EUROPEAN COMMISSION Brussels, 10.1.2017 SWD(2017) 5 final COMMISSION STAFF WORKING DOCUMENT Ex-post REFIT evaluation of the ePrivacy Directive 2002/58/EC Accompanying the document Proposal for a Regulation of the European Parliament and the Council on the protection of privacy and confidentiality in relation to electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications) {COM(2017) 10 final}

{SWD(2017) 3 final}

{SWD(2017) 4 final}

{SWD(2017) 6 final}



Table of Contents 1.Introduction 1.1.Purpose of the evaluation 1.2.Scope of the evaluation 2.Background 2.1.Successive review towards the adoption of Directive 2002/58 as last amended in 2009 2.1.1.Telecommunications Privacy Directive 97/66/EC 2.1.2.ePrivacy Directive 2002/58/EC 2.1.3.Citizens’ rights Directive amending Directive 2002/58/EC 2.2.Related recent legislative developments 2.2.1.Adoption of the General Data Protection Regulation and its relationship with the ePrivacy Directive 2.2.2.Commission proposal for a new European Electronic communications Code 2.3.Description of the initiative and its objectives 2.4.Baseline situation at the time of the adoption of Directive 2002/58/EC 3.Evaluation questions 4.Method 4.1.Timing and Sources 4.2.Method-used for the analysis and overall evaluation exercise 4.3.Limitations

5.Implementation state of play 5.1.Transposition 5.2.Monitoring of national measures 5.3.Choice of competent authorities 6.Answers to the evaluation questions 6.1.Horizontal effectiveness issue: Scope of the ePD and choice of competent authorities 6.1.1.Scope of the ePD 6.1.2.Applicable law and cross-border situations 6.1.3.Diversity of competent authorities 6.2.Security of electronic communications 6.2.1.Relevance of the current rules 6.2.2.Effectiveness 6.2.3.Coherence 6.2.4.Efficiency 6.2.5.EU added value 6.3.Confidentiality of communications and related traffic data 6.3.1.Relevance of the current rules 6.3.2.Effectiveness 6.3.3.Coherence 6.3.4.Efficiency

6.3.5.EU added value 6.4.Confidentiality of information stored in terminal equipment 6.4.1.Relevance 6.4.2.Effectiveness 6.4.3.EU added value 6.4.4.Efficiency 6.4.5.Coherence 6.5.Protection against unsolicited communications (so called "spam") 6.5.1.Relevance of the current rules 6.5.2.Effectiveness 6.5.3.EU added value 6.5.4.Efficiency 6.5.5.Coherence 6.6.Other provisions ensuring users' privacy and the protection of subscribers' legitimate interests 6.6.1.Relevance 6.6.2.Effectiveness 6.6.3.EU added value 6.6.4.Efficiency 6.6.5.Coherence 7.Conclusions – key findings

8.Annexes 1.Introduction 1.1.Purpose of the evaluation This Staff Working Document ("SWD") provides the results of the evaluation carried out under the Regulatory Fitness and Performance Programme ("REFIT") of the ePrivacy Directive ("ePD"), announced under the Commission Work Programme 2015. The purpose of the REFIT evaluation is to assess the regulatory fitness of the current rules and to examine whether they have contributed to the achievement of their main objectives, as well as to identify possible redundancies (i.e. in case the same obligations are covered by another EU legal instrument), inconsistencies and simplification potential. In line with the "Better Regulation" requirements, the evaluation assesses 1) the effectiveness, 2) efficiency, 3) relevance, 4) coherence and 5) EU added-value of the ePD. This evaluation also seeks to meet the reporting obligation set out in Article 18 of the ePD. The Commission Communication “A Digital Single Market Strategy for Europe” announced that once the new rules on data protection would be adopted, in particular with the newly adopted General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Law Enforcement Directive (EU) 2016/680 , the Commission would conduct the evaluation and review of the ePrivacy Directive. Pursuant to this commitment, this REFIT evaluation has been carried out back to back with the Impact Assessment on policy options for the future of the ePD. The conclusions of this evaluation have – where relevant – fed into that Impact Assessment. 1.2.Scope of the evaluation The evaluation focuses on the objectives, areas and provisions set out in the ePD. This evaluation covers the period from December 2009, when the Directive resulting from the last revision entered into force, to July 2016. The period between 2004, when the original version of the ePrivacy Directive entered into force, up to December 2009 is not covered by this evaluation. However, whenever longer datasets were available and where they could be useful in showing impacts (i.e. in those provisions with little or no modifications during the 2009 review), these were adequately used. The geographic scope of the evaluation is the whole territory of the EU. 2.Background This section details first the successive steps towards the adoption of the ePrivacy Directive as last amended in 2009 (see Section 2.1), it then explains the relationship of the ePD with the Data Protection Directive (Section 2.2), then, it presents the general and specific objectives pursued by the Directive (Section 2.3). The last section concludes with the baseline situation at the time of the adoption of Directive 2002/58 review (Section 2.4). 2.1.Successive review towards the adoption of Directive 2002/58 as last amended in 2009 2.1.1.Telecommunications Privacy Directive 97/66/EC The origins of the ePrivacy Directive are set in Directive 97/66/EC, the Telecommunications Privacy Directive. The adoption of Directive 97/66/EC was prompted, on the one hand, by the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and, on the other hand, by the development of new technologies in the telecommunications sector. Directive 97/66/EC sought the harmonisation of Member States' provisions to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy, with respect to the processing of personal data in the telecommunications sector and to ensure the free movement of such data and of telecommunications equipment and services in the Community. As lex specialis to Directive 95/46/EC, Directive 97/66/EC relied on and were functionally bound by the former, particularly with regard to the definition of personal data .

Directive 97/66/EC focused on the telecommunications sector only and applied to the processing of personal data in connection with the provision of publicly available services in public telecommunications networks in the Community. Specific reference was made to the Integrated Services Digital Network (ISDN) and public digital mobile networks . four terms were specifically defined in the Directive: these were “subscriber”, “user”, “public telecommunications network”, and “telecommunications service” . 2.1.2.ePrivacy Directive 2002/58/EC In 2002, the Directive on privacy and electronic communications (2002/58/EC) repealed Directive 97/66/EC with a view to adapt its provisions “to developments in the markets and technologies for electronic communications services in order to provide an equal level of protection of personal data and privacy for users of publicly available electronic communications services, regardless of the technologies used”. Essentially, while the Telecommunications Privacy Directive 97/66/EC applied to circuit switched connections (traditional voice telephony), the ePrivacy Directive 2002/58/EC extended its scope to encompass packet switched transmissions (data transmission, use of the Internet). To this end, definitions of telecommunications services and networks were replaced by definitions of electronic communications services and networks to align the terminology with the proposed Directive establishing a common framework for electronic communications services and networks. The update of these definitions was necessary to ensure that all different types of transmission services for electronic communications were covered, regardless of the technology used. Other important changes included the specific protection of location data of a user of a publically available electronic communications service. The Commission’s Explanatory Memorandum explains that a new type of service is available over cellular and satellite networks which allows the exact positioning of a mobile user's terminal equipment. Given that the location data of a user are far more precise, a new Article 9 was inserted, stipulating that such data may only be used with the consent of the subscriber. A further change was made to introduce the protection of information stored in terminal equipment. The ePD was adopted as part of the Electronic communications Package ("the ECS Package"), consisting of five directives and two regulations: the Framework Directive (2002/21/EC), the Authorisation Directive (2002/20/EC), the Access Directive (2002/19/EC); the Universal Service Directive (2002/22/EC); the ePrivacy Directive (2002/58/EC; the Regulation on Body of European Regulators for Electronic communications (BEREC) (1211/2009) and the Regulation on roaming on public mobile communications networks (531/2012). The overall objective of the framework was to promote competition and set forth rules safeguarding end-user interests . The ECS Package was last amended in 2009, including with respect to the ePD. 2.1.3.Citizens’ rights Directive amending Directive 2002/58/EC In 2009 the third reform of the Electronic Communications Framework took place and introduce four fundamental changes to the rules applying to providers of electronic communications services and network: 1) it reinforced the rules on security of the processing, particularly by requiring all electronic communications service providers to notify personal data breaches to authorities as well as to subscribers or customers when they are likely to be adversely affected by the breach (i.e. by identity theft, reputational loss, etc.); (2) it required prior consent for storing or accessing information already stored in the user's terminal equipment such as cookies; (3) it reinforced the legal protection against unsolicited communications by ensuring that any individual or legal person having a legitimate interest may take legal action against infringements before the courts; (4) It specified that data collection and identification devices such as RFID would be covered by the ePrivacy Directive when they are connected or make use of public communication networks or service. 2.2.Related recent legislative developments 2.2.1.Adoption of the General Data Protection Regulation and its relationship with the ePrivacy Directive The reform of the data protection legal framework, initiated in 2012, is a cornerstone of the digital single market. In April 2016, the European Parliament and the Council adopted the GDPR". Morever, the Commission committed to review, once the new EU rules on data protection would be adopted, the ePD with a focus on ensuring a high level of protection for data subjects and a level playing field for all market players. Issues of data protection in the electronic communications sector not specifically addressed by the provisions of the ePD are covered by the Data Protection Directive and in the future by the newly adopted GDPR once its rules become applicable (as of 25 May 2018). The ePD needs to be reviewed in the light of the adoption of the GDPR. The review of the ePrivacy Directive announced in the Commission Digital Single Market strategy, seeks to assess whether the rules of the ePD remain relevant, while at the same time evaluating their EU added value, efficiency as well as their coherence with other EU instruments and in particular with the GDPR. Therefore a careful analysis article by article of the coherence with these instruments and the GDPR was conducted in the context of the REFIT evaluation. 2.2.2.Commission proposal for a new European Electronic communications Code On 14 September 2016, the European Commission published a proposal for a new European Electronic communications Code ("EECC ") which consists of a horizontal recasting of four of the existing Directives (Framework, Authorisation, Access and Universal Service), and bringing them all under a single Directive. The proposal also follows a REFIT evaluation which overall has shown that the regulatory framework for electronic communications has broadly achieved its general objective of ensuring a competitive sector providing significant end-user benefits. Nevertheless, while its main specific objectives —promoting competition, developing the internal market, and promoting end-user interest —remain relevant, a review of the regulatory framework appeared necessary in order to address the growing need for increased connectivity of the Digital Single Market and to streamline provisions taking into account market and technological developments. The code proposes increased competition and predictability for investments, better use of radio-frequencies, stronger consumer protection, a safer online environment for users and fairer rules for all players. The ePrivacy Directive is not part of the EECC as its REFIT evaluation and review was pending to the adoption of the GDPR due to the strong need of ensuring consistency of the rules. 2.3.Description of the initiative and its objectives According to its Article 1, the ePD serves three main objectives (see general objectives in Figure 1).

