Digital Omnibus Art. 88a: implications for the ePrivacy Directive

Recently, there have been a few strange comments on the ePrivacy aspects of the Digital Omnibus. I’ll tackle browser-level settings later, but today I want to focus on one issue: what are the ePrivacy Directive consequences of the new Art. 88a proposal?

Article 5(3) of the ePrivacy Directive (ePD) is known as the “cookie rule” and it regulates the storage of information on user devices, as well as access to information already stored on such devices. The rule is consent, unless one of two exceptions applies (the “service” and “communication” exceptions). Its scope is something I can debate all day long, but the focus here isn’t what it applies to – but what it would *cease* to apply to and what would come instead.

The Digital Omnibus proposal would limit Art. 5(3) ePD by removing from its scope the situation where the information stored or accessed on the device of a natural person “constitutes or leads to the processing of personal data”.
Instead, a new Article 88a in the GDPR would apply to those cases.

88a GDPR would be 5(3) ePD equivalent – but would have additional exceptions to consent.

Those new exceptions are odd, because they are currently interpreted by regulators as being *integrated* within the “service” exemption under 5(3) ePD – so by pulling them out of there for 88a GDPR, 5(3) ePD’s exemptions just got more limited and much that was permitted is now prohibited without consent.

But what then gets missed?

First, because 88a GDPR only applies to *personal data*, 5(3) ePD would apply in a situation where a natural person isn’t identifiable – but with narrower consent exemptions than today.

Second, there are various kinds of devices that are used not by specific individuals but groups. For instance, employers regularly make choices on what is permitted or not on corporate devices. You can argue whether a *single-user* corporate device can concern an “identifiable” natural person from the perspective of a digital service provider – but one cannot reasonably consider that meeting room equipment or smart TVs for office reception areas reveal anything regarding *one identifiable* natural person.

So suddenly, while aggregated analytics + security features could be used without consent on personal, single-user devices (= proposed 88a GDPR), the exact same things would be prohibited without consent (whose consent precisely?) on those multi-user “corporate” devices.

The perverse outcome would be that business offering products/services to other businesses would end up being more limited in how to improve those them than those offering them to consumers – despite presenting *far less* privacy risks.

In other words, if the proposed Article 88a GDPR becomes reality, it would have been better to scrap 5(3) ePD altogether rather than keep it in a zombie state.

More thoughts on the ePrivacy Directive – and what a more ambitious rethink could have looked like: https://lnkd.in/eYdWW7uq