Council of theEuropean Union
Brussels, 10 February 2021
(OR. en)6087/21
Interinstitutional File:
2017/0003(COD)
TELECOM 52
COMPET 90
MI 80
DATAPROTECT 34
CONSOM 38
JAI 131
DIGIT 20
FREMP 26
CYBER 33
CODEC 178
OUTCOME OF PROCEEDINGS
From:
To:

General Secretariat of the Council

No. prev. doc.:
No. Cion doc.:

5840/215358/17

Subject:

Proposal for a Regulation of the European Parliament and of the Council
concerning the respect for private life and the protection of personal data inelectronic communications and repealing Directive 2002/58/EC (Regulation
on Privacy and Electronic Communications)

Delegations- Mandate for negotiations with EP

Delegations will find in the Annex the Mandate on the above mentioned Proposal for a Regulation
adopted by the Permanent Representative Committee on 10 February 2021.
______________

6087/21

PB/ek
TREE.2.B

1EN

ANNEX I
Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
concerning the respect for private life and the protection of personal data in electronic
communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic
Communications)(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 16
and 114 thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Having regard to the opinion of the European Economic and Social Committee19,
Having regard to the opinion of the Committee of the Regions210,
Having regard to the opinion of the European Data Protection Supervisor311,

Acting in accordance with the ordinary legislative procedure,
Whereas:

1

9
10
3
11
2

OJ C , , p. .
OJ C , , p.
OJ C , , p. .

6087/21
ANNEX I

PB/ek
TREE.2.B

2

EN

(1)

Article 7 of the Charter of Fundamental Rights of the European Union ("theCharter") protects the fundamental right of everyone to the respect for private andfamily life, home and communications. Respect for the confidentiality of one’s
communications is an essential dimension of this right, applying both to naturaland legal persons. Confidentiality of electronic communications ensures that
information exchanged between parties and the external elements of such
communication, including when the information has been sent, from where, towhom, is not to be revealed to anyone other than to the parties involved in acommunication. The principle of confidentiality should apply to current and futuremeans of communication, including calls, internet access, instant messaging
applications, e-mail, internet phone calls and personal messaging provided throughsocial media.

(2)

The content of electronic communications may reveal highly sensitive information
about the natural persons involved in the communication, from personal experiencesand emotions to medical conditions, sexual preferences and political views, thedisclosure of which could result in personal and social harm, economic loss orembarrassment. Similarly, metadata derived from electronic communications may
also reveal very sensitive and personal information. These metadata includes thenumbers called, the websites visited, geographical location, the time, date andduration when an individual made a call etc., allowing precise conclusions to be
drawn regarding the private lives of the persons involved in the electronic
communication, such as their social relationships, their habits and activities ofeveryday life, their interests, tastes etc.

6087/21
ANNEX I

PB/ek
TREE.2.B

3EN

(2a) Regulation (EU) 2016/679 regulates the protection of personal data. This
Regulation protects in addition the respect for private life and communications.
The provisions of this Regulation particularise and complement the general ruleson the protection of personal data laid down in Regulation (EU) 2016/679. This
Regulation therefore does not lower the level of protection enjoyed by natural
persons under Regulation (EU) 2016/679. The provisions particularise
Regulation (EU) 2016/679 as regards personal data by translating its principles
into specific rules. If no specific rules are established in this Regulation,
Regulation (EU) 2016/679 should apply to any processing of data that qualify aspersonal data. The provisions complement Regulation (EU) 2016/679 by setting
forth rules regarding subject matters that are not within the scope of Regulation(EU) 2016/679, such as the protection of the rights of end-users who are legal
persons.
Processing of electronic communications data by providers of electronic
communications services and networks should only be permitted inaccordance with this Regulation. This Regulation does not impose any
obligations on the end-user End-users who are legal persons may have rights
conferred by Regulation (EU) 2016/679 to the extent specifically required bythis Regulation

6087/21
ANNEX I

PB/ek
TREE.2.B

4

EN

(3)

Electronic communications data may also reveal information concerning legal
entities, such as business secrets or other sensitive information that has economic
value and the protection of which allows legal persons to conduct their business,
supporting among other innovation. Therefore, the provisions of this Regulation
should in principle apply to both natural and legal persons. Furthermore, thisRegulation should ensure that, where necessary, provisions of the Regulation (EU)2016/679 of the European Parliament and of the Council[1], also apply mutatis
mutandis to end-users who are legal persons. This includes the definition ofprovisions on consent under Regulation (EU) 2016/679.

(3a)This Regulation should not affect national law regulating for instance theconclusion or the validity of a contract. Similarly, this Regulation should notaffect national law in relation to determining who has the legal power torepresent legal persons in any dealings with third parties or in legal
proceedings.

(4)

Pursuant to Article 8(1) of the Charter and Article 16(1) of the Treaty on the
Functioning of the European Union, everyone has the right to the protection of
personal data concerning him or her. Regulation (EU) 2016/679 lays down rules
relating to the protection of natural persons with regard to the processing of personal
data and rules relating to the free movement of personal data. Electronic
communications data may include personal data as defined in Regulation (EU)2016/679.

6087/21
ANNEX I

PB/ek
TREE.2.B

5

EN

(5)

(6)

While the principles and main provisions of Directive 2002/58/EC of the European
Parliament and of the Council4 remain generally sound, that Directive has not fully
kept pace with the evolution of technological and market reality, resulting in aninconsistent or insufficient effective protection of privacy and confidentiality inrelation to electronic communications. Those developments include the entrance on
the market of electronic communications services that from a consumer perspective
are substitutable to traditional services, but do not have to comply with the same setof rules. Another development concerns new techniques that allow for tracking of
online behaviour of end-users, which are not covered by Directive 2002/58/EC.
Directive 2002/58/EC should therefore be repealed and replaced by this Regulation.

4

13 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processingof personal data and the protection of privacy in the electronic communications sector (Directive on privacy andelectronic communications) (OJ L 201, 31.7.2002, p.37).

6087/21
ANNEX I

PB/ek
TREE.2.B

6

EN

(7)

The Member States should be allowed, within the limits of this Regulation, tomaintain or introduce national provisions to further specify and clarify theapplication of the rules of this Regulation in order to ensure an effective applicationand interpretation of those rules. Therefore, the margin of discretion, which Member
States have in this regard, should maintain a balance between the protection ofprivate life and personal data and the free movement of electronic communications
data.

(7a)

This Regulation does not apply to the protection of fundamental rights andfreedoms related to activities which fall outside the scope of Union law, and inany event measures, processing activities and operations concerning national
security and defence, regardless of who is carrying out those operations,
whether it is a public authority or a private operator acting at the request of apublic authority.

(8)This Regulation should apply to providers of electronic communications services,and to providers of publicly available directories. This Regulation should also apply
to natural and legal persons who use electronic communications services to send
direct marketing commercial communications or make use of processing andstorage capabilities of terminal equipment or collect information processed by oremitted by or stored in end-users’ terminal equipment.

(8aaa) Furthermore, this Regulation should apply regardless of whether the processingof electronic communications data or personal data of end-users who are in theUnion takes place in the Union or not, or of whether the service provider or
person processing such data is established or located in the Union or not.

6087/21
ANNEX I

PB/ek
TREE.2.B

7EN

(8aa) Some end-users, for example providers of payment services or payment systems,
process as recipients their electronic communications data for different
purposes or request a third party to process their electronic communications
data on their behalf. It is also important that end-users, including legal entities,
have the possibility to take the necessary measures to secure their services,
networks, employees and customers from security threats or incidents.
Information security services may play an important role in ensuring thesecurity of end-users' digital sphere. For example, an end-user as an
information society service provider may process its electronic communications
data, or may request a third party, such as a provider of security technologies
and services, to process that end-user's electronic communications data on its
behalf, for purposes such as ensuring network and information security,
including the prevention, monitoring and termination of fraud, unauthorised
access and Distributed Denial of Service attacks, or facilitating efficient delivery
of website content. Processing of their electronic communications data by theend-users concerned, or by a third party entrusted by the end-users concernedto process their electronic communications data after receipt on their behalf, isshould not be covered by this Regulation. For the purpose of protecting the enduser’s terminal equipment processing upon receipt, including also just before
receipt, by a third party entrusted should not be covered by this Regulation.

(8a)This Regulation does not apply to the electronic communications data ofdeceased persons. Member States may provide for rules regarding theprocessing of electronic communications data of deceased persons.

6087/21
ANNEX I

PB/ek
TREE.2.B

8

EN

(9)

(10)

Radio equipment and its software which is placed on the internal market in theUnion, must comply with Directive 2014/53/EU of the European Parliament and of
the Council5. This Regulation should not affect the applicability of any of therequirements of Directive 2014/53/EU nor the power of the Commission to adopt
delegated acts pursuant to Directive 2014/53/EU requiring that specific categories orclasses of radio equipment incorporate safeguards to ensure that personal data andprivacy of end-users are protected.

5Directive 2014/53/EU of the European Parliament and of the Council of 16 April 2014 on theharmonisation of the laws of the Member States relating to the making available on themarket of radio equipment and repealing Directive 1999/5/EC (OJ L 153, 22.5.2014, p. 62).

6087/21
ANNEX I

PB/ek
TREE.2.B

9

EN

(11)

The services used for communications purposes, and the technical means of theirdelivery, have evolved considerably. End-users increasingly replace traditional voice
telephony, text messages (SMS) and electronic mail conveyance services in favour offunctionally equivalent online services such as Voice over IP, messaging services andweb-based e-mail services. In order to ensure an effective and equal protection of
end-users when using functionally equivalent services, this Regulation uses thedefinition of electronic communications services set forth in the Directive (EU)2018/1972 [1]6. That definition encompasses not only internet access services andservices consisting wholly or partly in the conveyance of signals but alsointerpersonal communications services, which may or may not be number-based,such as for example, Voice over IP, messaging services and web-based e-mailservices.

(11a) The protection of confidentiality of communications is crucial also as regardsinterpersonal communications services that are ancillary to another service; therefore,
the processing of electronic communications data in the context of the provisionof such type of minor ancillary services should be covered by this Regulation.

6

Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December
2018 establishing the European Electronic Communications Code (Recast). Commission
proposal for a Directive of the European Parliament and of the Council establishing theEuropean Electronic Communications Code (Recast) (COM/2016/0590 final - 2016/0288(COD)).

6087/21
ANNEX I

PB/ek
TREE.2.B

10EN

(11aa) In all the circumstances where electronic communication is taking place
between a finite, that is to say not potentially unlimited, number of end-users
which is determined by the sender of the communications, e.g. any messaging
application allowing two or more people to connect and communicate, suchservices constitute interpersonal communications services. Conversely, acommunications channel does not constitute an interpersonal communications
service when it does not enable direct interpersonal and interactive exchange of
information via electronic communications networks between a finite number of
persons, whereby the persons initiating or participating in the communication
determine its recipient(s). This is for example the case when the entity providing
the communications channel is at the same time a communicating party, such as
a company that operates a communications channel for customer care thatallows customers solely to communicate with the company in question. Also,
where access to an electronic communications is available for anyone, e.g.
communications in an electronic communications channel in online games which
is open to all persons playing the game, such channel does not constitute aninterpersonal communications feature. This reflects the end-users' expectations
regarding the confidentiality of a service.