ØIts first objective is to ensure an equivalent level of protection across the EU of the fundamental right to privacy and confidentiality with respect to the processing of personal data in the electronic communications sector. This protection is also granted to subscribers who are legal entities . ØIts second objective is to ensure an equivalent level of protection with respect to the processing of personal data in the electronic communications sector to protect the fundamental right to data protection. ØIts third objective relates to the internal market and is to ensure free movement of personal data processed in the electronic communications sector and the free movement of electronic communications terminal equipment and services in the EU. These objectives are closely intertwined and rely on one another (e.g. the free flow of personal data depends on the existence of common standards to protect such data). The three main objectives of the ePD are supported by a series of specific provisions (see Intervention logic described in Figure 1). These specific provisions, each of which pursues one or several of the ePD main objectives, can be classified around 5 main areas harmonised by the ePD, namely: ·Security of electronic communications; ·Confidentiality of communications and related traffic data; ·Confidentiality of information stored in terminal equipment; ·Protection of users (i.e. natural and legal persons) against unsolicited communications; ·Other provisions ensuring users' data protection and the protection of subscribers' legitimate interests. The main objectives, the 5 areas and the specific provisions ('inputs') attached to them as well as the expected impacts are detailed below in Figure 1 – Intervention logic Figure 1 - Intervention logic 2.4.Baseline situation at the time of the adoption of Directive 2002/58/EC Until the end of the 90's, the electronic communications industry was characterised by separate sectors specialised in the provision of distinct services: voice telephony, data transmission and broadcasting. Each of these services was delivered over a determined network. And the user accessed it via a given terminal: the telephone, the computer or the TV set. Digital technologies that emerged early 2000 changed that situation with any service being offered over any network or accessed via any terminal. The focal point of this convergence process was the advent of the Internet, which created a platform bringing together all communications services and terminals, a key vector of economic growth and innovation in Europe. The consequence of such revolution is that telecom networks started to carry data, rather than only voice, using Internet protocol and packet switching. While this ensured that the end user could be always connected – anywhere, anytime, such situation drew concerns as to the key position of electronic communications service providers in having access to crucial information about internet users,. All of this called for a step-change in the Community's policy on telecoms and other transmission networks, which led to the so-called 1999 Review – made up of proposals for a regulation and five directives, including the ePrivacy Directive 2002/58/EC - adopted in July 2000 and which entered into force in 2002. The mentioned package aimed at creating a new framework for all electronic communications for which a key objective was to ensure a high level of user rights and privacy protection, in the light of the privacy challenges which recently emerged. In this context Directive 2002/58 tackled this issue by extending the principle of ensuring confidentiality of communications to all electronic communications service providers while that principle was extending to traffic and location data. The uptake of mobile internet around 2005-2006 confirmed the importance of protecting traffic and location data in a similar manner as the content of communications given that the collection of these data allow ECS providers to draw very intrusive conclusions about one's life. In parallel a rise of security breaches and the evolution around the delivery of online advertising that started to rely more and more on internet users' behaviour triggered a new range of provisions in the context of the 3rd review of the Electronic Communications rules that led to the adoption of the 2009 Electronic Communications Package. Directive 2002/58/EC was specifically amended to address those issues.

3.Evaluation questions Pursuant to the Commission Better Regulation Framework , the ePrivacy Directive has been evaluated against the five evaluation criteria. Relevance ·To what extent are the general and specific objectives of the ePD still relevant? ·To what extent do the objectives of the ePD – ensuring an equivalent level of protection across the EU of fundamental rights and freedoms, in particular the right to privacy in the electronic communications sector and ensuring the free flow of personal data and services – still correspond to the needs and problems in this sector within the EU? Effectiveness ·To what extent have the objectives of the ePD been met? Have the ePD rules proved relevant to the privacy needs of citizens and legitimate interest of legal persons as well as the needs of the electronic communications market? What are the major constraints to the attainment of the ePD objectives? Coherence ·Is the ePD coherent both internally and in relation with other existing regulations? The interplay (covering an assessment of possible overlaps, contradictions and synergies) with in particular the General Data Protection Regulation, the review of the Electronic communications Regulatory Framework and the Radio Equipment Directive will be an essential element of this analysis. Efficiency ·Do the provisions of the ePD allow for an efficient implementation by Member States? ·What costs have the provisions of the ePD produced and what benefits for the different stakeholders? Could the objectives be achieved at a lower cost? ·To what extent are the costs proportionate to the benefits achieved? To what extent has the intervention been cost-effective, including for SMEs? EU added value

·What is the additional value resulting from the ePD, compared to what could be achieved by Member States at national and/or regional level? 4.Method 4.1.Timing and Sources The evaluation took place between December 2015 and July 2016 and drew from the following main data sources: ·Stakeholder consultations: oA Eurostat community survey on ICT usage by households and individuals of December 2015, (specific questions on citizens' level of awareness of cookie tracking) ; oA public consultation on the evaluation and review of the ePrivacy Directive (open from 12 April - 5 July 2016); oA Eurobarometer survey on e-Privacy, targeting citizens (conducted in July 2016); oAd hoc consultations of (and discussions with) relevant EU expert groups: BEREC , ENISA , the Article 29 Working Party , the European Data Protection Supervisor, the REFIT stakeholder platform, Europol , COCOM and the CPC Network between January and July ; o2 workshops organised by the Commission – one open to all stakeholders and one limited to the national competent authorities in April 2016; oA Round Table organised by the Commission – a closed meeting with 17 key stakeholders from all fields, the European Data Protection Supervisor and the Article 29 Working Party to gather views at a later stage of the review (October 2016); oAd hoc meetings with representatives of the affected industry, public authorities as well as with Digital Rights (Human Rights), consumer and citizens associations, as well as written input received from these stakeholders; ·Evidence gathered through COCOM: Already as of September 2014, the Commission sent a questionnaire to the Communications Committee (COCOM), which gathers the representatives of authorities responsible for electronic communications, requesting Member States to detail how they have implemented Article 4.2 of the ePrivacy Directive. More generally speaking, regular discussions took place in the COCOM on the implementation of the ePD in the context of bi-annual meetings of the COCOM ; ·Evidence gathered through publicly-tendered studies: oThe first comprehensive study on the Directive, titled "ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation" , was finalised in January 2015. The study did not encompass the entire ePrivacy Directive but focused on Article 3 on scope, Article 5 on confidentiality of communications, Articles 6 and 9 respectively on traffic and on location data (other than traffic data); and Article 13 on commercial communications; oA second study was commissioned to help the evidence gathering exercise to evaluate the ePrivacy Directive (by covering the provisions not evaluated in the first study) . The final report was received in October 2016 ; oA Study on future trends and business models in communication services, was also used. This study investigates competitive pressures on Electronic Communications Service providers from companies offering internet-based communication services, Over-the-Top providers ("OTTs") , which end-users increasingly regard as substitutes for traditional telecom services;

