Digital Omnibus and ePrivacy: complexity and regulatory gaps

Digital Omnibus & ePrivacy: good intentions but bad outcome. While I have praised the Commission’s attempt at GDPR-related pragmatism (though a good idea re special categories of data didn’t make it), I have remained silent on the ePrivacy front.

There, the proposal is not good in my view.

It would create an alternative to Art. 5(3) of the ePrivacy Directive that would be integrated within the GDPR (Art. 88a) for personal data processing situations, with no longer a choice among 3 justifications (“consent”, “provision of a service” or “transmission of a communication”) but 5, through the addition of the following:
– “creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use
– “maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service

Basically, first-party analytics now good, and security also (not just terminal equipment security but also service security).
Sounds good!

The problem?

First, this only concerns personal data processing, not the rest. Yet these exceptions are critical beyond personal data processing.

Second, it creates an awkward situation whereby some national exceptions that have been created under the current regime (under “service”) wouldn’t work well in the future – for non-personal data or for personal data (because the new additions could be seen as restricting a broader interpretation from today).

For instance: is fraud prevention considered “security”? And why can’t a processor be involved in analytics, as long as the analytics is for the benefit of the controller? What about A/B testing, will that be accepted as it is in some jurisdictions?

And that’s without talking about consent restrictions:
– How does a “single-click button” for refusal work in a “pay or OK” approach? Can we consider the “pay” button to be the “refuse” button?
– Consent rejection lasts 6 months no matter what happens to the consent conditions (so that has to be stored – expect litigation coming from those who delete cookies storing that and are then shocked to see another request appear). What if the conditions change then?
– What if a user refuses for one vendor (for ads, analytics, content personalisation etc) – does it mean no consent popup can mention that vendor anywhere on the web during 6 months, but it can mention others?

Basically, it seems good, but it creates far more problems. Today’s regime isn’t good or workable because of disparate national approaches and overly restrictive exception interpretations (+ the whole issue of overbroad scope interpretations). The proposal just makes things more complex and challenges even approaches considered valid today in some jurisdictions.

And that’s without talking about 88b. That’s for later.

cookies data protection privacy