Interaction e-Privacy Principles / GDPR

On 10 January 2017, the EU Commission issued a proposal for a Regulation on the respect for private life and the protection of personal data in electronic communications ("e-Privacy Regulation") which aims to replace the current legal framework established under Directive 2002/58/EC ("e-Privacy Directive").

The e-Privacy Directive, as implemented into the national legislations of the EU Member States, provides special privacy rules for electronic communications services and therefore regulates activities such as the use of cookies and unsolicited electronic communications.

The proposal for the e-Privacy Regulation intends to further harmonize the rules on electronic communications across all Member States by defining better and clearer rules on tracking technologies, in particular by taking into account the principles and requirements deriving from the General Data Protection Regulation 2016/679 ("GDPR").

In terms of timing, the EU institutions were initially aiming to adopt the e-Privacy Regulation by 25 May 2018, i.e. the date of entry into application of the GDPR. This was then post-poned until the end of 2018. This timing would have established a comprehensive framework on the matter at hand. However, the adoption of the e-Privacy Regulations has taken longer than expected due to the huge economic and financial stakes at hand. Indeed, discussions are still ongoing within the Council and the proposal has not made it yet to the first reading at the Parliament.

Meanwhile, following a request from the Belgian data protection authority, the European Data Protection Board ("EDPB") adopted on 12 March 2019 Opinion 5/2019 on the interplay between the e-Privacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities ("Opinion").

The Opinion recalls that certain processing activities...