June 15, 2020

The Commission adopted the proposal for a Regulation on Privacy and Electronic Communications on 10 January 2017 with the aim to replace the current E-Privacy Directive (2002/58/EC). The European Parliament Committee on Civil Liberties, Justice and Home Affairs adopted its report on 19 October 2017, which was confirmed by a plenary vote on 26 October 2017.

The Council Working Party on Telecommunications and Information Society (WP TELE) has examined the proposals on a number of occasions, the latest being on 7 June 2019. At the Permanent Representatives Committee (COREPER) meeting held on 27 November 2019 Member States were unable to reach a general approach on the proposed text. The Finnish Presidency presented a progress report to the Transport Telecommunications and Energy Council on 3 December 2019.

Following further discussions, the Croatian Presidency decided that further work could not continue on the basis of the existing version of the text and that substantial changes were necessary. The Presidency therefore proposed a number of revisions to simplify the text of some of the core provisions and to further align them with the GDPR.

The most important modification made is the possibility of allowing the processing of electronic communications metadata (Article 6b) and using processing and storage capabilities of terminal equipment and the collection of information from end-users’ terminals (Article 8) when it is necessary for the purpose of “legitimate interests”. In order to provide a balanced solution, the Presidency has also proposed a number of safeguards, namely:

• a prohibition on sharing the metadata or the collected information with third parties, unless they are anonymised;
• the need to carry out an impact assessment and, where appropriate, consult a supervisory authority;
• an obligation to inform end-users of the envisaged processing operations and to provide them with the right to object;
• an obligation to provide adequate technical and organisational measures, such as pseudonymisation or anonymization.

Further, the text provides that providers cannot use the “legitimate interests” ground when it is overridden by interests or fundamental rights and freedoms of end-users (for instance if the data or information are used to determine the nature or characteristics or the end-user or to build an individual profile of the end-user). The proposed text also provides for certain presumptions for when this would be the case.

The Presidency has also deleted a number of other processing grounds in Articles 6b, 6c and 8, which would have been covered by “legitimate interests”. Accompanying recitals provide examples of situations where the “legitimate interests” ground can be relied upon.

Other modifications introduced by the Presidency are aimed mainly at clarifying the text, in particular, in the preamble, including on the processing of electronic communications data by end-users after receipt, including when this is carried out by third parties (Recital 8aa). Other clarifications concern the extent to which the proposed Regulation would apply to Machine-to-Machine or Internet of Things services (Recital 12). Finally, the Presidency also tried to streamline the text by reshuffling and regrouping text parts in the preamble, without changing the substance.

The Presidency says that Member States’ reactions to the modifications, in particular to the introduction of the “legitimate interests” ground, were “rather mixed”. Some would prefer not to include this new ground and would prefer to revert to the previous text with a closed list of permitted processing grounds. Others were positive about trying to align the text with the GDPR, but warned about the need to keep the right balance between the rights and interests of end-users and those of providers. Some supported going even further. Some also proposed re-introducing some of the deleted processing grounds as they are not convinced that those would be adequately covered by “legitimate interests”, taking into account all the safeguards that would need to be applied. Some asked for more clarity when it comes to information society services financed through advertising.

Subsequent deliberations on the proposals in WP TELE were rendered impossible by the outbreak of the COVID-19 pandemic. In addition, it was clear from Member States’ reactions that further work is needed. The Croatian Presidency says that it is committed to work closely with the incoming German Presidency in June to facilitate further discussions. To read the progress report in full, click here.