Orange 37%

OVERALL – 37%

Orange is a member of the Telecommunications Industry Dialogue and has made explicit human rights commitments on freedom of expression and privacy. It scored significantly higher than five other telecommunications companies but lagged substantially behind AT&T and Vodafone in disclosing policies and practices that affect users’ rights. Orange, with operations in 29 countries in Europe and Africa (as of December 2014), faces challenges in setting policies, practices, and disclosures for its global operations given that laws differ significantly in each country. The company receives operating licenses from governments based on its compliance with local laws. With this context in mind, we examined Orange France, the operating company in Orange’s home market. While French law prevents Orange from receiving a full score on several indicators, even without changes to the legal environment in France, there is substantial room for Orange to improve its global commitments as well as policies and disclosures that pertain to Orange France.

COMMITMENT – 73%

On Commitment, Orange came second only to Vodafone among telecommunications companies. The company could make clearer disclosures on the scope and regularity of its human rights impact assessments, as well as how the company uses the assessments (C4). The credibility of Orange’s public statements about its impact assessments would improve if its assessments were externally assured and accredited to a relevant and reputable human rights standard by a credible and independent organization, such as the Global Network Initiative.

The company discloses little about its grievance and remedy process (C6). Company representatives told project researchers that while the company does track customer complaints, it does not disclose information about them. In future iterations of the Index, Orange could receive additional credit if it discloses such information to the public.

FREEDOM OF EXPRESSION – 29%

While Orange’s disclosure related to freedom of expression is significantly better than five other telecommunications companies, it is substantially less than AT&T and Vodafone.

Transparency about requests for content restriction: Orange group generally, and Orange France specifically, lack transparency about policies and practices that affect users’ freedom of expression. Improvements should be possible even in the current legal and regulatory context. For example the company discloses no information about its process for evaluating and responding to requests from third parties to restrict content or access to the service (F6). While operating companies in some jurisdictions may face obstacles to fulfilling this indicator, our research identified no clear legal impediment to such disclosures by Orange France.

On privacy-related requests the story is different. The company is prohibited from disclosing information about government surveillance requests (covered in the Privacy category). In many cases, it is also forbidden to disclose the web addresses or location of content that has been restricted (F5). However our research found no legal barriers to disclosing aggregate data about the numbers of requests received to restrict content or service (Indicators F7 and F8), or the process used to receive and consider those requests (F6). Orange can bolster the credibility of its commitment to freedom of expression by offering maximum transparency possible under the law about policies, practices, and actions that affect users’ freedom of expression.

Network management: Orange discloses nothing about its network management practices that affect the transmission and delivery of content (F10). In communications with researchers, company representatives stated that its network management “is guided by quality of service when degrading or prioritizing the delivery of content” and that the company is compliant with French law. It is also worth noting that the E.U. is currently considering net neutrality legislation, and that as a result of this process, the regulatory situation in individual countries has been unclear. Orange may receive credit on this indicator in future iterations of the Index if it publicly discloses such information, as its peers do.

PRIVACY – 24%

With the exception of security-focused indicators on which it performed well, Orange’s disclosure on privacy related policies and practices was surprisingly poor, given its strong commitments. Notably, Orange France does not make its privacy policies publicly available at all, in stark contrast to nearly all other companies evaluated in this Index.

Handling of user information: Orange discloses that it is compliant with the law but often does not provide further information so that users can understand what compliance entails. For example, company representatives told our research team that the Orange follows French legal requirements related to data retention (P7), which are publicly available on a French government website. However the company does not publicly reproduce or reference this information in its own policies, and it received zero credit on P7. On disclosures about collection of user information (P3) the company was substantially outperformed by fellow Industry Dialogue members AT&T and Vodafone. Those same two companies, as well as Etisalat, surpassed Orange France on disclosure about sharing of user information (P4).

Transparency about requests for user data: Despite some legal obstacles, Orange should be able to improve its performance on transparency-related indicators. Orange provides no disclosure about its processes for responding to any types of third-party requests for user information (P9). While surveillance laws might be interpreted as constraining Orange’s disclosure about government requests, the law does not prevent Orange from disclosing whether and how it entertains requests from non-government entities. The French Code of Criminal Procedure prevents Orange from notifying users about government surveillance (P10).

While Orange does produce a transparency report on government requests for user information (P11), it does not disclose the actual number of government requests it receives. For France it refers to a government report that discloses the total number of requests made to all operators. However it is not possible to ascertain from such a report how many government requests Orange received versus how many requests went to other operators. To receive credit for publishing data about third-party requests for user information, Orange would need to disclose how many requests it processes as distinct from other companies.

Also, our research was unable to identify a legal reason why the company cannot disclose to users the legal basis under which it may comply with government requests for user information, assuming that the existence of the laws themselves is not a secret. Similarly, the law does not limit the company from clarifying to users the legal circumstances that prevent it from notifying individuals about requests for user data.

Security: Orange received a relatively strong score for disclosing information about its security practices (P12), and it earned full marks for user education about potential threats (P14).