6087/21
ANNEX I

PB/ek
TREE.2.B

11

EN

(12)

The use of machine-to-machine and Internet of Things services, that is to say
services involving an automated transfer of data and information between
devices or software-based applications with limited or no human interaction, isemerging. In order to ensure full protection of the rights to privacy andconfidentiality of communications, and to promote a trusted and secure Internetof Things in the digital single market, this Regulation, in particular therequirements relating to the confidentiality of communications, should apply tothe transmission of such services. The transmission of machine-to-machine orInternet of Things services regularly involves the conveyance of signals via anelectronic communications network and, hence, constitutes an electronic
communications service. This Regulation should apply to the provider of thetransmission service if that transmission is carried out via a publicly available
electronic communications service or network. Conversely, where thetransmission of machine-to-machine or Internet of Things services is carried out
via a private or closed network such as a closed factory network, this Regulation
should not apply. Typically, providers of machine-to-machine or Internet ofThings services operate at the application layer (on top of electronic
communications services). These service providers and their customers who use
IoT services are in this respect end-users, and not providers of the electronic
communication service and therefore benefit from the protection ofconfidentiality of their electronic communications data. Specific safeguards could
also be adopted under sectorial legislation, as for instance Directive 2014/53/EU.

6087/21
ANNEX I

PB/ek
TREE.2.B

12

EN

(13)

The development of fast and efficient wireless technologies has fostered theincreasing availability for the public of internet access via wireless networks
accessible by anyone in public and semi-private spaces such as 'hotspots' situated at
different places within a city, department stores, shopping malls and hospitals. To theextent that those communications networks are provided to an undefined group of
end-users, regardless if these networks are secured with passwords or not, theconfidentiality of the communications transmitted through such networks should beprotected. The fact that wireless electronic communications services may be ancillary
to other services should not stand in the way of ensuring the protection ofconfidentiality of communications data and application of this Regulation. Therefore,
this Regulation should apply to electronic communications data using publicly
available electronic communications services and public electronic communications
networks. In contrast, this Regulation should not apply to closed groups of end-users
such as home (fixed or wireless) networks or corporate networks or networks towhich the, access is limited to a pre-defined group of end-users, e.g. to family
members or, members of a corporation. Similarly, this Regulation does not apply
to data processed by services or networks used for purely internal
communications purposes between public institutions, courts, court
administrations, financial, social and employment administrations. As soon aselectronic communications data is transferred from such a closed group
network to a public electronic communications network, this Regulation applies
to such data, including when it is M2M/IoT and personal/home assistant data.
The provisions of this Regulation regarding the protection of end-users'
terminal equipment information also apply in the case of terminal equipment
connected to a closed group network such as a home (fixed or wireless) network
which in turn is connected to a public electronic communications network.

6087/21
ANNEX I

PB/ek
TREE.2.B

13

EN

(14)

Electronic communications data should be defined in a sufficiently broad andtechnology neutral way so as to encompass any information concerning the content
transmitted or exchanged (electronic communications content) and the information
concerning an end-user of electronic communications services processed for the
purposes of transmitting, distributing or enabling the exchange of electronic
communications content; including data to trace and identify the source anddestination of a communication, geographical location and the date, time, durationand the type of communication. Whether such signals and the related data areconveyed by wire, radio, optical or electromagnetic means, including satellite
networks, cable networks, fixed (circuit- and packet-switched, including internet) andmobile terrestrial networks, electricity cable systems, the data related to such signals
should be considered as electronic communications metadata and therefore be subject
to the provisions of this Regulation. Electronic communications metadata may
include information that is part of the subscription to the service when suchinformation is processed for the purposes of transmitting, distributing or exchanging
electronic communications content.

(15)

Electronic communications data should be treated as confidential. This means that
any interference of electronic communications data, whether directly by humanintervention or through the intermediation of automated processing by machines,
without the consent of the communicating parties should be prohibited. Interceptionof electronic communications data may occur, for example, when someone other thanthe communicating parties, listens to calls, reads, scans or stores the content ofelectronic communications, or the associated metadata for purposes other than theexchange of communications. Interception also occurs when third parties monitor
websites visited, timing of the visits, interaction with others, etc., without the consent
of the end-user concerned. As technology evolves, the technical ways to engage ininterception have also increased. Such ways may range from the installation ofequipment that gathers data from terminal equipment over targeted areas, such as theso-called IMSI (International Mobile Subscriber Identity) catchers, to programs andtechniques that, for example, surreptitiously monitor browsing habits for the purpose

6087/21
ANNEX I

PB/ek
TREE.2.B

14EN

of creating end-user profiles. Other examples of interception include capturing
payload data or content data from unencrypted wireless networks and routers,
including browsing habits without the end-users' consent.

(15aa) In order to ensure the confidentiality of electronic communications data,
providers of electronic communications services should apply security measuresin accordance with Article 40 of Directive (EU) 2018/1972 and Article 32 ofRegulation (EU) 2016/679.

(15aaa) Moreover, trade secrets are protected in accordance with Directive (EU)2016/943.

(15a) The prohibition of interception of electronic communications content under thisRegulation should apply until receipt of the content of the electronic
communication by the intended addressee, i.e. during the end-to-end exchangeof electronic communications content between end-users. Receipt implies thatthe end-user gains control over, and has the possiblity to interact with, theindividual electronic communications content, for example by recording,storing, printing or otherwise processing such data, including for security
purposes. The exact moment of the receipt of electronic communications content
may depend on the type of electronic communications service that is provided.
For instance, depending on the technology used, a voice call may be completed
as soon as either of the end-users ends the call. For electronic mail or instantmessaging, depending on the technology used, the moment of receipt may be assoon as the addressee has collected the message, typically from the server of theelectronic communications service provider. Upon receipt, electronic
communications content and related metadata should be erased or madeanonymous in such a manner that no natural or legal person is identifiable, by
the provider of the electronic communications service except when processing ispermitted under this Regulation After electronic communications content has
been received by the intended end-user or end-users, it may be recorded orstored by those end-users. End-users are free to mandate a third party to recordor store such data on their behalf.

6087/21
ANNEX I

PB/ek
TREE.2.B

15

EN

(16)

The prohibition of processing, including storage of communications is not intended
to prohibit any automatic, intermediate and transient processing, including storageof this information insofar as this takes place for the sole purpose of carrying out thetransmission in the electronic communications network. Processing of electronic
communications data by providers of electronic communications services andnetworks should only be permitted in accordance with this Regulation. It should
not prohibit the processing of electronic communications data without consent of
the end-user to ensure the security, including the availability, authenticity,
integrity or confidentiality, of the electronic communications services, including
for example checking security threats such as the presence of malware or viruses,or the identification of phishing. Security measures are essential to prevent
personal data breaches in electronic communications. Spam electronic messages
may also affect the availability of the respective services and could potentially
impact the performance of networks and services, which justifies the processingof electronic communications data to mitigate this risk. Such security measures,
including anti-spam measures, should be proportionate and should be
performed in the least intrusive manner. Providers of electronic
communications services are encouraged to offer end-users the possibility tocheck electronic messages deemed as spam in order to ascertain whether they
were indeed spam.

6087/21
ANNEX I

PB/ek
TREE.2.B

16EN

(16a) The protection of the content of electronic communications pertains to the essenceof the fundamental right to respect for private and family life, home andcommunications protected under Article 7 of the Charter. Any interference with thecontent of electronic communications should be allowed only under very clear
defined conditions, for specific purposes and be subject to adequate safeguards
against abuse. This Regulation provides for the possibility of providers of electronic
communications services to process electronic communications content in transit,
with the informed consent of all the end-users concerned. For example, providers
may offer services that entail the scanning of emails to remove certain pre-definedmaterial. Given the sensitivity of the content of communications, this Regulation sets
forth a presumption that the processing of such content data will result in high risks
to the rights and freedoms of natural persons. When processing such type of content,
the provider of the electronic communications service should consult the supervisory
authority if necessary pursuant to Article 36 (1) of Regulation (EU) 2016/679.
Such consultation should be in accordance with Article 36 (2) and (3) of Regulation(EU) 2016/679. The presumption does not encompass the processing of content toprovide a service requested by the end-user where the end-user has consented to suchprocessing and it is carried out for the purposes and duration strictly necessary andproportionate for such service.

6087/21
ANNEX I

PB/ek
TREE.2.B

17EN

(16b) Services that facilitate end-users everyday life such as index functionality,
personal assistant, translation services and services that enable more inclusion
for persons with disabilities such as text-to-speech services are emerging.
Processing of electronic communication content might be necessary also forsome functionalities used normally in services for individual use, such as
searching and organising the messages in email or messaging applications.
Therefore, as regards the processing of electronic communications content forservices requested by the end-user for their own individual use, consent should
only be requested required from the end-user requesting the service taking into
account that the processing should not adversely affect fundamental rights andinterest of another end-user concerned. Processing of electronic communications
data should be allowed with the prior consent of the end-user concerned and to
the extent necessary for the provision of the requested functionalities.

(16c) Providers of electronic communications services may, for example, obtain theconsent of the end-user for the processing of electronic communications data, at
the time of the conclusion of the contract, and any moment in time thereafter.
In some cases, the legal person having subscribed to the electronic
communications service may allow a natural person, such as an employee, tomake use of the service in accordance with Regulation 2016/679.

6087/21
ANNEX I

PB/ek
TREE.2.B

18

EN

(17)

The processing of electronic communications metadata can be useful for businesses,
consumers and society as a whole. Vis-à-vis Directive 2002/58/EC, this Regulation
broadens the possibilities for providers of electronic communications services toprocess electronic communications metadata. However, end-users attach great
importance to the confidentiality of their communications, including their online
activities, and they also want to control the use of electronic communications
metadata for purposes other than conveying the communication. Therefore,
providers of electronic communications networks and services should be permitted
to process electronic communications metadata after having obtained the endusers' consent. In addition, those providers should be permitted to process an
end-user’s electronic communications metadata where it is necessary for theprovision of an electronic communications service based on a contract with that
end-user and for billing related to that contract. Examples of commercial usagesof electronic communications metadata by providers of electronic communications
services may include the provision of heat maps; a graphical representation of datausing colours to indicate the presence of individuals. To display the traffic
movements in certain directions during a certain period of time, an identifier isnecessary to link the positions of individuals at certain time intervals. This identifier
would be missing if anonymous data were to be used and such movement could not
be displayed. Such usage of electronic communications metadata could, for example,
benefit public authorities and public transport operators to define where to develop
new infrastructure, based on the usage of and pressure on the existing structure.
Where a type of processing of electronic communications metadata, in particularusing new technologies, and taking into account the nature, scope, context andpurposes of the processing, is likely to result in a high risk to the rights and freedomsof natural persons, a data protection impact assessment and, as the case may be, aconsultation of the supervisory authority should take place prior to the processing, in
accordance with Articles 35 and 36 of Regulation (EU) 2016/679.

