Proposed new Swedish law for electronic communications

Läs på svenska: Förslag till ny lag för elektronisk kommunikation

The following is a general summary of parts of the newly proposed Electronic Communications Act (the “New LEK”), based on the Ministry of Infrastructures memorandum on the new proposal, the EU directive establishing a European Electronic Communications Code1 (the “Code”) and the legislative history of the current Electronic Communications Act (the “LEK”).

Note that the summary is not exhaustive and its sole purpose is to provide you, as a user, with a certain overall, general understanding of the new law and an understanding of why Mullvad VPN is , probably, not subject to the new law. The summary is not intended to constitute, and must not be used as, professional legal advice in any respect. All use of the content is at the user's own risk.

1. Generally regarding the code and the new Electronic Communications Act

The Ministry of Infrastructure has produced a memorandum containing a proposal for a new act on electronic communications which replaces the current LEK (SW: lagen om elektronisk kommunikation). The newly proposed act the New LEK implements the Code.

Many parts of the new proposal entail that the current provisions of the LEK will be transferred in whole or in part to the proposed new act for electronic communications, the New LEK. The provisions of the New LEK are essentially the same as before, with some updates and additions and with a different structure than the current LEK. The Swedish Post and Telecom Authority (“PTS”) states in a consultation response regarding the memorandum that they believe that the New LEK is considerably easier to understand than the current LEK. The New LEK is proposed to enter into force on 21 December 2020, which is the date on which the Code should have been implemented into national law by EU Member States.

2. The scope of application of the Act

Chapter 1, section 3 of the New LEK states that the scope of application of the Act shall be as follows: “This Act applies to electronic communications networks and communications services with associated facilities and services as well as other radio use. The Act does not apply to content transmitted in electronic communications networks using electronic communications services.” This section corresponds to the current rules set forth in Chapter 1, section 4 of the LEK, with the exception of certain linguistic changes. The exclusion from the scope of application of the Act encompasses so-called content services with content provided in, for example, radio and television programs as well as services involving the provision of content on the Internet. VPN services are not to be considered content services as a VPN service does not provide any content on the Internet. VPN services “only” provide access to encryption and IP addresses. Therefore, VPN services should not be considered to be covered by the exception.

The difference between the scope of application of the LEK and the scope of application of the proposed New LEK is primarily that the definition of publicly available communication services is proposed to be amended to include interpersonal communications services. The proposed amendment to the definition means that the processing of personal data that falls under the Data Protection Regulation may also be covered by the New LEK and PTS’ areas of supervision.

3. Electronic communications networks and public electronic communications networks

3.1 Definitions

In the current provision set forth in Chapter 1, section 7 of the LEK, public electronic communications network means the following: “[…]electronic communications network used wholly or mainly for the provision of publicly available electronic communications services which support the transfer of information between network termination points.” The definition conforms with the newly proposed definition of public electronic communications network. The definition of electronic communications network in the current provision set forth in Chapter 1, section 7 of the LEK is the following: […] transmission systems and, where applicable, switching or routing equipment as well as passive network components and other resources, which permit the conveyance of signals by wire, radio, optical or other electromagnetic means, irrespective of the type of information conveyed.” The proposed definitions of electronic communications network also conforms with the current definition in the LEK.

3.2 Is a VPN service a public electronic communications network?

The legislative history of the LEK states that VPN can take place over a public communications network but that does not subject the party providing a VPN to a special obligation to report the activities under LEK. It is the party providing the public communications network that is subject to the reporting obligation (where the VPN is provided in exchange for remuneration). The previous legislative history thus indicate that a VPN service is not to be equated with a public communications network. Since the new proposal does not propose any change in the definition, the previous legislative history may still be considered to provide guidance in determining what is to be regarded as a public electronic communications network and an electronic communications network. In addition, VPN services are currently not considered to be covered by the definition of a public communications network, since a VPN service consists of a “private network”. This applies regardless of whether the virtual private network is offered to the public through agreements and in exchange for remuneration.

4. Electronic communications services

4.1 The definition of electronic communications services

The New LEK introduces a partially new definition of electronic communications services. The background for the change is that the services used for communications purposes and the technical methods to provide these services has developed. It is proposed that the definition be adapted such that the description of electronic communications services is functionally based rather than technically based. In accordance with the proposed new definition of electronic communications service the following is stated: [...] a service normally provided in electronic communications networks for remuneration and which, with the exception of services in the form of providing content transmitted by means of electronic communications networks and communications services or exercising editorial control over such content, constitutes a: (1) ‘internet access service’ as defined in point (2) of the second paragraph of Article 2 of Regulation (EU) 2015/2120; (2) interpersonal communications service; or (3) services consisting wholly or mainly in the conveyance of signals such as transmission services used for the provision of machine-to-machine services or for broadcasting”.

