EUROPEAN COMMISSION

Brussels, 10.1.2017

SWD(2017) 3 final

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT

Accompanying the document

Proposal for a Regulation of the European Parliament and of the Council

concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)

{COM(2017) 10 final}
{SWD(2017) 4 final}
{SWD(2017) 5 final}
{SWD(2017) 6 final}

Table of Contents

1.What is the problem and why is it a problem?

1.1.Policy Context

1.2.Findings of the REFIT evaluation

1.3.What are the problems that may require action?

1.3.1.Problem 1: Citizens' private life when communicating online is not sufficiently and effectively protected

1.3.2.Problem 2: Citizens are not effectively protected against unsolicited marketing

1.3.3.Problem 3: Businesses face obstacles created by fragmented legislation and differing legal interpretations across MS as well as unclear and outdated provisions

1.4.Problem drivers

1.5.Who is affected by the problem and to what extent?

1.6.Baseline scenario: how would the problem evolve?

2.Why should the EU act?

3.What should be achieved?

3.1.General objectives

3.2.Specific objectives

4.What are the various options to achieve the objectives?

4.1.Option 0: Do-nothing.

4.2.Option 1: Non-legislative ("soft law") measures.

4.3.Option 2: Limited reinforcement of privacy/confidentiality and harmonisation

4.4.Option 3: Measured reinforcement of privacy/confidentiality and harmonisation

4.5.Option 4: Far reaching reinforcement of privacy/confidentiality and harmonisation

4.6.Option 5: Repeal of the ePD

5.What are the impacts of the different policy options and who will be affected?

5.1.Baseline scenario: no policy change

5.2.Option 1: Non-legislative ("soft law") measures

5.3.Option 2: Limited reinforcement of privacy and harmonisation

5.4.Option 3: Measured reinforcement of privacy/confidentiality and harmonisation

5.5.Option 4: Far-reaching reinforcement of privacy/confidentiality and harmonisation

5.6.Option 5: Repeal of the ePD

6.How do the options compare?

6.1.Comparison of options

6.1.1.Effectiveness

6.1.2.Efficiency

6.1.3.Coherence

6.2.Outcome of the comparison

6.2.1.REFIT Dimension of the preferred option: simplification and administrative burden reduction

6.3.Choice of legal instrument

7.Monitoring and evaluation

1.What is the problem and why is it a problem?

1.1.Policy Context

The digital economy has been a major driver of growth in the past two decades, and is expected to grow seven times faster than the overall EU GDP in coming years 1 . Information and Communications Technology (ICT) has therefore become the foundation of all modern innovative economic systems.

In the Communication on the Digital Single Market Strategy ("DSM Communication") 2 , the Commission recognised that the DSM must be built on reliable, trustworthy, high speed, affordable networks and services that safeguard consumers' fundamental rights to privacy and personal data protection while also encouraging innovation.

The ePrivacy Directive ("ePD") 3  aims at ensuring the protection of privacy and confidentiality in the electronic communications sector and at ensuring the free flow of related personal data and electronic communication equipment and services in the EU. The ePD particularises and complements Directive 95/46/EC on the protection of personal data ("Directive 95/46") 4 in relation to the processing of personal data in the electronic communications sector.

The ePD is particularly relevant for electronic communication service providers ("ECS") as well as for many companies with a website storing information or accessing information already stored in users' terminal equipment (such as for example "cookies" 5 ). A description of the legal and socio economic context of the ePD is provided in Annex 4, to which this report refers for essential background information and a better understanding of the present document.

The reform of the data protection legal framework, initiated in 2012, is a cornerstone of the digital single market. In April 2016, the European Parliament and the Council adopted the General Data Protection Regulation ("GDPR") 6 . Morever, the Commission committed to review, once the new EU rules on data protection would be adopted, the ePD with a focus on ensuring a high level of protection for data subjects and a level playing field for all market players. The review must ensure consistency with the GDPR.

As a part of the DSM Strategy, the Commission has also undertaken a review of the electronic communications legal framework ("Telecom Framework") 7 . The ePD has traditionally been part of the Telecom Framework from which it derives essential elements such as some of its key definitions. The review of the ePD should, among others, ensure consistency with the Telecom Framework. The ePD is also closely connected with the Radio Equipment Directive ("RED") 8 , which lays down detailed rules relating to the marketing of terminal equipment in the EU including an essential requirement for this equipment to incorporate privacy safeguards.

