Finally, there is an ePrivacy Regulation 2021 status update and it comes in the form of the current EU Council’s new draft proposal published on 10th February 2021.
Finally, there is an ePrivacy Regulation 2021 status update and it comes in the form of the current EU Council’s new draft proposal published on 10th February 2021.
Check our 2022 ePrivacy Regulation update.
The latest ePrivacy Regulation draft has been proposed by the Portuguese Presidency of the EU Council that began on Jan 1, 2021.
An interesting fact is that it is the 14th overall draft tabled for approval.
Notably, the ePrivacy Regulation 2021 draft proposal makes the text simple and shows significant alignment with the GDPR (General Data Protection Regulation).
If approved, the ePrivacy Regulation 2021 draft will establish new data processing requirements in relation to electronic communications, cookies, direct marketing, to name a few.
With that in mind, let us take a closer look at what you should expect in case the Portuguese Presidency’s ePrivacy Regulation draft is eventually adopted by the EU.
Table of Contents
Explore more privacy compliance insights and best practices
What is the Scope of the ePrivacy Regulation under the 2021 Draft Proposal?
The ePrivacy Regulation 2021 draft proposal seeks to protect the right of EU citizens to the confidentiality of their electronic communications content and metadata of that content.
The scope of the ePrivacy Regulation as envisaged by the 2021 draft also extends to machine-to-machine data transmitted over a public network.
The objective of this is to guarantee the privacy of users’ data when using Internet of Things (IoT) applications, which is still an emerging technology.
If adopted, the latest draft will apply to the processing of personal data of users by electronic communication service providers and networks.
Therefore, you will be subject to the ePrivacy Regulation if you;
Examples of businesses that will be subject to compliance if the ePrivacy Regulation 2021 draft is adopted include;
Electronic communications are considered to contain highly sensitive user data shared. If the current ePrivacy Regulation draft passes, some of the data that you process that will be subject to compliance requirements includes;
How does the ePrivacy Regulation 2021 Draft Differ from Previous Proposals?
Compared to previous proposals, the Portuguese Presidency’s ePrivacy Regulation draft simplifies the text of the law and provides a clear alignment with the GDPR.
The standout changes in the ePrivacy Regulation 2021 draft published on 10th February in comparison to previous ones include;
Will the ePrivacy Regulation Come into Force in 2021?
No one knows yet, but, depending on the outcome of the Council’s talks with the EU Parliament, the ePrivacy Regulation will be adopted within 20 days after it is published in the EU’s Official Journal, followed by a grace period of 2 years before enforcement begins.
This is after EU member states agreed on a negotiating mandate for the ePrivacy Regulation 2021 draft proposal on 10th February 2021, which allows the Portuguese Presidency to open talks with the European Parliament.
If successful, these talks will pave the way for the drafting of the final text of the law.
It is important to remember that the ePrivacy Regulation was meant to come into effect in May 2018 alongside the GDPR, as a replacement for the ePrivacy Directive, also known as the ‘EU Cookie Law,’ which was adopted in 2002.
However, it has been pushed back a couple of times since then because of significant lobbying from different stakeholders and institutional dialogues that resulted in delays in its implementation. See more about ePrivacy Regulation Status.
Will the ePrivacy Regulation replace the GDPR?
No. The ePrivacy Regulation is not meant to be a substitute for the GDPR (ePrivacy Regulation vs GDPR). It's designed to complement it.
The GDPR provides an oversight framework for activities involving the processing of personal data.
On the other hand, the ePrivacy Regulation focuses on supporting the GDPR’s general requirements by providing specific rules to govern the confidentiality of electronic communications of EU residents.
Since the GDPR focuses specifically on personal data while the scope of the ePrivacy Regulation can cover not only personal data, but also B2B data, it is likely that the ePrivacy Regulation may take precedent over the GDPR in instances where both laws are applicable.
What are the Key Differences between the ePrivacy Directive (EU Cookie Law) and the Proposed ePrivacy Regulation?
If the ePrivacy Regulation 2021 draft proposal is adopted, it will expand the 2002 ePrivacy Directive’s scope to incorporate emerging technologies such as;
Since the final text is yet to be agreed upon, it is impossible to provide a clear breakdown of how the ePrivacy Directive differs from the ePrivacy Regulation for now.
But, we will be sure to keep you updated on the developments with regards to these data protection legislations as they emerge.
What is the ePrivacy Regulation 2021 Draft’s Position on Consent and Cookies?
The ePrivacy Regulation 2021 draft makes it clear that your user’s device whether hardware or software may hold highly sensitive personal data e.g photos or lists of contacts.
