For years, the European Union has been trying to establish uniform rules for the internal market of digital services, to better protect users and copyright owners. The EU ePrivacy Regulation is discussed within this context. With this, the European Union wants to formulate binding data privacy regulations with EU-wide applications. These policies will not have any direct effect on internet services operating within the United States, but will be important to know for anybody looking to operate their online practices within the borders of the EU. It hasn’t yet been determined, though, when the EU’s ePrivacy Act will come into force and which requirements it will bring with it for the digital industry.
As a result, there’s a lot left unclear. So that you can get a picture of what to expect, we’ve summarized what we know so far.
The ePrivacy Regulation is not identical to the EU General Data Protection Regulation (GDPR), which came into effect in May 2018. Read more about this regulation in our detailed article on the GDPR and the new rules for businesses.
With the ePrivacy Regulation (officially: Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications), the European Union wants to strengthen the online privacy sphere of citizens and intensively regulate data protection. Basically, it’s concerned with restoring people’s trust in digital communication channels. Officially, at least, ePrivacy should bring about a reinforcement of the digital single market. It’s the third, and presumably last, measure within a wider European digital initiative. There’s also a desire to introduce Europe-wide regulations so that companies on the internet (at least within the EU) don’t run into issues as a result of national borders.
With this initiative, the EU embarks on a path that’s more than necessary: The internet, as we all know, knows no borders. But what exactly does the European authority anticipate with the ePrivacy Regulation? It’s important to first establish that the ePrivacy Regulation will affect more companies than any previous data protection policy. The requirements that are made this time are aimed specifically at software providers, for example, at providers of apps like WhatsApp or Skype – basically at the entire online industry.
One major change is set to affect the use of cookies: Rejecting cookies that are not necessary should become simpler for web users and for example be regulated via browser settings. Website operators may only use cookies if users explicitly agree to it. Even if the user doesn’t agree, all content should still be displayed to them in the future. Instead of an opt-out, an opt-in would be required.
Besides the GDPR, the ePrivacy Regulation has also been a key force – therefore also known as the EU cookie regulation, which defines to what extent website operators may set cookies for users.
To implement this, browser manufacturers could also be put under obligation: According to the draft, web browsers in the future should offer users the possibility to fundamentally regulate tracking. Is anybody allowed to read my cookie data? And if yes, are these only direct providers, or are they also third parties? Among other things, there’s controversy as to exactly how the default setting should look – i.e. whether the user has to become active themselves in order to protect their privacy. The GDPR at least assumes “Privacy by Default”: Data protection settings should be as strict as possible directly following installation, and then can only be weakened by the user afterwards. In general, tracking services should only be allowed without permission by the user if they serve a purely statistical purpose.
The World Wide Web Consortium (W3C) also took a critical look at privacy protection. The result was the do-not-track-HTTP-header, which many popular browsers already support. With this, users can set the preference in the browser that they don’t want any tracking. The HTTP header then forwards this information to the website. At the moment, though, website providers are not obligated to comply with this wish. This could be changed with the EU’s ePrivacy Regulation. It goes one step further, though, because according to the regulation, not only the browser but also all other technology for data transmission is supposed to be privy to the data protection.
The draft for ePrivacy also includes machine-to-machine communication. This is the EU’s response to the challenges of the Internet of Things. For these types of data transfer, the same should go for such instances where users are directly involved. The plan is that devices will only transfer personal data if the user has agreed to it. This could apply to GPS data for smartphones, for example. In general, it should apply that users must be informed about which data is being collected from them and for what purpose. Therefore, it shouldn’t be possible to hide an agreement in the T&Cs or link it to another service. For example, if user data needs to be transferred for online shopping – as it always does – this is allowed. It should not be allowed, though, to use this data for advertising purposes at the same time. For this, a new, specific agreement would be needed.
