The ePrivacy draft regulation, published by the European Commission on Jan. 10, updates and upgrades Directive 2002/58/EC (the “ePrivacy directive”), the source of the infamous “cookies banner.” Under its official name – Proposal for a Regulation Concerning the Respect for Private Life and the Protection of Personal Data in Electronic Communications, the draft ePrivacy regulation reorganizes and even re-conceptualizes the system of protecting the privacy of electronic communications.

Armed with equally large fines and equally wide territorial application, the future ePrivacy rules may end up overshadowing the GDPR in the age of the internet of things due to their wide material scope of application which could potentially cover all data related to connected devices.

Protecting the fundamental right to confidentiality

With the proposal for an ePrivacy regulation distinct from the GDPR, the EU makes it clear that the two sets of rules correspond to different fundamental rights: The GDPR is primarily an expression of the fundamental right to the protection of personal data as enshrined in Article 8 of the EU Charter of Fundamental Rights, while the ePrivacy draft regulation details the right to respect for private life, as enshrined in Article 7 of the Charter (see Recital 1 of the proposal).

This differentiation is of great consequence, affecting the manner in which EU courts will interpret and apply the rules. The protection of the right to private life is construed so as to restrict interferences to the private life to the minimum, whereas the right to the protection of personal data is construed so as to provide for “rules of the road” on how personal data must be used.

A telling example of ePrivacy rules intended to protect private life is the reference in the draft to the fact that “terminal equipment of end-users of electronic communications networks and any information relating to the usage of such terminal equipment … are part of the private sphere of the end-users requiring protection under the Charter of Fundamental Rights of the EU and the European Convention of Human Rights” (emphasis added). (Recital 20)

In addition, many member states (e.g., Germany, Italy, Netherlands, Greece, Romania, Denmark, Belgium, Poland, Estonia, Bulgaria, Czech Republic) provide in their Constitutions for a separate right to the “secret of correspondence” (distinct from the right to respect for private life), which can be restricted under limited situations and usually only for objectives of public safety. The rules of the proposal fall under the scope of this particular right, being thus capable of igniting national constitutional reviews – for instance, concerning the rules that allow access to content of communications.

Electronic communications data and information on smart devices, the centerpiece of the ePrivacy framework

The new system of protecting the confidentiality of communications is built around two concepts:

• “Electronic communications data,” which includes electronic communications content and electronic communications metadata; and
• “Information related to the terminal equipment of end-users.”

Article 2(1) of the proposal establishes that the regulation “applies to processing of electronic communications data carried out in connection with the provision and the use of electronic communications services and to information related to the terminal equipment of end-users. 

This represents an important change compared to the current regime of the ePrivacy directive, which is centered on processing personal data (see Article 3(1) of Directive 2002/58). For the new rules to be applicable, it will not matter whether the data going through electronic communications channels fall under the GDPR definition of personal data or not. Recital 4 of the proposal explains that “electronic communications data may include personal data as defined in [the GDPR],” meaning they may also not include personal data.

ECC is defined as “the content exchanged by means of electronic communications services, such as text, voice, videos, images and sound.” The definition of ECM is more complex and it refers to data processed “in an electronic communications network for the purposes of transmitting, distributing or exchanging electronic communications content,” giving examples such as location data or data used to trace the source or destination of the communication.

By “information related to the terminal equipment of end-users” the future ePrivacy framework could refer to all metadata related to and all data going through smart devices and other terminal equipment. This concept is not specifically defined in the draft, which only refers to the definition of "terminal equipment" under Directive 2008/63/EC on competition in the markets in telecommunications terminal equipment.

According to Article 1(1) of this Directive, a terminal equipment is equipment “directly or indirectly connected to the interface of a public telecommunications network to send, process or receive information; in either case (direct or indirect), the connection may be made by wire, optical fibre or electromagnetically.” It is thus probable that the definition covers PCs, tablets, smartphones, smart cars, smart TVs and all other smart devices connected to the internet – and therefore that the ePrivacy rules are intended to apply to information “related” to these devices including  metadata.

Areas of interaction with the GDPR

Whenever ECD and information related to terminal equipment qualify as personal data, their processing is also covered by the GDPR. In this case, the question of which of the two laws will apply arises. According to Article 1(3) of the proposal, the ePrivacy draft regulation “particularizes and complements” the GDPR. Therefore, the GDPR applies as the general rule, by default, and the ePrivacy Regulation will be lex specialis, according to the explanatory memorandum accompanying the proposal (See Section 1.2. of the Explanatory Memorandum, p. 2). This means that when the two regulations enshrine rules for the same situation, the ePrivacy rules should prevail. However, as specified in Recital 5 of the draft, the ePrivacy Regulation should not lower the level of protection enjoyed by natural persons under the GDPR.

The areas where the two laws regulate the same situation will not be obvious until applied in practice. Nevertheless, there are some aspects that could already raise questions, such as the lawful grounds for processing, the principles of purpose limitation, the obligations related to data protection by design and the rules on liability (for instance, the GDPR specifically provides for the possibility of data subjects to engage in class-actions, whereas the ePrivacy draft doesn’t enshrine such a possibility).

Lawful grounds for processing 

One of the most important questions to be looked into is the interaction between the lawful grounds for processing under the GDPR and under the proposed ePrivacy rules. Is this an area where the ePrivacy regulation "complements" the GDPR, by adding to the legal grounds of processing personal data that are also ECD, or is it an area where the ePrivacy regulation "particularizes" the GDPR, derogating thus from its rules as lex specialis whenever personal data is ECD? The answer comes from Recital 5 of the draft, according to which processing of ECD "by providers of electronic communications services should only be permitted in accordance with this Regulation."

This means that in all cases where ECD qualifies as personal data and the electronic service providers qualify as data controllers of that data (fulfilling this condition will not always be obvious), the ePrivacy lawful grounds for processing will apply instead of the GDPR grounds pursuant to its Article 6. 

Adding to the complexity of this matter, the ePrivacy draft enshrines two different sets of rules for lawful grounds of processing data – Article 6, directed towards all processing of ECD by "providers of electronic communications networks" and Article 8, directed towards the use by anyone other than by the end-user of "information stored in and related to end-users’ terminal equipment."

This initial analysis is based on the proposal for the ePrivacy regulation and should be considered as such. Nevertheless, it seems indeed that the future set of ePrivacy rules goes far beyond regulating "cookies" and that it may have a comparable impact to that of the GDPR. The debates are just in their initial stage. The European Commission aims to have the ePrivacy regulation adopted and ready to be applicable May 25, 2018 – the same day as the GDPR. This is a very tight deadline, and meeting it will be a challenge. According to the information available on the Legislative Observatory of the European Parliament, a rapporteur for the European Parliament has not yet been appointed for this file, which will be referred to the LIBE committee.

photo credit: DesignRecipe European Union Flags 2 via photopin (license)