What’s the issue?
The ePrivacy Directive (EU Directive 2002/58/EC) establishes (amongst others) specific rules on privacy for the electronic communications sector, such as limiting the use of traffic and location data and prohibiting listening to, or otherwise accessing the contents of, communications. These rules apply to “service providers” (and more specifically, to providers of a publicly available “electronic communications services” (“ECS“)).
Historically, a “service provider” under the ePrivacy Directive was understood to be limited to traditional telecoms providers and ISPs. Companies that provided “telecoms-like” communication services over the internet were not traditionally seen as being caught by these requirements (or by EU telecoms law requirements generally), unless they facilitated communications using numbering resources.
However, from 21 December 2020, this position will change due to the new European Electronic Communications Code (“EECC“), which is set to be transposed (and therefore take effect) in European Union member states as of this date. The EECC is expected to harmonize the existing legal framework for electronic communications across the EU. Amongst other changes, the EECC will broaden the definition of an ECS. As the related definition of a “service provider” under the ePrivacy Directive will also be updated to align with the new definition of an ECS per the EECC, these changes look poised to bring into the scope of the ePrivacy Directive a wider spectrum of service providers than ever before.
Given that these changes are effective prior to the end of the Brexit transition period on 31 December 2020, they will apply in the UK too, though the UK is not proposing to implement the new regime in full.
To expand: the EECC applies to electronic communications network (“ECN“) providers and (as we know) ECS providers. Importantly for privacy professionals, the EECC extends the definition of an ECS to include a number of activities typically carried out by instant messaging applications, email, internet phone calls and personal messaging provided through social media — collectively, over-the-top services (“OTTs“). (As before, an ECS still excludes content services i.e. services providing or exercising control over content transmitted using electronic networks and services (for example, a shopping portal or an electronic newspaper)).
Under the EECC, an ECS will now also include sub-categories of services, including “interpersonal communications services” (“ICS“). An ICS is defined as a service that enables the “direct interpersonal exchange of information via electronic communications networks between a finite number of people“, provided that this communication service is “not a minor ancillary feature that is intrinsically linked to another service” (an “Ancillary Feature“). As a result, a number of OTTs that would previously have escaped ECS classification may now be caught.
The Ancillary Feature element of the ICS test is of particular interest for OTTs, given that communications functionality can be inbuilt into different types of services (e.g. as part of a website, application, or other types of software), which might otherwise escape categorisation as an ICS. However, note that this exemption is to be interpreted narrowly and from the perspective of the ultimate end-user. Ultimately, in order to fall within the exemption, the communications aspect of the service must in reality be “barely used” by the end-user; and should be integrated into a wider service such that the communications functionality cannot be used without the underlying service. Further, the application of the Ancillary Feature test must be considered on a case-by-case basis, to determine whether the communications element of the service is truly is ancillary or is in fact integral to the overall end user experience. For example, an in-game video communications feature may be an Ancillary Feature (unless the game is inherently social in nature); and a banking app that enables customer communication with the banking support team is also likely to fall into the Ancillary Feature category.
What’s the catch?…
IAB Europe’s advertising bidding model uses personal data, EU court rules
After clarification from Luxembourg, the Belgian Court of Appeal will now rule on the case…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
