This document provides an overview of privacy in online communication and data protection laws. It discusses: 1) How the EU has laws like the 1995 Data Protection Directive and 2009 ePrivacy Directive to regulate personal data processing and require consent for cookies. 2) Differences between EU and US privacy laws, with the US having a combination of legislation and self-regulation instead of comprehensive data protection. 3) Examples of messaging apps Telegram and WhatsApp, which take different approaches to prioritizing customers' privacy within legal bounds.

1. PRIVACY IN ONLINE
COMMUNICATION
Communication and reputation – 2015
Teacher: Ute Vrijburg
Valeria Sali
Abstract:
1. Introduction: what is the privacy online.
2. The challenge: the EU and non-EU law about privacy online.
3. Example: Telegram and WhatsApp: two different way of caring about
customers’ privacy.
4. Solution: 10 useful and easy tips.
5. Conclusion for my target group: what I want to achieve with my article.

2. Privacy in online communication
Do you think that the privacy is still respected in the online communication? Maybe yes, maybe
not, but most of the time we don’t know because we do not inquire about it.
What is online privacy?
When I talk about “privacy”, I mean all the stuff related to a private person and his private life.
Nowadays, it’s harder and harder that privacy is respected because of Internet and the World Wide
Web: on the web, all the information – and personal data too – are easy to share and to be tracked.
This is the reason why I am wondering if privacy still exist in the online world.
Nowadays, both teenagers and adults – including me – often do not know how the applications
on their smartphones work; this unawareness lead us to trust something we should not trust: we
just press the button “OK”, without wondering if we are giving information we had better not to
give. Most of the time, we see smartphones as something, comfortable, smart, easier, etc…and
actually they are. However, we don’t keep in mind the other side of this innovation: private
information and data are easily sharable, and sometimes we might not have the control on them.
For instance, I have recently read about a new app for smartphone called TrueCaller: this app
allows the owner of the phone to know who is calling him, even if he doesn’t have this number in
his contact list. The app uses a database with advanced filtering options that create customized
filters with known spam keywords or number series (area codes or country codes). This app has
also a “Name Search” option, which looks within your social circle: it means that you must have
at least one connection in common with this person. Is it fair that our data can be discovered and
used by this app?
Everything about our social life is linked on the wide web: it seems to me that almost nothing can
be private anymore.
Thus, in this article I’m going to talk about the online data protection, in Europe and outside the
Europe, and the observance of the privacy online – if “privacy” still exists –.
Do you know if and how EU take care of your online
privacy?
In 1995, the European Union adopted the Data Protection Directive – which is officially called
Directive 95/46/EC – to regulate the processing of personal data within the European Union. In
July 2002, the European Parliament approved the Directive 2002/58/EC, the Directive on Privacy
and Electronic Communications, also known as “ePrivacy Directive”: it sets out some new rules
on how providers of electronic communication services, such as telecoms companies and Internet
Service Providers, should manage their subscribers’ data.
In January 2012, the European Commission proposed a new reform of the online data protection
adopted in 1995, in order to tackle the globalization and the new technological issues.
If we want to understand something about all the problems that an unappropriated data protection
could cause, we should know something about how our personal data are used online. I will try to
sum up the main activities that PCs, games consoles, mobile devices, media player or any other
equipment connected to Internet can do with our personal data – according to the information I
found on the European Union website.

