Privacy & Information Security Law Blog

On March 12, 2019, the European Data Protection Board (“EDPB”) adopted an opinion on the interplay between the EU Directive on Privacy and Electronic Communications (“the ePrivacy Directive”) and the General Data Protection Regulation (“GDPR”) (the “Opinion”).

The Belgian Data Protection Authority (“DPA”) requested the Opinion, highlighting questions on the competence, tasks and powers of EU DPAs and the applicability of the GDPR’s cooperation and consistency mechanisms in those situations where both the GDPR and the ePrivacy Directive apply to the processing of personal data. Without prejudicing current negotiations over the draft ePrivacy Regulation, the Opinion addresses (1) the material scope of the ePrivacy Directive and the GDPR; (2) the interplay between the two; (3) the competence, tasks and powers of EU DPAs; and (4) the applicability of the GDPR cooperation and consistency mechanisms to the situations at issue.

Processing Activities within the material scope of both the ePrivacy Directive and the GDPR

• The Opinion notes that there are many examples of data processing activities that fall within the material scope of both the ePrivacy Directive and the GDPR, such as the use of cookies.

Interplay between the ePrivacy Directive and the GDPR

• The Opinion reiterates that the ePrivacy Directive contains “special rules” with respect to the processing of personal data in the electronic communication sector. These include the provisions of Article 5(3) of the ePrivacy Directive that require user consent for storing information, including personal data, in the end user’s device or gaining access to this information (e.g., via cookies), and Article 6 of the ePrivacy Directive, which explicitly limits the conditions under which traffic data, including personal data, of subscribers and users of a publicly available electronic communications service may be processed.
• In accordance with the principle lex specialis derogate legi generali, these specific ePrivacy provisions take precedence over the (more general) provisions of the GDPR (such as Article 6 of the GDPR, which provides for a full range of possible legal bases to process personal data).
• In all other cases, where the processing of personal data is not specifically governed by the ePrivacy Directive (or where the ePrivacy Directive does not contain a “special rule”), the GDPR applies. For example, the GDPR provisions regarding the exercise of data subjects’ rights with respect to their personal data will apply, as there are no specific ePrivacy provisions on these rights. Similarly, any subsequent processing of personal data (such as personal data obtained via cookies) must also have a legal basis under Article 6 of the GDPR in order to be lawful and comply with all the other provisions of the GDPR.

Competence, tasks and powers of EU DPAs

• When the processing of personal data falls within the material scope of both the GDPR and the ePrivacy Directive, EU DPAs are competent to scrutinize data processing operations that are governed by national rules implementing the ePrivacy Directive only if national law confers this competence on them. Further, such scrutiny must happen via the supervisory powers assigned to the DPA by the national law implementing the ePrivacy Directive.
• The competence of EU DPAs under the GDPR remains intact with respect to data processing operations not subject to special rules contained in the ePrivacy Directive. The mere fact that a subset of the processing also falls within the scope of the ePrivacy directive does not limit the competence of EU DPAs under the GDPR.
• When exercising their tasks and powers under the GDPR, EU DPAs may take into account the provisions of the ePrivacy Directive only if:
  • A GDPR violation also constitutes an infringement of the national provisions implementing the ePrivacy Directive. The DPA’s enforcement decision, however, will need to be justified on the basis of the GDPR if the DPA is not competent under national law to directly enforce the national provisions implementing the ePrivacy Directive in addition to the GDPR; or
  • The DPA has been designated under national law as a competent authority for enforcing the national provisions implementing the ePrivacy Directive.

Applicability of the GDPR’s cooperation and consistency mechanisms

• The cooperation and consistency mechanisms available to EU DPAs under the GDPR do not apply to the enforcement of the national implementation of the ePrivacy Directive. However, the cooperation and consistency mechanisms remain fully applicable to the processing operations subject to the general provisions of the GDPR (and not to a special rule contained in the ePrivacy Directive).

In addition to the Opinion, the EDPB also published a statement on March 13, 2019, inviting EU Member States to finalize their positions on the proposed ePrivacy Regulation so that negotiations with the European Parliament can begin as soon as possible. The ePrivacy Regulation is the last step to complete the EU’s framework for data protection and confidentiality of electronic communications. The EDPB stressed the importance of the ePrivacy Regulation as legislation that complements the GDPR by providing additional strong safeguards for all types of electronic communications. The EDPB called on the EU legislator to ensure that the ePrivacy Regulation will not provide lower protection than what is already provided in the current ePrivacy Directive.