The objectives, scope, main content of the ePD and its relationship with other pieces of legislation such as the GDPR, the Telecom Framework and the RED are set out in Annex 4.

1.2.Findings of the REFIT evaluation

The REFIT evaluation has shown that the general and specific objectives of the ePD still remain relevant today 9 . Some rules have become less pertinent and possibly outdated in the light of technological and market developments and changes in the legal framework. This is, for example, the case of the rules on security, which are entirely mirrored in the GDPR, and itemised billing, given that they have become obsolete in light of technological and market developments.

By contrast, the REFIT evaluation has emphasised that several of the ePD rules have shortcomings. The following specific flaws were highlighted:

The effectiveness of confidentiality of communications rules has been mainly hampered by the incapacity of the rules to anticipate technological changes. Services which are functionally equivalent to ECS 10 , such as the so-called over-the top ("OTT") services 11 , are not subject to the same rules. Therefore, the level of protection varies according to the communication technique utilised.

As regards the rule on confidentiality of terminal equipment 12 , which applies to cookies, the REFIT evaluation found that consent given online suffers from a number of shortcomings: citizens do not have time to read long and complex privacy statements and find it difficult to understand what consent implies. Moreover, the rule is at the same time over-inclusive, as it also applies to non-intrusive practices (e.g. first party analytics), and under-inclusive, as it does not address new tracking techniques (e.g. device fingerprinting).

The effectiveness of the rules on unsolicited communications has been questioned. The results of the Eurobarometer survey 13 and the sheer number of complaints received by national authorities from MS nationals are strong evidence of a problem in this area.

Diverging implementation/interpretations and inconsistent enforcement of several key provisions also emerged as common issues. This is, at least in part, linked with the current system of enforcement, where MS are free to choose which authorities are competent. This has given rise to a complex situation, with several authorities competent in the same MS. The situation aggravated by the fact that the instrument under consideration is a directive, and not a regulation.

The REFIT evaluation highlighted that most of the costs incurred as a result of the obligations imposed by the ePD in 2002 had been offset or were very difficult to quantify. The REFIT focussed on costs incurred by operators relate to the cookie consent provision. A Commission external study estimated that the overall costs of the ePD for businesses operating in the EU through a website using cookies (i.e. around 50% of the total) in the period 2002-2015 has approximately been of EUR 1,861.7 million per year 14 . Overall, the efficiency of this rule has been questioned by a number of stakeholders. They complain against the current coverage of this provision. Moreover, some stakeholders complain that cookie banners interfere with users Internet experience by asking repeatedly for consent.

1.3.What are the problems that may require action?

Building on the findings of the REFIT analysis, three main problems have been identified. The first two problems address citizens' protection issues (effectiveness of the existing rules), while the third mostly addresses efficiency concerns related to limited harmonisation and complexity of the rules.

1.3.1.Problem 1: Citizens' private life when communicating online is not sufficiently and effectively protected

The confidentiality provision applies only to a portion of today's electronic communications. While it covers the traditional voice and text communications services and Internet access provided by traditional telecommunications companies (the "ECSs"), it does not apply to an increasingly relevant and popular portion of software-based online communications (the "OTTs") 15 . While, therefore, electronic communications carried by the ECSs can only be processed with the consent of the users, communications carried by means of the so called over-the-top providers can be processed on the basis of the various legal grounds provided by the GDPR, including the necessity for performing a contract and controller's legitimate interest.

The Court of Justice has recognised on various occasions the utmost importance of ensuring effective confidentiality of electronic communications, for example in the Digital Rights Ireland case 16 , which has led to the invalidation of the Data Retention Directive 2006/24/EC. Article 7 of the Charter provides that everyone has the right to respect for his or her private and family life, home and communications. Given the broad and general formulation of the protection afforded to communications under the Charter provision a different protection of users' fundamental rights on the basis of the technology used is not justified.

