Source: https://marketinglaw.osborneclarke.com/data-and-privacy/art29wp-publishes-opinion-draft-e-privacy-regulation/
Timestamp: 2019-04-18 18:55:46+00:00

Document:
The European Commission’s draft proposal for an e-Privacy Regulation (intended to replace the outdated e-Privacy Directive) was published in January 2017. On 4 April 2017, the Article 29 Working Party adopted its opinion on the Regulation. In general, the Art 29 WP welcomed the proposal. However, the opinion highlighted certain areas of concern, whilst also recommending a number of clarifications to protect end-users and ensure legal certainty.
a new targeted exception for the non-intrusive measuring of web traffic.
Despite what it perceived as positives, the Art 29 WP drew particular attention to four key areas of “grave” concern which it believes undermine the promise to provide an equal or higher level of protection than the GDPR.
The proposed Regulation suggests that the mere display of a notice, implementation of security measures, and informing users of steps to minimise or stop the collection, are adequate for the collection of tracking data from terminal equipment. The Art 29 WP considers that this falls far short of the requirements under the GDPR. Furthermore, the Regulation fails to impose any clear limitations on the scope of collecting and processing such tracking data, and the Art 29 WP recommends the promotion of the development of technical standards for automatic signalling by mobile devices against such tracking.
The Regulation affords different protection to content and metadata, a distinction with which the Art 29 WP strongly disagrees, arguing that both may be highly sensitive. Its recommendation is to prohibit processing of both unless consent is obtained from all end-users, i.e. both sender and recipient – with certain exemptions where strictly necessary.
Although the Regulation obliges software providers to offer end-users the option to prevent interference with their device, the Art 29 WP believes this falls far short of the requirement of “privacy by design and default” under the GDPR, pointing out that the “option” to prevent interference already exists and has done little to address the issue of unwarranted tracking. The Art 29 WP believes equipment and software must discourage and prevent such interference by default.
Tracking walls prevent an individual from accessing a website or service unless they agree to be tracked on other websites and services. The Art 29 WP believes such conditionality should be expressly prohibited, stating that the ability to track users over time or across several services may seriously intrude on an individual’s privacy.
the ambitious deadline to implement the Regulation alongside the GDPR in May 2018.
The Art 29 WP’s opinion is not binding on the European Commission and, therefore, it is not clear whether, and to what extent, its concerns will be addressed in the final Regulation. However, the European Commission may be influenced by one or more of the “grave” concerns, particularly given the intention of the Regulation to compliment, and ensure consistency with, the GDPR.
Both the e-Privacy Regulation and the GDPR aim to harmonise privacy rules across the EU. However, with certain aspects currently suggesting a different standard of protection, it is likely to lead to confusion.
With just one year until its intended implementation date, businesses should be assessing their own processes to ensure they address any data protection issues. Organisations should keep a close eye on the developments of the e-Privacy Regulation as, come May next year, much stricter requirements could catch businesses off-guard.

References: Art 29
 Art 29
 Art 29
 Art 29
 Art 29
 Art 29
 Art 29
 Art 29
 Art 29