The new Electronic Communications Act (LEK, Sweden)

1. Generally regarding the new Electronic Communications Act

On 11 December 2018, Directive (EU) 2018/1972 of the European Parliament and of the Council establishing the European Electronic Communications Code (the "Directive") was adopted. The Directive entered into force on 21 December 2018.

The Directive recasts and replaces, for example:

• Directive 2002/21/EC of the European Parliament and of the Council on a common regulatory framework for electronic communications networks and services (Framework Directive),

• Directive 2002/19/EC of the European Parliament and of the Council on access to, and interconnection of, electronic communications networks and associated facilities (Access Directive),

• Directive 2002/20/EC of the European Parliament and of the Council on the authorisation of electronic communications networks and services (Authorisation Directive), and

• Directive 2002/22/EC of the European Parliament and of the Council on universal service and users' rights relating to electronic communications networks and services (Universal Service Directive).

In March 2022, the government presented a bill proposing a new Electronic Communications Act (SW: ny lag om elektronisk kommunikation) (the "New LEK").1 The New LEK is proposed to enter into force on 1 August 2022, thereby replacing the current Electronic Communications Act (2003:389) (SW: lagen om elektronisk kommunikation) (the current "LEK").

The Bill proposes extensive statutory amendments to implement the Directive. In addition, further statutory amendments are proposed in certain regards.

2. What parties are affected by the new provisions?

The new rules will apply to all parties already affected by currently applicable law and regulations. The target group is therefore primarily providers of public electronic communications networks and publicly available electronic communications services. However, certain provisions of the new law will also apply to operators providing so-called interpersonal number-independent communications services and other types of communications services. Providers of these services may therefore be subject to the new rules.

Mullvad is therefore conducting this analysis in order to provide its users with a balanced analysis and conclusion regarding how the new legislation affects Mullvad's service.

3. The Scope of application of the Act

Chapter 1, section 2 of the New LEK states that the scope of application of the Act shall be as follows: "The Act applies to electronic communications networks and electronic communications services with associated facilities as well as services and other radio use". This section corresponds to the current general rule set forth in Chapter 1, section 4 of LEK with the exception for certain linguistic changes. The current LEK also contains an explicit exclusion, stating in the same provision that "The Act does not apply to content transmitted in electronic communications networks using electronic communications services". This exclusion is removed from the proposal for Chapter 1, section 2 of the New LEK. Instead, the legislator is of the opinion that the definition of what constitutes an "electronic communications service" already makes it clear that content services are excluded. The exclusion will therefore follow from the definition of electronic communications service itself in the New LEK. Thus, no substantive difference in the scope of application between the old and the New LEK appears to be intended. However, VPN services should not be considered content services as a VPN service does not provide any content on the Internet but only access to encryption and IP addresses. Therefore, VPN services should anyway not be covered by the exemption.

4. Electronic communications networks and public electronic communications networks

Definition of public electronic communications network

In the current provision, as set forth in Chapter 1, section 7 of LEK, public communications network means: "[…] electronic communications network used wholly or mainly for the provision of publicly available electronic communications services and which support the transfer of information between network termination points." The definition conforms with the newly proposed definition of public communications network.2

Summary and conclusion: In the preparatory works to the current LEK, it is stated that VPNs can take place over a public communications network, but that it is not required that the provider of a VPN give special notice of the activity. It is the party providing the public communications network that is subject to the reporting obligation for this (where it is provided for remuneration). The previous preparatory works thus indicate that a VPN service is not to be equated with a public communications network. Since the proposal for the new law does not propose any change in the definition, the previous preparatory works may still be considered to provide guidance in determining what is to be regarded as a public electronic communications network and an electronic communications network. In addition, VPN services are currently not considered to be covered by the definition of a public communications network, since a VPN service consists of a "private network". This applies regardless of whether the virtual private network is offered to the public through agreements and in exchange for remuneration.

Thus, there is nothing in the preparatory works or in the Directive which, either expressly or interpretatively, gives reason for Mullvad to adopt an interpretation different from that already stated. Thus, Mullvad's VPN service should not be covered by the New LEK under the definition of a public electronic communications network.

Definition of electronic communications network

The definition of electronic communications network in the current provision set forth in Chapter 1, section 7 of LEK is as follows: "[…] transmission systems and, where applicable, switching or routing equipment as well as passive network components and other resources, which permit the conveyance of signals by wire, radio, optical or other electromagnetic means, irrespective of the type of information being transmitted." This definition is also reflected in the proposal for the New LEK.3

Summary and conclusion: There is nothing in the new preparatory works or in the Directive which expressly or interpretatively gives reason for Mullvad to adopt an interpretation different from that already stated. Thus, Mullvad's VPN service should not be covered by the New LEK under the definition of electronic communications network.

5. Electronic communications services

The definition of electronic communications services

In accordance with the Directive, the definition of electronic communications services is changed. According to the Swedish preparatory works, the reason for this change is that the services provided for communication purposes – as well as the technical methods to provide these services – have evolved. For example, it is stated that traditional voice telephony, SMS, and e-mail services have been replaced by functionality equivalent online services such as IP telephony, messaging services, and web-based e-mail services. It is stressed that it does not matter to an end-user whether the provider transmits signals itself or whether the communication is delivered via an Internet access service.4 It is therefore proposed that the definition be adapted such that the description of electronic communications services is functionally based rather than technologically based.5

The proposed new definition is: "A service normally provided for remuneration over electronic communications networks which, with the exception of services consisting of the provision of content transmitted using electronic communications networks and electronic communications services, and services involving the exercise of editorial responsibility over such content, is (1) an internet access service as defined in Article 2(2) of Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November 2015 laying down measures concerning open internet access and retail tariffs for regulated communications within the EU and amending Directive 2002/22/EC and Regulation (EU) No 531/2012 ; (2) an interpersonal communications service; or (3) a service consisting entirely or mainly of transmission of signals such as transmission services used for providing machine-to-machine services or for radio broadcasting".