6087/21
ANNEX I

PB/ek
TREE.2.B

19EN

(17aa) Further processing for purposes other than for which the metadata where
initially collected may take place without the consent of the end-users
concerned, provided that such processing is compatible with the purpose forwhich the metadata are initially collected, certain additional conditions andsafeguards set out by this Regulation are complied with, including therequirement to genuinely anonymise the result before sharing the analysis withthird parties. As end-users attach great value to the confidentiality of theircommunications, including their physical movements, such data cannot be used
to determine the nature or characteristics on an end-user or to build a profile ofan end-user, in order to, for example, avoid that the data is used forsegmentation purposes, to monitor the behaviour of a specific end-user or to
draw conclusions concerning the private life of an end-user. For the same
reason, the end-user must be provided with information about these processing
activities taking place and given the right to object to such processing.

(17a) The processing of electronic communications metadata should also be regarded
to be permitted where it is necessary in order to protect an interest which isessential for the life of the end-users who are natural persons or that of anothernatural person. Processing of electronic communications metadata for theprotection of vital interests of the end-user may include for instance processing
necessary for humanitarian purposes, including for monitoring epidemics andtheir spread or in humanitarian emergencies, in particular natural and manmade disasters. Processing of electronic communications metadata of an enduser for the protection of the vital interest of an end-user who is a natural
person should in principle take place only where the processing cannot be
manifestly based on another legal basis and where the protection of suchinterests cannot be ensured without that processing.

6087/21
ANNEX I

PB/ek
TREE.2.B

20EN

(17b) Processing of electronic communication metadata for scientific research or
statistical purposes could also be considered to be permitted processing. This
type of processing should be subject to safeguards to ensure privacy of the endusers by employing appropriate security measures such as encryption andpseudonymisation. In addition, end-users who are natural persons should begiven the right to object. Processing for statistical counting and scientificpurposes should only result in aggregated data, and not be used in support ofmeasures or decisions regarding any particular natural person. In particular,such data should not be used to determine the nature or characteristics of an
end-user, to build an individual profile or to draw conclusions concerning an
end-user private life. Such usage of electronic communications metadata could,
for example, benefit public authorities and public transport operators to define
where to develop new infrastructure, based on the usage of and pressure on theexisting structure. Such usage should also include processing that is necessary
for the development, production and dissemination of official national or
European statistics in accordance with national or Union law, to the extent
necessary for this purpose.

6087/21
ANNEX I

PB/ek
TREE.2.B21

EN(18) End-users may consent to the processing of their metadata to receive specific services
such as protection services against fraudulent activities (by analysing usage data,
location and customer account in real time). In the digital economy, services areoften supplied against counter-performance other than money, for instance by endusers being exposed to advertisements. For the purposes of this Regulation, consent
of an end-user, regardless of whether the latter is a natural or a legal person, shouldhave the same meaning and be subject to the same conditions as the data subject's
consent under Regulation (EU) 2016/679. Basic broadband internet access and voicecommunications services are to be considered as essential services for individuals tobe able to communicate and participate to the benefits of the digital economy.
Consent for processing electronic communications data from internet or voicecommunication usage will not be valid if the data subject end-user has no genuine
and free choice or is unable to refuse or withdraw consent without detriment.

(19)

Third parties are legal or natural person that do not provide an electronic
communications service to the end-user concerned. However, sometimes thesame legal or natural person can also provide different kind of services to thesame end-user, for example information society service such as cloud storage.
With respect to the provision of this other service, the same legal person isnormally deemed to be a third party. If the other service is necessary for theprovision of the electronic communication service, such as automatic storage ofthe messages in the cloud by web-based email, the provider of such a service
normally is not deemed to be a third party.

6087/21
ANNEX I

PB/ek
TREE.2.B22EN(20) Terminal equipment of end-users of electronic communications networks and any
information relating to the usage of such terminal equipment, in particular wheresuch information is processed by, stored in, or collected from such equipment, or
where information is collected from it or processed in order to enable it to connect
to another device and or network equipment, are part of the end-user's private
sphere, including the privacy of one’s communications, and require protection inaccordance with the Charter of Fundamental Rights of the European Union. Given
that such equipment contains or processes information that may reveal details of anindividual's emotional, political, social complexities, including the content ofcommunications, pictures, the location of individuals by accessing the device’s GPS
capabilities, contact lists, and other information already stored in the device, theinformation related to such equipment requires enhanced privacy protection.
Furthermore, the so-called spyware, web bugs, hidden identifiers, tracking cookies
and other similar unwanted tracking tools can enter end-user's terminal equipment
without their knowledge in order to gain access to information, to store hidden
information and to trace the activities. Information related to the end-user’s device
may also be collected remotely for the purpose of identification and tracking, using
techniques such as the so-called ‘device fingerprinting’, often without the knowledgeof the end-user, and may seriously intrude upon the privacy of these end-users.
Techniques that surreptitiously monitor the actions of end-users, for example bytracking their activities online or the location of their terminal equipment, or subvert
the operation of the end-users’ terminal equipment pose a serious threat to theprivacy of end-users. Therefore, the use of processing and storage capabilities andthe collection of information from end-user's terminal equipment should be allowed
only with the end-user's consent and or for other specific and transparent purposesas laid down in this Regulation. The information collected from end-user’s
terminal equipment can often contain personal data.

6087/21
ANNEX I

PB/ek
TREE.2.B23EN

(20aa) In light of the principle of purpose limitation laid down in Article 5 (1) (b) ofRegulation (EU) 2016/679, it should be possible to process in accordance withthis Regulation data collected from the end-user's terminal equipment for
purposes compatible with the purpose for which it was collected from the enduser’s terminal equipment.

(20aaa) The responsibility for obtaining consent for the storage of a cookie or similar
identifier lies on the entity that makes use of processing and storage capabilities
of terminal equipment or collects information from end-users’ terminal
equipment, such as an information society service provider or ad network
provider. Such entities may request another party to obtain consent on theirbehalf. The end-user's consent to storage of a cookie or similar identifier may
also entail consent for the subsequent readings of the cookie in the context of arevisit to the same website domain initially visited by the end-user.

6087/21
ANNEX I

PB/ek
TREE.2.B24EN

(20aaaa) In contrast to access to website content provided against monetary payment,
where access is provided without direct monetary payment and is madedependent on the consent of the end-user to the storage and reading of cookies
for additional purposes, requiring such consent would normally not be
considered as depriving the end-user of a genuine choice if the end-user is able
to choose between services, on the basis of clear, precise and user-friendly
information about the purposes of cookies and similar techniques, between anoffer that includes consenting to the use of cookies for additional purposes on
the one hand, and an equivalent offer by the same provider that does not involve
consenting to data use for additional purposes, on the other hand. Conversely, insome cases, making access to website content dependent on consent to the use ofsuch cookies may be considered, in the presence of a clear imbalance between
the end-user and the service provider as depriving the end-user of a genuine
choice. This would normally be the case for websites providing certain services,such as those provided by public authorities. Similarly, such imbalance could
exist where the end-user has only few or no alternatives to the service, and thus
has no real choice as to the usage of cookies for instance in case of service
providers in a dominant position.

To the extent that use is made of processing and storage capabilities of terminal
equipment and information from end-users’ terminal equipment is collected forother purposes than for what is necessary for the purpose of providing an electronic
communication service or for the provision of the service requested, consent should
be required. In such a scenario, consent should normally be given by the end-user
who requests the service from the provider of the service.

6087/21
ANNEX I

PB/ek
TREE.2.B25EN

(20a) End-users are often requested to provide consent to the storage and access tostored data in their terminal equipment, due to the ubiquitous use of tracking
cookies and similar tracking technologies. As a result, end-users may beoverloaded with requests to provide consent. This can lead to a situation whereconsent request information is no longer read and the protection offered byconsent is undermined. Implementation of technical means in electronic
communications software to provide specific and informed consent throughtransparent and user-friendly settings, can be useful to address this issue.
Where available and technically feasible, an end user may therefore grant,
through software settings, consent to a specific provider for the use ofprocessing and storage capabilities of terminal equipment for one or multiple
specific purposes across one or more specific services of that provider. For
example, an end-user can give consent to the use of certain types of cookies bywhitelisting one or several providers for their specified purposes. Providers ofsoftware are encouraged to include settings in their software which allows endusers, in a user friendly and transparent manner, to manage consent to thestorage and access to stored data in their terminal equipment by easily setting
up and amending whitelists and withdrawing consent at any moment. In light ofend-user’s self-determination, consent directly expressed by an end-user should
always prevail over software settings. Any consent requested and given by an
end-user to a service should be directly implemented, without any further delay,by the applications of the end user’s terminal. If the storage of information or
the access of information already stored in the end-user’s terminal equipment ispermitted, the same should apply.

6087/21
ANNEX I

PB/ek
TREE.2.B

26

EN

(21)

Use of the processing and storage capabilities of terminal equipment or access to
information stored in terminal equipment without the consent of the end-user
should be limited to situations that involve no, or only very limited, intrusion ofprivacy. For instance, consent should not be requested for authorizing the technicalstorage or access which is necessary and proportionate for the purpose of providing
a specific service requested by the end-user. This may include the storing of cookies
for the duration of a single established session on a website to keep track of the enduser’s input when filling in online forms over several pages, authentication session
cookies used to verify the identity of end-users engaged in online transactions or
cookies used to remember items selected by the end-user and placed in shoppingbasket. In the area of IoT services which rely on connected devices (such as
connected thermostats, connected medical devices, smart meters or automatedand connected vehicles), the use of the processing and storage capacities of thosedevices and access to information stored therein should not require consent to
the extent that such use or access is necessary for the provision of the service
requested by the end-user. For example, storing of information in or accessing
information from a smart meter might be considered as necessary for theprovision of a requested energy supply service to the extent the information
stored and accessed is necessary for the stability and security of the energy
network or for the billing of the end-users' energy consumption. The same
applies for instance to storing, processing or accessing of information fromautomated and connected vehicles for security related software updates.

6087/21
ANNEX I

PB/ek
TREE.2.B27EN

(21aa) In some cases the use of processing and storage capabilities of terminal
equipment and the collection of information from end-users' terminal
equipment may also be necessary for providing a service, requested by the enduser, such as services provided in accordance with the freedom of expression
and information including for journalistic purposes, e.g. online newspaper orother press publications as defined in Article 2 (4) of Directive (EU) 2019/790,
that is wholly or mainly financed by advertising provided that, in addition, theend-user has been provided with clear, precise and user-friendly information
about the purposes of cookies or similar techniques and has accepted such use.

(21a) Cookies can also be a legitimate and useful tool, for example, in assessing theeffectiveness of a delivered information society service, for example of website
design and advertising or by helping to measure the numbers of end-users
visiting a website, certain pages of a website or the number of end-users of an
application. This is not the case, however, regarding cookies and similar
identifiers used to determine the nature of who is using the site, which always
require the consent of the end-user. Information society providers that engage in
configuration checking to provide the service in compliance with the end-user's
settings and the mere logging of the fact that the end-user’s device is unable toreceive content requested by the end-user should not constitute access to such a
device or use of the device processing capabilities.

