The e-Privacy Directive and the e-Privacy Regulation – What to Expect

What is the e-Privacy Directive?

The e-PD applies to “the processing of personal data in connection with the provision of publicly available electronic communications services in public communication networks in the community”. This means that the e-PD regulates all publicly available electronic communications services and telecommunication services irrespective of the technologies used.

Under the Directive, service providers are required to take appropriate technical and organizational measures to ensure confidentiality of communications, safeguard the security of their services and inform the subscribers of any special risks arising out of the breach of security of the network.

What is the relationship of e-Privacy Directive and GDPR?

The objective of both the GDPR and the e-PD is to ensure an appropriate level of security and confidentiality of data and communications of European Union residents. However, the matters that fall under the subject matter domain of one regime are outside the scope of the other. This is clarified in Recital 173 and Article 95 of the GDPR, according to which, the GDPR does not apply where there are already existing e-Privacy rules.

Despite having two separate applicability areas, there may be some overlap and, in that situation, both GDPR and e-PD must be read together.

The e-PD and Electronic Marketing:

Corporations that send electronic marketing including email advertising in the European Union must comply with the requirements of both GDPR and e-PD. The e-PD requires service providers to obtain the consent of data subjects before processing their data for marketing. This includes an obligation upon corporations to provide full and accurate information to data subjects about the types of processing they intend to perform, their rights to not give consent and withdraw consent. The e-PD also grants subscribers protection against unsolicited communications for direct marketing purposes.

Similarly, the GDPR provides data subjects the right to object to data being processed for direct marketing purposes including an objection to profiling. The GDPR clarifies that in the context of the use of information society services, i.e. services delivered over the internet, the data subject may exercise his or her right to object by automated means using technical specifications, notwithstanding anything contained in the e-PD.

The e-PD and Cookies:

The e-PD was originally known as the “cookie law” because it provides specific rules on cookies, unlike the GDPR. As per the e-PD, organizations must provide clear and comprehensive information to users in relation to the processing of cookies and must acquire informed consent of users before tracking with cookies. The two exceptions to this are “where technical storage or access is for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user”. Under the e-PD, users must have the opportunity and the right to refuse to have a cookie stored on their terminal equipment.

Although the GDPR does not specifically mention cookies, it classifies cookie identifiers as a type of “online identifier” meaning that it may be considered personal data under certain circumstances. The GDPR further requires controllers and processors to demonstrate that the data subjects have consented to the processing of their information and that there must be some lawful basis for the processing of data subjects’ personal information.

What is the e-Privacy Regulation and why is replacing e-PD?

The e-PD will soon be replaced by the e-Privacy Regulation (e-PR) that is currently in its draft stage and under review by the European Union. The e-PR is expected to complement the GDPR just like the e-PD but will be an updated version which will be more in line with the industry-wide technological changes that have taken place in the last few years.

The proposed e-PR will not only provide protection to the content of European Union residents’ electronic communications but it will also stop the transfer and use of metadata associated with that communication. Therefore, e-PR is expected to update e-PD by ensuring confidentiality in all current and future means of communications including telecommunication services over the internet, emails, internet phone calls, personal messaging services through social media, voice services and other interpersonal communication services.

Having revised rules on cookies, the e-PR will allow users to refuse the tracking of cookies by being in control of the privacy settings. Furthermore, no consent shall be required for “non-privacy intrusive cookies”. The e-PR provides protection against any form of unsolicited electronic communications including spam.

How will e-PR change compliance requirements for online businesses in the European Union?