Article 2(2) of the TSM Regulation (see below) defines an Internet access service as a publicly available electronic communications service that provides connectivity to the Internet and thus the possibility of connection between almost any end point on the Internet, regardless of the network technology and terminal equipment used. Article 2(5) of the EU Directive defines an interpersonal communications service as a service, normally provided for remuneration, which enables the direct interpersonal and interactive exchange of information by electronic communications networks between a limited number of persons, whereby the persons initiating or participating in the communication determine the recipient or recipients of the communication. It does not include services that enable such communications merely as a minor ancillary feature directly linked to another service. As defined, there is no requirement that an interpersonal communications service consist wholly or mainly of the transmission of signals over electronic communications networks. This means that certain services that were previously not considered to be electronic communications services will be deemed to be so in the future. The foregoing applies, e.g., to software services for direct communication between end-users' computers where the service provider has no influence or control over the transmission of the communication itself, unless the service is merely a minor ancillary feature directly linked to another service.6

In addition, the Government Bill states that it should be clarified that transmission services used for the provision of machine-to-machine services and for broadcasting services are examples of services which consist wholly or mainly of the transmission of signals in electronic communications networks.

In summary, the new definition of electronic communications services is such that it applies to three partly overlapping types of services that are usually provided for remuneration via electronic communications networks. These services are7:

• Internet access services as defined in Article 2(2) of Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November 2015 laying down measures concerning open internet access and retail tariffs for regulated communications within the EU and amending Directive 2002/22/EC and Regulation (EU) No 531/2012 (the TSM Regulation - see above);

• interpersonal communications services, and

• services consisting wholly or mainly of the transmission of signals, such as transmission services used for the provision of machine-to-machine services and for broadcasting services.

Service provided for remuneration

The new definition addresses three partly overlapping types of services that are usually provided for remuneration via an electronic communications network. The provision of a service for remuneration means that the service must be provided commercially. Although a service must be provided for remuneration, this also includes commercial services provided "free of charge" in exchange for personal data and other data such as cookies, or where the end user is exposed to advertising as a condition for accessing the service.

Mullvad's service is for remuneration (in order to provide the service) - however, not to infringe on anyone's privacy. On the contrary. Mullvad does not want personal data or other information regarding you as a user.

Is a VPN service an electronic communications service?

That Mullvad's service is a type of VPN service which is an electronic communications service in the form of an Internet access service or an interpersonal communications service can reasonably be excluded.

Is the VPN service then a service that can be considered to consist wholly or mainly of the transmission of signals? Or is it a service mainly used for the provision of machine-to-machine services?

The preparatory work for the New LEK emphasises that it is not easy to determine what constitutes a service consisting entirely or mainly of the transmission of signals. It is pointed out that in the case law of the European Court of Justice8, the provision of a basic cable package has been considered to constitute an electronic communications service to the extent that the service essentially involves the transmission of television broadcasts over the cable network to the consumer’s receiver. The transmission of signals does not have to take place on the provider's network, but the essential point is whether the provider is responsible to end-users for the transmission of signals which ensures that end-users are provided with the service to which they subscribe.9

In respect of the concept of "machine-to-machine", it is also difficult to fully understand what is meant in practice. No further guidance is provided.

However, based on the material we have had at our disposal and the analysis of the New LEK, Mullvad is of the opinion that the reasonable interpretation is that a VPN service (such as the one Mullvad offers) should not be interpreted to be an electronic communications service based on the previous preparatory works to the LEK and data storage10, the Directive, other directives replaced by the Directive, and PTS’11 statements regarding VPN services.

6. Summary and conclusion

It may be considered as far-fetched for a VPN service to be deemed to be a public electronic communications network since this is dependent upon the user being connected to the Internet in order to use the VPN service. Furthermore, in the preparatory works to the current LEK (and also statements from PTS), the legislator has expressed that a VPN service is not subject to a reporting obligation under the LEK. This suggests that a VPN service is also not to be considered as an electronic communications service since, according to the previous positions, the service does not, wholly or mainly, have control, either physical or contractual, over the signal transmission that enables the service to be used. Nor should it be considered that Mullvad's service is the type of service covered by the concept of "machine-to-machine", as such an interpretation would in practice mean that almost all communications that take place today will eventually be covered. Nor is there anything else in the preparatory works to the New LEK (or the Directive) that clearly indicates that the legislator now wishes to change the current scope of the legislation in a way that entails that a service, like the one Mullvad provides, should be covered.

On the whole, it appears to be the reasonable interpretation based on the previous preparatory work and PTS statements that a provider of a VPN service is not subject to a reporting obligation under the New LEK where the provider does not simultaneously provide another service that is subject to a reporting obligation (e.g., an Internet operator).

Pending other statements and/or practice in this area, it should thus be possible to interpret the situation such that the VPN services in question are not covered by the New LEK. Mullvad will continue to focus on the issue and update its analysis in the event new information arises.

Notes

1 Prop. 2021/22:136.

2 This definition is also found in Chapter 1, section 7 of the New LEK.

3 See also Chapter 1, section 7 of the New LEK.

4 Prop. 2021/22:136 p. 122.

5 Recital 15 of the Directive.

6 Prop. 2021/22:136 p. 123.

7 Prop. 2021/22:136 p. 123.

8 C-518/11 (UPC Nederland judgment), EU:C:2013:709, pp. 44 and 47.

9 Prop. 2021/22:136 p. 123.

10 Swedish Government Official Reports 2017:75.

11 The Swedish Post and Telecom Authority.