Things move fast in the world of privacy and data protection. Recently, the collective group of EU data protection authorities, the Article 29 Working Party (“WP29”), has been particularly active. In addition to publishing guidelines and launching consultations regarding the General Data Protection Regulation (“GDPR”), WP29 also released its views on the proposed ePrivacy law reforms, which legislators are aiming to coincide with the commencement of the GDPR. We examine the views of WP29.
What is the ePrivacy Directive?
In July 2016, following a public review and consultation carried out by the European Commission, WP29 issued an opinion on the reform of the Directive. In January 2017, the European Commission proposed a new law to regulate ePrivacy issues (the “Proposed Regulation”). This Proposed Regulation is intended to replace the Directive, and will overhaul the laws relating to electronic communications, direct marketing, cookies and other issues. One of the biggest changes will be the extension of the rules relating to confidentiality of communications to so-called ‘over-the-top’ service providers: online messaging providers who are not regulated under the existing ePrivacy Directive. Changes to align enforcement with the GDPR are also proposed.
In April 2017, WP29 issued an opinion on the Proposed Regulation. WP29 welcomed aspects of the Proposed Regulation, including the expansion to regulate ‘over-the-top’ service providers and the alignment of enforcement responsibilities with the GDPR.
In addition, WP29 is advocating a stricter standard for the tracking of the location of terminal equipment, such as smartphones and tablets. It states that the level of protection in the Proposed Regulation is lower than that in the GDPR, and it advocates the adoption of primarily consent-based approach. In relation to direct marketing, WP29 has expressed concern that the scope of direct marketing is too limited. WP29 wants the definition to be extended to all advertising sent, directed or presented to users. This could have a notable impact on the online advertising market.
What is expected next?
The proposed Regulation is not yet in its final form. There are two further rounds of legislative scrutiny due, as the European Parliament and Council will also have an opportunity to amend the legislation. If there is disagreement between the three bodies as to the final draft of the legislation, there may be a trilogue, a three way negotiation over the final text, as was needed to finalise the GDPR. As the legislative procedure moves forward, we may see some changes on foot of the WP29 recommendations.
For online operators, the Proposed Regulation is as significant as the GDPR due to the impact on potential advertising revenue. We should hope for a thorough debate as the legislation progresses to finalisation.