3. These devices usually collect a person’s details through an online application form: it means that
some information about what you like, based on what we search on Internet, can be accessed by
the network – but not by the publishers! Thus, for instance, if a publisher wants to place an
advertisement on the web page you are looking at, he cannot see your information directly, but he
can chose the adverts based on which other affiliated websites you have visited: the publisher can
just affiliate to some advertising networks that deduce what you might be interested in.
You can easily figure out, thanks to the example that any device, which can connect to Internet,
uses cookies or IP addresses to target content at a particular individual: it means that they can
associate a certain content to a certain person, and in this way they can also suggest what to search.
They use personal data to market goods or to deliver public services, and they use cloud computing
facilities to process personal data too. In those cases, the data collected by the network is not
always used to associate a person to a specific need or taste: these data are just useful to the
companies to identify their consumers’ needs.
Now that we have a clearer idea of how personal data are used online, we can easily understand
that an appropriate data protection is very
important for us and for our privacy. Our
data online can be easily stolen by people
able to hack an informatics system.
The EU ePrivacy Directive I mentioned
before was updated in 2009 to provide
clearer rules on costumers’ right on
privacy, since the usage of online personal
data was growing up more and more in
those years. This directive is also called
“Cookies law” because it introduces new
requirements on data, such as “cookies”.
From 2009, users have to grant their
consent before cookies are stored and
accessed to their devices. Moreover,
Telecom and Internet Services Providers,
which possess a huge amount of
consumers’ data, must report any
“personal data breach” to the national
authority, so that the consumers are
protected also by higher authority.
What is this annoying cookies banner?
Let’s start by taking in account that cookies are “small piece of data” stored by your browser: every
website you visit “asks” to your browser to store some data about your actions or preferences on
the web. From 2011, all EU countries adopted the EU Directive about cookies: this Directive gave
individuals right to refuse the use of cookies that reduce their online privacy.
Websites mainly use cookies to identify the user, remember the user’s custom preferences, and
help him to complete tasks without having to enter the whole information; moreover, they can
also be used to show adverts related to something that the user had searched in the past. For

4. instance, last month I searched on Amazon a case for my new laptop; at the end, I did not buy it
because my boyfriend bought it for me. Now, it’s been a month I see the advertisement of that
case every time I open Facebook: my browser does not know that my boyfriend bought it for me
– because he has used his own account – and so it keeps on asking me if I want to buy it.
EU legislation on cookies follows the Commission’s guidelines contained in the ePrivacy directive:
it establishes that, if a website is using cookies, it must inform users and ask them if they agree on
the website using cookies. However, there a few kind of cookies that are exempt from asking the
users’ consent: most of them are cookies that only have to carry out the transmission of a
communication, or cookies that a service provider company needs to use in order to carry out the
user’s requirement.
However, in general, the “cookie law” establish that websites, which use “not technical” cookies,
must show a banner that inform about which cookies are used and how. With “not technical”
cookies, I mean cookies used by commercial websites, that want to advertise or sell their products.
According to this law, the informative banner must be a suitable size to be immediately noticed by
users, and must tell people which cookies the website uses and what is their purpose. In other
words, the information that the banner must contain are:
1. Warn that the website is using cookies to store your preferences and send you
advertisement according to them;
2. If the website sends information to third parties;
3. The link containing the full law, so that the user can read it and get informed about it;
4. The possibility to accept or refuse cookies: only accepting, users can go on navigating on
the website.
The biggest difference between EU and USA
The UE developed all these rules to protect its citizens; but in the USA the rules are not the same,
and the citizens are not so well protected by the government’s authorities. First of all, it’s important
to notice that the USA has not a single data protection law for all the States, and it is neither
comparable to the EU’s Data Protection Directive. Rather than a governmental regulation, the

5. U.S. has a combination of legislation and self-regulation, and privacy is not an explicit right
guaranteed by the U.S. Constitution.
At federal level, the government defend the citizens’ right to be free from research, to keep one’s
information personal, to be free to communicate without interceptions; however, the government
is allowed to intercept whichever communication whenever it want or need to. Privacy rights can
be enforced also by State attorneys and some local district attorneys, and by some federal agencies
or some consumer protection agencies.
In the U.S. there is not the “Cookie law”: it means, for instance, that a website owned by a US
company can avoid the European cookies law, and still serve content to the EU. In theory, a
website that serves EU citizens ha to comply with respect the EU rules, regardless of who owns
the website; in practice, however, a website owned by a US company can easily avoid the law and
still serve EU citizens, while gathering better information about visitors.
Have you ever heard about “Telegram”?
Now that I have outlined the situation about laws and rules, we can move to see different ways to
take care of the consumers’ privacy – more respectful or less respectful – but all legal. To make it
immediately clear, I’m going to show you a practical example.
WhatsApp and Telegram are both apps for messaging, but few people know Telegram because
WhatsApp is the most common. Telegram is very similar to WhatsApp: it is connected to the
phone number, and you can use it to send messages, photos, videos, audio notes and other kind
of files such as doc, zip, mp3, etc… You can create group chats, as well. There is also another
option that allows users to set up a public username: in this way, people can find you even if they
do not have your number in their contacts; but this is your own choice: you can also choose not
to have a public username – as I did.
Thus, what are the differences with WhatsApp? There are some small differences, such as the
Telegram’s desktop app, or Telegram stickers – available on an open sticker platform –; Telegram
is also free and it will stay free forever – no ads, no subscription fees. However, all these features
are not related to privacy. The main point about Telegram is that, unlike WhatsApp, it is cloud-
based and heavily encrypted: it means that everything you share in a conversation is recorded in
a multi-data centre infrastructure and encryption, and nobody can access to it. On WhatsApp, on
the contrary, the communication is not encrypted with a key that the provider does not have access
to: it means that past messages are not secure if the encryption keys are stolen.

