Will the ePrivacy Reg overshadow the GDPR in the age of IoT?

The ePrivacy draft regulation, published by the European Commission on Jan. 10, updates and upgrades Directive 2002/58/EC (the “ePrivacy directive”), the source of the infamous “cookies banner.” Under its official name – Proposal for a Regulation Concerning the Respect for Private Life and the Protection of Personal Data in Electronic Communications, the draft ePrivacy regulation reorganizes and even re-conceptualizes the system of protecting the privacy of electronic communications.

Armed with equally large fines and equally wide territorial application, the future ePrivacy rules may end up overshadowing the GDPR in the age of the internet of things due to their wide material scope of application which could potentially cover all data related to connected devices.

Protecting the fundamental right to confidentiality

With the proposal for an ePrivacy regulation distinct from the GDPR, the EU makes it clear that the two sets of rules correspond to different fundamental rights: The GDPR is primarily an expression of the fundamental right to the protection of personal data as enshrined in Article 8 of the EU Charter of Fundamental Rights, while the ePrivacy draft regulation details the right to respect for private life, as enshrined in Article 7 of the Charter (see Recital 1 of the proposal).

This differentiation is of great consequence, affecting the manner in which EU courts will interpret and apply the rules. The protection of the right to private life is construed so as to restrict interferences to the private life to the minimum, whereas the right to the protection of personal data is construed so as to provide for “rules of the road” on how personal data must be used.

A telling example of ePrivacy rules intended to protect private life is the reference in the draft to the fact that “terminal equipment of end-users of electronic communications networks and any information relating to the usage of such terminal equipment … are part of the private sphere of the end-users requiring protection under the Charter of Fundamental Rights of the EU and the European Convention of Human Rights” (emphasis added). (Recital 20)

In addition, many member states (e.g., Germany, Italy, Netherlands, Greece, Romania, Denmark, Belgium, Poland, Estonia, Bulgaria, Czech Republic) provide in their Constitutions for a separate right to the “secret of correspondence” (distinct from the right to respect for private life), which can be restricted under limited situations and usually only for objectives of public safety. The rules of the proposal fall under the scope of this particular right, being thus capable of igniting national constitutional reviews – for instance, concerning the rules that allow access to content of communications.

Electronic communications data and information on smart devices, the centerpiece of the ePrivacy framework

The new system of protecting the confidentiality of communications is built around two concepts:

  • “Electronic communications data,” which includes electronic communications content and electronic communications metadata; and
  • “Information related to the terminal equipment of end-users.”

Article 2(1) of the proposal establishes that the regulation “applies to processing of electronic communications data carried out in connection with the provision and the use of electronic communications services and to information related to the terminal equipment of end-users. 

This represents an important change compared to the current regime of the ePrivacy directive, which is centered on processing personal data (see Article 3(1) of Directive 2002/58). For the new rules to be applicable, it will not matter whether the data going through electronic communications channels fall under the GDPR definition of personal data or not. Recital 4 of the proposal explains that “electronic communications data may include personal data as defined in [the GDPR],” meaning they may also not include personal data.

ECC is defined as “the content exchanged by means of electronic communications services, such as text, voice, videos, images and sound.” The definition of ECM is more complex and it refers to data processed “in an electronic communications network for the purposes of transmitting, distributing or exchanging electronic communications content,” giving examples such as location data or data used to trace the source or destination of the communication.

By “information related to the terminal equipment of end-users” the future ePrivacy framework could refer to all metadata related to and all data going through smart devices and other terminal equipment. This concept is not specifically defined in the draft, which only refers to the definition of "terminal equipment" under Directive 2008/63/EC on competition in the markets in telecommunications terminal equipment.

According to Article 1(1) of this Directive, a terminal equipment is equipment “directly or indirectly connected to the interface of a public telecommunications network to send, process or receive information; in either case (direct or indirect), the connection may be made by wire, optical fibre or electromagnetically.” It is thus probable that the definition covers PCs, tablets, smartphones, smart cars, smart TVs and all other smart devices connected to the internet – and therefore that the ePrivacy rules are intended to apply to information “related” to these devices including  metadata.

Areas of interaction with the GDPR

Whenever ECD and information related to terminal equipment qualify as personal data, their processing is also covered by the GDPR. In this case, the question of which of the two laws will apply arises. According to Article 1(3) of the proposal, the ePrivacy draft regulation “particularizes and complements” the GDPR. Therefore, the GDPR applies as the general rule, by default, and the ePrivacy Regulation will be lex specialis, according to the explanatory memorandum accompanying the proposal (See Section 1.2. of the Explanatory Memorandum, p. 2). This means that when the two regulations enshrine rules for the same situation, the ePrivacy rules should prevail. However, as specified in Recital 5 of the draft, the ePrivacy Regulation should not lower the level of protection enjoyed by natural persons under the GDPR.

