The ePrivacy Regulation: an update

Under that German presidency, a new draft version of the ePrivacy Regulation was published on Sept. 24.(1) In this blog, we discuss the main changes in that draft version.

Prior to the new draft version

On July 1, Germany assumed the presidency of the European Council. Germany clearly has the ePrivacy issue high on its agenda. This is not unexpected. After all, the country is known to place great importance on data protection. At the time, for example, Germany was the very first member state to implement the AVG in its national legislation. In July, Germany outlined its plans in a discussion paper and indicated where input from member states was needed.(2) According to Germany, the issues related to the processing of metadata and the use of cookies are still causing the most headaches. As a starting point, Germany relied on the latest proposal from the Croatian presidency,(3) which we discussed in a previous blog.(4)

Key changes

The first major change in the new proposal is that legitimate interest as a basis for setting cookies has been removed from Article 8 again. This is unfavorable for companies in the digital advertising market that were looking forward to this new basis, given the tightening of the rules on obtaining consent. Also, in the new proposal, the processing of metadata of electronic communications is no longer possible on the basis of legitimate interest. However, a possibility of processing metadata for statistical or scientific purposes has been added. In addition, the position on cookie walls has changed (again). The previous proposal stipulated that by means of cookiewalls in certain situations consent could be freely given, namely if the option was given to visit a similar website from the same provider without accepting cookies. The new proposal now explicitly provides that this is also the case when similar websites without a cookie wall are offered by other providers. This runs counter to the current cookie wall ban enforced by the Personal Data Authority. Furthermore, the provision in the previous proposal that the authority overseeing the AVG should also oversee the ePrivacy Regulation has been deleted in the new proposal. Under the previous proposal, one could thus conclude that in addition to the AVG, the Personal Data Authority would also supervise compliance with the ePrivacy Regulation. This provision has now been deleted, although this does not seem to represent a radical change from the previous proposal. In fact, the new proposal provides that each Member State must ensure that one or more authorities meet the requirements of Articles 51 to 54 of the AVG. However, with respect to Articles 12 to 16 of the ePrivacy Regulation (which includes the article on direct marketing), it does explicitly provide that Member States may leave the supervision to another authority with appropriate expertise. Thus, under the new proposal, it is not excluded that the Consumer and Market Authority continues to retain some of the supervision.

Now what?

For now, it remains to be seen how things will develop. The German presidency's ambition is to have reached agreement on the proposal in the European Council by the end of 2020 or early 2021. However, given the slow pace of negotiations so far, it remains to be seen whether it will indeed achieve this ambition.