A very recent Eurobarometer survey 20 shows that in 11 MS, individuals use these services daily or almost daily, with particularly high levels in Spain (70%), The Netherlands (61%), Italy (57%) and Germany (51%). At the same time, individuals attach great importance to the confidentiality of information sent or received through these new channels 21 . The public consultation showed that an overwhelming majority of citizens, civil society and public bodies finds that OTTs should provide the same level of protection when they provide communication services as ECS providers, while approximately a third of the industry respondents (including ECSs and OTTs) agree with this statement 22 . National data protection authorities 23 , BEREC 24 and the EDPS 25 also advocated for an extension of the scope of the ePD to OTTs. The International Working Group on Data Protection in Telecommunications reached similar views 26 . This is also the predominant view of citizens according to a recent Eurobarometer survey (92%) 27 .

Moreover, the public consultation (including the Eurobarometer) has revealed that citizens are significantly concerned with the confidentiality of their online activities (e.g. Internet browsing). This point is closely related to the widespread usage of online tracking tools, such as cookies and location tracking devices which monitor websites visited, timing of the visits, interaction with others, etc. 28 According to a survey, 69% of consumers say that it is not acceptable for service providers to use personal data (e.g. based on cookies) for commercial use 29 .

Cookies are widely used today for a variety of technical or commercial purposes, such as online behavioural advertising ("OBA")  30 . In the OBA ecosystem, a particular form of "tracking cookies" or other tracking techniques are used in order to profile the user and serve him/her with targeted advertising. When using online services, individuals are associated with technical (online) identifiers which are set by websites or emitted by their devices, applications, tools and protocols 31 and leave traces of their activity at each server they communicate with 32 . Annex 6 provides the technical explanation of the OBA market.

The REFIT evaluation revealed that users are very often not aware that they are being tracked or they have few alternatives to accepting 33 . Cookie policies are often complex, long or unclear. While cookies are probably the most common form of online identifiers used for OBA purposes, it should be noted that they are being replaced or combined today with even more invasive forms of tracking of communications, such as device fingerprinting 34 . The main difference between cookies and device fingerprinting is that the latter practice is not visible to users, as it leaves no trace in the device. 

The REFIT evaluation identified Wi-Fi tracking as another gap in the protection guaranteed by the ePD. When a Wi-Fi enabled device is switched on, it continually broadcasts unique identifiers called MAC (Media Access Control) addresses. Wi-Fi (and in a comparable way Bluetooth) tracking may be used to count people, to track and observe their movements within the area covered by the network, such as airports or shopping malls. This includes the trajectories they follow as well as the time they spend at certain locations 35 . Furthermore, it is not clear in all MS whether the current ePD protects in principle the confidentiality of electronic communications over Wi-Fi networks that are publicly accessible (such as in airports, department stores, etc.). Similarly, it remains unclear to which extent the electronic communications of the Internet of Things 36  ("IoT") is covered by the ePD 37 .

1.3.2.Problem 2: Citizens are not effectively protected against unsolicited marketing

There is evidence showing that the current rules on unsolicited advertising applying to telephone marketing have not effectively protected citizens. The Eurobarometer on e-Privacy has shown that a significant majority of responding citizens (61%) believe that they receive too many unsolicited calls offering them goods or services 38 . The percentages of citizens receiving too many communications are particularly high in three large MS, such as UK, Italy and France where it is on average around 75%.

Available statistics show that the number of nuisance calls in the EU is very high. UK authorities estimate, for example, that each year UK consumers receive around 4.8 billion nuisance calls: 1.7 billion live sales calls, 1.5 billion silent calls, 940 million recorded sales messages, and 200 million abandoned calls 39 . Another recent survey conducted over a selected number of countries around the world showed that the number of people registering to do-not-call lists is constantly increasing 40 .

The statistics of complaints in MS against unsolicited advertising (including all means) are impressive. The German Bundesnetzsagentur has received around 60,000 complaints related to spam in 2013, i.e. more than twice as many as in 2012. The majority of these complaints (68%) concerned telephone spam. In the UK, 180,000 complaints reached the various competent authorities in 2014 against nuisance marketing calls and texts. For the 12-month period ending October 2015, the ICO received an average of 14,343 complaints monthly about nuisance calls 41 . Similar figures are available for other major MS (see REFIT SWD). In comparison with the other provisions of the ePD, most competent authorities received the highest number of complaints for Article 13. For example, the Greek Data Protection Authority estimates that around 90% of all complaints received in relation to the ePD relate to unsolicited communications.

