European Commission announces proposal e-Privacy legislation

The European Commission (Commission) is proposing new legislation to ensure stronger privacy in electronic communications. Also, the Commission is updating current rules, extending their scope to all electronic communication providers. They also aim to create new possibilities to process communication data and reinforce trust and security in the Digital Single Market, one of the top priorities from the Commission. The proposal to update the rules for electronic communication align with the new General Data Protection Regulation. Question is whether overregulation is occurring with this new set of European privacy legislation.

The e-Privacy proposal

According to the press release from the Commission, the proposed Regulation on Privacy and Electronic Communications should increase the protection of people’s private life and open up new opportunities for business:

The following aspects are taken into account:

  • New players: 92% of Europeans say it is important that their emails and online messages remain confidential. However, the current ePrivacy Directive only applies to traditional telecoms operators. Privacy rules will now also cover new providers of electronic communications services, such as WhatsApp, Facebook Messenger, Skype, Gmail, iMessage, or Viber.
  • Stronger rules: By updating the current Directive with a directly applicable Regulation, all people and businesses in the EU will enjoy the same level of protection for their electronic communications.Businesses will also benefit from one single set of rules across the EU.
  • Communications content and metadata: Privacy will be guaranteed for both content and metadata derived from electronic communications (e.g. time of a call and location). Both have a high privacy component and, under the proposed rules, will need to be anonymised or deleted if users have not given their consent, unless the data is required for instance for billing purposes.
  • New business opportunities: Once consent is given for communications data, both content and/or metadata, to be processed, traditional telecoms operators will have more opportunities to use data and provide additional services. For example, they could produce heat maps indicating the presence of individuals to help public authorities and transport companies when developing new infrastructure projects.
  • Simpler rules on cookies: The so-called "cookie provision", which has resulted in an overload of consent requests for internet users, will be streamlined. New rules will allow users to be more in control of their settings, providing an easy way to accept or refuse the tracking of cookies and other identifiers in case of privacy risks. The proposal clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history). Cookies set by a visited website counting the number of visitors to that website will no longer require consent.
  • Protection against spam: Today's proposal bans unsolicited electronic communication by any means, e.g. by emails, SMS and in principle also by phone calls if users have not given their consent. Member States may opt for a solution that gives consumers the right to object to the reception of voice-to-voice marketing calls, for example by registering their number on a do-not-call list. Marketing callers will need to display their phone number or use a special pre-fix that indicates a marketing call.
  • More effective enforcement: The enforcement of the confidentiality rules in the Regulation will be the responsibility of national data protection authorities.

More legislation

Apart from the new e-Privacy proposal, the Commission announced another Regulation that sets rules for data protection for European institutions and bodies. These rules for European institutions and bodies should align existing rules, dating back from 2001, with the newer and more stringent rules set out by the General Data Protection Regulation from 2016. Anyone whose personal data is processed by European institutions is set to benefit from these higher standards of protection.

At last, the Commission released an announcement in which a strategic approach to the issue of international personal data transfers is set out. Law enforcement services and undertakings have to collaborate faster without diminishing the level of data protection. The Commission states that it will proactively engage in discussions on reaching “adequacy decisions” (allowing for the free flow of personal data to countries with “essentially equivalent” data protection rules to those in the European Union) with key trading partners in East and South-East Asia, starting with Japan and Korea in 2017, but also with interested countries of Latin America and the European neighborhood.

In addition, the Commission will make full use of other mechanisms provided by the new EU data protection rules (the General Data Protection Regulation and Police Directive) to facilitate the exchange of personal data with other third countries with which adequacy decisions cannot be reached.

The Commission also reiterates that the Commission will continue to promote the development of high data protection standards internationally, both at bilateral and multilateral levels. One could think of the Privacy Shield (that is subject to discussion).

Next steps

The Commission is calling on the European Parliament and the Council to work swiftly and to ensure their smooth adoption by May 25th, 2018, when the General Data Protection Regulation will enter into application. The intention is to provide citizens and undertakings with a fully-fledged and complete legal framework for data protection in Europe.

Besides the General Data Protection Regulation (and its implementation, which we reported earlier), additional European privacy legislation will have to be taken into account starting May 2018 and may be applicable to your business too.