ePrivacy Regulation

ePrivacy Regulation
Title	ePrivacy Regulation
Jurisdiction	European Union
Status	Proposed
Introduced	2017
Related	General Data Protection Regulation

ePrivacy Regulation

The ePrivacy Regulation is a proposed European Union regulation intended to update sector-specific privacy rules for electronic communications, aligning them with the General Data Protection Regulation and modern Internet services. It addresses confidentiality of communications, rules for cookies and tracking, and privacy in over-the-top VoIP and messaging services. The proposal has generated substantial debate among European Commission, European Parliament, Council of the European Union, privacy advocates such as European Data Protection Supervisor and Electronic Frontier Foundation, and industry groups including GSMA and ETNO.

Background and scope

The proposal stems from the 1995 Directive 97/66/EC on privacy and electronic communications and the more recent General Data Protection Regulation to create a harmonised legal framework for privacy in electronic communications across the European Union. It targets providers of electronic communications networks and services, including traditional telecommunications operators represented by BT Group, Deutsche Telekom, and Orange S.A., as well as internet companies such as Google, Facebook, Microsoft, and WhatsApp. The Regulation would cover metadata, content confidentiality, tracking technologies like cookies, and machine-to-machine traffic in the context of the Internet of Things and connected devices from manufacturers like Samsung and Bosch.

Key provisions

The proposal includes strict rules on the confidentiality of communications, requiring consent or other legal bases for processing content and metadata, with exceptions for emergency services such as 112 (emergency telephone number). It would limit storage and access to terminal equipment, regulating cookies and similar technologies used by advertising platforms run by DoubleClick and AppNexus. The text proposes stronger protections for end-to-end encrypted services including Signal and Telegram, while creating carve-outs for lawful interception under national laws such as those in France and Germany. It also envisages obligations on trusted registries and certification mechanisms similar to initiatives by the European Telecommunications Standards Institute.

Relationship with GDPR and other laws

Designed to complement the General Data Protection Regulation, the Regulation addresses sector-specific matters not fully covered by GDPR, such as the confidentiality of communications and traffic data retention rules debated under cases like Digital Rights Ireland. It interacts with directives and regulations including eIDAS Regulation, the NIS Directive, and national laws implementing lawful interception such as the Investigatory Powers Act 2016. The proposal seeks to avoid legal fragmentation by setting EU-wide rules, but overlaps and coordination mechanisms with the Court of Justice of the European Union jurisprudence and national data protection authorities like the CNIL and Bundesbeauftragter für den Datenschutz und die Informationsfreiheit are central to its application.

Legislative history and status

The European Commission tabled the initial draft in 2017, followed by amendments from the European Parliament and positions from the Council of the European Union. Negotiations have involved rapporteurs and shadow rapporteurs in Parliament, stakeholder consultations with civil society groups including Access Now and Privacy International, and industry lobbying from associations like DigitalEurope. Key milestones include votes in the Committee on Civil Liberties, Justice and Home Affairs and trilogue discussions; however, political disagreements over scope and enforcement have delayed final adoption, leaving the file under discussion in various Council working groups and Parliament committees.

Impact on telecommunications and online services

If adopted, the Regulation would affect network operators such as Vodafone and Telefónica, online platforms like Amazon and YouTube, and advertising ecosystems reliant on behavioral profiling by AdTech firms. It would influence deployment of default privacy settings, product design by manufacturers including Apple Inc., and business models across cloud providers like Amazon Web Services and Microsoft Azure. Compliance costs, potential changes to targeted advertising, and implications for cross-border data flows involving entities in United States and India have been central concerns for multinational corporations and trade associations.

Enforcement and compliance

Enforcement mechanisms would involve national data protection authorities, coordinated by the European Data Protection Board, using powers akin to those under the General Data Protection Regulation including fines and corrective orders. Supervisory bodies such as AEPD (Spain) and DPC (Ireland) would play roles in cross-border cases affecting multinational platforms headquartered in jurisdictions like Dublin. Compliance obligations include data protection impact assessments, records of processing activities, and technical measures such as encryption and pseudonymisation promoted by standards from IEEE and IETF.

Criticisms and debate

Critics argue the Regulation could stifle innovation, increase compliance burdens for small and medium enterprises represented by groups like Digital SME, and create legal uncertainty for over-the-top services. Privacy advocates such as NOYB and European Digital Rights contend the text contains loopholes for tracking and governmental access, while industry bodies warn about conflicts with national security laws including those enacted in United Kingdom and France. Academic commentators from institutions like Oxford University, KU Leuven, and European University Institute have published divergent analyses on proportionality, subsidiarity, and the Regulation’s alignment with case law from the Court of Justice of the European Union.

Category:European Union law