The EU states have reached a compromise on reforming the ePrivacy directive, which covers privacy protection over communications networks. Work to reform the directive from 2002 started four years ago, in an attempt to extend the provisions to new forms of communication over the internet and mobile apps. Telecom operators said they support the underlying principle of confidentiality of communications, but want to ensure they are on a level regulatory footing with OTT services.
The agreement was reached by the Coreper, the committee of EU members' representatives in Brussels. A final text for the new regulation must still be negotiated with the European Parliament before it can be voted and take effect. The EU states would then have two years to implement the changes.
The ePrivacy directive complements the EU's General Data Protection Regulation of 2018 and applies specifically to public communications networks. In addition to guaranteeing the privacy of communications over those networks, the new regulation would protect metadata associated with the communications and machine-to-machine data for the emerging IoT services market. It covers end-users in the EU, including companies outside the EU that process data on EU subjects.
The telecom operators had lobbied for the right to use metadata collected from their networks to provide new commercial services, such as location analytics for businesses based on anonymised phone signals on mobile networks. They noted that companies such as Google and Apple already have access to GPS data from users' phones, so they should be allowed to monetise similar data from telecom networks.
The Portuguese presidency of the EU said metadata may be processed for instance for billing, or for detecting fraud. With the user’s consent, service providers also could use metadata for public services, for example for tracking people's movement during a pandemic or emergency, or helping to plan transport infrastructure. Furthermore, in certain cases, telecom operators could use metadata for a purpose other than that for which it was collected, even when this is not based on the user’s consent or outlined in EU or national law. This processing for another purpose must be "compatible with the initial purpose, and strong specific safeguards apply to it", the Council said.
Mobile phone makers also will face tighter controls of their use of personal data. As both the mobile hardware and software may store highly personal information, such as photos and contact lists, the use of processing and storage capabilities and the collection of information from the device will only be allowed with the user’s consent or for other specific transparent purposes laid down in the regulation.
The compromise was largely welcomed by telecom industry groups such as ETNO and the GSMA. Their main concern is ensuring that the final text does not vary significantly from the requirements of the GDPR, so the telecom sector is not put at a disadvantage compared to other industries. EuroISPA seconded that concern, noting there also needs to be clarity on which regulator has authority in enforcing the rules.
The CCIA, which represents most major internet companies, also wants clarity on potential overlap between the GDPR and the new rules for online communications and connected devices. This is also important in ensuring consistent enforcement across the EU, the group said.
Cookies fatigue
The other controversial element of the directive has been the regulation of website cookies. The EU said it wants to reform the system so internet users have a "genuine choice" whether to accept cookies or similar identifiers. Under the new rules, sites with a paywall or required cookies may not refuse access and instead must provide a third alternative of a website with equivalent content and no mandatory cookies.
The EU also wants to make it easier for people to manage cookies. They should be able to give consent to the use of certain types of cookies by whitelisting one or several providers in their browser settings. The browser developers will be encouraged to make it easy for users to set up and amend the whitelists and withdraw consent at any moment.
