The E-Privacy Regulation has been the bugbear of European advertising industry for years. The Council of the Union is discussing a new draft – with significant implications for marketing and tracking. A legal classification. An essential legislative project in data protection is the planned E-Privacy Regulation.
In addition to the general requirements of the General Data Protection Regulation (GDPR), this should or should have long since made area-specific regulations for handling personal data. Tracking is affected by this, for example. The Council of the Union has now published a new draft for the E-Privacy Regulation.
E-Privacy Regulation: Prehistory
Once again for classification: The currently valid E-Privacy Directive is also known as the “Cookie Directive.” It should have been revised long ago and adapted to technological developments.
After all, the original version dates back to 2002. The first draft of the E-Privacy Regulation from 2017 stipulated that it should be applied with the GDPR on May 25, 2018. That was a plan that was almost impossible to keep from the start. The new regulations in the E-Privacy Regulation are so relevant because they affect a wide variety of economic sectors. It starts with telecommunications.
New Changes In The Privacy Regulation
The draft of the Council Presidency that has now been published contains some practical adjustments compared to a version of the Croatian Council Presidency from March 2021. The draft provides that access to information in a user’s device or the use of storage options in the device should be possible without consent if this is technically necessary to provide a service that the user expressly desires.
The requirements that access is “technically” necessary have been added. Also new is that the user “expressly” requests the service. With both new requirements, the scope of this exception provision is narrowed to the basic rule that the user’s consent must always be obtained.
On the one hand, in case of doubt, companies would now have to prove that access to information in a device or the use of storage capacity was technically necessary. Or, to put it another way: Without this access, the service that the user requests should not work. In addition, a user’s behavior must make it very clear (“explicitly”) that he wants to use a specific service.
The “Legitimate Interest” Has Disappeared
Accordingly, the former recital 21b was deleted, in which it was still provided that companies can also consider financing their free online offer via advertising tracking as a “legitimate interest.” This adaptation of the E-Privacy Regulation massively restricts the tracking options for companies without the user’s consent if the purpose of the tracking is to market their online offer.
Conclusion On The E-Privacy Regulation
From the point of view of the advertising industry, the adapted draft of the E-Privacy Regulation is unlikely to meet with much enthusiasm. At least compared to the previous state of negotiations. It remains to be seen whether this is the last word. The new draft will be discussed in the Council on November 11, 2021. Then it should also be about further work on this critical project in general.