6. Telegram wants to take more care of its consumers, and for this reason, it supports a two layers
of secure encryption. The first one is the basic one: it uses a server-client encryption, and
everything you share in a conversation will be stored in the Telegram Cloud, protected by a key.
Then, there is the “Secret chat” that uses an additional layer of client-client encryption: all data is
encrypted with a key that only you and the recipient know; in this case, there is no way for anybody
– included the Telegram
Cloud – to see the content
you share. Even if the
Telegram Cloud is secure
too, if you want to be surer
that nobody can have access
to your conversation, the
“Secret chat” provides an
encryption key for your own
chat: this key is shown as a
picture that you can
compare with the other
participant of your chat. If
the two images are the same,
you can be sure that nobody
can see what you share.
The idea behind Telegram is to bring something more secure to the masses, who understand
almost nothing about security but want to use a secure communication medium.
So far, I explained why Telegram is secure; but what is the WhatsApp security flaw? WhatsApp is
not a cloud-based messenger, and this makes it easy to track the conversation. To demonstrate it,
a student of a Dutch university, Maikel Zewwrink, designed a web-orientated application as a
“Proof of Concept” that WhatsApp is broken in terms of privacy. This tool, called “WhatsSpy”,
tracks every move of whichever WhatsApp user one wishes to follow: it enable a user’s status to
be tracked, to see his changing profile pictures, privacy settings, status messages, and so on.
In addition to this, I can make an example that shows how easy it is, for people that have
knowledge in telecommunication, to have access to WhatsApp chats. In June 2015, in Belgium,
the police arrested sixteen people in the anti-terror raids thanks to their collaboration with U.S.
authorities, which monitored suspects’ communications on WhatsApp. The Belgian police was
already investigating on a Chechen group based in the Belgian city of Leuven, suspecting that they
were preparing a terrorist attack in the country; but the information obtained through WhatsApp
have been decisive to arrest them.
The U.S. authorities are not hackers but just people who have knowledge in telecommunications’
field: if they wanted, they could easily track our private conversation. There are many other people
able to do that, but they don’t do it because it’s not legal for private people. But what if there is
someone that doesn’t care about the law and wants to track your conversation on WhatsApp?
Think about it.

