impact assessment as referred to in Article 35 of Regulation (EU) 2016/679 and a prior consultation procedure as referred to in Article 36 of that Regulation have been conducted;

(d)with regard to new technology, meaning technology used for the purpose of detecting online child sexual abuse material that has not been used by any provider in relation to services provided to users of number-independent interpersonal communications services (‘users’) in the Union before 31 July 2026, and with regard to technology used for the purpose of identifying possible solicitation of children, the provider reports back to the competent authority on the measures taken to demonstrate compliance with written advice issued in accordance with Article 36(2) of Regulation (EU) 2016/679 by the competent supervisory authority designated pursuant to Chapter VI, Section 1, of that Regulation (‘supervisory authority’) in the course of the prior consultation procedure;

(e)the technologies used are sufficiently reliable in that they limit to the maximum extent possible the rate of errors regarding the detection of content representing online child sexual abuse and, where such occasional errors occur, their consequences are rectified without delay;

(f)the technologies used to detect patterns of possible solicitation of children are limited to the use of relevant key indicators and objectively identified risk factors such as age difference and the likely involvement of a child in the scanned communication, without prejudice to the right to human review;

(g)the providers:

(i)have established internal procedures to prevent abuse of, unauthorised access to, and unauthorised transfers of, personal and other data;

(ii)ensure human oversight of and, where necessary, human intervention in the processing of personal and other data using technologies falling under this Regulation;

(iii)ensure that material not previously identified as online child sexual abuse material, or solicitation of children, is not reported to law enforcement authorities or organisations acting in the public interest against child sexual abuse without prior human confirmation;

(iv)have established appropriate procedures and redress mechanisms to ensure that users can lodge complaints with them within a reasonable timeframe for the purpose of presenting their views;

(v)inform users in a clear, prominent and comprehensible way of the fact that they have invoked, in accordance with this Regulation, the derogation from Article 5(1) and Article 6(1) of Directive 2002/58/EC concerning the confidentiality of users’ communications solely for the purposes set out in point (a)(i) of this paragraph, the logic behind the measures they have taken under the derogation and the impact on the confidentiality of users’ communications, including the possibility that personal data are shared with law enforcement authorities and organisations acting in the public interest against child sexual abuse;

(vi)inform users of the following, where their content has been removed or their account has been blocked or a service offered to them has been suspended:

(1)the avenues for seeking redress from them;

(2)the possibility of lodging a complaint with a supervisory authority; and

(3)the right to a judicial remedy;

(vii)by 1 February 2027 and by 31 January every year thereafter, publish and submit to the competent supervisory authority and to the Commission a report on the processing of personal data under this Regulation, including on:

(1)the type and volumes of data processed;

(2)the specific ground relied on for the processing pursuant to Regulation (EU) 2016/679;

(3)the ground relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable;

(4)the number of cases of online child sexual abuse identified, differentiating between online child sexual abuse material and solicitation of children;

(5)the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of such complaints;

(6)the numbers and ratios of errors (false positives) of the different technologies used;

(7)the measures applied to limit the error rate and the error rate achieved;

(8)the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679;

(9)the names of the organisations acting in the public interest against child sexual abuse with which data has been shared pursuant to this Regulation;

(h)where suspected online child sexual abuse has been identified, the content data and related traffic data processed for the purposes set out in point (a)(i), and personal data generated through such processing are stored in a secure manner, solely for the purposes of:

(i)reporting, without delay, the suspected online child sexual abuse to the competent law enforcement and judicial authorities or organisations acting in the public interest against child sexual abuse;

(ii)blocking the account of, or suspending or terminating the provision of the service to, the user concerned;

(iii)creating a unique, non-reconvertible digital signature (‘hash’) of data reliably identified as online child sexual abuse material;

(iv)enabling the user concerned to seek redress from the provider or pursue administrative review or judicial remedies on matters related to the suspected online child sexual abuse; or

(v)responding to requests issued by competent law enforcement and judicial authorities in accordance with the applicable law to provide them with the necessary data for the prevention, detection, investigation or prosecution of criminal offences as set out in Directive 2011/93/EU;

(i)the data are stored no longer than strictly necessary for the relevant purposes set out in point (h) and, in any event, no longer than 12 months from the date of the identification of the suspected online child sexual abuse;

(j)every case of a reasoned and verified suspicion of online child sexual abuse is reported without delay to the competent national law enforcement authorities or to organisations acting in the public interest against child sexual abuse.

Defined terms · 4

Show every defined term

number-independent interpersonal communications service
means a number-independent interpersonal communications service as defined in Article 2, point (7), of Directive (EU) 2018/1972;
online child sexual abuse
means online child sexual abuse material and solicitation of children.
online child sexual abuse material
means:
solicitation of children
means any intentional conduct constituting a criminal offence under Article 6 of Directive 2011/93/EU;

Regulation (EU) 2026/1881

Defined terms · 4

Key facts

History · 1 version

Connections