While the ePrivacy Regulation's implementation date is still up in the air, a recent Morrison & Foerster webinar stressed that the pending and current member-state ePrivacy requirements have only been intensified by GDPR's stringent consent requirements.

The “Cookies, E-Privacy and One-Stop-Shop: GDPR at the One-Year Mark” webinar hosted by Morrison & Foerster partner Julie O'Neill and firm partner and global privacy and data security practice co-chairman Alex van der Wolk looked at what the EU's still-pending ePrivacy Regulation could entail and how it and current ePrivacy requirements interplay with the General Data Protection Regulation. 

When the ePrivacy Regulation is implemented, it will apply to web browser-tracking cookies and similar technologies, with few expected exemptions. The ePrivacy Regulation was intended to go into effect in all EU member-states alongside the GDPR on May 25, 2018. But as van der Wolk noted, the “European Council is not internally aligned on its position.”

As the European Council hammers out an agreement over the ePrivacy Regulation, since 2002 EU member-states have implemented the ePrivacy Initiative, with requirements vary per country.

O'Neill explained that while the GDPR is a general and wide regime, the ePrivacy directive and regulation specifically govern direct electronic marketing messages, cookies and similar tracking technologies and is based on where the end user is located. She also stressed for those specific tracking and marketing activities, the directive and regulation take precedence over the GDPR, even if the data collected is personal data.

However, the GDPR and ePrivacy do intermingle. Specifically, the ePrivacy directive and regulation looks to the GDPR for interpretations of certain points, including what is valid consent for cookie tracking, O'Neill noted.

The GDPR requires that valid consent be “freely given, specific and informed” and evidenced by an affirmative action. What's more, a service cannot be conditioned on cookie consent.  

Because defensible consent for cookies under the ePrivacy hinges on the GDPR interpretation, if a company uses cookies, it is subject to ePrivacy requirements and GDPR, O'Neill said.

Van der Wolk suggested companies prepare for the ePrivacy Regulation to include stricter consent requirements and cookie blocking by default. He also expects more types of communication to fall under the regulation's scope, beyond marketing-related emails and text messages.

While the ePrivacy Regulation crawls toward adoption, the European Data Protection Board issued an opinion on March 12 detailing the ePrivacy Directive's interplay with the GDPR. In a footnote, the EDPB also stressed the importance of a speedy adoption of the broader ePrivacy Regulation.

“The EDPB has called upon the European Commission, Parliament and Council to work together to ensure a swift adoption of the new ePrivacy Regulation,” the opinion stated.