7. 10 useful tips for you
Everything I said can show that there are several rules about personal data collection, depending
on the subject, the country, the communication medium, etc… Thus, we cannot control everything
connected to the processing of our personal data, but we can gather as much information as
possible, in order to be aware of what we give consent to, and how our data will be used.
Sometimes we can decide what to share, where and when, but if we don’t know that we have this
possibility, automatic privacy settings will be set on. If we are free to choose our own privacy
settings, why don’t we do it? However, to choose freely we need to get informed on how the
medium we are using works. This is the reason why here I will try to give you ten tips that are, in
my opinion, the main things to keep in mind.
1. The biggest risk is the free Wi-Fi. If you don’t want to give up the convenience of this free
internet access, you can at least take four fundamental precaution:
a. Turn off the file-sharing on your device – pay attention: I said DEVICE, not only the
laptop. Sometimes people forget to think about their smartphone if they are navigating
with a computer, but a lot of personal information can be shared from the smartphone
too!
b. Avoid doing payment online with your credit card: it could be very dangerous.
c. Avoid going on websites – like social networks – where you have to login.
d. Make sure to have a good anti-virus. I will not suggest any software because this is not an
advertising article: I can just suggest asking to an expert person, and not just listening to
rumours.
2. Avoid giving your number to a website where you need to sign in – like social networks, but
also shopping websites like Amazon – and vice versa: this precaution could help you keeping
separated your “private” life from your “social” life. In this way, if someone can track you and
your identity on internet against your will, he or she cannot reach you on your phone number.
3. When navigating, if personal information are required, try to figure out the reason, and what
they are used for. Most of the times, websites have privacy policies available for visitors,
explaining more about what kind of information they collect and what they use it for; since
these policies are usually lengthy and boring, most of the time people don’t care about them.
I know that it is very boring – I’m lazy too – but I would suggest at least reading the privacy
policies of websites where you purchase or that you are thinking to joining with a personal
account; moreover, keep updated with the privacy changes made to websites where you already
have an account.
4. If a website you are visiting uses cookies – and you don’t want to read the section in the banner
with “more information” –, at least, keep in mind not to do researches that you don’t want to
be related to your identity.
5. When installing a new app on your smartphone, gain information on how it works and if there
are any disadvantages for your privacy.
6. If you have an account – like a Google account on Gmail – with many information about you
synchronised with it, avoid logging-in, if you are using a device that is not yours. If you need
to log-in, at least, always REMEMBER TO LOG-OUT.
7. Avoid keeping all your accounts synchronised. For instance, if you have an email address at
work, keep it separated from your private life (payment you do, account on social networks
that require you to login with an email address, etc…). I suggest it because you may be
monitored at work. The same applies to the a private account: for instance, if you have a
Facebook account, you may be monitored by your manager or your work-place in general, so

8. it’s better to have a private profile – it means that people who are not your friends cannot see
your profile.
8. Pay attention to the location info and the geotagging settings. The “geotagging” feature is an
intrinsic part of many of our digital devices nowadays: this feature is not just a “tagging option”
in social networks, but it is also present in the smartphone’s camera. If you check the details
of the photos you have taken with your smartphone, you can find the GPS coordinates. It
means that, if you upload the photo on a social network – like Facebook – without tagging
your location, the position where you took the photo can be tracked anyway, because the
“location info” is part of the photo’s information. Thus, if you never want your location to be
tracked, turn off GPS for your device or for the camera app.
9. Do not reveal personal details to strangers or people that you “have met” on a social network.
This is quite an obvious thing, but it’s better to remind you that you SHOULD NEVER
TRUST people that you “know” just as “online people”: you do not know who is behind the
device that is talking to you. Each person can be another person online: remember it!
10. The last but not the least: remember that most of the time, even if you didn’t know about it,
you can decide what personal information to share, where, when and to whom. Be aware of
this, and choose for yourself.
‹What can I do now?›
In this whitepaper, I aim at increasing your awareness. I am talking to all the people who deal
everyday with the online network, and who have never wondered if their privacy is protected
enough or not. There is no difference if you are teenagers or adults, male or female, interesting in
computer science or not, etc… I don’t want to make my target group expert in computer science
and privacy laws: I just want you to know what you are dealing with when you connect to Internet
using your smartphone, laptop, tablet or any other device.
Moreover, I would like to point out another thing, to avoid any misunderstanding. My aim is not
convincing you to keep every personal information extremely protected and as much hidden as
possible. I just want to warn you that there are many thing you don’t usually care about – even if
you should: many things about your online privacy that you don’t know but that you had better be
aware of.
I have tried to give you some general tips on this topic; however, I can sum up in three points
what I want to achieve as regards my topic. I want you to:
1. make sure you are informed;
2. create your own awareness;
3. decide how to behave: are you sure you want to give your consent to the processing of
personal data? What do you want to share, where, when and to whom?
Valeria Sali

9. SourcesInformation about the app TrueCaller:
 https://www.truecaller.com/blog
 http://www.androidworld.it/2015/08/28/lapp-che-vi-dice-chi-vi-sta-chiamando-
truecaller-330382/?utm_source=AndroidWorld.it+News&utm_medium=twitter
Information about European law, the comparison between EU and US, and the Cookies’
regulation:
 http://europa.eu/index_en.htm
 https://it.wikipedia.org/wiki/Cookie
 http://uk.practicallaw.com
Information contained in the paragraph “Telegram VS WhatsApp”:
 https://telegram.org/
 http://tech.firstpost.com/news-analysis/whatsapp-security-flaw-allows-anyone-to-track-
you-regardless-of-your-privacy-settings-254265.html
 http://www.tuttoandroid.net/news/la-polizia-belga-arresta-dei-terroristi-grazie-a-
whatsapp-283617/?utm_source=dlvr.it&utm_medium=twitter