The ePrivacy Regulation shouldn’t be limited to the tapping of personal data by companies, though. Intervention on the state side should also be strongly regulated by ePrivacy. An end-to-end encryption should be obligatory: All data transmissions should be fully encrypted and not viewable by governments. The introduction of backdoors is also to be forbidden: Backdoors that the producer built to grant access for the government would be illegal.
ePrivacy shifts away from the internet when it comes to direct marketing: While nothing changes in the principle of email marketing, the regulation intends to more strongly regulate telephone marketing in particular. The proposal says that telephone calls for solicitation purposes should only be allowed if the caller reveals their telephone number or if they use an integrated code to indicate that it’s an advertising call.
The ePrivacy Regulation partially exists to replace the old ePrivacy guidelines and partially to supplement the GDPR. The old regulations have existed since 2002, and were expanded in 2009. However, a European community guideline is not directly effective and binding law, but instead directives that have to be converted into national law. As a result, individual nations are afforded a longer period. In the case of the regulation, the situation is different: As with the GDPR, it’s an EU-wide law that’s binding for all countries and comes into effect immediately. The law can grant a transitional period, though, for example.
What about the GDPR, though? What do you need to stick to now? As soon as the ePrivacy Regulation takes effect, the answer is simple: to both! The plan is that the regulations in ePrivacy will make the GDPR more concrete. The ePR (as the new regulations will be called) should be a lex specialis. This means that it has priority over the basic data protection regulation – a lex generalis. The GDPR is more general, and should be made clearer by the ePR through specific points with definite rules. The data protection regulation is not specifically tailored to the internet. ePrivacy will better protect this area.
Neither the GDPR nor the ePrivacy Regulation render any state data protection laws obsolete. This has already been decided in the GDPR, and the ePR should also contain the opening clauses: local regulations should be able to influence certain sections of the regulation when it comes to implementation details. Individual lawmakers must change or adapt points that are inconsistent with EU laws, however.
The ePrivacy Regulation has been discussed since April 2016, but has not yet come to a binding conclusion. In January 2017, the European Commission published its first draft. Subsequently, multiple committees issued responses to the Commission’s proposals, which eventually led to the EU Parliament’s own draft in October 2017 (the GDPR had already been decided at this time). Almost one month later, the EU Council Presidency published an assessment report, in which the current state of things was summarized. At this point, it’s the most current publication. The next move is for the EU Council to decide on the draft.
Originally, it was planned that ePrivacy and the GDPR would take effect at the same time. This plan has long since been abandoned: For years, the EU member states haven’t been able to agree on a common policy and turned down a compromise proposal in November 2019. Some members of the Council even called for a complete redesign of the regulation. Since a year-long transition period is also predicted for the ePrivacy Regulation, there won’t be any need to reckon with an immediate implementation of the draft. To which extent the draft will still be changed can’t yet be predicted. However, it’s fairly likely that this won’t remain as the final version.
Cuts made by an ePrivacy Regulation such as the one currently under negotiation affect operators of internet services and the online marketing industry, in particular (in addition to citizens whose privacy is to be protected). So, it’s not very surprising that the greatest criticism is drawn from these areas. The advertising industry, in particular, finds fault with the EU project.
Click here for important legal disclaimers.
Cookies can be helpful business tools, but they often toe the data protection line dangerously. As a result of this tendency towards uncertainty, the EU has introduced a new cookie policy to protect its users. The new policy makes opt-in procedures compulsory, because the user must provide their consent every time. This new policy will affect any US company that does online business with EU...
Since May 25, 2018 a new European law on data protection has been in place. However, despite it being relevant to day-to-day business, many companies and website operators are still unattuned to the General Data Protection Regulation (GDPR). On top of this, high fines are imposed on those violating the regulations. Here we summarize everything worth knowing on the new EU GDPR for entrepreneurs and...
The California Consumer Privacy Act, in effect since January 2020, makes it easier for US consumers to control the private information that a company hold on them or shares. If a business is found to be in breach of the CCPA, consumers can now also sue them. Here’s all you need to know about the Act, its major provisions, and what it means for you and your business.
Get found. Grow online.
Businesses are uniting with IONOS for all the tools and support needed for online success.
