This week, the Permanent Representatives Committee of the Council of the European Union once again rejected the latest draft of the ePrivacy Regulation.  

The Nov. 22 vote means that the member states still cannot agree on a common position. Despite the best efforts of the current Finnish Presidency, it's back to the drawing board again in the new year under the Croatian Presidency as the window of opportunity for agreeing on a general approach at the Transport, Telecommunications and Energy Council meeting Dec. 3 has now closed.

The council has been seeking better alignment of the proposed ePrivacy Regulation with the EU General Data Protection Regulation and to find solutions on many open questions. After two-and-a-half years of negotiations, it remains uncertain whether a common approach can be reached at all.

Under the Finnish Presidency (which took office July 1 this year), the Working Party on Telecommunications and Information Society examined the proposals on no fewer than 10 occasions, and the presidency issued multiple compromise texts.

The ePrivacy Regulation was proposed by the European Commission nearly three years ago in January 2017. The European Parliament agreed its negotiating position Oct. 26, 2017. Other bodies, such as the European Data Protection Supervisor and European Economic and Social Committee, published their opinions as early as April and July of the same year.

But the discussions in WP TELE between the different member states were fraught with difficulty from the beginning and, according to the Finnish Presidency, “revealed different views and priorities among member states on several aspects of the proposal.”

The most recent draft of the text also outlined the major stumbling blocks during the second half of 2019.

The biggest issue was the processing of electronic communications data for the purposes of prevention of child abuse imagery. “While there was support for addressing this issue at the EU level, delegations had diverging views on whether and how to do so in the ePrivacy proposal.” A number of delegations argued that if preventing child abuse imagery should warrant an exemption, so should other serious crimes.

Elsewhere, with regard to the protection of terminal equipment information (Article 8), the discussions evolved mainly around “the issue of conditional access to website content” (so called “cookie walls”) and “the need not to undermine existing business models,” explained the presidency.

This is relevant as the Parliament position differs vastly from the council in this area, meaning that the three-way trialogue talks will be difficult even if the council eventually manages to agree.

Processing of electronic communications data by third parties was also a major headache for the working party, and the latest draft included recital text clarifying the concept of third parties.

The presidency proposed a change on the processing of electronic communications data by the providers of electronic communications networks and services that would allow such processing when necessary to provide electronic communications service.

“The advantage of this solution is that the term ‘electronic communications service’ is clearly defined in the Electronic Communications Code and, at the same time, could be considered to be more flexible ground for processing compared to the mere transmission of the communication. It could also cover storage of the messages if necessary for the service,” explained the presidency.

Delegations also repeatedly underlined that the ePrivacy Regulation should not negatively impact any potential solution that may eventually be found on data retention.

A number of delegations also raised concerns about the cooperation among various enforcement authorities, in particular between data protection authorities and national regulatory authorities, as well as the role and involvement of the European Data Protection Board. The presidency proposed including an obligation for the EDPB to consult supervisory authorities other than DPAs before exercising its tasks under the ePrivacy Regulation.

Despite all these revisions, clarifications and compromises, the final draft of the text was not deemed acceptable by all.

Diego Naranjo, head of policy at European Digital Rights, was critical.

“By first watering down the text and now halting the ePrivacy Regulation, the council takes a stance to protect the interests of online tracking advertisers and to ensure the dominance of big tech. In this era of disinformation and privacy scandals, refusing to ensure strong privacy protections in the ePrivacy Regulation is a step backward for the EU," Naranjo said. "We hope the European Commission will stand on the side of citizens by defending the proposal and asking the council to ensure a strong revised text soon in 2020.”

Estelle Massé, senior policy analyst at Access Now, said the rejection “should not be a signal that the reform cannot happen. Instead, it should be a signal that states must go back to the negotiating table and deliver what was promised to EU citizens: stronger privacy protections.”

But Cecilia Bonefeld-Dahl, director general of DIGITALEUROPE, called on the new European Commission “to fundamentally reassess the nature and format of the ePrivacy proposal.

“We cannot afford to endanger our digital transformation due to uncertain and inflexible rules. We applaud the Finnish Presidency for its earnest attempt to unlock the ePrivacy file. But after three years without agreement in council, it is now time to recognize that a fresh start is needed,” Bonefeld-Dahl said.

Recently, DIGITALEUROPE published a report by HoganLovells “describing some of the key stumbling blocks of the current text.” The study argues that a revised text should instead move toward a risk-based approach that looks at proportionality and accountability.

Meanwhile the voice of Europe’s telecom and cable operators, represented by ETNO, the GSMA and Cable Europe, praised “the incremental improvement of the rules governing the processing of metadata” but said that “several outstanding issues remain unresolved.” In particular, “the articulation between the proposed ePrivacy Regulation and the GDPR; the lack of a level playing field for all digital players and of a coherent protection framework for citizens, and the need for future-proof rules that make Europe fit for the digital age in line with the incoming commission’s strategic objective.”

It is rare for an update of existing EU legislation to fail so spectacularly, and with the new European Commission yet to take up its seat — now expected to happen Dec. 1 — it’s unclear what new paths may be taken to deliver the desired result: an electronic communications law that is fit for purpose for the coming years.

Photo by chuttersnap on Unsplash