For this reason, you need the user’s explicit consent before you collect, store, or process this personal data. To achieve this, you must;
This is Secure Privacy’s GDPR compliant cookie banner that allows you to give your users control over their cookie consent choices
When it comes to cookie walls, the latest ePrivacy Regulation draft makes it clear that cookie walls are illegal.
A cookie wall is a type of cookie banner that denies access to visitor access to a website unless the visitor consents to cookies, and does not provide a mechanism for them to easily withdraw their consent.
Below is an example of a website with a cookie wall:
However, it appears that the ePrivacy Regulation 2021 draft proposal has an exception for the use of cookie walls;
Here is an example of an acceptable cookie wall if the ePrivacy Regulation 2021 draft is eventually adopted.
Nonetheless, where it is required, you will be expected to ensure that the cookie consent you obtain is valid.
To achieve this the ePrivacy Regulation 2021 draft clearly states that you need to comply with GDPR cookie consent requirements.
Check out our blog for a detailed breakdown of how to obtain valid GDPR cookie consent.
You can also watch our simplified video of what valid GDPR cookie consent entails here.
What is the ePrivacy Regulation 2021 Draft’s Position on Processing Electronic Communications Metadata?
Being one of the areas that generated significant interest from the previous draft in relation to the applicability of the GDPR data processing legal bases - consent and legitimate interest - it is not any different with the ePrivacy Regulation 2021 draft.
If you are an electronic communications network or service provider, you must obtain prior consent from the user before you process their electronic communications metadata.
One of the exceptions where you do not need consent to process metadata is when you do so in situations that are necessary to provide an electronic communications service because you are bound by either;
However, if your processing of a user’s metadata can pose high risks to the confidentiality rights of the user when providing a service;
Other exceptions include when;
What does the ePrivacy Regulation 2021 Draft Say about Browser-Based Opt-Outs?
If you intend to use tracking cookies in a GDPR compliant way, you need a cookie banner. However, cookie banners are unpopular to some people.
A cross-section of previous drafts proposed a requirement for browser software companies to explain cookies to their users during the setup process such that users could then block or consent to all tracking cookies by default.
However, questions were raised since this would create significant challenges for online advertisers.
Additionally, it would contradict the GDPR's requirement that consent must be "specific."
To address what the ePrivacy Regulation 2021 draft terms as ‘cookie consent fatigue,’ the Portuguese presidency proposes that end-users should be given a mechanism to give or withdraw consent to the use of certain types of cookies by whitelisting one or several providers easily within their browser settings.
While this means users will manage their cookie consents via their browser settings if the ePrivacy Regulation 2021 draft is adopted, it does not spell doom for the adtech industry as we know it.
What does the ePrivacy Regulation 2021 Draft say About Direct Marketing Activities?
According to the ePrivacy Regulation 2021 draft, direct marketing refers to any kind of advertising sent directly to an identifiable user through publicly available electronic communication channels. These channels can be;
You can send a direct marketing message without a user’s prior consent only if;
But even with this exception, the ePrivacy Regulation 2021 draft makes it clear that you have to do this in compliance with GDPR requirements.
Since they have an absolute right to object to these communications, you must stop immediately once consent is withdrawn
You will be fined if you use;
What are the Penalties for Non-compliance with the ePrivacy Regulation?
The ePrivacy Regulation 2021 draft proposes similar fines to the ones under the GDPR regime, with a maximum penalty of €20 million or 4% of a non-compliant organization’s global annual revenue, whichever is greater.
What does Brexit Mean for the ePrivacy Regulation and UK Businesses?
Well, it is still unclear whether the UK will enforce the ePrivacy Regulation in full or partially after Brexit if the Portuguese Presidency’s draft is adopted.
However, there is a possibility Britain will in all likelihood align itself with the EU to accelerate the adequacy decision.
Learn more about Brexit and what it means for UK Businesses’ compliance with the GDPR in our blog
What is the Position of the EDPB on the ePrivacy Regulation 2021 Draft?
In response to the latest ePrivacy Regulation proposal by the Portuguese Presidency, the European Data Protection Board (EPDB) swiftly released a statement expressing concerns.
The EDPB underlined the need to further support the guarantees outlined in the ePrivacy Regulation 2021 draft.
The proposals brought forth by the EDPB with an eye on bolstering the current ePrivacy Regulation draft are:
If you would like to get all your questions about the ePrivacy Regulation answered by a data privacy legal expert, book a 30-min call and we will be more than happy to help your compliance efforts.
Schedule a call to learn more
Read ePrivacy Regulation Latests Blog Posts
