Orange S.A.
Domicile: France
Website: www.orange.com
Operating company evaluated: Orange France
Download company report: English | Français
Key findings
- Orange disclosed strong governance and oversight over human rights issues, but failed to disclose adequate information about policies and practices affecting freedom of expression and privacy.
- Orange lacked transparency about how it handles government demands to hand over user data, to block or filter content, or to deactivate user accounts.
- It improved disclosure of how it handles user information, but disclosed less than its European peers about its security policies, including how it addresses vulnerabilities and responds to data breaches.
- Orange France (Prepaid mobile)
- Orange France (Postpaid mobile)
- Orange France (Fixed-line broadband)
Analysis
Orange ranked sixth among the 12 telecommunications companies evaluated, falling behind all of its European peers and AT&T.1 A member of the Global Network Initiative (GNI), Orange stood out for its strong governance and oversight over its human rights commitments across its global operations. But the company lacked sufficient disclosure of policies and practices affecting users’ freedom of expression and privacy.2 Orange was especially opaque about how it deals with government requests to block or filter content or to hand over user data: the company’s lack of transparency about government demands puts it out of step with its European counterparts. On the privacy side, Orange was more transparent, although there is ample room for improvement. Orange France did improve its clarity around its handling of user data in a number of areas. But it lacked disclosure of its policies for keeping user data secure, including its policies for responding to data breaches.
Orange S.A. provides telephone and mobile telecommunications and other services in Europe, Africa, and worldwide.
Market cap: USD 43.8 billion3
ENXTPA: ORA
- Be transparent about government demands: Orange should clearly disclose how it handles government demands for user data or to block or filter content and deactivate user accounts. It should publish the data about its compliance with these requests in all markets in which it operates.
- Give users more control over their information: Orange should let its users know what options they have to control their own information, including what information is collected, and how it is used for targeted advertising.
- Improve security disclosures: Orange should clarify what it does to protect user data and how it responds to data breaches.
Governance
Orange received the second-highest score among telecommunications companies in the Governance category, after Telefónica. A 2017 law in France requiring a “duty of vigilance” for multinationals means that strong human rights oversight and risk assessment are mandatory for Orange.4 The company improved disclosure of its due diligence practices, clarifying that it systematically considers how laws in the different jurisdictions where it operates affect freedom of expression and privacy and that the company’s board of directors considers the results of assessments and due diligence in their decision-making (G4). However, the company did not disclose whether it assesses risks associated with its use of automated decision-making or targeted advertising. Despite its strong disclosure across all indicators in this category, Orange could clarify its grievance and remedy procedures (G6): while it provided ways for users to appeal to the company if they feel their freedom of expression or privacy has been violated by the company, it offered less clear evidence that it is providing remedy to these complaints.
G4. Impact assessment
Orange disclosed more information about its human rights impact assessments and due diligence processes.
Freedom of Expression
Orange disclosed less than all of its European peers, except Deutsche Telekom, about policies and practices affecting users’ freedom of expression. The terms of service for Orange France’s mobile and broadband services were easily accessible, but not easy to understand (F1), and did not clearly indicate a policy of notifying users when these terms change (F2).5 Orange disclosed no information about how it handles government and private requests to block content or restrict user accounts (F5-F7)—although there are no legal obstacles in France preventing Orange from disclosing this information.
Orange France disclosed nothing about its network management practices (F9), making it one of five companies, along with Deutsche Telekom, Etisalat UAE, MTN South Africa, and Ooredoo Qatar, to receive no credit on this indicator (F9). While Orange provided an example of pushing back on government requests to shut down networks, it still revealed little about its processes for responding to these requests, lagging behind Telefónica, Telenor, and Vodafone (F10).
No score changes
Privacy
Despite some improvements, Orange still failed to disclose sufficient information about policies and practices affecting the privacy and security of its users—disclosing less overall across indicators in this category than all of its European peers and AT&T. The privacy policy covering Orange France’s mobile and broadband services was easy to find and understand (P1), but did not specify if users are notified of policy changes (P2). It clarified the different types of user information it collects (P3), and provided some information about the purposes for collecting and sharing user data (P5). However, it failed to disclose if it shares data across company services (P5), disclosed very little information about what data is shared (P4) and did not give users clear options to control what information is collected and shared, including for the purposes of targeted advertising (P7).
Orange disclosed far less than its European peers and AT&T about how it handles government and private demands for user data (P10, P11). It revealed the legal basis for complying with the French government’s requests, but gave no information about how it responds to these requests or those submitted by foreign governments (P10). It published some data about its compliance with government requests in France but not about those in other countries in which it operates (P11). If there are laws barring Orange from publishing this data, it should specify them. Like all the other telecommunications companies, Orange did not disclose if it notifies users about government requests for their data (P12).
Orange France also disclosed less than its European peers, AT&T, and América Móvil’s Telcel about its security policies (P13-P18). It offered some information about its internal mechanisms to keep user information secure (P13), but revealed nothing about what it does to address security vulnerabilities (P14), or about its processes for responding to data breaches (P15).
P3. Collection of user information
Orange France improved its disclosure of the types of user information it collects and how it collects them.
P5. Purpose for collecting and sharing user information
Orange France improved its disclosure about whether it limits its use of user information to the purposes for which it was collected; however, it no longer disclosed if it combines user data across services.
P6. Retention of user information
Orange France disclosed a time frame in which it will delete some types of user information after users terminate their account.
Footnotes
[1] The research period for the 2019 Index ran from January 13, 2018 to February 8, 2019. Policies that came into effect after February 8, 2019 were not evaluated in this Index.
[2] For Orange’s performance in the 2018 Index, see: rankingdigitalrights.org/index2018/companies/orange/
[3] Bloomberg Markets, Accessed April 18, 2019, www.bloomberg.com/quote/ORA:FP
[4] “The French Duty of Vigilance Law: What You Need to Know,” Corporate Social Responsibility and the Law, Foley & Hoag, www.csrandthelaw.com/2017/08/03/the-french-duty-of-vigilance-law-what-you-need-to-know/
[5] For most indicators in the Freedom of Expression and Privacy categories, RDR evaluates the operating company of the home market, in this case Orange France.
