Council of the European Union: Agreement on Amended Data Protection Draft

IRIS 2002-1:1/7

Ot van Daalen

De Brauw Blackstone Westbroek The Hague

On 6 December 2001, the Council of EU Telecoms Ministers agreed on a common position regarding the draft Directive concerning the processing of personal data and the protection of privacy in the electronic communications sector. The agreement differs on several points from the proposal adopted by the European Parliament, and the draft Directive will be given a second reading.

Compared to the position adopted by the European Parliament, the Council takes a more moderate approach towards information-gathering, including the use of cookies. Cookies are devices used by Internet browsers to track, authenticate and gather information about clients. Member States shall ensure that the user is clearly informed about the use of cookies and is offered the right to refuse processing by virtue of art. 5.3 ("opt-out"). On its first reading of the draft Directive on 13 November 2001, the European Parliament obliged Member States in art. 5.2a to prohibit the use of cookies without the explicit consent of the user ("opt-in"). Both provided an exception for technical uses. It is not sure if all parties will come to an agreement on this subject. Industrial stakeholders state that an opt-in solution would hamper e-commerce development, as cookies are an essential part of online businesses.

On the other hand, the agreement leaves less room for Member States to permit unwanted commercial e-mail ("spam"). The proposed wording as agreed on by the Parliament would leave Member States the freedom to choose between an opt-in and an opt-out solution (art. 13.2). The Council adopted this part, but added a paragraph explicitly prohibiting unsolicited e-mail where the identity of the sender is concealed (art. 13.4).