What to expect from the EDPB and EDPS on 10 February re the Digital Omnibus on GDPR and ePrivacy? Today I had the privilege of attending an event organised by The Lisbon Council with a very select group of representatives of companies, industry associations, BEUC, the Commission and the EDPB.
We discussed the Digital Omnibus at length, as well as the general issue of how to manage and encourage the adoption of Privacy-Enhancing Technologies or PETs in the context of digital advertising.
There were lots of great perspectives shared, and I highlighted a few thoughts based on my exchanges with organisations of different sizes and industries:
1. We have to get back to discussions about actual privacy risk. Because of the way that the ePrivacy Directive’s Article 5(3) (the “cookie rule”) has been interpreted by the EDPB in terms of its technical scope and because of the continued restrictive interpretation of the “service” exemption, it is insufficient to split that provision between the GDPR and the ePD If PETs remain de facto subject to consent. One participant seized upon this to propose the addition of an exception, or at least an interpretation of the service exemption, to cover the situation where PETs are used appropriately to reduce the privacy risk.
2. The proposal to have browser-level controls is a nice one on paper, but there are reasons it was dropped in the context of the ePrivacy Regulation discussions. You cannot have GDPR consent to every possible publisher or intermediary on the entire internet by way of a simple browser-level setting. In practice, the browser setting would therefore be just a central refusal or opt-out button, nothing more. Providing an exemption for media services appears to be illusory, as many media/content service providers have hybrid services, venturing into the notion of “platforms” very quickly.
And what of the EDPB? It looks set to have a critical view on the “personal data” definition changes (I disagree with that view) but to likely welcome the documentation provisions on DPIAs and personal data breach notifications.
The text will be adopted on 10 February – the day of the EDPB v WhatsApp judgment too. A big day for data protection professionals!
Did this analysis get you thinking? Reach out!
DataLaws.net is entirely open-access, and instead of getting your data in exchange for this content, how about another trade? If this commentary saved you research time or sparked an idea, feel free to invite me over for tea, chai or a hot chocolate next time you are around Brussels or Antwerp - or invite me over to your offices for a chat!
Get in touch ↗ Let's connect on LinkedIn ↗