Vodafone Group Plc 54%

OVERALL – 54%

A member of the Telecommunications Industry Dialogue, Vodafone was the top performer among telecommunications companies in the Index. The company also scored higher overall than most Internet companies, with the exception of the three founding members of the Global Network Initiative: Google, Microsoft, and Yahoo. With operations in 28 countries, Vodafone faces challenges in setting some policies, practices, and disclosures for its global operations given that laws are very different in each country, as it describes in its annual Law Enforcement Disclosure Report. The company receives operating licenses from governments based on its compliance with local laws. Nonetheless, even for Vodafone UK, the operating company in Vodafone’s home market that was evaluated in this Index, we identified a number of areas in which the company can improve its disclosures and policies within the confines of existing law.

COMMITMENT – 75%

Among telecommunications companies, Vodafone’s public commitments – and its disclosure of measures taken to implement those commitments – stood out. The company received a full score on oversight of freedom of expression and privacy (C2) and 88 percent on internal implementation of its commitments (C3). It was a relatively strong performer on impact assessments (C4), and it could boost its score further by having its assessments assured by an external third party that is accredited to a relevant and reputable human rights standard by a credible organization, such as the Global Network Initiative. Regarding remedy mechanisms, Vodafone received credit for disclosing its processes for receiving and responding to complaints or grievances (C6).

FREEDOM OF EXPRESSION – 47%

Vodafone performed better than all other telecommunications companies on Freedom of Expression. The Internet companies that outperformed Vodafone in this category were Google, Kakao, Twitter, and Yahoo.

User notification about content restriction: Vodafone UK mobile users have documented the notices they receive when attempting to access content blocked by the service. However the company only makes a public commitment to notify users in cases of content blocked on request of the Internet Watch Foundation, a child protection organization in the U.K. (F5). Vodafone does not commit to notify users in other cases, nor does it publish information about its approach to notification, which can only be verified by Vodafone UK subscribers when they try to access blocked content. (See further discussion of this indicator in section 4.2 of the report.)

Transparency about requests to restrict content: Vodafone was the only company in the entire Index to receive full marks for disclosing information about its process to evaluate and respond to requests from government and other third parties to restrict content or access to the service (F6). However the company received zero points on indicators F7 and F8, which examine whether a company discloses data about government and private third-party requests, respectively. In the U.K., where we specifically examined Vodafone’s mobile service, more than one law could potentially prevent a company from disclosing specific requests to restrict content or access to a service. However even if some U.K. laws limit Vodafone from being fully transparent, Vodafone could publish aggregate data related to all the requests it receives that it is legally allowed to publish. This would not be unprecedented. Some other U.K. companies publish the number of copyright-related blocking orders they receive, including Virgin, TalkTalk, and Sky. Vodafone could do likewise. Moreover, other data is published in other areas, such as the terrorist-related sites blocked upon request of the Counter Terrorism Internet Referral Unit. As the NGO Open Rights Group has documented, this material has been announced in Parliament. Vodafone could also be expected to publish this sort of data.

Network management: Notably, Vodafone UK was the only telecommunications company in the Index that discloses that it does not prioritize or degrade the delivery of content in its home market (F10).

PRIVACY – 49%

Vodafone placed second among telecommunications companies on Privacy, behind AT&T. It was outperformed by four Internet companies.

Handling of user information: Vodafone tied with AT&T among telecommunications companies for a 60 percent score on collection of user information (P3). The company was much less competitive on disclosure about sharing user information with third parties (P4). It also tied with others for a leading score on disclosure about user options to control the company’s sharing of user information (P5). However, all companies in the Index fared poorly on that indicator, the top score being only 25 percent. Vodafone’s disclosures on users’ ability to access the information the company holds on them (P6) and retention of user information (P7) lagged behind several Internet companies, but it led the telecommunications cohort on these two indicators.

Transparency about requests for user data: Vodafone had strong, though not perfect, disclosures about its process for responding to third-party requests for user information (P9). The company lost credit for not explaining its process for handling requests by private parties. A hypothetical example of such a request would be if a corporate entity whose intellectual property was violated by a user requests information about that user without first obtaining a court order. Intellectual property holders are known to have attempted such requests in other jurisdictions with other companies. If Vodafone were to publicly disclose a policy of not accepting or considering such private requests, it would gain credit in the Index.

In the U.K., the Regulation of Investigatory Powers Act (RIPA) 2000 can preclude Vodafone from notifying users when some government entities request their data. Provisions of other laws can also gag the company from notifying users. However RIPA does not prevent the company from clarifying practices related to requests from non-government entities.

Vodafone’s Law Enforcement Disclosure Report includes extensive information on what types of government demands it is unable to disclose, separated out by country and citing relevant laws. It received credit for this on Indicator P11, which examines disclosure of data about third-party requests for user information. Vodafone also provides extensive explanations of relevant legal authorities in its operating countries. All companies throughout the sector should emulate such disclosures.

However because Vodafone does not report any information about the numbers of requests of any kind that it receives in its home market, it received a relatively low overall score on Indicator P11 compared to AT&T, the second highest-scoring telecommunications company in the Index and fellow Industry Dialogue member. In its report, Vodafone cites RIPA as the reason why it cannot provide more detail about requests. It is worth noting that Vodafone has gone on public record calling for legal reforms to allow greater transparency. However, the NGO Open Rights Group has argued that even if the law precludes publication of details of warrants made under RIPA, this should not prevent Vodafone from publishing data pertaining to other governmental requests for access to user information not covered by RIPA.

Security: Vodafone, like AT&T, received full scores on indicators P12 and P14, which focus on security standards and informing users about cyber threats.