European Commission: Consultation on the evaluation and review of the e-Privacy Directive

IRIS 2016-6:1/4

Svetlana Yakovleva

Institute for Information Law (IViR), University of Amsterdam & De Brauw, Blackstone, Westbroek

On 12 April 2016, the European Commission launched a Public Consultation on the evaluation and review of the e-Privacy Directive (Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector, see IRIS 2002-7/10). The consultation is addressed to all relevant stakeholders from the civil society, business and public sectors.

The purpose of the consultation is twofold. Section I aims to retrospectively assess the functioning of the e-Privacy Directive, which is necessary for the review announced by the European Commission in the Digital Single Market Strategy for Europe (see IRIS 2015-6/3). Section II is aimed to produce a forward-looking assessment of possible improvements to the Directive.

Section I of the consultation corresponds to the so-called Regulatory Fitness and Performance Programme (REFIT) evaluation, and addresses the effectiveness, relevance, coherence, efficiency and “EU added-value” of the e-Privacy Directive. In particular, the stakeholders have to evaluate whether the Directive has been effective in achieving its objectives and whether these are still relevant given the new technological, social and legal developments. The focus is on the necessity and added value of the Directive’s sector-specific provisions in light of the new General Data Protection Regulation (GDPR). The questionnaire also aims to assess whether the existing rules fit with each other and whether they are coherent with other legal instruments, such as the Framework Directive, the GDPR, the Radio Equipment Directive, and the upcoming Network and Information Security Directive. A number of questions concern the efficiency of the Directive’s national implementation in regard to its contribution to the users’ trust in the protection of their privacy online and the additional costs to businesses.

The questions comprising Section II of the consultation correspond to five categories of potential improvements to the Directive. Among the most relevant is, first of all, the broadening of the Directive’s scope to include the so-called ‘over-the-top’ service providers. Although these providers render information society services functionally equivalent to the electronic communications services (such as voice over IP, instant messaging, webmail, and location services), unlike the electronic communications services providers they are currently not covered by the e-Privacy Directive. Second, the relative majority of questions are devoted to additional policy measures ensuring security and confidentiality of communications. Such measures, for example, include the securing users’ passwords, use of encryption apps, extension of security requirements to certain types of software, Internet of Things devices or network components (such as SIM cards), the so-called “cookie walls”, and consent to storage of or access to the information on users’ smart devices. Furthermore, attention is also drawn to the problems of unsolicited commercial communications and inconsistent enforcement and fragmentation.

The consultation also provides a possibility to identify any other issues that the stakeholders deem necessary and allows them to upload quantitative data reports or studies to support their views.

The consultation will run until 5 July 2016. The European Commission will then summarise the answers received in a report which it will publish on the website of the Directorate General for Communications Networks, Content and Technology one month after the consultation closes. The report will be used to draft a new legislative proposal on the e-Privacy Directive, expected by the end of 2016.