6087/21
ANNEX I

PB/ek
TREE.2.B28EN

(21b) Consent should not be necessary either when the purpose of using theprocessing storage capabilities of terminal equipment is to fix security
vulnerabilities and other security bugs or for software-updates for security
reasons, provided that the end-user concerned has been informed prior to such
updates, and provided that such updates do not in any way change thefunctionality of the hardware or software or the privacy settings chosen by theend-user and the end-user has the possibility to postpone or turn off theautomatic installation of such updates. Software updates that do not exclusively
have a security purpose, for example those intended to add new features to an
application or improve its performance, should not fall under this exception.

(22)

(23)

(24)

(25)

Accessing electronic communications networks requires the regular emission ofcertain data packets in order to discover or maintain a connection with the network orother devices on the network. Furthermore, devices must have a unique address
assigned in order to be identifiable on that network. Wireless and cellular telephone
standards similarly involve the emission of active signals containing unique
identifiers such as a MAC address, the IMEI (International Mobile Station
Equipment Identity), the IMSI, the WiFi signal etc. A single wireless base station(i.e. a transmitter and receiver), such as a wireless access point, has a specific range
within which such information may be captured. Service providers have emerged
who offer physical movements' tracking services based on the scanning ofequipment related information with diverse functionalities, including people
counting, such as providing data on the number of people waiting in line,
ascertaining the number of people in a specific area, referred to as statisticalcounting for which the consent of end-users is not needed, provided that suchcounting is limited in time and space to the extent necessary for this purpose.
Providers should also apply appropriate technical and organisations measures

6087/21
ANNEX I

PB/ek
TREE.2.B

29

ENto ensure the level if security appropriate to the risks, including
pseudonymisation of the data and making it anonymous or erase it as soon it is
not longer needed for this purpose. Providers engaged in such practices should
display prominent notices located on the edge of the area of coverage informing
end-users prior to entering the defined area that the technology is in operation
within a given perimeter, the purpose of the tracking, the person responsible forit and the existence of any measure the end-user of the terminal equipment cantake to minimize or stop the collection. Additional information should be
provided where personal data are collected pursuant to Article 13 of Regulation(EU) 2016/679. This information may be used for more intrusive purposes, whichshould not be considered statistical counting, such as to send commercial
messages to end-users, for example when they enter stores, with personalized offers
locations, subject to the conditions laid down in this Regulation, as well as the
tracking of individuals over time, including repeated visits to specified locations.

(25a) Processing the information emitted by the terminal equipment to enable it toconnect to another device would be permitted if the end-user has given consent
or if it is necessary for the provision of a service requested by the end-user. Thiskind of processing might be necessary for example for the provision of some
IoT related services.

(26)

When the processing of electronic communications data by providers of electronic
communications services falls within its scope, this Regulation should provide for the
possibility for the Union or Member States under specific conditions to restrict bylaw certain obligations and rights, including by way of derogations, when such a
restriction constitutes a necessary and proportionate measure in a democratic society
to safeguard specific public interests, including public security and the prevention,
investigation, detection or prosecution of criminal offences, or the execution of
criminal penalties, including the safeguarding against and the prevention of threats topublic security and other important objectives of general public interest of the Union
or of a Member State, in particular an important economic or financial interest of theUnion or of a Member State, or a monitoring, inspection or regulatory function
connected to the exercise of official authority for such interests. Therefore, this6087/21
ANNEX I

PB/ek
TREE.2.B

30

EN

Regulation should not affect the ability of Member States to carry out lawfulinterception of electronic communications, including by requiring providers toenable and assist competent authorities in carrying out lawful interceptions, ortake other measures, such as legislative measures providing for the retention ofdata for a limited period of time, if necessary and proportionate to safeguard the
public interests mentioned above, in accordance with the Charter of Fundamental
Rights of the European Union and the European Convention for the Protection of
Human Rights and Fundamental Freedoms, as interpreted by the Court of Justice of
the European Union and of the European Court of Human Rights. Providers ofelectronic communications services should provide for appropriate procedures tofacilitate legitimate requests of competent authorities, where relevant also taking into
account the role of the representative designated pursuant to Article 3(3).

(27)

As regards calling line identification, it is necessary to protect the right of the calling
party to withhold the presentation of the identification of the line from which the callis being made and the right of the called party to reject calls from unidentified lines.
Certain end-users, in particular help lines, and similar organisations, have an interestin guaranteeing the anonymity of their callers. As regards connected line
identification, it is necessary to protect the right and the legitimate interest of thecalled party to withhold the presentation of the identification of the line to which thecalling party is actually connected.

6087/21
ANNEX I

PB/ek
TREE.2.B

31

EN

(28)

There is justification for overriding the elimination of calling line identification
presentation in specific cases. End-users' rights to privacy with regard to calling line
identification should be restricted where this is necessary to trace malicious or
nuisance calls and with regard to calling line identification and location data where
this is necessary to allow emergency services, such as eCall, to carry out their tasks
as effectively as possible. Location information established by the terminal
equipment, using its built-in Global Navigation Satellite Systems (GNSS)
capabilities or other types of terminal equipment based location data, such as
location data derived from the WiFi functionality, may supplement the location
data supplied by providers of number-based interpersonal communications
services when a call is made to emergency services. The temporary denial orabsence of consent of an end-user to access location data provided by theterminal equipment GNSS, for example, because location settings are turned off,shall not prevent the transfer of such information to emergency services for the
purposes of facilitating access to such services. Directive 2014/53/EU empowers
the Commission to adopt delegated acts requiring that specific categories orclasses of radio equipment support certain features ensuring access toemergency services.

6087/21
ANNEX I

PB/ek
TREE.2.B

32

EN

(29)

Technology exists that enables providers of electronic communications services tolimit the reception of unwanted, malicious or nuisance calls by end-users in
different ways, including blocking silent calls and other unwanted, malicious andnuisance calls, such as calls originating from invalid numbers, i.e. numbers that
do not exist in the numbering plan, valid numbers that are not allocated to a
provider of a number-based interpersonal communications service, and valid
numbers that are allocated but not assigned to an end-user. Providers of numberbased interpersonal communications services should deploy this technology andprotect end-users against such calls free of charge. Providers should ensure that endusers are aware of the existence of such functionalities, for instance, by publicising
the fact on their webpage.

(30)

Publicly available directories means any directory or service containing information
on end-users of number-based interpersonal communication services such as
name, phone numbers (including mobile phone numbers), email address, homeaddress and includes inquiry services, the main function of which is to enable toidentify such end-users. End-users that are natural persons should be asked forconsent before their personal data are included in a directory, unless Member
States provide that such end-users have the right to object to inclusion of theirpersonal data. The legitimate interest of legal persons requires that end-users thatare legal persons have the right to object to the data related to them being included ina directory. End-users who are natural persons acting in a professional capacity
should be treated as legal persons for the purpose of the provisions on publicly
available directories.

6087/21
ANNEX I

PB/ek
TREE.2.B

33

EN

(31)

Providers of number-based interpersonal communications services should
inform the end-users who are natural persons of the search functions of thedirectory and obtain their consent before enabling such search functions related
to their personal data. The categories of personal data included in the directory andthe categories of personal data on the basis of which the end-user's contact details canbe searched should not necessarily be the same.

(32)

In this Regulation, direct marketing communications refers to any form ofadvertising sent by a natural or legal person directly to one or more specific endusers using publicly available electronic communications services.

The provisions on direct marketing communications do should not apply toother form of marketing or advertising that is not sent directly to any specificend-user for reception by that end-user at addresses, number or other contact
details, e.g. the display of advertising on a visited website or within an
information society service requested by that end-user. In addition to directcommunications advertising for the offering of products and services forcommercial purposes, Member States may decide that direct marketing
communications may include direct marketing communications sent by politicalparties that contact natural persons via publicly available electronic communications
services in order to promote their parties. The same applies to messages sent by othernon-profit organisations to support the purposes of the organisation.

6087/21
ANNEX I

PB/ek
TREE.2.B

34

EN

(33)

Safeguards should be provided to protect end-users against direct marketing
communications, which intrude into the privacy of end-users. The degree of privacy
intrusion and nuisance is considered relatively similar independently of the wide
range of technologies and channels used to conduct these electronic communications,
whether using automated calling and communication systems, instant messaging
applications, emails, SMS, MMS, Bluetooth, etc. It is therefore justified to requirethat consent of the end-users who are natural persons is obtained before direct
marketing communications are sent to them in order to effectively protect themagainst the intrusion into their private life. Legal certainty and the need to ensure thatthe rules protecting against direct marketing communications remain future-proof
justify the need to define in principle a single set of rules that do not vary according
to the technology used to convey these direct marketing communications, while atthe same time guaranteeing an equivalent level of protection for all citizens
throughout the Union. However, it is reasonable to allow the use of contact details
for electronic message within the context of an existing customer relationship forthe offering of similar products or services. Such possibility should only apply to thesame company that has obtained the contact details for electronic message inaccordance with Regulation (EU) 2016/679.

(33a) Voice-to-voice direct marketing calls that do not involve the use of automated callingand communication systems are more costly for the sender and impose no financial
costs on end-users. Member States should therefore be able to establish and or
maintain national systems which allow all or certain types of voice-to-voice calls to
end-users who are natural persons and who have not objected, including in thecontext of an existing customer relationship.

6087/21
ANNEX I

PB/ek
TREE.2.B

35

EN

(34)

When end-users who are natural persons have provided their consent to receiving
direct marketing communications, they should still be able to withdraw theirconsent at any time in an easy manner and without any cost to them. To facilitate
effective enforcement of Union rules on direct marketing communications, it isnecessary to prohibit the masking of the identity and the use of false identities, false
return addresses or numbers while sending direct marketing communications.
Direct marketing communications should therefore be clearly recognizable as suchand should indicate the identity of the legal or the natural person sending or thecommunication and, where applicable, on whose behalf the communication is sent
and provide the necessary information for end-users who are natural persons toexercise their right to withdraw their consent to receiving further direct marketing
communications, such as valid contact details (e.g. link, e-mail address) which
can be easily used by end-users who are natural persons to withdraw theirconsent free of charge.

(35)

Legal or natural persons conducting direct marketing communications through voiceto-voice calls and through calls by automating calling and communication systems
should present their identity line on which the company can be called. Member
States are encouraged to introduce by means of national law a specific code or
prefix identifying the fact that the call is a direct marketing call to improve thetools provided for the end-users in order to protect their privacy in more
efficient manner. Using a specific code or prefix should not relieve the legal or
natural persons sending direct marketing call from the obligation to present
their calling line identification.

(37)

6087/21
ANNEX I

PB/ek
TREE.2.B

36

EN

(38)

Member States should be able to have more than one supervisory authority, to reflect
their constitutional, organisational and administrative structure. The designation ofsupervisory authorities responsible for the monitoring of the application of thisRegulation cannot affect the right of natural persons to have compliance withrules regarding the protection of personal data subject to control by anindependent authority in accordance with Article 8(3) of the Charter asinterpreted by the Court. End-users who are legal persons should have the samerights as end-users who are natural persons regarding any supervisory
authority entrusted to monitor any provisions of this Regulation. Eachsupervisory authority should be provided with the additional financial andhuman resources, premises and infrastructure necessary for the effective
performance of the additional tasks designated under this Regulation.