·Literature review of relevant reports. This includes among others Opinions of Article 29 Working Party, Opinions of BEREC, Opinions of the Berlin Group on Telecommunications, Opinions of the European Data Protection Supervisor ("EDPS") as well as reports and studies from the Industry, many sent in the context of the public consultation. See Annex I for a detailed overview of these reports and studies. ·REFIT Platform opinion (see Annex II for the full overview of the opinion). 4.2.Method-used for the analysis and overall evaluation exercise The data gathering followed a participatory approach and strived for triangulation, cross-checking of desk research, consultation covering both qualitative and quantitative data. As further explained below, the Commission collected evidence from different sources and proceeded to cross check them. Citizens' views were specifically collected via easy to understand questionnaires in the context of a Eurostat survey of December 2015 and a Eurobarometer on e-Privacy conducted over the phone in July 2016. A 12 week open public consultation on the ePD gathered a total of 421 replies from stakeholders in all Member States as well as from outside the Union, among which 162 contributions from citizens, 33 from civil society, 186 from the industry and 40 from public bodies. For more details see Annex II covering the synopsis report. The consultation was supported by 2 stakeholder workshops (of which one was limited to competent public authorities only) and a Round Table. The views of the public consultation were supplemented by expert opinions of EU expert groups of national competent authorities. Such opinions were issued on the basis of targeted questionnaires sent by the Commission. All in all, stakeholders were consulted in several occasions. For example, the electronic communications industry and public authorities were consulted both via the public and targeted consultations but also though targeted questionnaires sent by the Commission via its contractor. In addition to the public consultation, study SMART 2016/0080 also relied on two online surveys in order to collect additional information and stakeholders views on the ePD, looking in particular for precise quantitative elements, practical costs and benefits that business and competent authorities have experienced while implementing the ePD. The formulation of all questions (both in the public and targeted consultations) took into account concerns or views expressed in previous occasions by various stakeholders (industry, citizens, public authorities etc.) as well as the state of the art in terms of technological developments and economic aspects. The data gathered from the sources above were analysed in house. Most of the data was also analysed by external contractors, in cooperation with the Commission, in the context of the 3 above-mentioned studies. Whenever possible, the Commission compared the consistency of the views received from different stakeholders, gathered through the above channels. Finally, it should be emphasised that the evaluation exercise was coordinated by the European Commission Directorate-General Communications Networks, Content and Technology with the support of a Steering Group, chaired by the SG, (with representatives of European Commission Directorates-General ). The Group steered and monitored the progress of the exercise, ensuring the necessary quality, impartiality and usefulness of the evaluation (see Annex I). 4.3.Limitations The evaluation faced limitations in the collection of data: Quantitative data on the costs for businesses to comply with some of the articles of the ePD is scarce. The majority of stakeholders consulted as part of this initiative (including in particular businesses and business associations consulted as part of online survey and interviews) were not able to estimate relevant figures for the provisions. The reasons for such difficulties relate primarily, according to businesses, to the fact that the necessary capital expenditures have been incurred right after the entry into force of the ePD in 2002 and have since then amortised themselves. Another explanation is the difficulty for businesses to distinguish the costs incurred due to the ePD from the ones arising from other legislations such as the Data Protection Directive (e.g. security requirements). Finally, difficulties stem from the fact that an important part of the costs are not compliance costs but opportunity costs, given that the ePD imposes negative obligations (e.g. not to process), which are the opportunities providers of public telecommunications services or operators of public electronic communications networks are not able to pursue. In relation to (recurring) operational expenditures, the feedback from businesses suggests that today, small costs are incurred in relation to e.g. itemised billing, presentation and restriction of calling and connected line identification and automatic call forwarding directories as these services are built-in features by design. Most costs related to other provisions of the ePD which had not been amortised yet, for example the requirement to set up security measures, the requirement to place cookie banners (to obtain consent), or the rules on commercial communications were mostly based on qualitative calculations and on available studies offering limited quantitative data. The external study supporting the present REFIT evaluation provided an estimation of costs for all the provisions based on a series of assumptions, including a quantification of benefits (see Annex VIII of the Impact Assessment).

5.Implementation state of play 5.1.Transposition Member States were required to transpose the 2009 ePD in their national legislation by the 25th of May 2011. This implementation suffered from delays in some Member States. In May 2012, 5 non-communication infringement cases were opened by the European Commission, which referred Belgium, the Netherlands, Poland, Portugal, and Slovenia - to the Court of Justice of the European Union because they had not implemented the revised EU telecoms rules into their national laws, including the Citizens' Rights Directive 2009/136 which amended the ePrivacy Directive . By January 2013 the Commission noted that all Member States had notified full transposition measures. No case led to a judgment of the Court of Justice of the European Union ("CJEU"). To avoid divergences in transposition of Article 5.3 of the ePrivacy Directive, the Commission lead discussions on this specific article in COCOM which resulted in Commission guidance on Article 5.3 of the ePrivacy Directive . On 24 June 2013 the Commission made use of its powers to adopt implementing measures by adopting Regulation 611/2013 on notification of personal data breaches. As regards the transposition of the ePrivacy rules itself, it took place in a very diverse manner. A large majority of Member States have transposed most of the ePD provisions in a national legal instrument regulating “electronic communications”, containing the rest of the provisions of the Electronic communications Package. But several provisions have been transposed by Member States in the context of another legal framework, such as the legislative instrument applicable to information society services, the general personal data protection law or the legal framework for consumer protection. When the transposition was done into the national legal framework on electronic communications, some Member States have widened the scope of particular provisions of the ePrivacy Directive at national level (especially the confidentiality of communications provisions), considering that these provisions should not only apply to providers of electronic communications services stricto sensu but cover also providers of functionally equivalent services. In Germany, the section of the Federal Telecommunications Act with regard to the processing of personal data – including e.g. traffic data – is not only applicable to services in the context of public networks but applies also to closed user groups . Overall, seven Member States took a wider approach with regard to the scope of the ePD provisions extending the rules to cover so called OTT services. As of 1 January 2015, the new Finnish Information Society Code entered into force . The new Code renders the obligations of the ePrivacy Directive also applicable to communications services other than ECS including instant messaging services. In France the Digital Republic Law was recently adopted and extends the scope of the rules on confidentiality of communications to so called "online providers of communications services to the public" . The assessment of the reasons for these implementation/transposition difficulties and their consequences are assessed under Section 6. 5.2.Monitoring of national measures Once the transposition measures had been put in place, the Commission carried out targeted actions to ensure appropriate transposition of the ePD. The Commission engaged in an assessment of the transposition measures, through evidence and analysis carried out in the context of the first implementation study mentioned under Section 4. The study includes country reports detailing the transposition of the ePD rules in all the Member States and an analysis of whether national transposing laws are in line with the ePD. On the basis of this information, the European Commission has conducted discussions in the period 2013-2016 with a few Member States on their transposition of the ePD. The Commission has also monitored compliance and took proactive measures to ensure harmonised application of the ePD. This has been done through informal contacts with stakeholders and through more systematic actions. For example, the Commission has actively promoted self and co-regulatory actions, including the so-called ‘Online Behavioural Advertising Roundtable ’ and the development of the W3C Do-Not-Track Standard , which is still being discussed at international level. The Commission has also engaged with national authorities responsible for the enforcement of the ePD, through bi-annual meetings to discuss specific issues such as the implementation of the data breach provision and of the Commission Regulation 611/2013 of 24 June 2013 on personal data breach; national experiences on confidentiality of communications and law enforcement; issue of applicable law etc. .

Other than the above, it is worth noting that prior to the transposition of the 2009 ePD in national law, one infringement procedure was launched against the United Kingdom in September 2010. This case referred to the UK rules on the confidentiality of electronic communications. The Commission identified three issues in the United Kingdom legislation relating to the confidentiality of electronic communications, which did not transpose the European legislation correctly: ·There was no independent national authority to supervise interception of communications; ·The UK law did not comply with EU rules defining consent as a freely given, specific and informed indication of a person’s wishes; ·The UK legislation prohibiting and providing sanctions in case of unlawful interception of communications were limited to ‘intentional’ interception only, whereas the ePrivacy Directive requires Members States to prohibit and sanction any unlawful interception, regardless of whether committed intentionally or not. The procedure was closed by the Commission in 2012 following the announcement by the UK government of amending its legislation with a view to bring it in line with European law. 5.3.Choice of competent authorities The enforcement of the ePD provisions at national level is entrusted to a “competent national authority” (Article 15a of the ePD), without further defining that authority or body. This has led to a fragmented situation in the EU and within Member States. As illustrated in the table provided under Annex V, Member States have often allocated competences to enforce the provisions of the ePD to multiple authorities within their country rather than to one: data protection authorities ("DPAs"), telecom national regulatory authorities ("NRAs"), other types of bodies (consumer protection bodies). Overall, in the majority of Member States DPAs are the most appointed as enforcers of the ePD , but they are the sole competent authority in charge of EPD rules only in Italy, Luxembourg, Spain and Romania and the main authority in Portugal, Lithuania and Czech Republic. For further details see Annex V. This situation causes overlapping competences between authorities as well as a certain degree of legal uncertainty which contributes to hamper harmonised interpretations of the ePD provisions and cooperation in cross-border cases – more details under Section 6. 6.Answers to the evaluation questions The evaluation questions (relevance, effectiveness, coherence, EU added value, and efficiency) will be answered vis-à-vis the five main areas of the ePD sketched under Section 2.3 above, namely, (i) security of electronic communications; (ii) confidentiality of communications and related traffic data; (iii) confidentiality of information stored in terminal equipment; (iv) protection of users against unsolicited communications and, (v) other provisions ensuring users' privacy and the protection of subscribers' legitimate interests. Prior to this, the horizontal problems specifically affecting the effectiveness of the ePrivacy Directive, i.e. the definition of the scope and the choice of the competent authorities, will be discussed in the outset of this section. 6.1.Horizontal effectiveness issue: Scope of the ePD and choice of competent authorities 6.1.1.Scope of the ePD The ePrivacy Directive regulates “the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the Community” . In particular, its provisions apply to providers of “electronic communications networks and services” . To be covered by the Directive:

