Key findings
- Orange disclosed more about policies affecting users’ freedom of expression and privacy than most telecommunications companies evaluated, but less than its European peers.
- The company improved its disclosure of how it handles network shutdown requests from governments, but lacked sufficient information about other policies affecting users’ freedom of expression.
- Orange disclosed far less about how it handles user information than its European peers, and almost nothing about how it keeps user information secure.
Analysis
Orange ranked fourth among the 10 telecommunications companies evaluated, disclosing less about its policies and practices affecting freedom of expression and privacy than Vodafone, AT&T, and Telefónica. The company disclosed a strong commitment to freedom of expression and privacy as human rights, and as a full member of the Global Network Initiative (GNI) since March 2017, it now commits to engage with a range of stakeholders on freedom of expression and privacy issues. Orange made several positive changes in the 2018 Index, including clarifying a commitment to push back on government requests to shut down networks and improving its disclosure of options users have to obtain the information that Orange holds about them. Despite these steps, the company fell short of its European and GNI peers in key areas. It disclosed nothing about how it handles government requests to block content or restrict user accounts, and Orange France did not provide the same level of detail as Vodafone UK or Telefónica Spain about its handling of user information. The company also lacked disclosure of its internal security procedures for keeping user data secure.
- Improve grievance and remedy mechanisms. Orange should improve its grievance mechanisms by providing clear procedures for users to directly submit complaints of violations to their freedom of expression or privacy rights.
- Improve disclosure of external requests. Orange should disclose more about how it responds to government and private requests to block content or restrict user accounts.
- Clarify security practices. Orange should disclose more about what it does to protect user data and how it responds in cases of data breaches.
Orange S.A. provides telephone and mobile telecommunications and other services in Europe, Africa, and worldwide.
Governance
Orange received the third-highest governance score among telecommunications companies, after Vodafone and Telefónica. Orange’s governance score improved in the 2018 Index due to its joining the Global Network initiative (GNI), and to its improved clarity of its human rights due diligence practices. Notably, it earned the highest score among telecommunications companies for its human rights due diligence commitments (G4). However, the company disclosed almost nothing about its grievance and remedy mechanisms (G6), tying with Ooredoo for the second-lowest score among telecommunications companies on this indicator.
G4. Impact assessment
Orange improved its disclosure of its human rights due diligence practices by clarifying that it conducts human rights impacts assessments (HRIAs) on a regular basis.
G5. Stakeholder engagement
Orange improved its commitment to engage with stakeholders by joining the Global Network Initiative (GNI).
Freedom of expression
Orange disclosed little about its policies affecting users’ freedom of expression, lagging behind Vodafone, AT&T, and Telefónica in this category.
Content and account restriction requests: Unlike AT&T, Vodafone, and Telefónica, Orange disclosed no information about how it handles government and private requests to block websites, content, or user accounts (F5-F7). There are no legal obstacles preventing Orange from disclosing this information.
Network management and shutdowns: As in the 2017 Index, Orange France disclosed nothing about its network management practices (F9), making it one of three companies, along with Etisalat UAE and Ooredoo Qatar, to receive no credit on this indicator (F9). While it clarified a commitment to push back on government requests to shut down networks, the company still revealed little about its processes for responding to these requests, lagging behind Vodafone UK, AT&T, and Telefónica Spain on this indicator (F10).
Identity policy: Orange France requires pre-paid customers to provide a government-issued ID to activate a SIM card. This appears to be legally required in France.
F10. Network shutdown
Orange France improved its transparency of its handling of government network shutdown demands by disclosing an example in which it pushed back on such a request. However, the company still fell short of making a clear commitment to push back on overbroad requests.
Privacy
Orange failed to disclose sufficient information about policies affecting users’ privacy, ranking fourth among telecommunications companies in this category, behind AT&T, Vodafone, and Telefónica.
Handling of user information: Orange France disclosed less information than Vodafone UK and AT&T about how it handles user information (P3-P8), but more than the rest of its peers. It did not disclose if targeted advertising is off by default, and provided only its fixed-broadband customers with a few options to control how their information is used for targeted advertising (P7). The company clarified that users can obtain a copy of the data that Orange France holds on them (P8), although it still did not indicate if this includes all of the public and private data it holds.
Requests for user information: Orange disclosed less than AT&T, Vodafone, and Telefónica about how it handles government and private requests for user information (P10, P11). While Orange provided some data on government requests for user information, it failed to provide data on such requests for a number of countries in which the company operates. When national law prohibits the release of such data, Orange should specify the legal barrier to disclosure. Orange, like the rest of its peers, did not commit to notify users about government and private requests for their data (P12).
Security: Orange France disclosed less than Vodafone UK, AT&T, and Telefónica Spain about its security policies (P13-P18). The company disclosed some information about its internal mechanisms to keep user information secure (P13), but provided no information about what it does to address security vulnerabilities (P14), and disclosed nothing about its processes for responding to data breaches (P15). There are no legal obstacles preventing the company from disclosing how it handles security breaches.
P8. Users’ access to their own user information
Orange France improved its disclosure of how users can obtain a copy of data that the company holds on them.
P13. Security oversight
Orange France improved its disclosure of security oversight processes by clarifying that the company has security teams conducting security audits on the company’s products and services.