(39)

Each supervisory authority should be competent on the territory of its own Member
State to exercise the powers and to perform the tasks set forth in this Regulation.
Member States and their supervisory authorities are encouraged to take account of
the specific needs of micro, small and medium-sized enterprises in the application ofthis Regulation.

6087/21
ANNEX I

PB/ek
TREE.2.B

37

EN

(40)

In order to strengthen the enforcement of the rules of this Regulation, eachsupervisory authority should have the power to impose penalties including
administrative fines for any infringement of this Regulation, in addition to, or insteadof any other appropriate measures pursuant to this Regulation. This Regulation
should indicate infringements and the upper limit and criteria for setting the related
administrative fines, which should be determined by the competent supervisory
authority in each individual case, taking into account all relevant circumstances ofthe specific situation, with due regard in particular to the nature, gravity and durationof the infringement and of its consequences and the measures taken to ensurecompliance with the obligations under this Regulation and to prevent or mitigate theconsequences of the infringement. For the purpose of setting a fine under thisRegulation, an undertaking should be understood to be an undertaking in accordancewith Articles 101 and 102 of the Treaty.

6087/21
ANNEX I

PB/ek
TREE.2.B

38

EN

(41)

In order to fulfil the objectives of this Regulation, namely to protect the fundamental
rights and freedoms of natural persons and in particular their right to the protection of
personal data and to ensure the free movement of personal data within the Union, thepower to adopt acts in accordance with Article 290 of the Treaty should be delegatedto the Commission to supplement this Regulation. In particular, delegated acts should
be adopted in respect of the information to be presented, including by means ofstandardised icons in order to give an easily visible and intelligible overview of thecollection of information emitted by terminal equipment, its purpose, the person
responsible for it and of any measure the end-user of the terminal equipment can taketo minimise the collection. It is of particular importance that the Commission carries
out appropriate consultations and that those consultations be conducted in accordancewith the principles laid down in the Interinstitutional Agreement on Better LawMaking of 13 April 2016[1]. In particular, to ensure equal participation in the
preparation of delegated acts, the European Parliament and the Council receive all
documents at the same time as Member States' experts, and their experts
systematically have access to meetings of Commission expert groups dealing withthe preparation of delegated acts. Furthermore, in order to ensure uniform conditions
for the implementation of this Regulation, implementing powers should be conferredon the Commission when provided for by this Regulation. Those powers should be
exercised in accordance with Regulation (EU) No 182/2011.

6087/21
ANNEX I

PB/ek
TREE.2.B

39

EN

(42)

Since the objective of this Regulation, namely to ensure an equivalent level ofprotection of natural and legal persons and the free flow of electronic
communications data throughout the Union, cannot be sufficiently achieved by theMember States and can rather, by reason of the scale or effects of the action, be better
achieved at Union level, the Union may adopt measures, in accordance with theprinciple of subsidiarity as set out in Article 5 of the Treaty on European Union. In
accordance with the principle of proportionality as set out in that Article, thisRegulation does not go beyond what is necessary in order to achieve that objective.

(43)

Directive 2002/58/EC should be repealed.

HAVE ADOPTED THIS REGULATION

6087/21
ANNEX I

PB/ek
TREE.2.B

40

ENCHAPTER I

GENERAL PROVISIONS

Article 1

Subject matter

1.

This Regulation lays down rules regarding the protection of fundamental rights
and freedoms of natural and legal persons in the provision and use of electronic
communications services, and in particular, the rights to respect for private lifeand communications and the protection of natural persons with regard to theprocessing of personal data.

1a.

This Regulation lays down rules regarding the protection of the fundamental
rights and freedoms of legal persons in the provision and use of theelectronic communications services, and in particular their rights to respectof communications.

2.

The free movement of electronic communications data and electronic
communications services within the Union shall be neither restricted nor
prohibited for reasons related to the respect for the private life andcommunications of natural persons and the protection of natural persons withregard to the processing of personal data, and for protection of communicationsof legal persons.

6087/21
ANNEX I

PB/ek
TREE.2.B

41

EN

3.

The provisions of this Regulation particularise and complement Regulation (EU)2016/679 by laying down specific rules for the purposes mentioned in paragraphs
1 to 2.

Article 2

Material Scope

1.

This Regulation applies to:(a)the processing of electronic communications content and of electronic
communications metadata carried out in connection with the provision and theuse of electronic communications services;(b)

end-users' terminal equipment information.

(c)the offering of a publicly available directory of end-users of electronic
communications services;(d)the sending of direct marketing communications to end-users.

2.

This Regulation does not apply to:(a)activities, which fall outside the scope of Union law, and in any event measures,processing activities and operations concerning national security and defence,
regardless of who is carrying out those activities whether it is a public authority
or a private operator acting at the request of a public authority;

6087/21
ANNEX I

PB/ek
TREE.2.B

42

EN

(b)

activities of the Member States which fall within the scope of Chapter 2 of Title Vof the Treaty on European Union;(c)electronic communications services which are not publicly available;(d)activities, including data processing activities, of competent authorities for the
purposes of the prevention, investigation, detection or prosecution of criminal
offences or the execution of criminal penalties, including the safeguarding against
and the prevention of threats to public security;(e)electronic communications data processed after receipt by the end-userconcerned,

4.

This Regulation shall be without prejudice to the application of Directive
2000/31/EC, in particular of the liability rules of intermediary service providers in
Articles 12 to 15 of that Directive.

5.

This Regulation shall be without prejudice to the provisions of Directive
2014/53/EU.

6087/21
ANNEX I

PB/ek
TREE.2.B

43

EN

Article 3

Territorial scope and representative

1.

This Regulation applies to:(a)the provision of electronic communications services to end-users who are in
the Union,(aa)

the processing of electronic communications content and of electronic
communications metadata of end-users who are in the Union;

(b)

(c)

the protection of terminal equipment information of end-users who are in
the Union.

(cb)

the offering of publicly available directories of end-users of electronic
communications services who are in the Union;(cc)

the sending of direct marketing communications to end-users who are in
the Union.

6087/21
ANNEX I

PB/ek
TREE.2.B

44

EN

2.

Where the provider of an electronic communications service, the provider ofa publicly available directory, or a person using electronic
communications services to send direct marketing communications, or aperson using processing and storage capabilities or collecting
information processed by or emitted by or stored in the end-users’
terminal equipment is not established in the Union it shall designate inwriting, within one month from the start of its activities, a representativein the Union and communicate it to the competent Supervisory
Authority.

2a.

The requirements laid down in paragraph 2 shall not apply if activities listed
in paragraph 1 are occasional and are unlikely to result in a risk to thefundamental rights of end-users taking into account the nature, context,
scope and purpose of those activities.

3.

The representative shall be established in one of the Member States where
the end-users of such electronic communications services are located.

4.

The representative shall be mandated by the provider or person it represents
to be addressed in addition to or instead of the provider it represents, inparticular, to supervisory authorities, and end-users, on all issues related toprocessing electronic communications data for the purposes of ensuring
compliance with this Regulation.

6087/21
ANNEX I

PB/ek
TREE.2.B

45

EN

5.

The designation of a representative pursuant to paragraph 2 shall be without
prejudice to legal actions, which could be initiated against the provider or
person it represents.

6.

This Regulation applies to the processing of personal data by a provider not
established in the Union, but in a place where Member State law applies byvirtue of public international law.

Article 4

Definitions

1.

For the purposes of this Regulation, following definitions shall apply:(a)the definitions in Regulation (EU) 2016/679;(b)

the definitions of ‘electronic communications network’, ‘electronic
communications service’, ‘interpersonal communications service’, ‘number-based
interpersonal communications service’, ‘number-independent interpersonalcommunications service’, ‘end-user’ and ‘call’ in paragraphs (1), (4), (5), (6),(7), (14) and (31) respectively of Article 2 of Directive (EU) 2018/1972;(c)the definition of 'terminal equipment' in Article 1(1) of Commission Directive
2008/63/EC;

6087/21
ANNEX I

PB/ek
TREE.2.B

46

EN

(d)

the definition of ‘information society service’ in point (b) of Article 1 (1) of
Directive (EU) 2015/1535.

2.

For the purposes of this Regulation, the definition of ‘interpersonalcommunications service’ referred to in point (b) of paragraph 1 shall include
services which enable interpersonal and interactive communication merely as aminor ancillary feature that is intrinsically linked to another service.

2a.

For the purposes of this Regulation, the definition of 'processing' referred toin Article 4 (2) of Regulation 2016/679 shall not be limited to processing of
personal data.

3.

In addition, for the purposes of this Regulation the following definitions shallapply:(a)‘electronic communications data’ means electronic communications content andelectronic communications metadata;(b)‘electronic communications content’ means the content exchanged by means ofelectronic communications services, such as text, voice, videos, images, andsound;

6087/21
ANNEX I

PB/ek
TREE.2.B

47

EN

(c)

‘electronic communications metadata’ means data processed by means ofelectronic communications services for the purposes of transmitting, distributing
or exchanging electronic communications content; including data used to trace
and identify the source and destination of a communication, data on the locationof the device generated in the context of providing electronic communications
services, and the date, time, duration and the type of communication;(d)‘publicly available directory’ means a directory of end-users of number-based
interpersonal communications services, whether in printed or electronic form,
which is published or made available to the public or to a section of the public,
including by means of a directory enquiry service and the main function ofwhich is to enable identification of such end-users;(e)‘electronic message’ means any message containing information such as text,
voice, video, sound or image sent over an electronic communications network
which can be stored in the network or in related computing facilities, or in theterminal equipment of its recipient, including e-mail, SMS, MMS andfunctionally equivalent applications and techniques;(f)‘direct marketing communications’ means any form of advertising, whether
written or oral, sent via a publicly available electronic communications service
directly to one or more specific end-users, including the placing of voice-tovoice calls, the use of automated calling and communication systems with orwithout human interaction, electronic message etc.;(g)‘direct marketing voice-to-voice calls’ means live calls, which do not entail theuse of automated calling systems and communication systems;

6087/21
ANNEX I

PB/ek
TREE.2.B

48

EN

(h)

‘automated calling and communication systems’ means systems capable ofautomatically initiating calls to one or more recipients in accordance with
instructions set for that system, and transmitting sounds which are not live speech,
including calls made using automated calling and communication systems whichconnect the called person to an individual;(i)'direct marketing calls' means direct marketing voice-to-voice calls and calls
made via automated calling and communication systems for the purpose of
direct marketing.

(j)‘location data’ means data processed by means of an electronic
communications network or service, indicating the geographic position of theterminal equipment of a user of a publicly available electronic
communications service;

Article 4aConsent1.

The provisions for consent provided for under Regulation (EU) 2016/679/EU
shall apply to natural persons and, mutatis mutandis, to legal persons.

1a.

Paragraph 1 is without prejudice to national legislation on determining thepersons who are authorised to represent a legal person in any dealings withthird parties or in legal proceedings.

6087/21
ANNEX I

PB/ek
TREE.2.B

49

EN

2.

Without prejudice to paragraph 1, where technically possible and feasible, for the
purposes of point (b) of Article 8 (1), consent may be expressed by using theappropriate technical settings of a software application enabling access to theinternet placed on the market permitting electronic communications,
including the retrieval and presentation of information on the internet.

2aa.