Moreover, it should be noted that marketing calls or messages sent using VoIP and over the Internet, provided by OTTs, are not clearly covered by the current rules. The use of VoIP and instant messaging has the potential to lower down even further the cost of direct marketing, thus unsolicited communications sent via these channels will be even easier and cheaper to send while imposing a cost on end-users 42 .

1.3.3.Problem 3: Businesses face obstacles created by fragmented legislation and differing legal interpretations across MS as well as unclear and outdated provisions

First, the REFIT evaluation has shown that the transposition of the ePD rules took place in a very disperse and different manner. ECS providers and businesses that operate a website or engage in direct marketing across MS face additional costs related to the fact that the ePrivacy rules are interpreted and applied differently across the MS. This entails additional compliance costs, related for instance to the need to verify whether their practices comply with the different implementing laws and their official interpretations in 28 MS, including the use of professional advice. This differential is a barrier for businesses, especially for SMEs willing to establish or operate in other MS, as they need to face additional compliance costs, such as the cost of legal advice and the cost to verify/adapt their businesses processes. Ultimately, the limited harmonisation discourages companies to invest in new enterprises, start-ups, innovation, which in turn makes the EU less competitive in the digital arena. This constitutes a clear limit to the achievement of the internal market and to the ambitions of the DSM strategy.

Second, some provisions such as those regarding security, itemised billing and automatic call forwarding are considered to be outdated or no longer necessary. The rules on security essentially require ECS to take appropriate technical and organisational measures to safeguard the security of its services and to notify personal data breaches. However, almost identical provisions have been included in the GDPR, which will enter into force in 2018, and several rules of the telecom framework (also currently under review) have been reinforced. The provision on itemised billing provides for the right for subscribers to receive non-itemised bills (not showing the complete numbers called). However, in view of the penetration of cost flat rates, the increasing use of mobile phones, as well as considering the increase of communications service providers that provide a calling service for free (especially among OTT services relying on the internet for providing voice calls), this provision is considered to be outdated.

Third, under the ePD, ECS can only process such data if they have been made anonymous or with the consent of the users, to the extent that this is necessary to provide a value-added service. ECS providers stressed that these provisions are too strict because they essentially prevent them from competing with OTTs in an increasingly remunerative segment of the market (i.e. the OBA market)  43 . This argument finds some support in the findings of a recent Commission external study 44 . The main argument developed in the study is that, should the restrictions related to the provision of a value added service be relaxed, ECS would be enabled to compete with OTT platforms by providing services (free-of-charge) financed by OBA.

1.4.Problem drivers

The REFIT evaluation has shown that the ePD lack of effectiveness results from a series of problems and flaws in the drafting and implementation of the relevant provisions, particularly the lack of sufficient technological neutrality 45 . The following drivers have been identified as the main causes of the problem:

1.Rules ill adapted to technical and market changes: The ePD rules are tailored on traditional telecommunications services, i.e. the prevailing electronic communication technology when the predecessor of the ePD was first enacted in 1997. In order to respond to market developments, in 2002, the rules have been extended to cover Internet service providers and reviewed in 2009 to reinforce the rules on security and unsolicited communications. The lack of technological neutrality is, therefore, one of the causes of the problem affecting the ePD according to the REFIT evaluation. Given technological and market changes (see Annex 4), the ePD is no longer able to deal with new forms of communications, which were not foreseen when it was adopted.

2.Issues regarding the current consent rules: the REFIT evaluation has shown that citizens are often not adequately informed about the consequences of their consent online. Cookie policies may be often complex, long and unclear 46 . Given the sheer number and complexity of online privacy policies, users find it difficult to get properly informed or feel have few alternatives to accepting 47 . Numerous sources have, for example, highlighted the limitations of the current notice and consent mechanism in the online environment 48 . Moreover, the consent based rules as formulated in the current ePD have, in some cases, proven to be excessively rigid and therefore unfit to the new realities of online communications. For example, the cookie consent provision lacks the necessary flexibility (e.g. in terms of exceptions) to support technical uses that do not present substantial threat for users' privacy. The REFIT evaluation has shown that it has imposed significant cost on a large number of businesses, without much added value in terms of privacy.

