On Monday, 12 December, a leaked version of the ePrivacy Regulation was published online. The most obvious change is that the file is being proposed as a European Regulation, rather than a Directive. This significantly affects the way that the law would apply - Directives require national implementation and usually Member States have two years to assess how to bring the European law within their national regimes. As a Regulation, the law could apply immediately upon adoption, and would apply directly in Member States. It would take precedence over the GDPR because it is specified as a lex specialis.
In terms of substance, the ePrivacy Directive has been commonly referred to as the "cookie directive". The draft Regulation seeks to change the cookie provision only slightly - adding a new exception to the consent rule for first party analytics - but would introduce an overall higher standard of consent, taken from the GDPR. Consent may also be given through browser settings (e.g. through DNT settings), which the recitals elaborate to be binding and enforceable on third parties, though the wording has been refined to specifically address web browsers. This provision would now be included in the Articles of the Regulation, as opposed to being in a recital.
The most troublesome part of the proposed Regulation is Article 10, which introduces far-reaching rules on privacy by design. While the GDPR contains provisions on this concept, they are aimed at promoting general good data protection practices. The draft ePrivacy Regulation's privacy by design clause, on the other hand, requires that software and hardware must be configured to prevent third parties from storing or processing information on user's devices. This has the effect that users have to enable third party cookies of their own volition, and also specifically enable tracking cookies if they choose to do so.
Sources have informed IAB Europe that the leak represents an unfinished version of the proposal, but that not much will change in terms of substance when the Commission officially publishes its proposal on January 11, 2017.
For more information, please contact Matthias Matthiesen, Public Policy Manager at IAB Europe ([email protected]).