(1)the service should be an electronic communications service, (2)the service should be offered in an electronic communications network, (3)the aforementioned service and network should be publicly available, and (4)the network or service should be provided in the Community. The ePD applies, for the most part, to traditional telecommunication service providers, i.e. those providers that are responsible for carrying signals over an electronic communications network. Services which are functionally equivalent to ECS, over the top services are not covered. A series of stakeholders, in particular competent authorities, consumer and civil society associations as well as traditional telecom providers, have criticised that the scope of the ePD in relation to the types of services covered in their view is too narrow based on the definition of electronic communications services, potentially hindering the achievement of the right to privacy and confidentiality in the electronic communications sector. This view is also supported by the Deloitte survey towards businesses for which 14 out of 26 replied that the scope was too narrow, whereas 16 respondents out of 28 agreed the scope was out of date. The scope of the rules set out in the ePD was also considered ambiguous and lacking coherence by the same stakeholders. While Article 3 of the ePD expressly limits the scope to publicly available electronic communications services in public communications networks, other provisions have a different scope, which may create legal uncertainty such as: ·the provision on confidentiality of terminal equipment is nevertheless applicable to providers of information society services (Article 5.3); ·the rule on unsolicited communications applies to anyone who sends commercial communications (Article 13). Furthermore, as the ePD only applies to publicly available electronic communications networks, this means that closed (private) user groups and corporate networks are excluded from the scope of the ePD. In this context, there is a lack of clarity as to which services qualify as a publicly available electronic communications services in public communications networks. Indeed, Member States have diverging views on whether Wi-Fi access offered by an airport or internet access provided in internet cafes and shopping malls qualify as publicly available electronic communications services in public communications networks.The Article 29 Working Party also noted that the distinction between public and private networks is not always clear, as private and public elements are increasingly intertwined. Examples of such ambiguous services according to the Article 29 Working Party include: ·Internet access provided to ten thousands of students at a university; ·Internet access provided by multinational companies to their employees; and ·Internet access provided to any visitor of a cybercafé. The definition of “electronic mail” is also unclear, as demonstrated by the opinion of the Nordic Ombudsman regarding whether messages appearing to a Facebook user under ‘News Feed’ can be deemed as ‘electronic mail’ (and thus be subject to the rules on unsolicited commercial communications). The Nordic Consumer Ombudsmen say: “It is uncertain whether messages from traders appearing under a Facebook user’s ‘News Feed’ fall within the definition of electronic mail“. Finally, it remains unclear to which extent the electronic communications of the Internet of Things is covered by the ePD scope as its Article 3 expressly refers to "public communication networks supporting identification devices" . According to the EDPS, this seeks to clarify that the communications provider normally should not be concerned with the purpose or content of communications, nor should it even be aware of such specificities of the messages and other communications being transmitted through their services. Recital 56 of Directive 2009/136/EC provides that the provisions of the ePD, in particular those on security, traffic and location data and on confidentiality of communications apply to Radio Frequency Identification. Overall, it can be concluded that the effectiveness of the ePrivacy Directive was partially hampered by its unclear scope and definitions. 6.1.2.Applicable law and cross-border situations Contrary to the Data Protection Directive, the ePrivacy Directive does not contain an explicit provision with regard to the applicable national law. This may create legal uncertainty as to which law should apply in a cross-border context. In particular, it is unclear whether the rules on applicable law of the DPD apply (country of origin) or whether the ePrivacy Directive should be considered as following the applicable law rules set forth in the directives belonging to the ECS package (country of destination).

The unclear situation derives from the lacking of a specific applicable law rule, which hinders an effective application of the rules in a cross-border situation. 6.1.3.Diversity of competent authorities The ePrivacy Directive entrusts the enforcement of its rules to a “competent national authority” (Article 15a of the ePD), without further defining that authority or body. Each of these authorities has different responsibilities, structures and inherent specificities not conducive to reaching the same views on the interpretation and enforcement of the ePD, so that the same processing is treated divergently across Member States and thus impacts cross-border processing activities. This situation fosters different interpretations across Member States and this is reinforced by the fact that there is no recognised EU group to gather together all authorities responsible for the enforcement of the ePD. DPAs meet through the Article 29 Working Party (which is tasked with providing advice and guidance on the Data Protection Directive and the ePD) and NRAs through BEREC. In practice, this diversity of competent authorities, whose competences often overlap, has led in many countries to an ineffective enforcement of the rules as evidenced by the lack of compliance of companies in practice with some of the provisions (e.g. the so called "cookie" rule) further supported by the inexistence of case-law . This is confirmed by the views of a strong majority of stakeholders in the public consultation: Consumers and industry converge in thinking that because Member States have allocated enforcement powers to different authorities, this has caused divergent interpretation of the rules. A majority of citizens and consumers and their representative associations believe that this has led to significant or moderate divergent interpretation of the rules in the EU and to non-effective enforcement. Of those that have reported significant and moderate problems, the main source of confusion is for citizens, and then the providers themselves, followed by the competent authorities. The REFIT platform opinion expressly calls on the Commission to address the fragmentation generated from the diversity of allocation of competences throughout Member States. Overall, it appears that the effectiveness of the rules in cross-border cases is hampered due to the allocation of enforcement competences to a wide range of authorities that often overlap. 6.2.Security of electronic communications The ePD requires providers of electronic communications services to take appropriate technical and organisational measures to safeguard the security of their services (Article 4). In case of a particular risk of a breach of the security of the networks, the service providers must also inform their subscribers of this risk (Article 4.2). Publicly available electronic communications service providers must also notify personal data breaches to relevant authorities, and in certain cases (if the breach is likely to adversely affect that person) also to the subscribers and individuals concerned (Article 4.3). 6.2.1.Relevance of the current rules Ensuring the security of information processed remains an essential pre-condition to achieve the objectives of this directive, e.g. privacy and confidentiality of communications as well as the free flow of personal data and services. If one takes into account that the numbers of deliberate or accidental security incidents is increasing, the relevance of the security requirements are even bigger today than in 1997, when this requirement was first adopted. The fact that similar obligations have been imposed in other sectors, such as those covered by the Directive concerning measures for a high common level of security of network and information systems across the Union ("NIS Directive") and the strengthened general rules on security relating to processing of personal data in the GDPR, highlights the importance and increased relevance of security requirements in general. Nevertheless, the existence of these new provisions has put into question the relevance of maintaining security requirements within the ePrivacy Directive. Therefore a careful assessment of overlaps with relevant EU legislation has been conducted under the coherence criteria under section 6.2.3. Such assessment has shown that most of Article 4 (except Article 4(2)) is covered by the security provisions of the GDPR and therefore such article remains only partially relevant. 6.2.2.Effectiveness Under this criterion it is assessed whether Article 4 has achieved its objectives and proved effective. The evaluation shows that Article 4 has only been partially effective in ensuring security of services. Before the review of 2009, the Directive provided little guidance on the measures appropriate to fulfil the security requirements while there was no obligation to report breaches at EU level. The security rules introduced in 2009 brought more clarity and a degree of uniformity regarding security of telecommunication services insofar as they spelled out with a high degree of detail the specific security measures to be applied by electronic communication providers to protect communication services. Nevertheless, as regards the contents of the provision itself, some uncertainties remain. For instance, it is not specified whether the security obligations in Article 4.1 and 4.2 should apply to personal data only or also to non-personal data. Although some explicit references to “personal data” are made e.g. in Article 4(1a), the “security of services” refers rather to the overall functionality and provision of the service, including personal data but possibly also other aspects. As concerns the obligation to inform subscribers of security risks (Article 4.2), ENISA pointed out that there are difficulties relating to its practical application. In particular, there is little guidance about the type of risks and proposed mitigating measures that the providers should be informing for . On this basis, the quality of information provided to subscribers may vary. A questionnaire sent to Member States through the Communications Committee (COCOM) about the application of Article 4.2 indicated that Member States have little experience on the application of this provision as well as important divergences on how it is being applied. For example, in some Member States the providers must notify subscribers about the risks through the provider website (e.g. Poland). In some Member States, the notification must be provided directly to the subscriber (e.g. Sweden). Several countries such as Belgium, Greece, Ireland, Malta, Romania and Spain have transposed the data breach requirements under 4.2 and 4.3 literally.

