Finland’s Traficom openly disputes the EDPB interpretation of ePrivacy scope

Now this says a lot: Traficom, the Finnish ePrivacy regulator, has disputed the EDPB’s interpretation of the scope of Art. 5(3) of the ePrivacy Directive in comments it submitted on the EDPB’s proposed ePrivacy Guidelines (in the words of Traficom, they have “some reservations” about “some aspects of the opinion that may lead to an overly broad scope of application”).

Along the same lines as what was included in two sets of comments to which we contributed, Traficom notably says the following:

– Regarding URLs:
“In order for there to be an action qualifying as an “access” as in an intrusion into the private sphere, it should normally be required that the transmission of such information is not initiated by the user. Instead, as also recognised in paragraph 31 of the Opinion, the accessing entity must take active steps toward gaining access to that information. While the creation and distribution of tracked URLs is indeed a processing operation, it seems not firmly established that this falls within the scope of Art. 5(1) ePD rather than (only) the GDPR, because the connection of that action with the functioning of a terminal equipment is so indirect and conditional as perhaps not qualifying as an instruction that influences the terminal’s functioning.
[NOTE: they write “5(1)” but I assume they mean 5(3)]

– On IP-based tracking:
“it might be argued that the scope of Art. 5(3) ePD does not cover the collection of IP addresses when they are data that a device actively transmits about itself as part of the normal functioning of the internet, such as in connection with requests for web content. If the information is shared in the usual interaction of client and server without specific instruction, it might not normally be considered as “access”.

In general, Traficom seems opposed to the broad interpretation to which the EDPB seems to subscribe, or to at any rate raise the question of whether storage and access shouldn’t be limited to only “active” storage and access – not passive receipt or generic “instructions”.

This goes to show that the EDPB’s ePrivacy guidance *does not* represent the views of all ePrivacy regulators – which raises questions as to the EDPB’s authority in this respect.

Traficom submission to the EDPB public consultation on ePrivacy: https://lnkd.in/eqzgW-W8

All submissions are published here: https://lnkd.in/eiN3uRH3

data protection gdpr