It seems a long time since I wrote about the ePrivacy Regulation. This was supposed to come into force alongside the GDPR, back in May 2018, and provide specific guidance on its application to the communications sector. You may remember it as “Cookie law”, though it was never just that. Unfortunately its scope grew and, for at least the past eighteen months, discussion among Member State Governments has been going around in (sometimes increasing) circles.
Germany took over the EU Presidency last week, and on Monday published what looks (mostly) like a decisive approach to the outstanding issues. They have summarised (nearly all) the issues in three questions to be discussed at a meeting in a couple of weeks’ time (my summary, though theirs aren’t much longer, once you discount the strawman sections of legislation):
- Particularly in the light of COVID-19, should there be sector specific rules on processing communications metadata for health purposes, or can we just rely on the GDPR “vital interests” justification and safeguards?
- Should there be sector-specific rules on processing communications data for purposes others than security, service delivery, etc., or can we just rely on the GDPR “legitimate interests” justification and safeguards?
- Should there be sector-specific rules on accessing terminal devices (e.g. to install security patches), or can we just rely on the GDPR “legitimate interests” justification and safeguards?
So far, so good. But, several presidencies ago, it was noticed that any law on how networks could process communications data and content was likely to have an impact on how networks detect and block illegal content, in particular child abuse imagery. Alarmingly, although the Presidency thinks it can assume that all Member States think those activities should continue, it seems that “elementary questions” on the correct legislative approach to achieving that “remain highly controversial”. So that discussion is postponed to “a later date”.
Finally, note that we are still in the process of European Governments coming to a shared agreement on what the legislation should look like. Once they’ve done that, they still need to negotiate with the European Parliament (which reached its opinion two and a half years, and an election, ago) to find a mutually agreeable text. Not quite so long ago, the UK Government indicated that, despite Brexit, it was minded to follow the European lead. But when there might be such a lead to consider is still a very open question.