The obligation to inform subscribers of security risks (Article 4.2) and the rules on the notification of personal data breaches (Article 4.3) may positively contribute to the security of processing as they ensure that any breach must be notified to the competent authorities and in some cases to individuals. Only 13% of industry respondents to the public open consultation indicated that they have faced problems . Public bodies expressed difficulties in enforcing the data breach rule as reflected by the online survey conducted by Deloitte in the context of study SMART 2016/0080. According to some authorities, the breach notification provision is good on theoretical level but its effectiveness has not been fully achieved yet. This seems to be confirmed by the inexistent or very low numbers of breach notifications in many Member States (see Table 1 on Reported incidents of personal data breaches in selected EU Member States below). Some authorities explained that businesses in some cases have failed to report personal data breaches but the degree of compliance is difficult to verify given that most authorities rely on information provided by companies themselves. This might be caused by the lack of defining criteria to determine what type of breaches needs to be notified. Table 1 -Reported incidents of personal data breaches in selected EU Member States Member State 2010 2011 2012 2013 2014 2015 Belgium / / 0 0 4 1 Croatia 0 0 0 Cyprus 0 0 0 0 0 0 Estonia 1 2 5 Germany - - 17 66 112 261 Greece (HDPA) n/a n/a 0 0 0 4 Greece (ADAE) 4 7 5 16 30 11 Ireland 410 1167 1592 1507 2188 2317 Romania 1 3 Sweden 5 4 16 24 United Kingdom 491 381 308 550 Total 414 1174 2110 1975 2661 3176 Source: Deloitte - Responses of competent authorities to Deloitte online survey In addition, there have been in the recent years some major cyber-attacks and other breaches , which further put into question the extent to which the rules are applied in practice and adequately enforced. A few authorities also expressly reported to the Commission that they do not have the power to impose penalties in case of violation. On a positive note, the transposition check carried out by one of the supporting studies of the REFIT shows that most Member States transposed all relevant parts of this article. On this basis, the effectiveness of this article in achieving secure processing is not hindered in most Member States. Indeed, almost half of the Member States appear to have transposed this article more or less literally . Quantitative data about the incidents reported may be interpreted in different ways: it may be read as a sign of greater responsiveness from operators. A study published by university researchers in the United States found that in the US, the adoption of personal data breach notification laws resulted in a reduction of identity thefts by 6.1 % in average . There is no similar information available for the EU. To conclude, it can be concluded from the above that Article 4 was relatively effective in imposing adequate security obligations upon providers of electronic communications but that such effectiveness could be increased with more clarity on security breach notification and powers to competent authorities, 6.2.3.Coherence This section assesses whether the rules of Article 4 are coherent both internally and in relation with other existing EU legal instruments. Article 4 is closely linked to Article 13a of the Telecom Framework Directive 2002/21/EC and Articles 32, 33 and 34 of the GDPR and other instruments. In the table below, the connection between the ePD and the GDPR as well as the Electronic communications package is presented. For each relevant provision a brief summary is provided, using the following colour code: ·Green: positive relationship (e.g. synergies); ·Yellow: potential challenges. Table 2 - Comparison of Article 4 with the similar security provisions in the GDPR and Framework Directive: Provision in the ePD Provision in the other instrument Main findings GDPR Security of Processing (Article 4.1 and 4.2) -Principles relating to processing of personal data (Article 5) -Security of processing (Article 32) -Data protection by design and by default (Article 25) -Data Protection Impact Assessment (Article 35) The measures provided in Paragraphs 1 and 1a of Article 4 of the ePD are covered by the GDPR. The GDPR goes into greater detail than the ePD, providing further references to measures such as pseudonymization, encryption, confidentiality, integrity, availability, and resilience of processing systems, as well as disaster recovery plans, regular testing, and adherence to codes of conduct and standards. However, the requirements of Article 4.2 regarding the breach to the security of the network are not addressed under the GDPR. Notification of personal data breaches (Article 4.3 and 4.4) -Notification of a personal data breach to the supervisory authority (Article 33) -Communication of a personal data breach to the data subject (Article 34) The procedures for personal data breaches vary considerably between the ePD and the GDPR; thus, an ECS may need to follow different procedures in case it offers electronic communications and other services, with divergences on: ·Conditions for notification to authorities; ·Conditions for notification to data subjects; ·Content of the notification; and ·Exceptions to the notification to data subject. Electronic Communications Package (Framework Directive) Framework Directive Security of processing (Article 4.1 and 4.2) Security and integrity (Article 13a.1 and 13a.2) Article 4.1, 4.1a and 4.2 of the ePD focus on ensuring the integrity and confidentiality of the personal data both stored and in transit. Article 13.a and 13.b of the FD focus on security matters affecting the continuity of the service and of the network. It works in synergy with Article 4 of the ePD. The requirements of Article 4.2 are not addressed under the Article 13a.1 and 13a.2. Security of processing (Article 4.3 and 4.4) Security and integrity (Article 13a.3 and 13a.4) The breach notifications under Article 4.3 and 4.4 of the ePD focus on the privacy impact such a breach would have on the individual. The breach notifications under 13.a.3 and 13.a.4 are requested when a breach will significantly impact the operation of networks or services (e.g. server down, no access to internet). Thus, the provisions do not overlap or contradict each other, but rather work on synergy. Many of the competent authorities interviewed by Deloitte criticised that with the adoption of the GDPR there will be two different data breach notification regimes, if the regime detailed under Article 4 of the ePD remains. This view was supported by ENISA, which argued that the data breach requirements of the ePD overlaps with Articles 33 and 34 of the GDPR and that these provisions achieve the same objective in a more efficient and flexible way than in the ePD. The deadline for notifying the supervisory authority of breaches is more flexible in the GDPR than in the ePD (72 versus 24 hours). ENISA therefore concludes that the GDPR scheme seems to be preferable to the one of the ePD as it has the potential to achieve the same objective, allowing for more efficiency and better quality of results but with a more flexible regime. Conversely, ENISA confirms that Article 4(2), which relates to notification of risks, is not part of the GDPR; it is specific to the electronic communications sector. For more details on coherence with GDPR, see Annex IV. On the coherence of these security provisions with the Framework Directive and GDPR, around one third of citizens and consumers reported that they do not know, whether such coherence is achieved. In the light of the above, and in particular of the coherency check with other existing instruments, it can be summarised that Article 4.1, 4.1a and Article 4.3 and 4.4 are redundant with the security provisions of the GDPR. Article 4.2 remains relevant as it is neither covered by the Framework Directive nor by the GDPR. 6.2.4.Efficiency

Businesses have indicated that they incurred most of compliance cost with Article 4 after the adoption of these rules (some in 1997, some in 2002 and also as for the data breach notification in 2009). This provision is one of the more costly provisions for businesses and competent authorities, as it entails several concrete obligations. For businesses, the provision entails costs as to the implementation of security standards, potential interaction with competent authorities in the context of audits and since 2009, the obligation to notify security breaches as detailed further below.. The SMART study provided a detailed calculation of the compliance costs as for the data breach notification regime. It explains that excluding any estimates on the costs of setting up necessary internal business organisation (assumed to be already included in any adequate risk management approach), the notification costs are estimated using staff costs and time requirements. The costs for a staff person entrusted with reporting and follow-up activities are assumed to be EUR 60,000. Presupposing that reporting activities are similar to those under Article 13a of the Framework Directive 2002/21/EC and that no further analysis within the organisations are necessary, time required for notification is assumed to be one 0.5 working days. Combining these two factors, the average cost for reporting one incident is EUR 125. While this number is not considered to be very significant for businesses, it may underestimate the expenses due to a very narrow definition of work steps and staff involved in the notification process. With regard to post data breach response costs, investigations are considered as a significant driver of costs. In relation to administrative burden, mostly stemming from the notification obligations for telecommunication service providers, it is estimated that an annual amount of around EUR 28 per affected business per year.From the perspective of competent authorities, Article 4 tends to be one of the most time-consuming provisions, with variations across Member States. Other studies have evaluated these costs differently and allude to higher figures. Nevertheless, it should be noted that the costs of notifying breaches are by definition only incurred in case of an actual breach; so real costs incurred must be estimated in the light of the (very low level of) notification of such breaches in the Member States. Regarding the requirements to implement security measures, several studies reported that large organisations are progressively increasing their spending on IT security. The same research finds that organisations who have invested more in security defences have fewer breaches. This seems to indicate a positive effect associated to the security requirements. To monitor compliance of such security requirements, available information suggests that the actual time spent by public authorities depends on the Member State. Three authorities indicated that this takes less than one working day, four indicated that it takes between 1 day and less than a week and three authorities indicated that it takes 1 week or more. Several stakeholders in the online survey and interviews conducted by Deloitte pointed out that the efficiency may be hindered based on the interaction of the ePD with other instruments. More specifically, it was argued that there might be to many overlapping requirements (GDPR, ePD, Network and Information Security Directive, Framework Directive), creating administrative burden. Overall, Article 4, in particular the requirement to notify personal data breaches, appears to be one of the most costly provisions, both for businesses and competent authorities, while this provision mostly overlaps with the GDPR. Keeping overlapping provisions between the ePD and the GDPR could potentially entail additional costs, administrative burden and legal uncertainty for ECS providers. It would also add extra costs for competent authorities given that more than one authority may have to investigate the same data breach. 6.2.5.EU added value Having different levels of national security requirements, including different procedures and circumstances under which personal data breach notifications are required to be notified may lead to uncertainty and to more cumbersome procedures and significant administrative costs for providers operating across borders. Operators are moving towards offering cross-border services; hence, having harmonised security EU rules becomes more relevant as otherwise they may have to comply with different national rules. Furthermore personal data breaches are not confined to the borders of one Member State, an operator may have to notify personal data breaches in various Member States. This highlights the need for harmonised procedures to notify personal data breaches. When the security obligations of the ePD were streamlined in 2009 with new personal data breach obligations the intention was to render electronic communications service providers more accountable across the EU while such rules did not exist in any other EU instruments. The added value of having harmonised rules at EU level is confirmed by a majority of public bodies, citizens and civil society that responded to the public consultation. However, as for the personal data breach notification, a great majority of industry did not see any EU added value , which appears to be due to the fact that the recently adopted GDPR sets forth similar rules (see section on coherency). The above leads to the conclusion that there is EU added value to have rules requiring notification of personal data breaches but there is no added value in having these requirements in the ePD, given that similar rules exist under the GDPR. KEY FINDINGS: The pertinence of having security requirements at EU level to protect personal data from loss or unauthorised access as well as data breach notification was demonstrated; the scarce evidence on the related costs and benefits is not sufficient to estimate whether such costs have been fully proportional vis-à-vis the benefits and objectives pursued At the same time, the above confirms that the security provisions of the ePD (Articles 4.1 and 4.1a, 4.3, 4.4 and 4.5) overlap with other legislation and cause duplication. The effectiveness of the security provision under the ePD has been partly limited due to various reasons, such as the lack of enforcement powers of competent authorities in some Member States. Moreover, keeping overlapping provisions between the ePD and the GDPR could potentially entail additional costs, administrative burden and legal uncertainty for ECS providers. In light of the above, it can be concluded that Articles 4.1, 4.1a, 4.3 and 4.4. appear redundant while the requirement of Article 4.2 to report risks is still relevant and coherent with the GDPR and Framework Directive. 6.3.Confidentiality of communications and related traffic data The principle of confidentiality of communications and related traffic data and location data is spelled out respectively in Articles 5.1, 6 and 9 of the ePD (hereinafter we refer to these provisions as "confidentiality of communications and related traffic data"). Member States must ensure confidentiality of communications and of related traffic data in public communication networks and services. Therefore, listening, tapping, storing or engaging in other kinds of interception or surveillance of communications and the related traffic data without the consent of the citizen concerned (except when legally authorised) is prohibited .

