On 1 January 2021, Portugal took over the baton of the rotating presidency of the Council of the EU from Germany for the coming six months. On 5 January 2021, the Portuguese Presidency of the Council released a new draft of the proposed ePrivacy Regulation that includes significant changes compared to the previous draft. The text was discussed in the meeting of the Working Party on Telecommunications and Information Society of the Council (WP TELE) that took place on 7 January 2021.

The Presidency proposes to simplify the text of the ePrivacy Regulation and further align it with the GDPR, reflecting the lex specialis character of ePrivacy in relation to GDPR. The most notable changes include:

• reintroduced and aligned with the GDPR, previously deleted provisions that permit the processing of electronic communications metadata and storage capabilities of terminal equipment and the collection of information from end-user’s devices for further compatible processing;
• aligned provisions relating to processing for “performance of contract” with the GDPR and made them less restrictive. In this respect, provisions on electronic communications data (Article 6(1)(a) ePrivacy Regulation) changed to include broadly defined provision of electronic communications service that will cover all related processing operations. Provisions on electronic communications metadata for performance of contract (Article 6b (1) (b)) are redrafted to clearly include other permitted processing activities, such as billing, calculating interconnection payments, detecting/stopping fraudulent or abusive use of electronic communications service. In Article 8 (1) (c) on protection of end-users' terminal equipment information, reference to “technical” performance of contract is deleted as too restrictive;
• reinstated provisions of Article 6b(2) (a), (b) and (c) permitting sharing anonymised statistical metadata (which is no longer considered personal data) with third parties, subject to additional obligation to carry out a data protection impact assessment (DPIA) and prior consultation with the DPA and inform end-users about intended processing;
• expanded provisions to allow audience measurement (Article 8 (1) (d)) to all service providers (without excluding other than “information service providers” or other broadcasters – such as radio);
• simplified cookies provisions that were previously too restrictive (in recital 20aaaa); and
• included a definition of location data.

The proposal is available here.