Scope of the right to personal data protection in organizations that carry out uninformed HTTPS inspection

Abstract

In the context of Internet access, a tension arises between the right of organizations to protect their assets and the right to privacy of individuals. This tension is exacerbated when organizations inspect HTTPS traffic without informing or obtaining consent. Many individuals use devices provided by an organization to connect to the Internet and trans-mit personal information about whose privacy they are concerned, with the expectation that this transmission is private and cannot be inspected by third parties. In some cases, organizations that provide these devices, in a legitimate attempt to protect their assets from threats on the Internet, use techniques to inspect this information, but they do so without notice, without requesting consent, and in a way that is very difficult for a non-specialized user to perceive. In this paper we elaborate an argument against this practice when it is carried out without the knowledge and consent of the owners of the personal data. We also comment on the Opinion No. 22/022 of the Regulatory and Personal Data Control Unit, which was drafted at the request of our consultation, and the implications of the recent Law 20.327 on cybercrime.