Telia Company Law Enforcement Disclosure Report 2020 TELIA COMPANY LAW ENFORCEMENT DISCLOSURE REPORT 2020 Telia Company Law Enforcement Disclosure Report 2020 CONTENTS Letter from the general counsel and the chief external affairs, governance and trust officer .............................. 1 1. About this report ....................................................................................................................................................... 2 2. Unconventional requests and demands ................................................................................................................ 4 3. Statistics for conventional requests ...................................................................................................................... 5 Authority requests 2019 and 2020 ............................................................................................................................... 5 4. Laws providing governments direct access.......................................................................................................... 7 5. Laws on mandatory data retention for law enforcement ....................................................................................... 9 6. Governments’ law enforcement disclosure reports ........................................................................................... 10 7. Additional transparency measures ....................................................................................................................... 11 Appendix 1. Extract from Annual & Sustainability Report ...................................................................................... 12 Appendix 2. additional information regarding conventional requests ................................................................... 14 Executive summary This Law Enforcement Disclosure Report aims to offer detailed and updated insights into the context and extent of surveillance and collection of customer data by government and authorities in Telia Company’s main markets. The report includes statistics on conventional (day-to-day) authority requests, information on legislation regarding ‘direct access’ and on mandatory ‘data retention’ for law enforcement purposes. It also includes information on unconven- tional authority requests which Telia Company labels “major events”. A summarized version of this report is published in the Telia Company 2020 Annual and Sustainability Report availa- ble at annualreports.teliacompany.com. This full report provides more context, as well as information about definitions, challenges and the scope of the reporting. Telia Company Law Enforcement Disclosure Report 2020 LETTER FROM THE GENERAL COUNSEL AND THE CHIEF EXTERNAL AFFAIRS, GOVERNANCE AND TRUST OFFICER Millions of customers trust Telia Company to provide tel- strong legal framework, with the right checks and bal- ecommunications services and to protect their communi- ances. Whenever there is an opportunity, we argue for cations, data and personal information. We publish Law legislation which supports and promotes freedom of ex- Enforcement Disclosure Reports to contribute to an open pression and privacy. and transparent world where freedom of expression and privacy are at the forefront. We encourage governments to be transparent them- selves about their use and scope of surveillance of com- Safeguarding privacy is of utmost importance at Telia munications. We welcome reports – such as the ones in Company: It is one of the pillars of our Code of Respon- Denmark, Finland, Lithuania, Norway and Sweden – sible Business Conduct. At the same time, Telia Com- where each respective government regularly and pub- pany and its local subsidiaries – like all telecommunica- licly reports about the scope of their surveillance, even if tions companies – are obliged by legislative, administra- these publications might not always cover all types of re- tive, license or law enforcement requirements to respond quests and demands. We view publicly shared govern- to requests and demands from authorities to disclose ment reports as the preferred starting point for meaning- customer information. Such obligations are specified by ful transparency, based on the fact that a government law and regulations and are based on specific reasons, can cover not only Telia Company but all operators in e.g. enforcing criminal law and safeguarding national se- any respective country, and also respond to any ques- curity. tions as to the actual necessity and proportionality of the surveillance measures they apply. To supplement such government reporting we publish “Safeguarding customer privacy is of our full Law Enforcement Disclosure Report together utmost importance at Telia Com- with our Annual and Sustainability Report every year in pany: It is one of the pillars of our March, and an update of the statistics every October. Code of Responsible Business The report covers conventional day-to-day requests from Conduct.” the police and other authorities in Denmark, Estonia, Finland, Lithuania, Norway and Sweden. We also pub- lish information about unconventional requests, i.e. ‘ma- According to our policies and procedures, Telia Com- jor events’. In 2020, major events related primarily to ac- pany discloses information to authorities only to the ex- tions taken due to the COVID-19 pandemic. Additional tent required by law. This is a non-negotiable part of the information about those requests can also be found on way we are to operate. Our process is intended to iden- our website. tify and mitigate potential violations to individuals’ free- dom of expression and privacy, and we have clear esca- lation procedures in place to make sure that risks to pri- Solna March 11th, 2021 vacy are handled in a robust way. However, it is im- portant to stress that the actual outcome of information Jonas Bengtsson requests heavily depends on local laws. Governments Executive Vice President, Group General Counsel may also have direct access, where Telia Company has no insight into the extent of surveillance (when, who and Telia Company what) and cannot provide statistics. What we can do, as in this report, is to be transparent about the laws applica- Rachel Samrén ble in the markets where we operate. We also provide Senior Vice President, Chief External Affairs, Govern- links to laws on mandatory data retention for law en- ance and Trust Officer forcement purposes. The issues can be complex. Different stakeholders have different views on topics related to freedom of expres- sion and privacy, and there are societal needs both for surveillance, security and privacy. Nevertheless, funda- mentally we respect and support individual’s rights to freedom of expression and privacy, even as we accept that sometimes there need to be limitations on those rights, to the extent allowed by applicable legislation. Limitations – defined by governments - must be neces- sary and proportionate and clearly delineated within a 1 Telia Company Law Enforcement Disclosure Report 2020 1. ABOUT THIS REPORT Purpose of the report aim to build user trust and gain the confidence of inves- tors and other stakeholders by demonstrating that Telia Telia Company is committed to respect Company manages its human rights risks related to free- dom of expression and privacy in a proper way. Our aim freedom of expression and the privacy of is also to contribute to meaningful oversight and discus- our users. This report reflects that ambi- sions regarding the proper limits of government surveil- tion and aims to provide insights into the lance powers. extent of authorities’ collection of customer In this report, we provide: data for law enforcement purposes. Oper- • Statistics on the number of conventional (‘day-to- ators must adhere to law enforcement re- day’) law enforcement requests reported in four dif- ferent categories; ‘Lawful interception’, ‘Historical quirements which may impact an individ- Data’, ‘Subscription Data’ and ‘Challenged/rejected ual’s freedom of expression and privacy. requests’ What Telia Company can do is to chal- • Information about unconventional (‘major events’) government requests and legislative initiatives; and lenge such requests if they have no or un- • Links to laws providing governments with direct ac- clear legal grounds, advocate for neces- cess as well as links to laws on mandatory data re- sity and proportionality and inform its cus- tention for surveillance. tomers and stakeholders of the extent of The governments’ requests can be divided into four main such surveillance, including the legal con- categories: text. Through Law Enforcement Disclosure 1. Requests from law enforcement authorities: Reporting, our transparency reporting in the context of surveillance, we aim to build • Real-time access to the content of communica- user trust and gain the confidence of in- tions (e.g. listening in to voice calls) and access to historical content (e.g. checking what was vestors and other stakeholders by demon- written in an e-mail message) strating that Telia Company manages its • Real-time access to traffic data (e.g. checking human rights risks related to freedom of who is calling who, when and for how long or expression and privacy in a proper way. internet traffic) • Access to historical traffic data which the pro- Our aim is also to contribute to meaningful vider has stored or retained (e.g. checking who oversight and discussions regarding the has called who, when and for how long) proper limits of government surveillance •