Orange ranked fourth out of the 10 telecommunications companies evaluated and 11th in the Index overall. A member of the Telecommunications Industry Dialogue (TID), Orange disclosed strong public commitments to freedom of expression and privacy as human rights at the governance level, but revealed far less about its policies affecting these rights in practice. Like all companies, Orange is constrained by legal requirements in the countries where it operates, including in France, but there are changes it can make that would not necessitate legal reform. For instance, French intelligence services have permanent, unchecked access to Orange’s network, and the company could be more upfront with users about the state’s surveillance powers. It could also significantly improve its disclosure of network shutdown policies, as there is no apparent legal obstacle to doing so.
Orange provides a range of fixed telephony and mobile telecommunications, data transmission, and other value-added services to consumers, businesses, and other telecommunications operators worldwide with a major presence in Europe and Africa. The company offers mobile, fixed-line, and carrier services; sells mobile devices and accessories; sells and rents fixed-line equipment; and offers network and platform services.
Orange ranked second among telecommunications companies in the Governance category, after Vodafone, and received the third-highest score of all 22 companies. Orange received the highest score among telecommunications companies for its disclosures about its human rights impact assessments (G4). The company, however, tied with Ooredoo for the second-lowest score on G6, which looks for clear disclosure by companies of a remedy and grievance mechanism allowing users to issue complaints about violations to their freedom of expression and privacy rights. In France, “data subjects” may bring privacy-related complaints to the French Data Protection Agency but Orange should provide users with information on that process as well as offer direct channels to users for grievance and remedy.
Orange lagged behind Vodafone, Telefónica, and AT&T in the Freedom of Expression category, tying with América Móvil for the fourth-highest score of the 10 telecommunications companies evaluated.
Content and account restriction requests: Orange was one of six telecommunications companies to score no points on these indicators (F5-F7). It offered no information about how it handles or complies with government and other third-party requests to restrict content or accounts.
Network management and shutdowns: Orange did not disclose if it engages in network management policies; only two other companies, Etisalat and Ooredoo, also received no credit on this indicator (F9). It also revealed little about its processes for responding to network shutdown requests, lagging behind Vodafone and Telefónica on this indicator (F10). The 2015 Intelligence Law authorizes French authorities to shut down service or restrict access to the internet, with the help of ISPs such as Orange. Orange should clearly disclose this obligation to its users.
Identity policy: Orange requires pre-paid customers to provide a government-issued ID to activate a SIM card, although there is no law in France explicitly requiring mobile operators to obtain this information from pre-paid subscribers.
Orange ranked fourth among telecommunications companies in the Privacy category, behind Vodafone, AT&T, and Telefónica.
Handling of user information: While Orange disclosed far less information about how it handles user information than Vodafone and AT&T, it performed better than most telecommunications companies on these indicators (P3-P8). It disclosed some information about what user information it collects (P3), shares (P4), and why (P5). Like all telecommunications companies other than AT&T, Orange disclosed no information about how long it retains this information (P6).
Requests for user information: Orange disclosed little about how it handles requests from governments and private parties for user information, but received the third-highest score on these indicators after AT&T and Vodafone (P10, P11). While the company provided some data about government and private requests for user information, the company failed to provide data on such requests for many countries in which Orange operates, including France (P11). When national law prohibits the release of such data, Orange should specify the legal barrier to disclosure.
Security: Orange disclosed less than most of its peers about its security policies, lagging behind AT&T, Telefónica, and Vodafone on these indicators (P13-P18). The company provided some disclosure of its systems to ensure the security of their products and services (P13), but had no information about what it does to address security vulnerabilities via a bug bounty program (P14). Like most companies evaluated, Orange had no disclosure of its processes for responding to data breaches (P15).
