What happened to the ePrivacy Regulation?

The ePrivacy Regulation will replace the current ePrivacy Directive, which is the European law that informs the UK’s Privacy and Electronic Communications Regulations (PECR). The new Regulation proposed sweeping changes to the rules governing electronic marketing.

The changes were wide-ranging but in essence, it would mean only consent could be relied upon as a legal basis for electronic marketing. This is concerning because many marketers are relying on legitimate interest as their legal basis.

The law was not just contentious in the marketing community but among MEP’s too. The Parliament’s version of the text was narrowly passed by 318 to 280 votes (with 20 abstentions). This weakened the mandate of the Council. Many MEP’s that voted against the text were concerned about the effect the text may have on the economies of Europe.

That vote took place in October 2017 and since then the Parliament has been ready to enter into Trilogue negotiations. The process whereby the Commission, Parliament and Council enter into secret negotiations and a compromise is reached. The final text represents input from all 3 institutions and in theory, should achieve a balance between different points of view.

However, the Council has been making very slow progress by comparison. Just under a year and a half since the Parliament voted to approve its version of the text and the Council has still not debated many aspects of the text that would impact direct marketing, such as Article 16.

The DMA has met with the Department for Digital, Culture, Media and Sport (DCMS) negotiating team that attends EU Council meetings and they understand the concerns of data and marketing sector. In many instances, they share our fears and this has been reflected in proposed UK amendments to the text. For example, the UK proposed that the Regulation referenced other lawful bases for processing, including legitimate interest.

FEDMA, who represent Europe’s DMA’s, submitted a letter to the Council urging the 28 Member States to review the direct marketing parts of ePrivacy. The letter was signed by over 70 other organisations.

The received wisdom has been that slow progress is preferable to a rushed decision. While direct marketing issues have not been addressed yet, there is promise that the Council will produce a much more balanced text in the end. There are echoes of GDPR where the Council was the group similarly responsible for pushing a risk-based approach that has benefitted organisations compliance with the new data protection law.

The delays to ePrivacy have resulted in new problems to consider. The EU Parliament elections in May 2019 are one such problem. Were the elections to result in a significant change in the make-up of Parliament, new MEP’s may well demand to re-open the ePrivacy file. The new Parliament would not be bound to follow the decision of the old Parliament. Were this to be the case it would significantly delay the process. It is not entirely out of the question either given the very small majority in Parliament that voted to approve Parliament’s version of the text.

In the UK, we have another complicating factor to consider and no prizes for guessing this one? Brexit. The UK officially leaves the EU at the end of March, before the Council will have likely reached an agreement on its version of the text. Under the Prime Minister’s Withdrawal Agreement the UK will closely align with the EU on data protection law, including the ePrivacy Regulation. However, in a no-deal Brexit, the situation might be different and the UK may decide to diverge on ePrivacy. This would make it harder to strike a data deal with the EU though and would mean transferring data from the EU to the UK became more difficult. This would pose a significant barrier to cross-border trade.

There are many variables to consider but we can estimate the earliest that the ePrivacy Regulation would be enforceable in the UK. There will either be a 12 or 24 month transition period and Trilogue negotiations may begin in May or June this year. Assuming a Brexit where the UK aligns on data protection and a 12 month transition period the Regulation would be enforceable from Q2-Q4 2020. However, it could easily be significantly later than this, especially if there is a 24 month transition period.

The DMA will continue to work with DCMS and FEDMA in lobbying for a balanced ePrivacy Regulation. Ultimately, the Regulation puts the success of the UK’s creative industries at risk. Considering annual UK exports of advertising services are worth £4.1 billion and every £1 spent on advertising returns £6 to the economy, resulting in £120 billion to UK GDP, policymakers have much to consider.