Consent directly expressed by an end-user in accordance with Paragraph (2)shall prevail over software settings. Any consent requested and given by an
end-user to a service shall be directly implemented, without any further
delay, by the applications of the end user’s terminal, including where thestorage of information or the access of information already stored in the enduser’s terminal equipment is permitted.

2a.

As far as the provider is not able to identify a data subject, the technicalprotocol showing that consent was given from the terminal equipment shallbe sufficient to demonstrate the consent of the end-user according Article 8(1) (b).

3.

End-users who have consented to the processing of electronic communications
data in accordance with this Regulation shall be reminded of the possibility towithdraw their consent at periodic intervals of [no longer than 12 months], aslong as the processing continues, unless the end-user requests not to receive
such reminders.

6087/21
ANNEX I

PB/ek
TREE.2.B

50

ENCHAPTER II

PROTECTION OF ELECTRONIC COMMUNICATIONS OF END-USERS AND OF THE
INTEGRITY OF THEIR TERMINAL EQUIPMENT

Article 5

Confidentiality of electronic communications data

Electronic communications data shall be confidential. Any interference with electronic
communications data, including listening, tapping, storing, monitoring, scanning or otherkinds of interception, surveillance and processing of electronic communications data, by
anyone other than the end-users concerned, shall be prohibited, except when permitted bythis Regulation.

Article 6

Permitted processing of electronic communications data1.

Providers of electronic communications networks and services shall be permitted
to process electronic communications data only if:(a)6087/21
ANNEX I

it is necessary to provide an electronic communication service; or

PB/ek
TREE.2.B

51

EN

(b)

it is necessary to maintain or restore the security of electronic communications
networks and services, or detect technical faults, errors, security risks or attacks
on electronic communications networks and services;(c)

it is necessary to detect or prevent security risks or attacks on end-users’
terminal equipment;(d)

it is necessary for compliance with a legal obligation to which the provider issubject laid down by Union or Member State law, which respects the essenceof the fundamental rights and freedoms and is a necessary and proportionate
measure in a democratic society to safeguard the prevention, investigation,
detection or prosecution of criminal offences or the execution of criminal
penalties, and the safeguarding against and the prevention of threats topublic security.

2.

Electronic communications data shall only be permitted to be processed forthe duration necessary for the specified purpose or purposes according to
Articles 6 to 6c and if the specified purpose or purposes cannot be fulfilled byprocessing information that is made anonymous.

3.

A third party acting on behalf of a provider of electronic communications
network or services may be permitted to process electronic communications
data in accordance with Articles 6 to 6c provided that the conditions laid
down in Article 28 of Regulation (EU) 2016/679 are met.

6087/21
ANNEX I

PB/ek
TREE.2.B

52

EN

Article 6a [previous art. 6(3)]Permitted processing of electronic communications content
1.

Without prejudice to Article (6) 1, providers of the electronic communications
networks and services shall be permitted to process electronic communications
content only:

(a)
(a)

for the purpose of the provision of a service requested by an end-user forpurely individual use if the requesting end-user has given consent and wheresuch requested processing does not adversely affect fundamental rights andinterests of another person concerned; or(b)if all end-users concerned have given their consent to the processing of theirelectronic communications content for one or more specified purposes.

6087/21
ANNEX I

PB/ek
TREE.2.B

53

EN

2.

Prior to the processing in accordance with point (b) of paragraph 1 theprovider shall carry out a data protection impact assessment of the impact of
the envisaged processing operations on the protection of electronic
communications data and consult the supervisory authority if necessary
pursuant to Article 36 (1) of Regulation (EU) 2016/679. Article 36 (2) and (3)of Regulation (EU) 2016/679 shall apply to the consultation of the supervisory
authority.

Article 6b [previous art 6(2)]Permitted processing of electronic communications metadata1.

Without prejudice to Article (6) 1, providers of electronic communications
networks and services shall be permitted to process electronic communications
metadata only if:(a)

it is necessary for the purposes of network management or network
optimisation, or to meet technical quality of service requirements pursuant to
Directive (EU) 2018/1972 or Regulation (EU) 2015/212020; or(b)

it is necessary for the performance of an electronic communications service
contract to which the end-user is party, or if necessary for billing, calculatinginterconnection payments, detecting or stopping fraudulent, or abusive use of, or
subscription to, electronic communications services; or(c)the end-user concerned has given consent to the processing of communications
metadata for one or more specified purposes; or(d)6087/21
ANNEX I

it is necessary in order to protect the vital interest of a natural person; or

PB/ek
TREE.2.B

54

EN

(e)

in relation to metadata that constitute location data, it is necessary for
scientific or historical research purposes or statistical purposes, provided
that:i. such data is pseudonymised;ii.

the processing could not be carried out by processing informationthat is made anonymous, and the location data is erased or madeanonymous when it is no longer needed to fulfil the purpose; andiii.

the location data is not used to determine the nature or
characteristics of an end-user or to build a profile of an end-user.

(f)in relation to metadata other than location data, it is necessary for scientificor historical research purposes or statistical purposes, provided that suchprocessing is in accordance with Union or Member State law and subject toappropriate safeguards, including encryption and pseudonymisation, toprotect fundamental rights and the interest of the end-users and is inaccordance with paragraph 6 of Article 21 and paragraphs 1, 2 and 4 of
Article 89 of Regulation (EU) 2016/679.

2a.

Data processed under point e and f of paragraph 1 of this article may also be
used for the development, production and dissemination of official national
and European statistics to the extent necessary for this purpose and inaccordance, respectively, with national or Union law.

6087/21
ANNEX I

PB/ek
TREE.2.B

55

EN

2.

Without prejudice to Article 6 (3), electronic communications metadata
processed pursuant to paragraph 1 (e) shall not be shared by the provider
with any third party unless it has been made anonymous.

Article 6c [Previous art 6(2a)]Compatible processing of electronic communications metadata

1.

Where the processing for a purpose other than that for which the electronic
communications metadata have been collected under paragraph 1 of Articles
6 and 6b is not based on the end-user's consent or on a Union or Member
State law which constitutes a necessary and proportionate measure in a
democratic society to safeguard the objectives referred to in Article 11, theprovider of electronic communications networks and services shall, in order
to ascertain whether processing for another purpose is compatible with the
purpose for which the electronic communications metadata are initiallycollected, take into account, inter alia:(a)any link between the purposes for which the electronic communications
metadata have been collected and the purposes of the intended further
processing;(b)

the context in which the electronic communications metadata have beencollected, in particular regarding the relationship between end-users
concerned and the provider;6087/21
ANNEX I

PB/ek
TREE.2.B

56

EN

(c)

the nature of the electronic communications metadata as well as themodalities of the intended further processing, in particular where such dataor the intended further processing could reveal categories of data, pursuant
to Articles 9 or 10 of Regulation (EU) 2016/679;(d)the possible consequences of the intended further processing for end-users;(e)

the existence of appropriate safeguards, such as encryption andpseudonymisation.

2.

Such processing, if considered compatible, may only take place, provided
that:

(a)

the processing could not be carried out by processing information that is
made anonymous, and electronic communications metadata is erased or
made anonymous as soon as it is no longer needed to fulfil the purpose, and(b)the processing is limited to electronic communications metadata that is
pseudonymised, and(c)the electronic communications metadata is not used to determine the natureor characteristics of an end-user or to build a profile of an end-user, which
produces legal effects concerning him or her or similarly significantly affects
him or her.

3.

For the purposes of paragraph 1 of this Article, the providers of electronic
communications networks and services shall not, without prejudice to Article
6 (3), share such data with any third parties, unless it is made anonymous.

Article 6d6087/21
ANNEX I

PB/ek
TREE.2.B

57

EN

Processing of electronic communications data for the purpose of preventing child sexual
abuse

Article 7

Storage and erasure of electronic communications data

1.

The provider of the electronic communications service shall erase electronic
communications content or make that data anonymous when it is no longer
necessary for the purpose of processing in accordance to article 6 (1) and 6a
(1).

2.

Without prejudice to points (b), (c) and (d) of Article 6 (1), points (c), (d), (e),(f), point (g) of Article 6b, Article 6c and points (b) to (g) of Article 8 (1) the
provider of the electronic communications service shall erase electronic
communications metadata or make that data anonymous when it is no longer
needed for the purpose of providing an electronic communication service.

6087/21
ANNEX I

PB/ek
TREE.2.B

58

EN

3.

Where the processing of electronic communications metadata takes place forthe purpose of billing in accordance with point (b) of Article 6b (1), therelevant metadata may be kept until the end of the period during which a bill
may lawfully be challenged, or a payment may be pursued in accordancewith national law.

4.

Union or Member state law may provide that the electronic communications
metadata is retained, including under any retention measure that respects
the essence of the fundamental rights and freedoms and is a necessary andproportionate measure in a democratic society, in order to safeguard theprevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, and the safeguarding against and theprevention of threats to public security, for a limited period. The duration of
the retention may be extended if threats to public security of the Union or ofa Member State persists.

Article 8

Protection of end-users' terminal equipment information

1. The use of processing and storage capabilities of terminal equipment and the collectionof information from end-users’ terminal equipment, including about its software andhardware, other than by the end-user concerned shall be prohibited, except on thefollowing grounds:(a)

it is necessary for the sole purpose of providing an electronic communication
service; or6087/21
ANNEX I

PB/ek
TREE.2.B

59

EN

(b)

the end-user has given consent; or(c)

it is strictly necessary for providing a service specifically requested by the enduser; or(d)if it is necessary for the sole purpose of audience measuring, provided that suchmeasurement is carried out by the provider of the service requested by the enduser, or by a third party, or by third parties jointly on behalf of or jointlywith provider of the service requested provided that, where applicable, theconditions laid down in Articles 26 or 28 of Regulation (EU) 2016/679 are
met; or(da)

it is necessary to maintain or restore the security of information society
services or terminal equipment of the end-user, prevent fraud or prevent or
detect technical faults for the duration necessary for that purpose; or(e)

it is necessary for a software update provided that:(i) such update is necessary for security reasons and does not in any way
change the privacy settings chosen by the end-user,(ii) the end-user is informed in advance each time an update is being
installed, and(iii) the end-user is given the possibility to postpone or turn off the automatic
installation of these updates; or6087/21
ANNEX I

PB/ek
TREE.2.B

60

EN

(f)

it is necessary to locate terminal equipment when an end-user makes an
emergency communication either to the single European emergency number‘112’ or a national emergency number, in accordance with Article 13(3).

(g)

where the processing for purpose other than that for which the information
has been collected under this paragraph is not based on the end-user's
consent or on a Union or Member State law which constitutes a necessary
and proportionate measure in a democratic society to safeguard theobjectives referred to in Article 11 the person using processing and storage
capabilities or collecting information processed by or emitted by or stored in
the end-users’ terminal equipment shall, in order to ascertain whether
processing for another purpose is compatible with the purpose for which theelectronic communications data are initially collected, take into account, inter
alia:

(i)

any link between the purposes for which the processing and storage
capabilities have been used or the information have been collected andthe purposes of the intended further processing;(ii)

the context in which the processing and storage capabilities have beenused or the information have been collected, in particular regarding therelationship between end-users concerned and the provider;6087/21
ANNEX I

PB/ek
TREE.2.B

61

EN

(iii) the nature the processing and storage capabilities or of the collecting of
information as well as the modalities of the intended further processing,in particular where such intended further processing could reveal
categories of data, pursuant to Article 9 or 10 of Regulation (EU)2016/679;(iv) the possible consequences of the intended further processing for endusers;(v)

the existence of appropriate safeguards, such as encryption andpseudonymisation.