The areas where the two laws regulate the same situation will not be obvious until applied in practice. Nevertheless, there are some aspects that could already raise questions, such as the lawful grounds for processing, the principles of purpose limitation, the obligations related to data protection by design and the rules on liability (for instance, the GDPR specifically provides for the possibility of data subjects to engage in class-actions, whereas the ePrivacy draft doesn’t enshrine such a possibility).

Lawful grounds for processing 

One of the most important questions to be looked into is the interaction between the lawful grounds for processing under the GDPR and under the proposed ePrivacy rules. Is this an area where the ePrivacy regulation "complements" the GDPR, by adding to the legal grounds of processing personal data that are also ECD, or is it an area where the ePrivacy regulation "particularizes" the GDPR, derogating thus from its rules as lex specialis whenever personal data is ECD? The answer comes from Recital 5 of the draft, according to which processing of ECD "by providers of electronic communications services should only be permitted in accordance with this Regulation."

This means that in all cases where ECD qualifies as personal data and the electronic service providers qualify as data controllers of that data (fulfilling this condition will not always be obvious), the ePrivacy lawful grounds for processing will apply instead of the GDPR grounds pursuant to its Article 6. 

Adding to the complexity of this matter, the ePrivacy draft enshrines two different sets of rules for lawful grounds of processing data – Article 6, directed towards all processing of ECD by "providers of electronic communications networks" and Article 8, directed towards the use by anyone other than by the end-user of "information stored in and related to end-users’ terminal equipment."

This initial analysis is based on the proposal for the ePrivacy regulation and should be considered as such. Nevertheless, it seems indeed that the future set of ePrivacy rules goes far beyond regulating "cookies" and that it may have a comparable impact to that of the GDPR. The debates are just in their initial stage. The European Commission aims to have the ePrivacy regulation adopted and ready to be applicable May 25, 2018 – the same day as the GDPR. This is a very tight deadline, and meeting it will be a challenge. According to the information available on the Legislative Observatory of the European Parliament, a rapporteur for the European Parliament has not yet been appointed for this file, which will be referred to the LIBE committee.

photo credit: DesignRecipe European Union Flags 2 via photopin (license)

Written By

Gabriela Zanfir-Fortuna


If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find a KnowledgeNet Chapter Near You

Talk privacy and network with local members at IAPP KnowledgeNet Chapter meetings, taking place worldwide.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

The Privacy Core™ Library Has Evolved

Privacy Core™ e-learning essentials just expanded to include seven new units for marketers. Keep your data safe and your staff in the know!

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

Upcoming Web Conferences

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Team

Get your team up to speed on privacy by bringing IAPP training to your organization.

Let’s Get You DPO Ready

There’s no better time to train than right now! We have all the resources you need to meet the challenges of the GDPR.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

FIP Designation

Recognizing the advanced knowledge and issue-spotting skills a privacy pro must attain in today’s complex world of data privacy.

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.


The IAPP’S CIPP/E and CIPM are the ANSI/ISO-accredited, industry-recognized combination for DPO readiness. Learn more today.

Learn more about IAPP certification »

IAPP-OneTrust Website Scanning & Cookie Compliance Tool

Scan your website for cookies, tags, forms and policies and create a custom, dynamically updated cookie policy based on the results of your scans.

Are You Ready for the GDPR?

Check out the IAPP's EU Data Protection Reform page for all the tools and resources you need.

Privacy Vendor List

Find a privacy vendor to meet your needs with our filterable list of global service providers.

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

More Resources »

Global Privacy Summit 2017

The world’s premier privacy conference returns with the sharpest minds and unparalleled programs—plus a whole new spin on Active Learning!

Canada Privacy Symposium 2017

The Symposium returns to Toronto! Take advantage of Early Bird rates before March 31 and join your fellow privacy pros for a stellar program.

The Privacy Bar Section Forum 2017

The Privacy Bar Section Forum is SOLD OUT and the wait list is closed. If you got on the wait list, we'll keep in touch about your status. Good luck!

Asia Privacy Forum 2017

Join us in Singapore for exclusive networking and intensive education on data protection trends and challenges in the Asia Pacific region.

Privacy. Security. Risk. 2017

We're bringing the best of the best in privacy and infosecurity to sunny San Diego. Early registration for P.S.R. opens in May.

Europe Data Protection Congress 2017

Your source for European policy debate, multi-level strategic thinking and thought-provoking discussion. Registration opens in early June.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»