Scope

Evaluation of Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive) as amended by Directive 2009/136/EC.

Evaluation findings

The provisions of the Directive remain in general relevant to meet the objectives of ensuring privacy and confidentiality of communications.

The rules on confidentiality of communications achieved their objectives vis-à-vis providers of electronic communication services. However, while the objectives of the rules remain valid, the effectiveness of the rules has been hampered by technological developments. The Directive failed to ensure an adequate protection of citizens when they use 'Over-the-Top services', given that the Directive does not apply to such services.

The evaluation also found that the application of the consent rules on the confidentiality of terminal equipment has not been fully effective. Citizens are confronted with many consent requests, are not always fully informed and offered a genuine choice regarding the storing or accessing of information in terminal equipment.

The evaluation found no evidence of major inconsistencies between the Directive and the other relevant EU pieces of legislation with which it interacts. However, some rules have become redundant after being encompassed in the General Data Protection Regulation.

The evaluation concluded that the ePrivacy has EU added-value as it imposes harmonised provisions on confidentiality of communications and traffic data (also called metadata).  In the light of an increasingly transnational electronic communications market, metadata are becoming ever more important.

Estimated savings and benefits

The evaluation concluded that it was not possible to provide reliable quantified information on the costs and benefits related to the implementation of the ePrivacy Directive (ePD). The main reason for this was that businesses could not separate the costs caused by the ePD from other types of costs.

Which objective(s) does the Commission pursue?

The objectives of the Commission proposal to review were to remove unnecessary burdens and to make the rules operate in a more effective way. In particular, this would be achieved by streamlining the rules that apply to the placement of cookies and by enhancing user control. Also, the review aimed to ensure more transparency concerning device tracking by requiring the display of a notice. In particular, the proposal aimed to:

1) simplify the framework by repealing outdated or unnecessary provisions;

2) streamline the framework by removing overlaps and ensuring consistency with other pieces of legislation, in particular the GDPR.

3) clarify provisions to avoid different interpretations and thus improving their effectiveness.

4) broaden the scope of application of the ePrivacy Directive to include communications services that are functionally equivalent to those provided by traditional telecom operators to ensure the effectiveness of the rules.

Following the three sets of recommendations made by the REFIT Platform, the proposal included specifically:

– Use of technologically neutral definitions to apprehend new services and technologies to ensure that the Regulation is future-proof;

– Repeal of the security rules to eliminate regulatory duplication;

– Clarification of scope to help eliminate/reduce the risk of divergent implementation by Member States (point 3 of the Opinion);

– Clarification and simplification of the consent rule for the use of cookies and other identifiers, as explained in Sections 3.1 and 3.4 (point 2 of the Opinion);

– Alignment of the supervisory authorities with the authorities competent to enforce the GDPR and reliance on the consistency mechanism of the GDPR.

Estimated savings and benefits

The measures envisaged would reduce costs on businesses essentially thanks to simplifying the consent rules and greater harmonisation. No further quantification was possible.