3.Unclear/incoherent rules and their inefficient implementation: the implementation of the ePD requirements has been problematic for a number of reasons, mostly related to the unclear or vague formulation of some of its provisions across MS 49 . Moreover, certain provisions have become unnecessary or redundant because the GDPR will cover the same matters with more general rules. The security rules are a clear example of this risk of overlap. In addition, some provisions give ample margin of manoeuvre to MS, thus leading to fragmentation.

4.Insufficient and inconsistent enforcement: the information collected in the framework of a Commission's external study has shown a low level of enforcement in practically all MS 50 . Moreover, the effectiveness of the rules in cross-border cases is hampered due to the allocation of enforcement competences to a wide range of authorities that often overlap. This situation fosters different interpretations across Member States. Finally, there is no recognised EU group to gather together all authorities responsible for the enforcement of the ePD. This has made coordination, especially in cross-border cases, particularly difficult.

1.5.Who is affected by the problem and to what extent?

(i) Citizens

Consumers are affected by the limited scope of confidentiality obligations when using new communications services. Confidentiality of communications is an essential element of democratic systems and a precondition for other fundamental freedoms 51 . The expansion of mobile broadband connections fostered a rapid growth of OTT services, which is exemplified by some reported numbers: (1) by 2013 Skype had international voice minutes equal to almost 40% of the entire traditional international telecom market; (2) WhatsApp reached 500 million users in 2010 and 1 billion users in 2016; (3) by 2016 Facebook Messenger and WhatsApp carried 60 billion messages a day, i.e. three times more than SMS 52 . This gives indications about the seriousness and the size of the problem and on the fact that, with the growth of the broadband coverage, the situation will likely worsen if privacy rules are not clarified and reinforced.

According to a Commission external study, the number of EU citizens who in 2015 were affected by the problem(s), i.e. the share of the population using Internet to browse online, is about 390 million 53 . This share is projected to increase and approach virtually the entirety of EU population by 2022. Moreover, confidentiality of emails and online instant messaging is very important for consumers. Eurobarometer data shows that 92% of consumers find this important (72% "very important", 20% "fairly important"). Only 7% of consumers indicate that confidentiality of emails and online instant messaging is not important to them 54 .

Citizens consider unsolicited communications as an annoying interference with their fundamental right to privacy. A recent UK survey shows, for example, that 80% of marketing calls were perceived as annoying and 5% as distressing. Rather few (12%) were considered as being not a problem and very few were considered useful (1%). Participants who considered calls as being annoying or distressing commonly indicated that this was the case because they had received a lot of nuisance calls already, the call interrupted what they were doing, or there was no reply when answering the phone 55 . 

The fragmented implementation of the ePD rules and the uncertainties surrounding their interpretation directly affect consumers as the scope of their rights is not clear and varies among MS. The existence of several national competent authorities within a MS with responsibility for the ePD makes it more difficult for consumers to file complaints. The responses to the public consultation show that a large majority of citizens and consumers believe that because some MS have allocated enforcement powers to different authorities this has led to significant or moderate divergent interpretation of the rules in the EU and to non-effective enforcement. Of those that have reported significant and moderate problems, the main source of confusion is for citizens.

(ii) Businesses

The fact that the ePD does not apply to OTTs leads to a situation in which services which are regarded by consumers as largely substitutable from a functional standpoint are subject to different legal requirements 56 . A 2016 study prepared by Ecorys and TNO on behalf of the European Commission 57 found that end-users increasingly regard OTTs as substitutes for traditional ECSs. The study also indicates that between 2008 and 2014 fixed and mobile revenues have been declining in the EU by 19% - mainly driven by a decline in traffic related revenues. Similar developments have also been observed in non-EU regions. The impact of OTTs on ECS is clearly observed in mobile revenues. The revenues of the telecommunications sector went down by 10% between 2012 and 2016 (forecasted figure). This trend is confirmed by other market studies 58 .

Inconsistent, unclear or outdated regulation across MS makes it burdensome and costly for market players to offer services in multiple countries and creates artificial barriers to market integration. A Commission external study 59 estimates that about 2.8 million businesses were affected by at least some of the ePD rules in 2015. Of these, approximately 2.5 million were microenterprises (less than 10 employees) and approximately 260,000 were SMEs (10-250 employees). For companies that offer services or sell their products online, cross-border or provide the same service in several MS the lack of harmonisation increases compliance costs, thus preventing them from benefitting from economies of scale.

