Two of Peru's Top ISPs Improve Transparency Practices, While Two Competitors Lag Behind, New Hiperderecho's Report Shows

Peru’s top two telecom operators Movistar (Telefónica) and Claro (América Móvil) continued to earn high marks for being transparent about government requests for user data, while competitors Bitel (Viettel) and Entel slightly improved practices promoting human rights, but in general lagged behind, according to a new report issued today from digital rights group Hiperderecho. 

Hiperderecho’s new ¿Quién Defiende Tus Datos? (“Who Defends Your Data”) report, launched today, reveals disparities in data protection and privacy practices among Peru’s four leading internet service providers (ISPs). Movistar came out slightly ahead in the new report after tying with Claro for the top position in the report’s last edition. Except for the user notification category, Movistar received full credit in all other evaluated parameters. Even though all four companies—Bitel, Claro, Entel, and Movistar—have improved their marks since the first edition in 2015, the disparities in the latest results are evident. In four out of eight evaluated categories, Bitel and Entel received no credit, highlighting their lack of transparency regarding government requests for getting access to user personal data.

Only Movistar and Claro received scores  for publishing information about government requests for user data, disclosing guidelines they follow when responding to such requests, explicitly committing to require judicial orders before handing user data to authorities, and disclosing practices for notifying users about such government requests. The report also looked at companies’ privacy policies, digital security practices, and human rights policies. In those categories, all four companies earned at least partial scores.

This report, the fourth evaluating Peru’s major telecom operators,  included a new category: whether telecom companies make available webpages, contracts, and/or privacy policies in native languages, like Quechua and Aymara. As Hiperderecho’s report highlights, “[w]e consider this to be of utmost importance because there is no free and informed consent if the information presented regarding the processing of personal data is not in an understandable language.” 

Main findings

Publishing privacy policies is already a steady practice among evaluated ISPs. All earned full scores in the last two reports. They publish privacy/data protection policies that apply to their telecommunication services (not only to their apps or communication channels), disclosing, in simple and clear language, what  information they collect, for how long, and instances when they share data with third parties. Movistar stands out for a Transparency Center on its website that presents the information in a more helpful and attractive way.

As for publishing more detailed guidelines on how they handle government requests for user data, both Claro and Movistar received full scores. In contrast, Bitel and Entel don’t disclose any guidelines. For the first time, Movistar went beyond publishing its global policies, and published guidelines relating to Peru. Claro had done so already in the last report. Back then and this year, Claro’s published guidelines earned a full star. Claro discloses applicable norms for lifting telecommunications secrecy, competent authorities to issue data requests, requirements they should follow, and the ISP procedure for processing government demands. The guidelines mention norms that include communications content and metadata. 

Both companies also explicitly commit to requiring a judicial order before handing user data to government authorities. With transparent law enforcement guidelines, Claro and Movistar disclose more than vague statements th&