4.2 Service provided for remuneration

The new definition addresses three partially overlapping types of services that are usually provided in exchange for remuneration via an electronic communications network. The provision of a service for remuneration means that the service must be provided commercially. Despite the fact that a service must be provided in exchange for remuneration, commercial services provided “free of charge” in exchange for personal data and other data such as cookies are also included, or where the end user is exposed to advertising as a condition for accessing the service.

5. Is a VPN an electronic communications service?

It can be ruled out that a VPN service is an electronic communications service in the form of an Internet connection service or an interpersonal communications service. The remaining question is thus whether a VPN service can be considered as a service consisting wholly or mainly in the conveyance of signals?

The legislative history of the LEK stated that a VPN can take place over a public communications network but that does not subject the party providing a VPN to a special obligation to report the activities under the LEK. It is the party providing the public communications network that is subject to the reporting obligation (where the VPN is provided in exchange for remuneration). The foregoing is also evident from the investigation regarding data storage and EU law (Swedish Government Official Reports 2017:75), which was undertaken after the Data Storage Directive was declared invalid and the Tele2 judicial decision, that the storage obligation under LEK does not include storage of data regarding anonymisation services (i.e. VPN services) which are not activated until after Internet access. This may imply that the legislature considers that a VPN service is not to be deemed as an electronic communications service or a publicly accessible communications network provided in exchange for remuneration.

The reason for the legislature’s clear position may possibly be that a VPN service is dependent on the end user having a separate Internet connection in order for the service to work. It can be interpreted such that the VPN service is a type of service provided over the internet and operating at a level above another type of IP-based communications network. Thus, the VPN service operates at a level above the basic communication level’s ability to transmit the package without the need for the IP-based service to integrate with it.

However, some form of signal transmission takes place at the VPN provider in order for the service itself to be up and running. In addition, the VPN provider provides a unified IP address to its users which could indicate that it is an electronic communications service. However, providing a unified IP address is not the same as that the service itself, wholly or mainly, is having power over the signals that enable the user to make use of the service. A VPN service does not provide the network or the Internet connection itself, but the user’s traffic is transmitted through signals to the VPN’s servers (the VPN tunnel) which encrypt the connection to the user’s computer and mask the user’s real IP address when the user, for example, visits different websites on the Internet.

According to the memorandum containing the proposal for the New LEK, it is stated that a transmission of signals does not need to take place in the provider’s network. In addition, it is stated that what is of significance in transmitting signals is whether the provider is responsible to the end user (subscriber) for the transmission of signals which ensures that the users are provided the current service to which they subscribe. Since a VPN service is dependent on the user being connected to the Internet for the service to function, the proposal should be interpreted as meaning that the VPN service is not responsible to the end user (subscriber) for the transmission of signals ensuring that the end user is provided the service. But it could be interpreted contrarily - that VPN services through, for example, encryption via signals that the VPN service itself has power over through agreements with subcontractors, etc. could possibly be seen as an electronic communications service. However, based on the material at hand and the analysis of the New LEK, our opinion is that the reasonable interpretation is that a VPN service is not to be considered as an electronic communications service based on previous legislative history of the LEK and data storage and PTS’ statements regarding VPN services.

6. Conclusion

A VPN service should not be considered as a public electronic communications network, as the VPN service is dependent on the user being connected to the Internet (in order to use the VPN service). In addition, the legislature in the legislative history of the LEK and PTS has stated that a VPN service is not subject to a reporting obligation under the LEK. This indicates that a VPN service is not to be considered as an electronic communications service since, in accordance with the previous positions, the service does not wholly or mainly have power, purely physically or via agreement, over the signal transmission that enables the use of the service. On the whole, with guidance from the previous legislative history and PTS’ statements, it appears that the reasonable interpretation is that a provider of a VPN service is not subject to a reporting obligation under the New LEK where the provider does not simultaneously provide another service subject to a reporting obligation (for example, an Internet operator). Thus, VPN services that do not provide other services covered by LEK do not have any reasonable control over the signal transmission as they cannot work without the user’s Internet connection, and also cannot be considered to be an Internet connection service or an interpersonal communication service. However, it should be added that, until the New LEK has been finalized and entered into force, it is uncertain whether VPN services will be covered. Pending the final wording of the New LEK, and until PTS states otherwise, the interpretation should be that VPN services will probably not be covered by the New LEK. However, this is not a final position, but should be regarded as a preliminary interpretation of the New LEK based on the memorandum on the new proposal, legislative history for the LEK and data storage and previous statements from PTS regarding the interpretation of the LEK.

 

1 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018

establishing the European Electronic Communications Code.