Updated Draft Of ePrivacy Regulation: Still Hampering Innovation

On 8 September 2017, the European Council published its first revisions ("Revised Draft") to the draft EU ePrivacy Regulation (version COM(2017) 10 of 10 January 2017, "ePrivacy Regulation"). The Revised Draft is based on the discussions held in previous meetings of the European Union's Working Party for Telecommunications and Information Society ("WP TELE"), and on comments provided by delegations.

The Revised Draft

The Revised Draft aims for clarifications compared with the previous draft by the European Commission, and outlines issues to be discussed in further WP TELE meetings. The Revised Draft does not make changes to the general scope addressed by the ePrivacy Regulation. It tries, however, to be clearer about the territorial scope of applicability of the ePrivacy Regulation, and also about excluding legal entities from the definition of data subjects. Even in the form of the Revised Draft, the ePrivacy Regulation seems like an "elephant" that hampers innovation in Europe.

In terms of tracking technologies and commercial communications, the proposed amendments include, inter alia, the following elements:

Tracking Technologies

As under the ePrivacy Regulation, use of cookies and other tracking tools is only permitted if either such use is necessary to provide the service requested by the user, or if the user has consented. The Revised Draft upholds the idea that users can consent via browser settings (Article 4a (2) of the Revised Draft). It clarifies that users may be asked to consent upon installation or first usage of the software (Article 10 (2) of the Revised Draft). As a key change to the first draft of the ePrivacy Regulation, the Revised Draft requires organizations to provide in a clear manner "easy ways" for users to change their consent preferences at any time (Article 10 (2a) of the Revised Draft). The Revised Draft does not provide further clarity on the permissions to further use the tracked data, e.g., for marketing or analytics purposes. Likely, therefore, a second "GDPR-consent" will be required to permit such use. Asking users for two consents is far away from practical life.

The ePrivacy Regulation already included the obligation to remind users of their possibility to withdraw the consent. However, the Revised Draft extends the time period for the reminder from six to 12 months (Article 4a (3) of the Revised Draft).

Marketing Communications

Regarding direct marketing communications (e.g., email or push notification...