The principle relates both the content of communications and their related traffic data . Article 6 of the ePD specifies that ECS providers must ask for their subscribers'/users' consent in order to use traffic data for the purpose of marketing electronic communications services as well as to provide "value added services". If individuals have not consented or if the data is not anonymised, the data must be erased after the period during which the bill may be challenged or payment pursued. Article 9 of the ePD requires users' consent for ECS providers to process location data other than traffic data. It can be processed to provide value added services to the extent and for the duration necessary for the provision of such services. These data can be processed for other purposes, without consent, as long as the data are made anonymous. 6.3.1.Relevance of the current rules The rationale behind the rules protecting the content of communications is the need to ensure that one’s communications (what is written or said) is kept private. These rules not only seek to protect privacy, but also support other fundamental rights, such as the freedom of speech. The rules ensure as well the secrecy of communications per se, independently of the protection of privacy, for example to exchange business information, which may not qualify as personal data. The prohibition to access communications covers indifferently the content of the electronic communications and the traffic and location data attached to it (so called "meta-data"). The latter is justified by the dangers caused by the ECS unobstructed view of citizen's daily behaviour online and physical moves. The European Court of Justice has acknowledged in recent rulings that traffic data may allow very precise conclusions to be drawn concerning the private lives of persons . Rules on confidentiality of communications under Article 5(1) and (2) have no direct equivalent in Directive 95/46/EC or the GDPR. The general data protection instruments do not refer to the prohibition of listening, tapping, storing, or otherwise intercepting communications and their related data. The need for such reules and the fact that they are not replicated elsewhere is confirmed by several stakeholders interviewed by Deloitte as well as BEREC and the EDPS. Similarly, the Article 29 Working Party argues that ensuring confidentiality of communications is a key objective of the ePD and that it is still relevant to have a “general prohibition of the interception/surveillance/monitoring of the content of electronic communications”. . 6.3.2.Effectiveness According to stakeholders, the ePD has not been fully effective in ensuring protection of privacy and electronic communications. In the public consultation, 76% of the citizens and civil society do not believe, or believe only to a limited extent, that Article 5.1 has ensured full protection of privacy and confidentiality of communications. Citizens and organisations representing consumers and civil society report that the application/understanding of the rules on confidentiality of electronic communications is problematic, citing various reasons, including the fact that they do not cover OTT services. 60% of the industry recognised that they had encountered difficulties in understanding or applying the rules on confidentiality of communications and related traffic data . As further described below, this lack of effectiveness could result from a variety of factors, including: -A series of problems and flaws in the wording and implementation of Article 5.1 and 5.2, which prevented the full achievement of the key objective of ensuring the confidentiality of communications detailed below: othe wording of the provisions (Article 5.1. and 5.2) appears partially outdated. It should be clarified that the confidentiality of electronic communications should also apply against “automatic” intrusions without human intervention. None of the Member States has provisions that deal explicitly with automated data processing, without human involvement, in the context of a breach of confidentiality of electronic communications. Moreover, diverging interpretations exists across Member States. For example, Sweden requires the involvement of a person in order to qualify for an illegitimate breach of confidentiality. Belgium, Germany and other Member States will consider the interception of MAC addresses a breach of confidentiality while in France there will need to be additional data captured that link the MAC to an individual . oSome Member States treat traffic data and content differently ; others have one provision/instrument covering both types of data . For eleven Member States only when content is in transit is it considered a communication of which the confidentiality should be protected . oMember States have also taken very different approach in transposing the lawful business exception (Article 5.2), due to the confusing wording of the provision, written in too broad terms. - the limited scope of application and related uneven playing field, a problem described in Section 6.1.1. Indeed, while the ePD covers some parts of consumers’ everyday communication means, new communication means that are expected to become more important over the next couple of years are not covered by the confidentiality rules. Source: 2016 Eurobarometer survey (EB) 443 on e-Privacy (SMART 2016/079) Over-the-top providers, which provide functionally equivalent communications services over the Internet (e.g. Voice over IP, instant messaging) have become prominent in the field, supported by the Eurobarometer survey table above on the usage of these services, and they are not covered by the current definition of ECS. For instance, as highlighted above, the Eurobarometer on ePrivacy shows that a large part of consumers also uses OTT services every day that are not covered by the ePD: ·Email is used by 46% of consumers every day;

·OTTs for the purpose of instant messaging (e.g. WhatsApp) are used by 41% every day ; and ·Online social networks are used by 38% every day. Considering actual traffic volumes, the use of OTT services has increased considerably: The OTT’s share of overall messaging traffic has already increased from 8.31% (2010) to 66.96% (2013) and is projected to rise to 90% until 2020. Conversely, the use of SMS continues to decrease in almost all EU MS since 2010, albeit at a different pace: In Finland and Germany. On the individual level, the average WhatsApp user is reported to send approximately 40 (while receiving around 80) messages per day as opposed to an estimated number of 4.5 SMS This ratio of approximately 1:10 for daily SMS versus OTTs messages is likely to be much higher in practice, due to the reported parallel use of multiple messaging apps.. Given the strong penetration of OTT services in the electronic communications market , the fact that the rules only apply to traditional ECS providers and not to these new players strongly questions the effectiveness of the rule as such situation deprives citizens from the very protection the Directive intends to provide. While the processing of personal data in deploying these services is covered under the GDPR (rights of data subjects, principles relating to processing of data, etc.), the specific, additional, protection provided by the ePD, which in the case of confidentiality of communications requires the consent of both communicating parties to interfere in the content of communications, is not applicable to OTTs. This situation also raises concerns as to the fact that the current legal framework has resulted in an uneven level playing field among different market players due to market and technological changes. The public consultation shows that 76% of citizens and civil society and public bodies find that OTTs should provide the same level of protection when they provide functionally equivalent communication services as ECS providers, while only very few think that this should not be the case (5.6%). Industry is more divided as 42% does not want the scope to be broadened while 36% does . This may be explained by the fact that OTT providers replied and belong to industry. Nevertheless, extension of the rules to cover OTT services is the second priority of industry (29%) after the option of not keeping any provision anymore. The need to guarantee confidentiality of communications regardless of the technology used is also confirmed by the Eurobarometer survey on e-Privacy: More than nine in ten (92%) say it is important that the confidentiality of their e-mails and online instant messaging is guaranteed. Source: 2016 Eurobarometer survey (EB) 443 on e-Privacy (SMART 2016/079) The Article 29 Working Party, BEREC and the EDPS also support an extension of the scope of Articles 5.1, 6 and 9 to cover at least OTTs. Wi-Fi tracking is another gap in the protection guaranteed by the ePD. When a Wi-Fi enabled device is switched on, it continually broadcasts unique identifiers called MAC (Media Access Control) addresses. WiFi (and in a comparable way Bluetooth) tracking may be used to count people, to track and observe their movements within the area covered by a private network, such as airports or shopping malls. This includes the trajectories they follow as well as the time they spend at certain locations. It is not clear in all MS whether the current ePD protects the information emitted from the devices, such as MAC addresses. Similarly, it remains unclear to which extent the electronic communications of the Internet of Things ("IoT") is covered by the ePD. Finally, the effectiveness of the rules on confidentiality of communications was also affected by the fragmentation generated by the competence of Member States to derogate to these rules. Indeed, Article 15 of the e-Privacy Directive sets out rules that allow national rules to be created to restrict the rights and obligations provided for under the general rules. This means that rules can be set, for example, forcing electronic communications service providers to retain data. This can be done for the purposes of "safeguard(ing) national security, defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorized use of the electronic communications system". It must be "necessary, appropriate and proportionate" and must comply with the EU Charter (e.g. interference with privacy rights must be "strictly necessary"). To sum up, the effectiveness of Article 5.1, 6 and 9 has been hindered by the problems described above. 6.3.3.Coherence Under this criterion it is relevant to assess the extent to which the principle of confidentiality of communications is coherent with the GDPR, meaning whether the protections provided by Article 5.1, 6 and 9 are also provided by the GDPR, causing a possible overlap. Article 7 of the EU Charter specifically protects the confidentiality of communications. This is separate from Article 8 of the EU Charter which protects personal data. The rules on confidentiality of electronic communications are only enshrined at EU level in the ePD. The GDPR contains a number of obligations upon data controllers and processors and rights of data subjects to ensure appropriate confidentiality, integrity and security of personal data under the principles of processing personal data (Article 5.1.f) , and in the specific security provision (Article 32 of the GDPR). The provisions of the GDPR seek to update, strengthen and modernise the Data Protection Directive. While the DPD and GDPR rules mentioned above are extremely relevant towards ensuring that personal data is kept secure, these rules do not regulate explicitly the principle of confidentiality of communications and related traffic data as laid down in Article 5. Therefore it is important to stress that the GDPR does not specifically cover the right to confidentiality of communications. In its opinion, the REFIT platform recommends that the two pieces of legislation are fully aligned and that the provisions ensuring confidentiality of communications of the ePD are revised to ensure that they are fit for the digital age and the new technology reality. Regarding the specific rules on traffic and location data, by requiring consent for the processing of these data, the ePD offers a single legal basis to permit processing of personal data. The GDPR, at least potentially, allows other legal grounds, such as legitimate interests, performance of a contract, or the data subject’s vital interest. Furthermore, the ePD also limits the validity of consent to the duration necessary for such services and the data must be used for the ‘value added services’ only. Furthermore, unless the individual has consented, the data must be anonymised or deleted after the period during which the bill may be lawfully challenged or the payment pursued.

