Key findings
- Telefónica disclosed a strong commitment to respect human rights but was less transparent about policies affecting users’ freedom of expression and privacy in practice.
- The company improved its disclosure of how it handles government requests to shutdown networks, block content, and hand over user information, but could still publish more data about its compliance with these types of requests.
- Telefónica lacked transparency about how it handles user information and what steps it takes to keep user information secure.
Analysis
Telefónica ranked third out of 10 telecommunications companies evaluated, after Vodafone and AT&T, and disclosed a strong commitment to protecting users’ freedom of expression and privacy. As a full member of the Global Network Initiative (GNI) since March 2017, the company now commits to engaging with a range of stakeholders on freedom of expression and privacy issues. The company made numerous improvements in the 2018 Index, including clarifying its process for handling government requests to shut down networks and providing more data about government requests for user data. Despite positive steps, the company could be more transparent about policies affecting users’ freedom of expression by publishing more data about government and private requests it receives to block content or accounts, as there are no legal obstacles in its home market of Spain preventing the company from doing so. It could also improve its commitments to protect users’ privacy by disclosing what user data it shares and with whom, and by providing greater clarity about what steps it takes to keep user information secure.
- Improve transparency reporting. Telefónica should disclose more detailed data about its compliance with government and private requests to block content or accounts, and for user information.
- Clarify handling of user information. Telefónica should disclose what user information it shares and retains, and whether users can obtain the information the company holds on them.
- Communicate more clearly about security. Telefónica should clearly disclose how it keeps user information secure, including if it limits employee access to user information.
Telefónica, S.A. provides mobile, fixed-line broadband, and other services to more than 276 million mobile customers in Spain, Latin America, and internationally.
Governance
Telefónica ranked second in the Governance category among telecommunications companies, after Vodafone. It significantly improved its disclosure of its public commitment to freedom of expression and privacy, resulting in increased scores in five of the six indicators in this category. The company improved its disclosure of senior-level oversight over freedom of expression and privacy issues within the company (G2), clarified that the company provides its employees with training on freedom of expression (G3), and strengthened its commitment to conducting human rights impact assessments (G4). The company also improved its engagement with stakeholders by joining the GNI (G5). Notably, Telefónica improved its disclosure on grievance and remedy mechanisms, and received the highest score of all 22 companies in the Index on this indicator (G6), although the company did not provide clear evidence that it is responding to these complaints.
G2. Governance and management oversight
Telefónica improved its disclosure of board oversight over freedom of expression and privacy issues within the company.
G3. Internal implementation
Telefónica clarified that it provides employee training on issues related to freedom of expression.
G4. Impact assessment
Telefónica improved its disclosure of human rights due diligence practices, including disclosing it conducts human rights risk assessments related to existing products and services and new activities.
G5. Stakeholder engagement
The company improved its disclosure of stakeholder engagement after joining the Global Network Initiative in March 2017.
G6. Remedy
Telefónica improved its disclosure of its process for responding to freedom of expression and privacy complaints.
Freedom of expression
Telefónica ranked third among the 10 telecommunications companies in the Freedom of Expression category, behind Vodafone and AT&T.
Content and account restriction requests: Telefónica disclosed little about how it handles government or private requests to block content or accounts (F5-F7), but it was among only three telecommunications companies in the Index to publish transparency reports. It provided more data on the number of government requests it received and complied with, including the number of URLs affected (F6). Like its peers, Telefónica published nothing about private requests to block content or accounts (F7).
Network management and shutdowns: As in the 2017 Index, Telefónica Spain disclosed almost no information about its network management policies, receiving the second-lowest score of all telecommunications companies on this indicator (F9). Yet, along with Vodafone UK, it was more transparent than the rest of its peers about how it handles government demands to shut down networks (F10). The company improved its disclosure of why it may reject a network shutdown demand and provided more detailed data about its compliance with these types of requests.
Identity policy: Telefónica Spain disclosed that it requires pre-paid mobile users to provide government-issued identification, which is legally required in Spain (F11).
F5. Process for responding to third-party requests for content or account restriction
Telefónica improved its disclosure of its processes for responding to government requests for content and account restrictions.
F6. Data about government requests for content or account restriction
Telefónica improved its disclosure of data on government requests it received to remove content and restrict accounts, including by publishing the number of URLs affected for some of the countries in which it operates.
F10. Network shutdown
Telefónica improved its disclosure of how it responds to government shutdown orders, disclosing some of the reasons why it may reject such demands, as well as the number of such requests with which it complied in some of the countries in which it operates.
Privacy
Telefónica ranked third out of the 10 telecommunications companies in the Privacy category, behind AT&T and Vodafone.
Handling of user information: Telefónica Spain disclosed less than AT&T and Vodafone UK but slightly more than Orange France and América Móvil’s Telcel about how it handles user information (P3-P8). It had the highest score of all telecommunications companies on what user information it collects (P3), and for what purpose (P5), but disclosed nothing about what user information it shares (P4), for how long it retains it (P6), or whether users can obtain all of the information the company holds on them (P8). It disclosed some options for users to control what information it collects, including for the purposes of targeted advertising, but did not reveal if targeted advertising is off by default (P7).
Requests for user information: Telefónica disclosed less than AT&T and Vodafone about how it handles government and private requests for user information (P10-P11). It improved its disclosure of its process for responding to government requests for user information by clarifying why it may reject a government request (P10). The company also provided more data on government and private requests for user information, including the number of accounts affected (P11). Like the rest of its peers, Telefónica did not disclose a policy of notifying users if their information is requested (P12).
Security: Telefónica Spain disclosed less than AT&T and Vodafone UK about is security policies and practices, but more than the rest of its peers (P13-P18). Although it disclosed it limits employee access to user information, it did not disclose it has systems in place to monitor this (P13). Like most telecommunications companies, the company did not disclose a bug bounty program allowing security researchers to submit vulnerabilities (P14). It received the second-highest score in the Index, after Vodafone UK, for disclosure of its processes for responding to data breaches (P15).
P10. Process for responding to third-party requests for user information
Telefónica improved its disclosure of how it handles government requests for user information.
P11. Data about third-party requests for user information
Telefónica improved its disclosure of data pertaining to government requests for user data in some countries, including proving data on the number of accounts affected and the number these requests with which it complied.
