In this recent preliminary ruling, the ECJ held that telecommunication providers based in one Member State may be required by law to provide their subscribers’ data to companies that provide directories and directory enquiry services, but are based in another Member State. According to the ECJ, this is in accordance with the EU’s objective to ensure the availability of good quality services through effective competition and choice throughout the EU. This ruling also discusses the principle of non-discrimination as well as consent. For our readers who would like to learn more about this ruling, a more thorough summary has been provided below:
The European Directory Assistance NV (EDA) is an undertaking that offers directory enquiry services and is incorporated under Belgian law. The EDA requested Tele2 (Netherlands) BV, Ziggo BV and Vodafone Libertel BV, all three undertakings incorporated under the laws of the Netherlands and who provide subscribers with telephone numbers (the Dutch undertakings), to provide EDA with data relating to their subscribers. The Dutch undertakings refused to provide the requested data.
On 18 January 2012, EDA submitted a dispute resolution request to the Autoriteit Consument en Markt (the ACM) (Authority for Consumers and Markets). By its decision of 5 June 2013, the ACM ruled that on grounds of the Besluit universele dienstverlening en eindgebruikersbelangen (Decree on universal service provision and end-user interests) (the Bude), EDA should be granted the requested data. The Bude provides that companies that assign telephone numbers have to meet all reasonable requests to provide the relevant information necessary for directories, and that it shall do so on fair and non-discriminatory terms. It also provides that the companies that assign telephone numbers have to obtain consent from its subscribers, and that this consent is implied when these companies provide the requested relevant information to a third party for directory purposes.
Following this decision of the ACM, the Dutch undertakings brought an action before the College van Beroep voor het bedrijfsleven (Administrative Court of Appeal for Trade and Industry) and asked whether the above reasoning also applies across EU Member States. To this respect, the Court pointed out that since art. 25(2) of the Universal Service Directive (Directive), which concerns the processing of personal data and the protection of privacy in the telecommunications sector (Directive 2002/22/EC), is transposed into the Bude, the scope and the purpose of art. 25(2) of the Directive requires to be determined in order to address the question. In light of this determination to be made, the Court referred to the ECJ for a preliminary ruling.
On March 17, 2017, the ECJ held that in accordance with art.25(2) of the Directive, telecommunication providers based in one Member State may be required by law to provide their subscribers’ data to companies that provide directories and directory enquiry services, but are based in another Member State.
The ECJ considered that the provision concerns all reasonable requests for the purpose of publicly available directory enquiry services, and that the relevant information should therefore be provided in a non-discriminatory manner. It points out that no distinction is made with regard to whether the request comes from the same Member State as the Member State where the receiver of the request is based. According to the ECJ, this is in accordance with the objective pursued by this Directive, which is to ensure the availability of good quality publicly available services through effective competition and choice throughout the European Union.
With regard to the question relating to the subject of renewed consent, the ECJ held that if the subscriber has been informed by the undertaking that assigned the telephone number of the possibility that their personal data might be passed on to a third-party, and that there telephone number might be published in a public directory, and that if the subscriber consented to this publication, then renewed consent is not required for the passing of the same data to another third-party undertaking, provided it is for the same purpose. In other words, the purpose of the first publication of the subscriber’s personal data to which the subscriber gave its consent is decisive for the purposes of determining the scope of that consent.
In addition to answering the two questions, the ECJ pointed out that telecommunication companies within the European Union operate within a highly harmonized regulatory framework. According to the ECJ, this makes it possible to ensure that the same respect of requirements relating to the protection of subscribers’ personal data is safeguarded throughout the Union.
This judgment is particularly interesting from a data protection perspective as it touches upon the question of how to balance respect for the principle of non-discrimination on one hand, and privacy on the other, particularly within the context of EU Competition Law. Whilst competition provisions of the EU Treaties were more reflected in the GDPR's predecessor, the EU Data Protection Directive (Directive 95/46/EC), the GDPR does retain the objective of ensuring free movement of personal data within the European Union. This can for example be found in art. 20, which provides for the right to data portability. Whether it assigns enough weight to the objective of effective competition and choice throughout the EU in the eyes of the EU Commission remains to be seen. We do know however that the EU Commission places immense importance upon EU Competition Law, taking into account the various cases it is currently pursuing for example, including three against Google. In light of the case at subject, it will be interesting to see what implications the GDPR will have when courts are faced with the choice of law.