The above leads to the conclusion that the ePD rules on confidentiality of communications and related traffic data are coherent with the GDPR. 6.3.4.Efficiency Under this criterion it is important to assess whether the costs involved in fulfilling the confidentiality requirements are proportionate to the benefits achieved. According to the study SMART 2016/0080, there is scarce information as to the cost of compliance with the confidentiality of communications rules, partly due to the fact that these rules had to be applied as of 1997 and they appear to have been amortised by now. The proportionality of these costs was addressed in the public consultation. A proportion of citizens and civil society (57.1%) think that the cost of compliance is proportional to the objectives of the ePrivacy Directive, while a majority of industry players (65.3%) report disproportionate compliance costs. A majority of public bodies (72.7%) believes that the costs of compliance are in line with the objectives pursued. Evidence collected by the study SMART 2016/0080 shows that rather than compliance costs, the costs incurred by ECSs appear rather as lost business opportunities, given that the ePD places limitations on the re-use of traffic data for purposes that are not related to the conveyance of communications, whereas functionally equivalent OTTs remain out of the scope of such rules. In the public consultation most consumers believe that the price of compliance is justified in order to reach the objectives of confidentiality of the ePD. 6.3.5.EU added value The rules on confidentiality of communications aim at ensuring the right to confidentiality of communications across the EU, by introducing harmonised standards. It can be argued that this cannot be achieved by Member States alone, as communications are not bound by borders (in particular within the internal market) and Member States’ standards on this varied before the introduction of the ePD. The EU added value also lays in the harmonisation of concepts and rules on confidentiality of electronic communications, traffic and location data. This EU added value of the rules on confidentiality of communications is confirmed by citizens and civil society (90%) and Member States and public authorities (90%) responding to the public consultation, while overall two thirds of respondents recognise this EU added value . These views are shared by Article 29 Working Party, EDPS and BEREC. Conversely, a vast majority of industry does not agree to the necessity to have rules on confidentiality of communications at EU level (63.34%). Although in August 2016, ETNO, an association representing Europe's leading telecom operators, published a report which stated that ‘privacy related provision of the ePrivacy Directive, i.e. the article on confidentiality of communications, may still be relevant today’. KEY FINDINGS: Confidentiality of communications is only ensured at EU level by the ePD, which key purpose is to specifically spell out the fundamental right to private life, correspondence and communications enshrined in Article 7 of the EU Charter. The relevance and EU added value of the rules on confidentiality primarily lay in their goal to afford an equivalent level of protection and confidentiality of the electronic communications throughout the EU. Specific rules ensuring confidentiality of communications are all the more needed according to citizens, civil society and public bodies in the light of technological changes and growing risks posed by online tracking. With regards to traffic/location data of electronic communications, the evaluation confirmed its high degree of sensitivity, given that such data may allow very precise conclusions to be drawn concerning the private lives of persons involved. This is repeatedly stressed in recent rulings of the EU Court. Hence, Article 29 Working Party, the EDPS and BEREC have recommended to keep the rules on confidentiality and to regulate any processing of traffic and location data within the ePD. All of them recommend extending its scope to OTTs providing functionally equivalent services. It is argued that new technologies would allow ECS to analyse network traffic in real time causing greater threats to privacy and confidentiality of communications. Furthermore, the rules are fully aligned with the GDPR, and constitute a complement to it. However, the assessment of the ePD has shown that it has not been fully effective in ensuring the protection of privacy and electronic communications in the EU. This is due to a series of problems and flaws in the wording and implementation of Article 5.1 and 5.2, 6 and 9 including their limited scope of application. Compliance costs faced by companies appear negligible as the costs have already been amortised. 6.4.Confidentiality of information stored in terminal equipment Article 5.3 of the ePD aims to ensure the confidentiality of information stored on the users’ terminal equipment (i.e. computers, smartphones), in particular by increasing awareness and empowering users. Under Article 5.3, Member States are required to ensure that "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent… ‘Information’ includes technologies and applications such as cookies, web-beacons or spyware but also contact lists, pictures, content of emails, etc. This requirement stems from the revision of the ePD in 2009. 6.4.1.Relevance Under this criterion it is necessary to assess whether the specific objectives of Article 5.3 are still relevant. Information transferred through electronic communications networks is increasingly stored in terminal equipment. This would normally include the content of emails, SMS, pictures, contact lists, videos, etc.

The relevance of this article is evident if one takes into account that the more information is stored in devices, the higher the sensitivity of such information is and the greater the damaging consequences for individuals if such information were released without their consent. This is confirmed both in the public consultation and in the Eurobarometer survey on e-Privacy, where a large majority of citizens considered that requesting their consent before accessing or storing information on their terminal equipment remains valid, given the sensitivity of the information stored on users' terminal equipment (e.g. pictures, contact list, etc.). More specifically, more than nine in ten respondents to the Eurobarometer survey on e-Privacy (92%) considered important that their permission be asked before: • their personal information (e.g. photos, calendar, contacts) on their computer, smartphone or tablet can be accessed; • tools are used to monitor their activities online (such as cookies). Source: 2016 Eurobarometer survey (EB) 443 on e-Privacy (SMART 2016/079) In addition to privacy issues, protecting the information in devices is relevant as a measure to minimise information theft and subsequent abuse of such information, for example to engage in theft (stealing from bank accounts) and identity theft. At the same time, the need for a more flexible consent rule was also supported by the Eurobarometer survey on e-Privacy and by a majority of the respondents to the public consultation. However the relevance of this provision is partially diminished by the fact that it is both over-inclusive with a scope that covers a non-privacy invasive practice, namely first party analytic cookies. For example, some stakeholders have argued that the provision should not cover technologies that are not privacy invasive. In its opinion, the REFIT Platform expressed a similar view and stressed the need to review the rules to allow greater flexibility for those tools that do not pose any privacy risks. For example, respondents to the Eurobarometer survey on e-Privacy are globally in favour of a request from a website to access their information, the first time or each time they visit the website (while 39% think this should happen each time they enter the website). Also in all but one country, the absolute majority of respondents to the Eurobarometer survey totally agree the default browser settings should stop their information from being shared. 6.4.2.Effectiveness In assessing the effectiveness of Article 5.3 we note that this provision is applicable not only to cookies but also to any other technology used to store or gain access to information on individuals' technical equipment (spyware, malware, etc.) . However, its effectiveness has been hindered because it is unclear whether it covers new techniques where identifiers emitted by the device are used for tracking purposes. For example, there is at least a lack of clarity relating to the coverage of some techniques, hindering its effectiveness: Wi-Fi tracking, and device fingerprinting. These techniques must comply with the GDPR when the processing involves personal data; however, it is unclear whether Article 5.3 would also apply . In its opinion, the REFIT Platform recommended the elaboration of rules that are future proof and support privacy-friendly technologies (see Annex III). It also points out that the GDPR rules remain applicable if the information stored or collected from the device entails the processing of personal data. Therefore, the user or the subscriber should be informed about the identity of the entity that wishes to store information or gain access to information that is already stored in his terminal equipment and about the purposes of the processing. Moreover, users should be provided with any information relating to the recipients or categories of recipients of the data, whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply, and the existence of their right of access. According to the study SMART 2013/0071 on the ePD , cookies that are exclusively used for website usage statistics (“first party analytics cookies”) should not require consent, as recommended by the Article 29 Working Party. To implement the obligation of Article 5.3, websites have set up cookie banners in their websites, often with boxes, which users have to click to agree to receive cookies. The fact that users are given a choice whether to allow access to information stored on their terminal equipment, theoretically empowers users. However, several issues hindering the effectiveness of this mechanism have been identified. One point of criticism relates to the transparency of the consent mechanism. More specifically, there are often no transparent tools to withdraw or manage consent. Information notices are not granular and sufficiently clear for average users. Indeed, for some users it may not be clear that giving mere consent can provide a justification to comprehensively track their behaviour in the online environment (“profiling”) , giving users a false sense of protection . There is a need for more clarity about these practices. As there is a widespread use by websites of cookies, this means that consent is required for a very large number of websites. As a result, citizens are constantly exposed to requests to give consent, causing consent fatigue, frustration, while affecting negatively their Internet experience. From this perspective, the method of using banners to which users are requested to click to accept cookies appears ineffective. Alternatively, more streamlined procedures, for example expressing consent through browser settings, appear as better options. Statistics on the type of cookies actually used The 2014 “Cookie Sweep” analysis initiated by the Article 29 Working Party and carried out in eight Member States found that the majority of the cookies are persistent third-party cookies. In the Cookie Sweep, 16555 cookies were recorded on 478 sites, 70% of which were third-party cookies. 86% were persistent cookies and 14% were session cookies. In addition, it was found that 74 out of 474 websites only used first party cookies. In addition, 15 out of 474 only used session cookies (first and third party). Source: Deloitte

