The current EU legal framework
After the 18th of May 2018, it’s not clear what the extends of the ePrivacy Directive will be as it’s not
immediately invoked. There are two instruments that we will use:
I. Directive 95/46/EC
II. Directive 2002/58/EC as amended by the 2009 Directive.
A directive cannot change or complement a regulation, while vice versa this is possible. Consider that
when one of them becomes a regulation, the other cannot complement the first anymore. Therefore,
the type of instrument is very important when changing the existing situation.
For now, both directives can apply to the same situation, one giving the general rules and the second
might provide for both general or specific rules. Looking at both instruments is therefore advised.
Confidentiality is regulated properly in ePrivay Directive and might not be regulated at the same level
in the GDPR, so this might be a reason to keep the ePrivacy Directive in some form.
For the definitions, other legislation need to be looked at as the ePrivacy Directive is also part of the
package that was adopted in the telecommunication sector. For example, ‘user’ is defined differently
in both materials. There are overlaps, gaps and inconsistencies and therefore you must walk through
different directives picking out the relevant parts for your case.
An example of traffic data thinking of landline network, you need two telephone numbers and the
duration of the call, to bill. When it concerns a mobile phone, it already becomes more complicated
as here, billing might depend on the location (country) you’re calling from, so you already need a
different type of data. The location data pinpoints the location of the user of the equipment.
Location data is that it discovers where you’ve been all day and Article 29 Working Party says that
this reveals so much about a person that it is regarded as sensitive data. Both types of data may only
be processed if they are anonymized or with consent of data subject, unless it’s necessary for billing.
There is an ongoing discussion about whether traffic and location data are always sensitive data.
The scope of the ePrivacy Directive concerns the processing of personal data in connection with
publicly available electronic communications services in public communications networks, therefore
a narrower scope than Directive 1995. The scope extends to public networks or services only.
Moreover, the Directive allows for exceptions in the national law regarding certain provisions of the
Directive by harmonization. Fragmentation is caused by the fact that two different Directives apply,
but in the end, you should check national legislation, implemented based on the two Directives.
The qualification of data is important because you need to know on which legal grounds you’re
allowed to process data. As you need either consent or anonymization for three of the four
categories of data and anonymization is probably not going to work when you develop an app as to
where people are, prior consent is the only legal ground on which your processing can be based.
Depending on the type of data, you need to determine the legal grounds on which you can process.
A lot of marketing strategies going on in location based services, not only when they address us,
sending us messages but determining where how and when we want to use a certain type of product
so they know where to put up a store or on which festivals to be.
1. Are we processing personal data? Common denominator in both Directives.
2. Is the data sensitive data? If so, we need prior consent.
After the 18th of May 2018, it’s not clear what the extends of the ePrivacy Directive will be as it’s not
immediately invoked. There are two instruments that we will use:
I. Directive 95/46/EC
II. Directive 2002/58/EC as amended by the 2009 Directive.
A directive cannot change or complement a regulation, while vice versa this is possible. Consider that
when one of them becomes a regulation, the other cannot complement the first anymore. Therefore,
the type of instrument is very important when changing the existing situation.
For now, both directives can apply to the same situation, one giving the general rules and the second
might provide for both general or specific rules. Looking at both instruments is therefore advised.
Confidentiality is regulated properly in ePrivay Directive and might not be regulated at the same level
in the GDPR, so this might be a reason to keep the ePrivacy Directive in some form.
For the definitions, other legislation need to be looked at as the ePrivacy Directive is also part of the
package that was adopted in the telecommunication sector. For example, ‘user’ is defined differently
in both materials. There are overlaps, gaps and inconsistencies and therefore you must walk through
different directives picking out the relevant parts for your case.
An example of traffic data thinking of landline network, you need two telephone numbers and the
duration of the call, to bill. When it concerns a mobile phone, it already becomes more complicated
as here, billing might depend on the location (country) you’re calling from, so you already need a
different type of data. The location data pinpoints the location of the user of the equipment.
Location data is that it discovers where you’ve been all day and Article 29 Working Party says that
this reveals so much about a person that it is regarded as sensitive data. Both types of data may only
be processed if they are anonymized or with consent of data subject, unless it’s necessary for billing.
There is an ongoing discussion about whether traffic and location data are always sensitive data.
The scope of the ePrivacy Directive concerns the processing of personal data in connection with
publicly available electronic communications services in public communications networks, therefore
a narrower scope than Directive 1995. The scope extends to public networks or services only.
Moreover, the Directive allows for exceptions in the national law regarding certain provisions of the
Directive by harmonization. Fragmentation is caused by the fact that two different Directives apply,
but in the end, you should check national legislation, implemented based on the two Directives.
The qualification of data is important because you need to know on which legal grounds you’re
allowed to process data. As you need either consent or anonymization for three of the four
categories of data and anonymization is probably not going to work when you develop an app as to
where people are, prior consent is the only legal ground on which your processing can be based.
Depending on the type of data, you need to determine the legal grounds on which you can process.
A lot of marketing strategies going on in location based services, not only when they address us,
sending us messages but determining where how and when we want to use a certain type of product
so they know where to put up a store or on which festivals to be.
1. Are we processing personal data? Common denominator in both Directives.
2. Is the data sensitive data? If so, we need prior consent.
