Law and Internet Foundation has shared their Opinion on the proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (ePrivacy Regulation), written in August 2018.

The proposed ePrivacy Regulation will regulate the confidentiality of electronic communication. LIF experts find that certain aspects of the ePR need to be revised and simplified, concepts clarified and further examined or even removed in order to strike the right balance and ensure both – the much needed protection of the fundamental rights and freedom of individuals, and set a framework which will allow Europe to be at the forefront of technology development in the e-communications sector, including artificial intelligence, machine learning and other forms of innovation. Simplification of the text would also be warranted as the European Economic and Social Committee states in its opening remarks.

The opinion contains the view of LIF’s experts on the main problems identified by them:

The confidentiality principle – The ePR proposal has some flaws in the concept of the confidentiality of communications principle and the exceptions to it, which could be tackled in a more balanced manner. This includes issues on the confidentiality, the storage of content by the service providers, the specific aspects of storage of metadata and the definition of “third parties”.

The conflict with legal acts of a higher degree as well as the conflict with similar obligations stemming from European law – Art. 7. Para. 1 of the ePR stipulates that end-users or the third parties must store data in accordance with the GDPR. LIF’s understanding is that such an approach may not entirely be suitable. Also, the EU legislation provides obligations for storage of information which might conflict with the prohibitions for storage stipulated by the ePR.

The legal grounds for processing of electronic communications data – The legal grounds for processing of electronic communications data are stipulated in Art. 6 of the ePR and most of them are based on the consent of the end-users which is further restricted by requirement that (i) there should be no other way to provide the services and in certain occasions (ii), a mandatory consultation with the supervisory authority is necessary where the proposed data use is not linked to the specific provision of the service to the end-user and the data cannot be anonymised. It is recommendable for the ePR to provide additional legal grounds for lawful processing of electronic communications data.

The second chapter of the Opinion deals with the cookies and privacy settings. The broad restrictions on any use of processing and storage capabilities of terminal equipment provided in the Regulation might limit many legitimate activities not covered by the exceptions defined in Art. 8 of the draft Proposal. Therefore, LIF encourages the introduction to the Proposal of additional grounds for access and processing information from and on terminal equipment and software.

The third chapter deals with the restriction imposed by art. 11 and the information about security risks – both the initial version of Art. 11 of the ePR, and the proposed amendments by the LIBE Committee may be considered to lack clarity and could undermine the values that ePR tries to protect – the confidentiality of electronic communication data. It is a common understanding that the ePR should establish higher standards for safeguarding the confidentiality of electronic communication data, even higher than the standards laid down in the GDPR in relation to the access to personal data, especially in the context of the activities of public/state bodies. For this reason, LIF advocates for the restriction of confidentiality to be permitted only in a very limited number of cases related to the investigation of serious crimes or by the reason of national security. Moreover, it would be reasonable to ensure clear restrictions on law enforcement authorities’ ability to demand data – rather than regulating the ability of service providers to disclose the data to them.

In addition, the Opinion contains suggestions and recommendation for clarifications and supplementations in the articles and recitals to complement the identified issues.

Please note that the Opinion is written in August 2018 and does not take into account the changes of the Proposal made afterwards.