Furthermore, some allege that Article 5.3 does not ensure that users have a real choice when it comes to cookies as most of the time they are constrained to consent to cookies if they want to access the content of websites (so called "cookie wall" practice). This is confirmed by research that has shown that when confronted to a ‘take it or leave it’ approach, most users will end-up consenting. A laboratory test conducted by the JRC on cookie banners has shown that whereas with a simple banner that allows entering the website without accepting cookies only 57% of the participants accepted cookies; almost 100% users gave their consent when presented with a ‘take it or leave it’ approach. In this respect, the results of the public consultation are also relevant, while reflecting a disparity of views. Indeed, a great majority of citizens, civil society and public bodies replying to the public consultation agreed that information service providers should not have the right to prevent access to their non-subscription based services in case they refuse the storing of identifiers in their terminal equipment. On the other hand, a great majority of industry did not agree with this option, arguing that this would contradict the freedom to trade . These results are confirmed by the Eurobarometer survey on e-Privacy according to which a strong majority of respondents does not consider acceptable to have their online activities monitored (for example what they read, the websites they visit) in exchange for unrestricted access to a certain website. Source: 2016 Eurobarometer survey (EB) 443 on e-Privacy (SMART 2016/079). A technical solution envisaged to address some of the inefficiencies related to consent through banners consists in enabling individuals to consent through browser settings. To this end, browsers should be configured to enable consent as a true expression of the individual’s will. The proposal to impose privacy by default in browser settings was strongly supported by 89% of the respondents to the Eurobarometer survey on e-Privacy. The concept of privacy by default in browser settings is similar to the data protection by design principle in the GDPR, which includes appropriate technical measures. An Eurostat survey suggests that the rule may have had an overall positive effect on the level of citizens' awareness on the use of tracking techniques online. Finally, the effectiveness of Article 5.3 is further hampered by the fact that the rule has been implemented and interpreted in different ways by various EU countries, thereby generating fragmentation in the legal framework. Enforcement actions in some countries have proved limited, as highlighted by country profiles from Study 2013/071. This problem has also been highlighted by the REFIT Platform, which adopted an opinion on the ePrivacy Directive in which it calls on the Commission to addresses national implementation problems and to facilitate the exchange of best practice amongst Member States. 6.4.3.EU added value Whilst Member States can enact rules to ensure confidentiality and integrity of terminal equipment, such a protection could not be achieved in a uniform way in the absence of common EU rules. The EU added value of the rule on confidentiality of terminal equipment derive from the fact that tracking techniques rising from the Internet, may often relate to companies located in another Member States. This common cross-border nature of navigating online supports the enactment of rules at EU level to better achieve the objective of ensuring online privacy. Uniformed rules within the EU are hence key to achieve the objective of protection. If this matter were solved at the national level, businesses would need to adjust their approach for every EU Member State and consumers would face a lack of transparency. 6.4.4.Efficiency The last review of the ePD brought additional administrative and compliance costs for Information Society Providers (i.e. website providers) due to the transformation of a duty to inform users of tracking tools and give the possibility to opt-out into an obligation to collect prior users' consent. In the public consultation as well as interviews and an online survey with businesses conducted in the context of one of the supporting studies to this REFIT evaluation, industry highlighted that the costs for compliance with Article 5.3 are the main cost factor regarding the ePrivacy Directive. In terms of the cost of compliance for businesses, industry respondents to the public consultation reply that the costs are significant (62%) or moderate (20.8%), while public authorities do not know (56%) or respond that they are moderate (17%). An assessment of compliance costs using quantitative and qualitative data concludes that the price per website to notify of the use of cookies and similar devices stored in users’ terminal equipment is of 300 Euro, per year. It estimates that the website will require adaptations each year, which will amount to 300 Euro. Thus, it concludes that over a period of 3 years, a company would have to spend a total of 900 Euro. This includes costs for legal advice, updates to privacy policies, and technical updates to websites and would be incurred once per website, i.e. at the time of the introduction of the new policy. The study calculated that the overall cost for businesses operating in the EU a website using cookies amounted to approximately EUR 1.8 billion in 2015. However, this cost is projected to gradually decrease until 2030 to approximately EUR 1.4 billion per annum. From the consumer perspective, the benefits of having such rules seem to be confirmed in particular by the Eurobarometer on ePrivacy. It is important to 82% of consumers that tools for monitoring their activities online (such as cookies) can only be used with their permission. In a similar vein, 89% of consumers think the default settings of their browser should stop the information stored on their terminal equipment from being shared. The above costs indicates that there is scope for finding more efficient ways to comply with the objectives of the rule, protecting privacy and empowering individuals, in more cost efficient ways, such as, for example, centralised consent mechanisms through the browser. 6.4.5.Coherence Article 5.3 is meant to protect the privacy of individuals extended to their terminal equipment. The rationale of the rule is based on the understanding that the terminal equipment is part of the private sphere of an individual, in the same way as his or her domicile and communications. Recital 24 of the ePD captures the rationale of this article by stating that "terminal equipment of users (…) and any information stored on such equipment are part of the private sphere of these users requiring protection under the European Convention for the Protection of Human Rights and Fundamental Freedoms". This purpose has been recognised by Article 29 Working Party. Thus, Article 5.3 is not concerned about the protection of personal data per se, in fact, Article 5.3 applies independently of whether the information stored or accessed in the device is personal data.

If the information accessed is personal data, any subsequent use and processing of such personal data collected from the device, for example, to build profiles of individuals, will be governed by the Data Protection Directive and in the future by the GDPR. This means that all the rights and obligations contained in the GDPR such as the right to have the data rectified (Article 16) or the right to erasure (Article 17) of the GDPR will apply to such further processing of personal data . In practice this means that the role of Article 5.3 is to empower users vis-à-vis their private sphere, giving them the possibility to decide over the content and access to their device. The goal of Article 5.3 is limited to this specific purpose. Then, the GDPR complements the protection offered by Article 5.3 if/when the data collected from the device is personal data. The interplay between the applications of both set of rules is illustrated in various opinions of Article 29 Working Party. In this respect, it should be stressed that the adoption of the GDPR will have an impact on the definition of consent under the ePD, and thus on Article 5.3. Under the GDPR consent requires a clear affirmative action establishing freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means (Article 4.11 of the GDPR). Recital 32 of the GDPR illustrates the meaning of consent. To conclude, it follows from the above that Article 5.3 rule is fully coherent with the rules of the GDPR. KEY FINDINGS: We conclude that the objective pursued by the rule remains relevant given the sensitive information stored on users' own device and need to protect them from being tracked online. However, the effectiveness of Article 5.3 is hindered due to various reasons, which include its scope and the challenges related to make consent truly effective. Critics were made on the ineffectiveness of consent as consumers may feel compelled to accept cookies if, not doing so, means that they are not able to access the web site. From this perspective, some have raised the question of whether consent is freely given because of the 'take it or leave it approach', where refusing cookies would prevent the access to a certain website. Furthermore, in many cases, the information given regarding online tracking is, in the view of some stakeholders, not considered to be sufficiently clear. Last, the method of using banners is perceived by some as detrimental to an optimal browsing experience. The coherent application of Article 5.3 and the rules of the Data Protection Directive have been illustrated in many opinions of Article 29 Working Party. As explained above, Article 5.3 complements the GDPR in a fully consistent manner. 6.5.Protection against unsolicited communications (so called "spam") Article 13 seeks to give individuals a right not to be disturbed in their privacy by unsolicited commercial communications. This is increasingly important as the costs of making such communications decreases and the technology is more capable of delivering new, more privacy invasive ways, to reach individuals. To this end, the ePD prohibits the use of electronic mail, fax and automatic calling machines for direct marketing, unless the user or subscri