(h)Such further processing in accordance with paragraph 1 (g), if considered
compatible, may only take place, provided that:(i) the information is erased or made anonymous as soon as it is no longer
needed to fulfil the purpose,(ii) the processing is limited to information that is pseudonymised, and(iii) the information is not used to determine the nature or characteristics ofan end-user or to build a profile of an end-user.

(i) For the purposes of paragraph 1 (g) and (h), data shall not be shared with any
third parties unless the conditions laid down in Article 28 of Regulation (EU)2016/697 are met, or data is made anonymous.

6087/21
ANNEX I

PB/ek
TREE.2.B

62

EN2. The collection of information emitted by terminal equipment of the end-user toenable it to connect to another device and, or to network equipment shall be
prohibited, except on the following grounds:(a) it is done exclusively in order to, for the time necessary for, and for the purpose of
establishing or maintaining a connection; or(b) the end-user has given consent; or(c) it is necessary for the purpose of statistical purposes that is limited in time andspace to the extent necessary for this purpose and the data is made anonymous orerased as soon as it is no longer needed for this purpose,(d) it is necessary for providing a service requested by the end-user.

2a.

For the purpose of paragraph 2 points (b) and (c), a clear and prominent notice
is shall be displayed informing of, at least, the modalities of the collection, its
purpose, the person responsible for it and the other information required under
Article 13 of Regulation (EU) 2016/679 where personal data are collected, as wellas any measure the end-user of the terminal equipment can take to stop or
minimise the collection.

2b.

For the purpose of paragraph 2 points (b) and (c), the collection of suchinformation shall be conditional on the application of appropriate technical andorganisational measures to ensure a level of security appropriate to the risks, as set
out in Article 32 of Regulation (EU) 2016/679, have been applied.

6087/21
ANNEX I

PB/ek
TREE.2.B

63

EN

3.

The information to be provided pursuant to paragraph 2a may be provided in
combination with standardized icons in order to give a meaningful overview of
the collection in an easily visible, intelligible and clearly legible manner.

4.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 25 determining the information to be presented by the standardized icon
and the procedures for providing standardized icons.

Article 9

Article 106087/21
ANNEX I

PB/ek
TREE.2.B

64

EN

Article 11

Restrictions

1.

Union or Member State law may restrict by way of a legislative measure the scopeof the obligations and rights provided for in Articles 5 to 8 where such a
restriction respects the essence of the fundamental rights and freedoms and is anecessary, appropriate and proportionate measure in a democratic society tosafeguard one or more of the general public interests referred to in Article 23(1)(c) to (e), (i) and (j) of Regulation (EU) 2016/679 or a monitoring, inspection or
regulatory function connected to the exercise of official authority for suchinterests.

1a.

Article 23 (2) of Regulation (EU) 2016/679 shall apply to any legislative
measures referred to in paragraph 1.

2.

Providers of electronic communications services shall establish internal
procedures for responding to requests for access to end-users’ electronic
communications data based on a legislative measure adopted pursuant toparagraph 1. They shall provide the competent supervisory authority, on demand,with information about those procedures, the number of requests received, thelegal justification invoked and their response.

6087/21
ANNEX I

PB/ek
TREE.2.B

65

ENCHAPTER III

END-USERS' RIGHTS TO CONTROL ELECTRONIC COMMUNICATIONSArticle 12

Presentation and restriction of calling and connected line identification

1.

Where presentation of the calling and connected line identification is offered inaccordance with Article [115] of the Directive (EU) 2018/1972, the providers of
number-based interpersonal communications services shall provide the following:(a)the calling end-user with the possibility of preventing the presentation of thecalling line identification on a per call, per connection or permanent basis;(b)

the called end-user with the possibility of preventing the presentation of thecalling line identification of incoming calls;(c)

the called end-user with the possibility of rejecting incoming calls where thepresentation of the calling line identification has been prevented by the callingend-user;(d)the called end-user with the possibility of preventing the presentation of theconnected line identification to which the calling end-user is connected.

6087/21
ANNEX I

PB/ek
TREE.2.B

66

EN

2.

The possibilities referred to in paragraph 1 shall be provided to end-users bysimple means and free of charge.

3.

Point (a) of paragraph 1 shall also apply with regard to calls to third countries
originating in the Union. Points (b), (c) and (d) of paragraph 1 shall also apply toincoming calls originating in third countries.

4.

Where presentation of calling or connected line identification is offered, providersof number-based interpersonal communications services shall provide information
to the public regarding the options set out in paragraph 1 and the exceptions set
forth in Article 13.

Article 13

Exceptions to presentation and restriction of calling and connected line
identification in relation to emergency communications

1.

Regardless of whether the calling end-user has prevented the presentation of thecalling line identification, where emergency communications are made to
emergency services, providers of number-based interpersonal communications
services shall override the elimination of the presentation of the calling line
identification and the denial or absence of consent of an end-user for theprocessing of metadata, on a per-line basis for organisations dealing withemergency communications, including public safety answering points, for the
purpose of responding to such communications.

6087/21
ANNEX I

PB/ek
TREE.2.B

67

EN

1a.

Regardless whether the called end-user rejects incoming calls where thepresentation of the calling line identification has been prevented by thecalling end-user, providers of number-based interpersonal communications
services shall override this choice, where technically possible, when thecalling end-user is an organisation dealing with emergency communications,
including public safety answering points, for the purpose of responding tosuch communications.

2.

3.

Notwithstanding Article 8(1), regardless of whether the end-user has
prevented access to the terminal equipment’s Global Navigation Satellite
Systems (GNSS) capabilities or other types of terminal equipment based
location data through the terminal equipment settings, when a call is made to
emergency services, such settings may not prevent access to GNSS suchlocation data to determine and provide the caller calling end-user's location
to emergency services an organisation dealing with emergency
communications, including public safety answering points, for the purpose of
responding to such calls.

6087/21
ANNEX I

PB/ek
TREE.2.B

68

EN

Article 14

Blocking Unwanted, malicious or nuisance calls

1.

Providers of number-based interpersonal communications services shall deploy
state of the art measures to limit the reception of unwanted, malicious or
nuisance calls by end-users.

1a.

Member States shall establish more specific provisions with regard to theestablishment of transparent procedures and the circumstances where
providers of number-based interpersonal communication services shalloverride, or otherwise address, the elimination of the presentation of thecalling line identification on a temporary basis, where end-users request the
tracing of unwanted, malicious or nuisance calls.

2.

Providers of number-based interpersonal communications services shall also
provide the called end-user with the following possibilities, free of charge:(a)to block, where technically feasible, incoming calls from specific numbers orfrom anonymous sources or from numbers using a specific code or prefix
referred to in Article 16(3a); and(b)

to stop automatic call forwarding by a third party to the end-user's terminal
equipment.

6087/21
ANNEX I

PB/ek
TREE.2.B

69

EN

Article 15

Publicly available directories

1.

The providers of number-based interpersonal communications services shallobtain the consent of end-users who are natural persons to include theirpersonal data in the directory and for inclusion of such data per category of
personal data, to the extent that such data are relevant for the purpose of thedirectory as determined by the provider of the directory.

1aa.

Notwithstanding paragraph 1, Member States may provide by law that theinclusion of personal data of an end-user who is a natural person in a
publicly available directory can take place provided that he end-user who is anatural person shall have the right to object to such inclusion.

2.

The providers of number-based interpersonal communications services shallinform end-users who are natural persons whose personal data are in the directoryof any search functions that is not based on name or number in the directoryand obtain the consent of end-users’ before enabling such search functions related
to their own data.

6087/21
ANNEX I

PB/ek
TREE.2.B

70

EN

3.

The providers of number-based interpersonal communications services shallprovide end-users that are legal persons with the possibility to object to data
related to them being included in the directory.

3a.

The providers of number-based interpersonal communications services shallgive end-users the means to verify, correct and delete data included in a publicly
available directory.

3aa.

Notwithstanding paragraphs 1aa to 3a, Member States may provide by law
that the requirements under those paragraphs apply to providers of publicly
available directories, in addition to or instead of, providers of number-based
interpersonal communications services.

4.

The possibility for end-users not to be included in a publicly available directory,or to verify, correct and delete any data related to them shall be provided free ofcharge.

4a.

Where the personal data of the end-users of number based interpersonalcommunications services have been included in a publicly available directory
before this Regulation enters into force, the personal data of such end-users
may remain included in a publicly available directory, including version withsearch functions, unless the end-users have expressed their objection against
their data being included in the directory or against the use of available
search functions related to their data.

6087/21
ANNEX I

PB/ek
TREE.2.B

71

EN

Article 16
Unsolicited and direct marketing communications
1.

Natural or legal persons shall be prohibited from using electronic
communications services for the purposes of sending direct marketing
communications to end-users who are natural persons unless they have given
their prior consent.

2.

Notwithstanding paragraph 1, where a natural or legal person obtains contact
details for electronic message from end-users who are natural persons, in thecontext of the purchase of a product or a service, in accordance with Regulation(EU) 2016/679, that natural or legal person may use these contact details for direct
marketing of its own similar products or services only if such end-users areclearly and distinctly given the opportunity to object, free of charge and in an easymanner, to such use. The right to object shall be given at the time of collection ofsuch end-users' contact details and, if that end-user has not initially refusedthat use, each time when a natural or legal persons sends a message to that
end-user for the purpose of such direct marketing.

2a.

Member States may provide by law a set period of time, after the sale of the
product or service occurred, within which a natural or legal person may use
contact details of the end-user who is a natural person for direct marketing
purposes, as provided for in paragraph.

6087/21
ANNEX I

PB/ek
TREE.2.B

72

EN

3.

Without prejudice to paragraphs 1 and 2, natural or legal persons using electronic
communications services for the purposes of placing direct marketing calls shallpresent the calling line identification assigned to them.

3a.

Member States may require natural or legal person using electronic
communications services for the purposes of placing direct marketing calls topresent a specific code or prefix identifying the fact that the call is a direct
marketing call in addition to the obligation set out in paragraph 3. Member
State requiring the use of such a specific code or prefix shall make itavailable for the natural or legal persons who use electronic communications
services for the purposes of direct marketing calls.

4.

Notwithstanding paragraph 1, Member States may provide by law that the placingof direct marketing voice-to-voice calls to end-users who are natural persons shall
only be allowed in respect of end-users who are natural persons who have notexpressed their objection to receiving those communications.

5.

Member States shall ensure, in the framework of Union law and applicablenational law, that the legitimate interest of end-users that are legal persons withregard to direct marketing communications sent by means set forth underparagraph 1 are sufficiently protected.

6.