10. Process reportMy source of inspiration has been an article I have read, which talked about a new app for
smartphone called “TrueCaller”. I found the link to this article on Twitter: it was posted by the
page AndroidWorld. After reading the article, I immediately thought “How is it possible that a
person can see who is calling, even if she doesn’t have the contact in his contacts list?”, and I
started reading more about this app.
After having read more about TrueCaller, I figured that this is just one of the thousands cases in
which we don’t know that our information are tracked and used by many app, software, website,
and so on. Moreover, sometimes we don’t even know which information we are sharing and with
who.
I think this topic can be a problem nowadays, if people are not aware of how the online world
works: everything that goes online is easier to track and to steal than information and personal
data not gathered online. This is the reason why I chose to write my whitepaper about the privacy
online and the importance of knowing how our personal data are gathered and why.
My classmates and me gave feedback to each other, about our works. I haven’t received negative
feedbacks, but some of them contained a suggestion on how to improve. The peer-to-peer
meetings have been useful for me because sometimes I think I’m clear in explaining my topic just
because I know it, but I figured that I am not always so neat as I think to be. Thus, these meetings
have been very useful to make some passages clearer.
I’ve been told that my target group was not very clear, and I decided to dedicate the last paragraph
to address explicitly my target group, and to explain who I’m talking with. I also received a
suggestion about titles: that address the audience would have been better to catch his attention.
Moreover, I got a good suggestion for the paragraph about the solution I purpose: I’ve been told
that making a check-list is fine and better for being clear, and I did it.

11. Publishing
Here I’m going to explain who I will contact to publish my whitepaper, and
why these people should publish my whitepaper in relation to my target group.
 Magazine “Rivista internazionale di scienze sociali” (http://riss.vitaepensiero.it/) – Publisher
“Vita e Pensiero”, the publisher connected to my University in Milan.
Contact people:
 Giuseppe Langella (Giuseppe.langella@unicatt.it) – coordinator for my faculty in Milan.
 Editrice.vp@unicatt.it – email address to contact directly the magazine’s director.
I thought to publish my article in in this magazine as first because this is the first time I publish a
whitepaper, and I think that referring to a magazine connected to the same academic environment
as me can be a good starting point. Though the publisher is Italian, this magazine in international
– so all the articles are written in English; moreover, “Rivista internazionale di scienze sociali” can
fit my subject because all the articles published in it are about actuality and topics connected to the
modern society. The writers are students, but the target group of the magazine is wider: all the
people of different ages interested in modern social issues. Since my whitepaper is not for experts,
but for normal people who want to start learning more about the online privacy, this magazine can
fit my need.
 http://paper.li/ - online platform for publishing curated content.
Contact: https://support.paper.li/hc/en-us. This link sends directly to the Support centre that I
can contact if I want to start using paper.li to publish my content.
Creating an account in this platform is free, and I can have access to the universe of article, blogs
and social media. If I create a page, I can share my own article and create a link to all my account
in other social media, in order to make the distribution of the article wider; moreover, I can also
create curated content for people who visit my page, and get more audience for my own
publication as well.
The audience that reads the content on this platform is very wide: people of different ages – both
teenagers and adults, males and females – search in this website subjects they are interested in.
Thus, a person who wants to learn more about the importance of the online privacy can easily find
my article here.

12. Peer-to-peer: posterDuring the last peer-to-peer section, we showed each other our posters. Both of the girls who
looked at my poster said that the title is catching, the design of the poster is clear, and the images
are helpful to fully understand my subject. One of the girls that gave me the feedback was surprised
by the fact that my subject is practical and actual for the real life.
The only useful tip I received regards where to publish my whitepaper: a girl suggested publishing
it on social media. Thus, to include all the social media, I choose an online platform – as I said in
the previous paragraph – that is linked to all the social media in which I have an account. It means
that, using this website, I can publish the article not only in the platform but also on Twitter,
Facebook, Linked-in and Google+, the social network I’m logged in.