On 21 February 2010, Peter Hustinx, the European Data Protection Supervisor (EDPS), issued an Opinion on the current negotiations by the European Union of an Anti-Counterfeiting Trade Agreement (ACTA), in which he calls on the European Union, and in particular the European Commission, "to strike a right balance between demands for the protection of intellectual property rights [IPRs] and the privacy and data protection rights of individuals" when negotiating ACTA.

The European Commission is currently negotiating with Australia, Canada, Japan, Korea, Mexico, Morocco, New Zealand, Singapore, Switzerland and the United States. The ACTA negotiations are aimed at adopting a new multilateral agreement designed to strengthen the enforcement of intellectual property rights and to combat counterfeiting and piracy of goods such as luxury brand clothing, music and films.

ACTA's goal of fighting piracy and counterfeiting will be pursued through three primary components: (i) international cooperation; (ii) enforcement practices; and (iii) definition of a legal framework for the enforcement of IPRs in several identified areas, in particular in the digital environment. Notably, ACTA will deal with legal procedures (such as injunctions and provisional measures), the role and responsibilities of internet service providers (ISPs) in deterring copyright infringement over the internet and multijurisdictional cooperation measures to prevent goods from crossing borders.

The EDPS raises the concern that even if the intended objective of ACTA is to pursue only large scale infringements of IPRs, the activities of ordinary citizens might be captured under ACTA, especially as enforcement measures take place in the digital environment. He stresses that this will require that appropriate guarantees are set forth to protect the fundamental rights of individuals.

The EDPS appears to question whether ACTA’s aims can be lawfully achieved with regard to the European Union’s current data protection regime. The Opinion cites reason after reason why large scale monitoring of the internet activities of individuals by copyright holders and collation by ISPs of IP addresses associated with allegedly infringing activity are basically unlawful. These arguments attack the legal foundation of any anti-piracy legislation based on a graduated or a “three strikes” response involving ISP monitoring of user activity and potential user disconnection from the internet.

The Opinion considers whether three strikes policies are necessary, as Article 8 of the European Convention on Human Rights refers expressly to the requirement that any interference or restriction must be "necessary in a democratic society". According to the EDPS, three strikes policies like the French HADOPI scheme constitute a disproportionate measure and cannot be considered as a necessary measure. The Opinion identifies specific legal reasons why the three strikes approach is problematic from a data protection point of view, highlighting first the doubtful legal grounds for processing, which is required by the Data Protection Directive, and second the obligation contained in the e-Privacy Directive to discard log files.

The EDPS is not alone with these concerns. On 10 March 2010, the European Parliament announced its own concerns over ACTA and whilst these focus more on the lack of transparency in the negotiations of the agreement, Members of the European Parliament (MEPs) are also insisting "that data protection and privacy rights of citizens must be safeguarded". As the protracted debate over the "fundamental right" to internet access during the passage of the EU telecoms package demonstrated, MEPs will fiercely resist three strikes anti-piracy measures.

The kernel of Mr Hustinx's opposition to three strikes policies, however, is not so much the question of interference with a fundamental right to internet access but rather a question of invasion of privacy and interference with the data protection rights of individuals on a massive scale, which is out of proportion to harms such policies seek to curtail. This is a narrow but significant focus in the wider discussions surrounding the issues of on-line copyright infringement and digital piracy.