Any natural or legal person using electronic communications services to send
direct marketing communications shall, each time a direct marketing
communication is sent:

6087/21
ANNEX I

PB/ek
TREE.2.B

73

EN

(a)

reveal his or its identity and use effective return addresses or numbers;(b)inform end-users of the marketing nature of the communication and the identity
and contact details of the legal or natural person on behalf of whom the direct
marketing communication is sent;

(c)

(d)

clearly and distinctly give the end-users who are natural persons a means to
object or to withdraw their consent, free of charge, at any time, and in aneasy and effective manner, to receiving further direct marketing
communications, and shall provide the necessary information to this end.
This means shall also be given at the time of collection of the contact details
according to paragraph 2. It shall be as easy to withdraw as to give consent.

7.

6087/21
ANNEX I

PB/ek
TREE.2.B

74

EN

Article 17

Information about detected security risks

CHAPTER IV

INDEPENDENT SUPERVISORY AUTHORITIES AND ENFORCEMENT

Article 18

Supervisory authorities

0.

Each Member State shall provide for one or more independent publicauthorities meeting the requirements set out in Articles 51 to 54 ofRegulation (EU) 2016/679 to be responsible for monitoring the application ofthis Regulation.

6087/21
ANNEX I

PB/ek
TREE.2.B

75

ENMember States may entrust the monitoring of the application of Articles 12
to 16 to the supervisory authority or authorities referred to in the previous
subparagraph or to another supervisory authority or authorities having theappropriate expertise.

1.

1ab.

The supervisory authorities shall have investigative and corrective powers,
including the power to impose administrative fines pursuant to article 23.

1b.

Where more than one supervisory authority is responsible for monitoring theapplication of this Regulation in a Member State, such authorities shallcooperate with each other to the extent necessary to perform their tasks.

2.

Where the supervisory authorities are not the supervisory authorities
responsible for monitoring the application of Regulation (EU) 2016/679, theyshall cooperate with the latter and, whenever appropriate, with national
regulatory authorities established pursuant to Directive (EU) 2018/1972 andother relevant authorities.

6087/21
ANNEX I

PB/ek
TREE.2.B

76

EN

Article 19

European Data Protection Board

1.

The European Data Protection Board, established under Article 68 of Regulation(EU) 2016/679, shall have the task to contribute to the consistent application ofChapters I and II and III of this Regulation.

2.

To that end, the Board shall have the following tasks:(a)advise the Commission on any proposed amendment of this Regulation;(b)

examine, on its own initiative, on request of a supervisory authority designatedin accordance with Article 18 (0) or on request of the Commission, any question
covering the application of this Regulation in relation to Chapters I, II and III
and issue guidelines, recommendations and best practices in order to encourage
consistent application of this Regulation;

(c)

(d)

issue guidelines, recommendations and best practices in order to facilitate
cooperation, including exchange of information, between supervisory
authorities referred to in paragraph 0 of Article 18 and/or the supervisory
authority responsible for monitoring the application of Regulation (EU)2016/679;

6087/21
ANNEX I

PB/ek
TREE.2.B

77

EN

(da)

issue guidelines, recommendations and best practices in accordance withpoint (b) of this paragraph to assess for different types of electronic
communications services the moment in time of receipt of electronic
communications content;(db)

issue guidelines, recommendations and best practices in accordance withpoint (b) of this paragraph on the provision of consent in the context ofArticles 6 to 6b and 8 of this Regulation by end-users who are legal persons
and or in an employment relationship;(e)provide the Commission with an opinion on the icons referred to inparagraph 3 of Article 8;

(f)

(g)

(h)

promote the exchange of knowledge and documentation on legislation onprotection of electronic communications of end-users and of the integrity of
their terminal equipment as laid down in Chapter II and practice relevantsupervisory authorities world wide;

3.

Where the Commission requests advice from the Board, it may indicate atime limit, taking into account the urgency of the matter.

4.

The Board shall forward its opinions, guidelines, recommendations, and bestpractices to the Commission and make them public.

6087/21
ANNEX I

PB/ek
TREE.2.B

78

EN

5.

The Board shall consult the supervisory authorities referred to in Article 18(0) before any of the tasks referred to in paragraph 2.

6.

The Board shall, where appropriate, consult interested parties and give themthe opportunity to comment within a reasonable period. The Board shall,
without prejudice to Article 76 of Regulation (EU) 2016/679, make the resultof the consultation procedures publicly available.

Article 20

Cross-border cooperation

Each supervisory authority shall contribute to the consistent application of thisRegulation throughout the Union and cooperate with each other and with theCommission.

6087/21
ANNEX I

PB/ek
TREE.2.B

79

EN

CHAPTER V

REMEDIES, LIABILITY AND PENALTIESArticle 21

Remedies

1.

Without prejudice to any other administrative or judicial remedy, every end-user
shall have the right to an effective judicial remedy in relation to any
infringement of rights under this Regulation, the right to lodge a complaint
with a supervisory authority and the right to an effective judicial remedy
against any legally binding decision of a supervisory authority concerning
them.

1a

Articles 77-80 of Regulation (EU) 2016/679 shall apply mutatis mutandis.

2.

Any natural or legal person other than end-users adversely affected byinfringements of this Regulation, including a provider of electronic
communications services protecting its legitimate business interests, shall have aright to bring legal proceedings in respect of such infringements.

6087/21
ANNEX I

PB/ek
TREE.2.B

80

EN

Article 22

Right to compensation and liability

Any person who has suffered material or non-material damage as a result of an
infringement of this Regulation shall have the right to receive compensation from theinfringer for the damage suffered in accordance with Article 82 of Regulation (EU)2016/679.

Article 23

General conditions for imposing administrative fines

1.

Article 83 of Regulation (EU) 2016/679 shall apply mutatis mutandis toinfringements of this Regulation.

2.

Infringements of the following provisions of this Regulation shall, in accordancewith paragraph 1, be subject to administrative fines up to EUR 10 000 000, or in thecase of an undertaking, up to 2 % of the total worldwide annual turnover of thepreceding financial year, whichever is higher:(a)the obligations of any legal or natural person who process electronic
communications data pursuant to Article 8;(b)6087/21
ANNEX I

PB/ek
TREE.2.B

81

EN

(c)

the obligations of the providers of publicly available directories pursuant to
Article 15;(d)the obligations of any legal or natural person who uses electronic
communications services pursuant to Article 16.

(e)

3.

the obligation to designate a representative pursuant to Article 3 number 2.

Infringements of the principle of confidentiality of communications, permitted
processing of electronic communications data, time limits for erasure pursuant to
Articles 5, 6, and 7 shall, in accordance with paragraph 1 of this Article, be subject toadministrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4
% of the total worldwide annual turnover of the preceding financial year, whicheveris higher.

4.

Member States shall lay down the rules on penalties for infringements of Articles 12,
13 and 14.

5.

Non-compliance with an order by a supervisory authority as referred to in Article 18,
shall be subject to administrative fines up to 20 000 000 EUR, or in the case of anundertaking, up to 4 % of the total worldwide annual turnover of the preceding
financial year, whichever is higher.

6.

Without prejudice to the corrective powers of supervisory authorities pursuant to
Article 18, each Member State may lay down rules on whether and to what extent
administrative fines may be imposed on public authorities and bodies established inthat Member State.

6087/21
ANNEX I

PB/ek
TREE.2.B

82

EN

7.

The exercise by the supervisory authority of its powers under this Article shall be
subject to appropriate procedural safeguards in accordance with Union and Member
State law, including effective judicial remedy and due process.

8.

Where the legal system of the Member State does not provide for administrativefines, this Article may be applied in such a manner that the fine is initiated by thecompetent supervisory authority and imposed by competent national courts, while
ensuring that those legal remedies are effective and have an equivalent effect to theadministrative fines imposed by supervisory authorities. In any event, the fines
imposed shall be effective, proportionate and dissuasive. Those Member States shallnotify to the Commission the provisions of their laws which they adopt pursuant tothis paragraph by [xxx] and, without delay, any subsequent amendment law oramendment affecting them.

Article 24

Penalties

1.

Member States shall lay down the rules on other penalties applicable toinfringements of this Regulation in particular for infringements which are not subject
to administrative fines pursuant to Article 23, and shall take all measures necessary
to ensure that they are implemented. Such penalties shall be effective, proportionate
and dissuasive.

2.

Each Member State shall notify to the Commission the provisions of its law which it
adopts pursuant to paragraph 1, no later than 8 months after the date set forth under
Article 29(2) and, without delay, any subsequent amendment affecting them.

6087/21
ANNEX I

PB/ek
TREE.2.B

83

EN

CHAPTER VI

DELEGATED ACTS AND IMPLEMENTING ACTS

Article 25

Exercise of the delegation

1.

The power to adopt delegated acts is conferred on the Commission subject to theconditions laid down in this Article.

2.

The power to adopt delegated acts referred to in Article 8(4) shall be conferred on
the Commission for an indeterminate period of time from [the data of entering
into force of this Regulation].

3.

The delegation of power referred to in Article 8(4) may be revoked at any time by
the European Parliament or by the Council. A decision to revoke shall put an end
to the delegation of the power specified in that decision. It shall take effect the day
following the publication of the decision in the Official Journal of the European
Union or at a later date specified therein. It shall not affect the validity of any
delegated acts already in force.

4.

Before adopting a delegated act, the Commission shall consult experts designatedby each Member State in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 2016.

6087/21
ANNEX I

PB/ek
TREE.2.B

84

EN

5.

As soon as it adopts a delegated act, the Commission shall notify it
simultaneously to the European Parliament and to the Council.

6.

A delegated act adopted pursuant to Article 8(4) shall enter into force only if noobjection has been expressed either by the European Parliament or the Council
within a period of two months of notification of that act to the European
Parliament and the Council or if, before the expiry of that period, the European
Parliament and the Council have both informed the Commission that they will not
object. That period shall be extended by two months at the initiative of theEuropean Parliament or of the Council.

Article 26

Committee

1.

The Commission shall be assisted by the Communications Committee establishedunder Article 118 of Directive (EU) 2018/1972. That committee shall be acommittee within the meaning of Regulation (EU) No 182/2011[1].

2.

Where reference is made to this paragraph, Article 5 of Regulation (EU) No
182/2011 shall apply.

6087/21
ANNEX I

PB/ek
TREE.2.B

85

ENCHAPTER VII

FINAL PROVISIONS

Article 27

Repeal1.

Directive 2002/58/EC is repealed with effect from [1August 2022].

2.

References to the repealed Directive shall be construed as references to thisRegulation.

Article 28

Monitoring and evaluation clauseBy [1 August 2024] at the latest, the Commission shall establish a detailed programme formonitoring the effectiveness of this Regulation.

No later than three years after the date of application of this Regulation, and every three
years thereafter, the Commission shall carry out an evaluation of this Regulation and present
the main findings to the European Parliament, the Council and the European Economic andSocial Committee. The evaluation shall, where appropriate, inform a proposal for theamendment or repeal of this Regulation in light of legal, technical or economic
developments.

6087/21
ANNEX I

PB/ek
TREE.2.B

86

EN

Article 29

Entry into force and application

1.

This Regulation shall enter into force on the twentieth day following that of its
publication in the Official Journal of the European Union.

2.

This Regulation shall apply from [24 months from the date of entry into force of
this Regulation].

_________________

6087/21
ANNEX I

PB/ek
TREE.2.B

87

EN