{"id":30311,"date":"2020-11-03T10:10:22","date_gmt":"2020-11-03T15:10:22","guid":{"rendered":"https:\/\/panamaadvisoryinternationalgroup.com\/blog\/?p=30311"},"modified":"2020-11-03T10:10:22","modified_gmt":"2020-11-03T15:10:22","slug":"ipandetecs-report-panamas-isps-show-improvements-work-needed-protect-users-privacy","status":"publish","type":"post","link":"https:\/\/panamaadvisoryinternationalgroup.com\/blog\/ipandetecs-report-panamas-isps-show-improvements-work-needed-protect-users-privacy\/","title":{"rendered":"IPANDETEC\u2019s Report on Panama\u2019s ISPs Show Improvements But More Work Needed to Protect Users\u2019 Privacy"},"content":{"rendered":"

\"\"<\/a><\/p>\n

\n
\n
\n
\n
\n
\n
\n

IPANDETEC<\/a>, the leading digital rights organization in Panama, today released its second annual Who Defends Your Data” (\u00bfQui\u00e9n Defiende Tus Datos?<\/a>) report assessing how well the country\u2019s mobile phone and Internet service providers (ISPs) are protecting users’ communications data. While most companies received low scores, the report shows some ISPs making progress in a few important areas: ensuring payment processing services and websites are secure, requiring law enforcement to obtain warrants before accessing user data, and publicly promoting data privacy as a human right. Regarding the latter, all ISPs surveyed are working on an agreement to provide Internet connection to students and persons affected by the COVID-19, a welcome development as many are struggling without Internet access during the pandemic.<\/p>\n

IPANDETEC looked at the privacy practices of Panama\u2019s main mobile companies:\u00a0Claro<\/b>\u00a0(America Movil),\u00a0Digicel<\/b>,\u00a0M\u00e1s M\u00f3vil<\/b>\u00a0(a joint operation between Cable & Wireless Communications and the Panamanian government, which owns 49% of the company), and\u00a0Tigo,\u00a0<\/b>the new name for Movistar, the brand owned by Spain\u2019s Telefonica whose assets were sold to Millicom International last year.<\/p>\n

\u00bfQui\u00e9n Defiende Tus Datos<\/a>?\u00a0<\/b>is modeled after EFF\u2019s Who Has Your Back report, which was created to shine a light on U.S. ISPs\u2019 policies for protecting users\u2019 private information so consumers could make informed choices about what companies they should entrust their data to. Internet access and digital communications are part of everyday life for most people, and the companies that provide these services collect and store vast amounts of private information from their customers. People have a right to know if and how their data is being protected\u2014that\u2019s why IPANDETEC and other digital rights organizations across Latin America and Spain are\u00a0evaluating and reporting<\/a>\u00a0on what ISPs publicly disclose about their data protection practices.<\/p>\n

ISPs in Panama were evaluated on seven criteria concerning data protection, transparency, user notification, judicial authorization, defense of human rights, digital security, and law enforcement guidelines. Complete descriptions of what the categories include are provided later in this post.<\/p>\n

Main Findings<\/a><\/h2>\n

\"\"<\/b><\/a><\/p>\n

Tigo<\/b>, previously called Movistar, scored the highest, achieving full or partial stars in five of the seven categories assessed. It was the only company in the survey to receive a full star for stating that it requires law enforcement agencies seeking user data to first obtain a warrant. Tigo was also the only company to receive some credit for providing partial information about procedures for law enforcement requests for customer data\u2014this is largely owing to the fact that its current parent company Millicom publishes a policy for assisting law enforcement. But the document refers to a global policy; Tigo\u2019s local policy in Panama isn\u2019t clear, so it received a quarter of a star.<\/p>\n

Tigo was also the only company to receive partial credit in the data protection policy category. The other companies provide some information about data collection from visits to their websites and use of their apps, but not about data collected from their regular Internet or mobile phone services.\u00a0M\u00e1s M\u00f3vil<\/b>\u00a0says its contracts with customers provide information about privacy and data protection. But these contracts aren\u2019t made public. How companies collect, use, share, and manage customers’ personal data should be publicly disclosed so it’s available to people before they choose a telecom operator. Tigo, through Millicom, discloses only some information about data collection policies for online services and received a quarter of a star.<\/p>\n

Claro\u00a0<\/b>had the second-highest score, with one full star in the digital security category and half stars in the defense of human rights and judicial order categories. In the latter category, the company\u2019s global policy is to only comply with law enforcement requests for users\u2019 content and metadata when there\u2019s an order from \u201cthe competent authority.\u201d The global policy isn\u2019t available on Claro\u2019s local Panama business website, and Claro\u2019s policy for Panama is less precise about a warrant requirement, hence the awarding of a half star.<\/p>\n

Claro received a full star in the digital security category, an improvement over last year, by committing to using HTTPS on its website and for processing online payments. A big problem revealed by the report is a general lack of transparency about privacy and security practices by ISPs in Panama. None of the ISPs surveyed received credit for publishing a transparency report. Tigo\u2019s previous and current parent companies, Telefonica and Millicom, respectively, didn\u2019t include information about their mobile Panamanian businesses in their transparency reports because the Movistar sale transaction was in progress. As such, Tigo received no stars in the transparency report category. We hope to see that change in the next report, not just for Tigo but for the other companies as well.<\/p>\n

The lack of transparency reports isn\u2019t the only disclosure flaw among Panama\u2019s leading ISP\u2019s. None commit to notifying users when the government gets access to their data, according to\u00a0 IPANDETEC’s study.<\/p>\n

The specific criteria for each category and the final results of the study are below. For more information on each company and Panama\u2019s ICT sector, you can find the full report on IPANDETEC\u2019s website.\u00a0[add link of the report – partners still have to send it]<\/p>\n

Data Protection<\/b>: Does the company post a document detailing its collection, use, disclosure, and management of personal customer data?<\/p>\n