Authority request disclosure report 2019 CONTENTS Introduction 2 Why are we reporting? 3 Governance 3 Policy 3 Our procedures 4 How we report 4 Limitations 5 Definitions 6 Grameenphone (Bangladesh) 7 Telenor Denmark 8 Digi (Malaysia) 9 Telenor Myanmar 10 Telenor Norway 11 Telenor Pakistan 12 Telenor Sweden 13 DTAC (Thailand) 14 INTRODUCTION Respect for privacy and freedom of expression is important for how we at Telenor Group run our business. Our commitment to human rights is long standing and embedded in our top governing document – the Code of Conduct – as well as our Supplier Conduct Principles. Specific operational requirements are included in various policies, including Group-wide requirements for handling authority requests for access to our networks and customer data. In all our markets there are laws that, in certain There are several reasons for this, but most centrally, the circumstances, require operators like Telenor, to same governments who restrict privacy and freedom of disclose information about customers to the authorities expression should also make all reasonable efforts to or to restrict communication. Our efforts to minimise ensure concerned citizens that these powers are used potentially negative impacts such requests may have on with due care. It is also important to note that in a few privacy and freedom of expression (e.g. possible misuse) markets, the relevant authorities have direct access to extend to systematic monitoring of incoming requests, operators’ networks and/or communication data, which initiating dialogue with relevant authorities, the industry means that the operator would not have full visibility on and other stakeholders on authority requests, and how authorities intercept communication. seeking to be transparent by reporting in this area. Some governments publish reports regarding their use 1 This is our sixth annual report . In our ‘Legal overview’ of legal powers to access communication information on reports, you can find relevant information about laws a regular basis. We encourage all governments to adopt applicable within our markets. this practice. In the meantime, we view this document as Whilst adopting transparency as a default position, we one of our contributions to increased transparency. continue to advocate that this report should not reduce the governments’ responsibility to inform the public of the extent of such requests. 1 For our first report published in May 2015. Please see our website for more information and previous years’ reports: https://www.telenor.com/sustainability/responsible-business/privacy-and-data-protection/handling-access-requests-from-authorities/ Telenor Group | Authority request disclosure report 2019 Page: 2 WHY ARE WE REPORTING? Telenor Group currently has mobile operators in nine countries across Europe and Asia. In each of these countries, there are laws that require telecom operators to disclose information about their customers to government authorities in certain circumstances. Over the last few years, there has been an important global public debate about the scope, necessity and legitimacy of the legal powers that government authorities use to access the communications of private individuals or to restrict communication. Questions have also arisen as to the role that telecommunications network and service providers play in relation to such access. Although the authorities have a legitimate need to protect national security and public safety, and to prevent or investigate criminal activities, we recognise that the application of these legal powers in some situations may challenge the privacy and freedom of expression of affected individuals. In light of this, since 2015, Telenor has contributed to transparency in this area. GOVERNANCE At Telenor Group we find that implementation is the As a member of the Global Network Initiative (GNI), key to ensuring that we properly handle requests from Telenor is fully committed to the GNI Principles. This authorities. This requires continuous improvement. We includes a commitment to comply with all applicable laws achieve this through a system of clear top management and respect internationally recognised human rights, ownership, dedicated personnel both at Group and wherever we operate. Where national laws, regulations company levels, and systems for checking compliance. and policies do not conform to international standards, Ownership of the Privacy and Sustainability policies are Telenor will seek to avoid, minimise, or otherwise address with the Group Executive Vice President for People and the adverse impact of government demands, laws, or Sustainability and they are managed by, respectively, the regulations, and seek ways to honour the principles of Group Privacy Officer and the Group Head of Sustainability internationally recognised human rights to the greatest and People Security. extent possible. Telenor Group’s compliance management system for Telenor’s Board of Directors has approved the company’s authority request is built on international standards. human rights policies and exercises oversight with the Risk assessments identify challenges and is the starting support of its Sustainability and Compliance Committee point for definition of group-wide requirements, controls, The Board of Directors also exercises oversight through its training ambitions and compliance follow-up. The Risk and Audit Committee who has direct reporting from specialised compliance management system for authority the Head of Group Internal Audit. Telenor’s commitment request is complemented by Telenor Group’s general to the GNI Principles is also overseen by the GNI Board of management system for human rights which covers Directors through independent assessments. activities ranging from overall human rights due diligence to project- or issue-specific risk assessments. BOARD OF DIRECTORS TELENOR ASA Sustainability and Risk and Audit Compliance Committee Committee POLICY Head of Group Internal Audit and Investigations In order to address requests from authorities for customer data or access to our networks professionally and Group CEO systematically we have applied Group-wide requirements to all the mobile operators. These mandatory Group EVP Head of Region Sustainability and requirements are part of our governance framework and Privacy Policy Owner Local CEOs are included in our Sustainability and Privacy policies and underlying manuals. SVP Sustainability and Group Chief Personnel security, Compliance Officer Local CCAO and Group Sustainability Local Policy Owner The authority request manual is managed by the Group Policy Manager for Privacy and Group Privacy Sustainabilty Privacy Officer and locally by our Data Protection Officers. Officer, Group Privacy Policy Manager Head of business unit PRIVACY POLICY SUSTAINABILITY POLICY Sustainability, Local Sustainability Policy Manager Authority Request Manual Human Rights Due Diligence Manual Data Protection Officer, Local Privacy Privacy Manual Policy Manager Telenor Group | Authority request disclosure report 2019 Page: 3 The purpose of our manual on handling authority requests is to ensure proper handling of authority requests in order to limit the risk that our companies’ networks are OUR PROCEDURES being used to impose illegitimate restrictions to privacy Our local teams across our markets implement procedures or freedom of expression. It covers lawful intercept and for checking that authority requests meet procedural access to historical data, blocking, network shutdown, and material requirements for a valid legal basis under distribution of authority information and other authority local law. When requests lack a clear legal basis or pose requests with a human rights impact. The manual includes a significant risk of serious human rights impact, the local requirements relating to: teams shall inform the authority accordingly and refrain • Organisation – including dedicated function(s), reporting from executing the request, to the extent reasonably to top management, staffed with qualified personnel possible without risking disproportionate reprisals. The local units are also required to interpret requests and legal • Handling – including checking legal basis and risk of basis as narrowly as possible. serious human rights impact, challenge and escalation criteria Group CEO Group Authority Request Steering • Consultation with Group – including process for Committee Group Authority notification in cases posing significant risk Request Task Force Data Protection • Information – including regular updates to company Officer and Local Authority Request CEO Operational AR Task Force unit(s) Figure 3: Escalation ladder • Transparency – including a general requirement of transparency to the extent possible At the local unit level, experts from privacy, legal, • Record keeping – including legal basis and process sustainability, security, communications, and public steps taken and regulatory affairs will assess challenging cases and escalate if needed to the local CEO. A point of contact • Access to remedy – including a requirement to establish at the Group level responsible for privacy engages with a process to receive complaints from users the local units on these issues, receives the escalations, and summons a Group level team representing the same • Risk assessment & mitigation – including regular functions as the local escalation team as required. For any reviews of legal frameworks, update of processes, and cases that are particularly challenging or of high risk,