EU’s tougher privacy rules: WhatsApp and Facebook set to be soon aligned with telcos

Andrus Ansip, Vice-President of the EC in charge of Digital Single Market, and Vĕra Jourová, Member of the EC in charge of Justice, Consumers and Gender Equality, gave a joint press conference on Digital Single Market. Date: 10/01/2017 Reference: P-033391/00-11 Location: Brussels – EC/Berlaymont. © European Union , 2017 / Source: EC – Audiovisual Service / Photo: François Walschaerts

With an official statement, the European Commission last week published its proposal to reform the existing European online privacy rules. Companies such as Facebook, WhatsApp and Google will face tougher rules on the tracking of users under a wider update of the e-privacy directive, which will also impact cookies regulation.

The EU says the new rules will not only benefit citizens with stronger data protection, but will also help generate business opportunities for telecom operators. However, the proposal was not welcomed with enthusiasm by everyone and made small advertisers unhappy.

The reform

The vision behind the reform of the existing Regulation on Privacy and Electronic Communication (the “ePrivacy Directive”, Directive 2002/58/EC) by the European Commission is to basically bridge the gap between traditional telephone operators and the instant messaging services, which are normally and widely operated by US tech firms. The existing rules, which date back to 2001, indeed only cover traditional telecom operators, and are not in line with the “newer and more stringent rules” set out by the General Data Protection Regulation of 2016, as declared by the EC.

“The measures presented today aim to update current rules, extending their scope to all electronic communication providers”, the official press release by the Commission said. “At the same time, the proposal aligns the rules for electronic communications with the new world-class standards of the EU’s General Data Protection Regulation. The Commission is also proposing new rules to ensure that when personal data are handled by EU institutions and bodies privacy is protected in the same way as it is in Member States under the General Data Protection Regulation”, the document also said.

Confidential messages

Privacy and data protection indeed are at the core of the proposed transformation of the European Regulation. Messaging services will be forced to guarantee the confidentiality of conversations and all information around them, such as time and place, as a response to the 92% of Europeans saying it is important that their emails and online messages “remain confidential”. Companies will therefore have to ask for the explicit ok-go of users before being able to use their data for advertising and marketing purposes. WhatsApp and Facebook Messenger are clearly among the targeted ones.

Digital Single Market

Andrus Ansip, Vice-President for the Digital Single Market said: “Our proposals will deliver the trust in the Digital Single Market that people expect. I want to ensure confidentiality of electronic communications and privacy”. “Our draft ePrivacy Regulation strikes the right balance: it provides a high level of protection for consumers, while allowing businesses to innovate”, he also added.

Also Věra Jourová, Commissioner for Justice, Consumers and Gender Equality, expressed satisfaction for the new EU plans concerning ePrivacy: “The European data protection legislation adopted last year sets high standards for the benefit of both EU citizens and companies. Today we are also setting out our strategy to facilitate international data exchanges in the global digital economy and promote high data protection standards worldwide”, she said.

Change on cookie policy

The rules are also intended to impact the use of cookies. Current regulation requires consent from user for all purposes and uses of cookies, and has ultimately led to a general warning that appears on a website at the first visit since May 2012. According to the European Commission, rules will be simplified and the so called “cookie provision” will be streamlined. “New rules will allow users to be more in control of their settings, providing an easy way to accept or refuse the tracking of cookies and other identifiers in case of privacy risks”, the Commission said in the official 10 January statement. In a few words, no consent will be required for non-privacy intrusive cookies, such as those ones that simply improve internet experience (e.g. to remember shopping cart history).

The reform also applies to protection against spam, such as unsolicited and nonconsensual electronic communication. Under the new regulation, unsolicited electronic communication “by any means”, as described by the EC, (e.g. by emails, SMS and also phone calls) will be banned if users have not given their consent. Marketing callers will also need to display their phone number or use a special pre-fix that indicates a marketing call.

New opportunities for business?

The EC has also pointed out that the new rules and the implementation of the ePrivacy Directive will also favour business and open up some new opportunities for traditional telecoms operators. “Traditional telecoms operators will have more opportunities to use data and provide additional services”, the EC wrote. “For example – the statement also said – they could produce heat maps indicating the presence of individuals to help public authorities and transport companies when developing new infrastructure projects”.

Mixed welcome

Despite that, the proposal also arouse discontent among some big players of the digital industry in Europe. European Telecommunications Network Operations (ETNO) indeed argued that that the new rules would put even more pressure on traditional telecom companies. Despite recognizing the effort by the European Commission to “protect the confidentiality of electronic communications” and the objective of establishing “a harmonised framework for electronic communications data”, ETNO called on the co-legislators to correct the new e-Privacy Regulation in an official statement, stressing that the proposed one does not have a “customer-friendly and innovation-ready approach”.

“Restrictive e-Privacy rules would result in unfair double regulation of one sector compared to others”, ETNO wrote last week. “Unless we overcome the current inconsistencies and restrictions, telecom operators in Europe will be prevented from expanding consumer choice and offering new competitive services to citizens”, the press release also stressed.

Impact on the advertising industry

The advertising industry doesn’t seem so happy about the new rules on digital either. The Interactive Advertising Bureau was indeed very critical about the proposed improvement to cookies. “People who thought cookie banners were annoying, will be disappointed to hear that things won’t get better,” said Townsend Feehan, CEO of IAB Europe. “Without significant improvements to the proposed text, users would have to actively change the settings of every single device and app they use, and more actively deal with constant requests for permission for the use of harmless cookies when visiting websites and using other digital services”, Feehan warned.

Also, according to the Guardian, Yves Schwarzbart, Head of policy and regulatory affairs at the Internet Advertising Bureau UK, was quite critic about the EC proposals, since tighter rules carry the risk of undermining the possibility for advertisers to offer free services. “It will particularly hit those companies that […] find it most difficult to talk directly to end users”, he declared. According to the IAB UK, online advertising generates around £ 10 billion of revenue for publishers and content creators in the UK alone, and any further complication to the advertising system could have a potential worse impact on the overall revenue.

The new rules are still only proposals, and will require approval from the European Parliament and single Member States before gaining the status of law. The Commission called on the European Parliament and the Council to ensure “the smooth adoption of the new rules” by May 25, 2018, when the General Data Protection Regulation will enter into application.

According to the European Data Market Study, the EU data economy was valued at €272 billion in 2015.