E-Privacy Regulation: Council of the European Union reaches a compromise agreement on the text that will succeed the E-privacy Directive

11 / 02 / 2021

Data Protection Alert Portugal

The Council of the European Union announced yesterday in a press release that Member States have agreed at negotiating a mandate for the revision of the rules on the protection of privacy and confidentiality in the use of electronic communications services, which include rules on the processing of metadata, the use of cookies and the sending of marketing communications.

This initiative, which aims to replace the current directive on privacy and electronic communications with a European regulation in this area, was announced several years ago, but has been repeatedly delayed due to a lack of consensus among Member States of the Council of the European Union. For this reason, the news now advanced represent an important step forward the approval of this legislation.

With regard to the regulation proposal approved, we highlight the following:

Metadata: these may be processed without the user's consent for several purposes, including billing purposes, to ensure the integrity of communications services and to check for the presence of malicious programs and detect or prevent fraudulent use. Metadata may also be processed to protect the users' vital interests (e.g. to monitor epidemics and their spread).
Cookies: the rule that cookies can only be installed in terminal equipment with the user's consent is maintained. However, the Regulation’ draft opens the door to the installation of cookies without the consent of the user for some purposes.
Marketing communications: the rule that the consent of the end-user is required for the sending of marketing communications through electronic communications services is maintained, as well as the existing exception for sending marketing communications to clients who are natural persons through soft opt-in.

As a novelty, the proposal sets out the possibility for Member States to define in national law the period, as of the date of sale of the product or service, during which the user's contact details may be used for sending marketing communications based in the soft opt-in mechanism.

It is also clarified that Member States will be able to define in national law that entities will be able to make marketing voice-to-voice calls to end-users unless they object to receiving these communications (i.e. based on an opt-out system).

Under the proposal, the Regulation will enter into force 20 days after its publication in the EU's Official Journal and will start to apply two years later.

Yesterday’s commitment enables the Portuguese Presidency of the Council of the European Union to start trilogue talks with the European Parliament and the Commission in order to reach an agreement on the final version of the Regulation.