A final reminder to voice your company’s concerns on the new ePrivacy guidelines

Just one month to go for comments on the EDPB’s new ePrivacy guidelines, so here’s a reminder of why you *should* respond if your company has digital activities:

– The new EDPB guidelines concern the scope of Art. 5(3) of the ePrivacy Directive, which was never only about cookies but about the storing of information + access to information on devices.

– That ePrivacy provision only allows such storage / access if there is (i) consent, (ii) strict necessity to provide an information society service [= digital service] explicitly requested by the user or (iii) storage/access for the sole purpose of transmission of an electronic communication.

– The new EDPB guidelines consider that this provision also covers (i) temporary, ephemeral “storage” (e.g. RAM and CPU cache) + (ii) dispatch of information without active access to the device (e.g. IP addresses sent automatically as part of the IP layer of communication packets) [= passive “access”].

– This broad interpretation suggests an intention to cover certain tracking methods that the EDPB (+ the data protection authorities it comprises) considers should be more strictly regulated, such as the use of device fingerprinting, user identifiers, IP addresses, URL parameters, pixels, etc. [whether GDPR applies or not]

– This has more significant & broader consequences than you might imagine, and it very likely affects your company. To illustrate:

(i) Even if you only have one website, there may be elements on it that could be challenged (e.g. an ad banner [even pure contextual advertising] or a �sign up for a newsletter� popup that appears to an individual who has not yet seen it on his or her device).

(ii) If you use IP addresses for anti-fraud checks, if you use URL parameters to track how many people read your newsletters, this will be covered – even though you never actually read that information from a device but get that information automatically when the device sends a request to your server.

(iii) To use a bit of an extreme example: even the developer of the �phone� core application on your smartphone needs to pay attention, as the phone number of the recipient of a call could be considered to be �stored� on the sender�s phone (temporarily) and �accessed� by the recipient as a result of the communication protocol � so any further use by the recipient beyond the communication (e.g., lists of past calls) could be regulated under Article 5(3) ePrivacy Directive following the EDPB�s approach.

Want help in figuring out how this affects your company and whether you should respond to the public consultation?
Or perhaps you want to respond but don’t want your company name to be mentioned?
Reach out!

For more information on what these guidelines mean:
– “Shorter” read: https://lnkd.in/eUrrHbwx
– Longer read: https://lnkd.in/ekdviZ_K (part I) and https://lnkd.in/eDV4NSRX (part II)