What are the main issues and why are they problematic?

The Council of the EU released a progress report on 23 November 2018 in which it highlighted the main topics where further work was necessary. These topics included the processing of electronic communications data, protection of terminal equipment, privacy settings and supervisory authorities. The Council of the EU highlighted that the provision on the processing of electronic communications data (article 6) must be ‘more future-proof and flexible enough to enable the development of innovative services’. It noted that the provision must align closer with the GDPR. With regard to the protection of terminal equipment information (article 8), the Council of the EU noted that the draft Regulation should not undermine business models where online services were financed through advertising. Concerns regarding the provision on privacy settings (article 10) include ‘the burden for browsers and apps, the competition aspect, the link to fines for non-compliance, but also the impact on end-users and the ability of this provision to address the issue of consent fatigue’. The Council also called for further flexibility regarding supervisory authorities (article 18).

What concerns have been raised in the industry?

Various industry associations have raised their concerns in a joint statement of 28 November 2018 (the Statement), which urges Member States not to rush into trialogues, but to address the main issues. The Statement stressed that there would be a large overlap between the GDPR and the draft Regulation which would cover most processing activities. The Statement also requested an alignment of legal justifications for electronic communications data and terminal equipment data with the GDPR. The industry associations highlighted the risks for innovation in artificial intelligence, energy transition, manufacturing, cooperative intelligent transport systems, medical technology and more. There are, however, also concerns about the current standstill of the legislative process. Businesses and authorities are confused by the interaction between the GDPR and the currently applicable EU Privacy and Electronic Communications Directive (the 2002/58/EC Directive) and its local implementing laws (if any). This results in legal uncertainty and the lack of harmonisation on the EU level. 

What are the next steps?

The Council of the EU still has to finalise its approach before the trialogue between the Council of the EU, the European Commission and the European Parliament can begin. In the trialogue, the three parties will negotiate the final version of the draft Regulation for its adoption.

What is the best estimate on a likely date for application of the Regulation?

At this point, it is tough to predict what the application date will be. There does not seem to be any real political momentum—and the European elections are coming up in May 2019. We do not think that the trialogue will commence before the election and therefore it will not conclude before the end of 2019. The latest draft from the Council of the EU also included a provision that the draft Regulation would start applying 24 months from the date it was adopted—a grace period similar to that under the GDPR. This means that it would not apply before the end of 2021.

What impact will Brexit have?

It remains to be seen if the draft Regulation will apply in the UK. As chances are high that it will not be adopted before the end of 2019, it will likely not apply in the UK. In the meantime, the UK laws implementing the 2002/58/EC Directive will continue to apply.