It took four years, but the representatives of EU member states in the European Council agreed on the ePrivacy Regulation. Under the Portuguese EU presidency, it succeeded in starting negotiations with the European Parliament and the European Commission, the final stage before the new privacy law can be adopted. So the law is going to come, although even now it may take some time.
The ePrivacy Regulation replaces the Dutch Telecommunications Act. This law contains the rules for e-mail, Whatsapp, SMS, telemarketing and cookies, among others. In terms of impact, the ePrivacy Regulation is similar to the General Data Protection Regulation (AVG) and the length of the drafting process is also equivalent. Portugal's Infrastructure Minister, who chaired the Council meeting, called the agreement "a good balance between protecting people's lives and stimulating innovation.
The next phase is also called the "trilogue. The Council, Commission and Parliament have each approved their own version of the ePrivacy Regulation - now they must agree on a final text. That could also be a fraught process, given that new European Commissioners have been appointed and new members of the European Parliament elected since the 2019 European elections. Those new members were not there when the proposal was written and approved in Parliament.
The Commission and Parliament also proposed a stricter text than the Council, for example on cookies. Whereas Parliament advocated a ban on cookie walls, the Council believes that room should be left for publishers. According to the Council, there should be an exception for publishers who finance their content with an advertising-based revenue model, provided they offer an alternative without cookies. Exactly what that alternative should be is not clear, but previously, paid access to content without cookies was considered. Moreover, the bill dating back to 2017 now seems to be overtaken by reality on this point. European regulators have already made it known that valid consent cannot be obtained with a cookie wall, and Google and other browser providers are going to stop or have already stopped third-party cookies. It is therefore questionable whether a cookie wall provision in the ePrivacy Regulation still makes sense as a result.
How long the trilogue lasts depends on the concessions people are willing to make. If the Council stands firm, this too could be a long process. It is already clear that Parliament has little to say about the final text from the Council. According to rapporteur Birgit Sippel, the MEP overseeing the dossier from Parliament, the negotiations will be "not easy" and it is hard to say whether there will be a final text as early as this year.
Even after the trilogue, the proposal does not directly affect businesses. The Council's text includes a two-year period for organizations to prepare, just as they did with the AVG. We probably won't be dealing with the ePrivacy Regulation even in 2022, but that the law is coming in one form or another is now certain.
Source: DDMA
