EDPB Publishes Opinion On The Interplay Between GDPR And ePrivacy

The European Data Protection Board (the “EDPB“) has published its opinion on the interplay between the GDPR and Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (the “ePrivacy Directive“).

The opinion confirms that it is possible for personal data processing to fall within the scope of both the GDPR and the ePrivacy Directive. For example, the use of cookies.

However, the opinion also deals with the following two key issues:

Precedence: The opinion confirms that, in situations where detailed provisions of the ePrivacy Directive apply to processing also caught by the general provisions of the GDPR, the detailed ePrivacy provisions will take precedence. At a practical level, this means that, in relation to electronic marketing for example, the specific provisions of Article 13 of the ePrivacy Directive (requiring explicit opt-in consent to receive such communications unless an exception such as the so-called 'soft opt-in' can be relied upon) will take precedence over the more general provisions of Article 6 of the GDPR which set out a number of lawful bases for processing, including where it is in the 'legitimate interests' of the controller. This is an important clarification but not aget out of jail free card for GDPR compliance as the EDPB confirms in its opinion that the mere fact that a subset of the processing falls within the scope of the ePrivacy Directive, does not limit the competence of data protection authorities under the GDPR. In other words, organisations will still need to comply with aspects of the GDPR that are not covered by the detailed ePrivacy Directive provisions. Enforcement: The opinion confirms that an infringement of the GDPR might also constitute an infringement of ePrivacy rules. The data protection...