Etisalat Group 14%

OVERALL SCORE – 14%

Etisalat received the lowest overall score of all telecommunications companies evaluated in the Index. Etisalat is headquartered in a country whose legal and regulatory environment is not conducive to public commitments or disclosure on policies and practices that affect users’ freedom of expression or privacy. The United Arab Emirates is rated “not free” in Freedom House’s 2015 “Freedom on the Net” index.

The country’s cybercrime law, updated in 2012, holds Internet intermediaries liable for the actions of their users; it has been used to silence social media activists and justify extensive surveillance of Internet users’ activities. Overall, this context does present challenges for the company to achieve a higher score in the Index. Nevertheless, Etisalat’s performance in the Index presents a potential starting point for dialogue between company representatives and stakeholders to identify where steps can be taken to provide disclosures and demonstrate a commitment to respect users’ rights.

COMMITMENT – 3%

In the Index, only one telecommunications company received a lower score than Etisalat in the Commitment category. The lone indicator on which Etisalat received any credit covered remedy and grievance mechanisms (C6). Etisalat provided avenues for users to contact the company if they had concerns about the terms of service or privacy policy, but even this disclosure left considerable room for improvement.

Etisalat operates in an environment with many legal restrictions, and the government has majority ownership of the company. The difficulty for the company to make substantive improvements in its commitment to freedom of expression and privacy in its home market nonetheless has implications for – and may potentially be of concern to – customers of the company’s subsidiary operations in 18 other countries.

FREEDOM OF EXPRESSION – 21%

Etisalat places sixth out of eight telecommunications companies on Freedom of Expression, falling in a cluster of four companies within the 15-25 percent range. The company’s credit in this category largely stems from the availability of its terms of service (F1) and disclosure about the circumstances in which it restricts content or access to the service (Indicators F3 and F4). The company’s lack of disclosure concerning its process to respond to requests from any third parties dragged down its score in this category.

Within the UAE, privacy is given considerable weight, often at the expense of free expression. However, this means the law can use privacy as a means to restrict expression. A poignant example is a 2013 viral video in which an Emirati was filmed beating an Indian man. The videographer in this case was charged with defamation and invasion of privacy and would be subject to more severe penalty than the attacker. Moreover, the country’s 2012 cybercrime law holds Internet intermediaries liable for any illegal or defamatory content appearing on their websites, which restricts free expression. In line with this legal and cultural expectation, Etisalat receives many of its points in this category on disclosures related to why it may restrict content, accounts, or service (F3 and F4).

User notification about content restriction: Though Etisalat does not fully commit to notify users when it restricts content or access to the service (F5), there is evidence that the company uses block pages in accordance with government requirements.

Network management: Etisalat has not made public statements about its network management practices (F10). This performance gap does not appear to be the result of regulatory compliance, as there is no known law in the UAE that directs Etisalat’s ability to prioritize or degrade transmission or delivery of different types of content over its network. Similarly, there is no law that limits its ability to disclose its practices in this regard.

PRIVACY – 14%

Etisalat tied with MTN for the lowest score of any telecommunications company on Privacy. Only one company in the entire Index scored lower, the Internet company Mail.ru. Etisalat’s performance showed gaps across all indicators, notably with respect to how it manages user information, how it processes requests from external parties, and how it secures its information. Especially given the premium placed on personal privacy, Etisalat has the opportunity to make basic commitments to privacy and data protections and to conduct related security audits.

Handling of user information: There are no obvious legal barriers against Etisalat improving its disclosure about how it handles user information. The company’s disclosures about collection of user information (P3) are at the low end of the telecommunications cohort. Notably, its disclosures about the sharing of user information with third parties (P4) received the same score as Vodafone – 32 percent – surpassed only by AT&T, which scored 48 percent. There is no evidence that users can control the company’s collection and sharing of their information (P5), though Etisalat scored higher than AT&T on disclosure about users’ ability to access information the company holds on them (P6).

Transparency about requests for user data: As noted above, there is widespread understanding that the UAE’s government surveils communications as part of an effort to identify political opponents or security threats. It is already established that the UAE operating context can restrict companies’ ability to disclose information; furthermore, the country’s penal code restricts what may be shared regarding police investigations and court trials. This, coupled with the fact that the company is majority-owned by the government, may disincentivize transparency in general, and the disclosure of law enforcement guidelines and transparency reports in particular (Indicators P9, P10, and P11). Nonetheless, the company should strive to be transparent with users about third-party requests for their information to the greatest extent possible under the law.

Security: It is reasonable to expect Etisalat to disclose basic information about its security practices (P12) and to publish materials that help users protect themselves from security threats (P14). The company received zero credit for either practice.