Particularly relevant is the position of ECSs, as the traditional subjects of the sector-specific regulation. In addition to the compliance costs, these operators also face opportunity costs, as the ePD rules limit their capacity to monetise the value of the data they convey, for example by operating in the OBA markets. The exact size of these opportunity costs cannot be quantified. However, the fact that OBA may be a very important source of revenue for ECS is confirmed by a Commission external study 60 . Also in this direction, a research conducted by a civil society organisation estimated that UK mobile operators could be making over half a billion pounds a year just from monetising the location of their customers 61 .

(iii) Public authorities

The growing sense of lack of protection may reduce the trust of people in the benefits of the digital economy 62 . Public authorities have undertaken considerable investments in making public services accessible online as well as in fostering the digital economy. The potential benefits require citizens' willingness to make use of online offerings.

As to unsolicited communications, the impact on public authorities is particularly serious. As the REFIT evaluation showed, the number of complaints from citizens concerning unsolicited advertising is very high. It follows that they have to dedicate substantial resources to this issue, with clear financial consequences in terms of resources allocation. Moreover, some cases may simply not be enforced, for example because of the difficulties related to the lack of sufficient resources compared to the workload of complaints. This may undermine the trust of citizens in the public administration and in the European Union 63 .

Public authorities are also affected by unclear provisions and powers (especially in an international context). There may be cases, for example, where multiple authorities are competent to deal with cases, within the same MS or in various MS, whereas economies of scale and scope could be achieved through better coordination. Lack of clarity on jurisdictional issues may lead to the legitimacy of enforcement actions being contested. The case of the Belgian DPA against Facebook illustrates this problem 64 .

Figure 1: Problem tree

1.6.Baseline scenario: how would the problem evolve?

The problem relating to confidentiality is unlikely to be solved in the absence of intervention. While the most popular OTT operators have consistently made efforts in respect of the protection of privacy and confidentiality (e.g. they largely ask for the consent of their users, have made efforts to improve transparency, enhance users' control, adopted pseudonymisation techniques and end-to-end encryption), these efforts are mostly voluntary and not enforceable. Even if the most important players might be considered as already de facto complying with confidentiality and the consent rule, respect for fundamental rights cannot be left solely to the good will of the parties concerned. In other words, the obligations relating to fundamental rights must be clearly spelt out in the law and be binding and enforceable vis-à-vis their addressees.

The full implementation of the GDPR would not solve by itself the problems identified 65 . The GDPR will reinforce the notion of consent, inter alia by specifying some clear conditions for the consent to be considered as freely-given 66 . It will also reinforce the protection of personal data in relation to online services, by among others imposing new obligations on data controllers and creating new rights for data subjects.

However, without action, a growing portion of electronic communications will remain subject to different and less specific rules with regard to confidentiality of communications and terminal equipment. In particular, the asymmetric regulation affecting more strongly the ECS sector will remain an unresolved issue. Moreover, all the issues identified in the REFIT evaluation concerning unsolicited communications (see Problem 2) as well as the lack of clarity, fragmentation and outdated or unnecessary character of some ePD provisions (see Problem 3) will remain substantially unaddressed. Finally, the coexistence between a general purpose Regulation and a sector specific Directive is likely to raise several consistency issues at national level, since it is not clear whether and under what conditions national laws implementing a directive may specify the provisions of a regulation.

The adoption of standards under the RED provisions would not fill the gap in terms of confidentiality protection between ECS and OTTs. First, technical standards under the RED concern the features of the radio equipment and do not, as a rule, apply to OTT communication software applications which are running on them. Second, technical standards under the RED can only cover radio equipment and not wire-connected devices. Finally, a number of issues identified in the REFIT evaluation concerning unsolicited communications (see Problem 2) as well as the lack of clarity, fragmentation and outdated or unnecessary character of some ePD provisions (see Problem 3) can obviously not be addressed by RED standards, as such matters clearly fall outside the scope of the that Directive.

Some MS have extended the scope of their national laws to cover explicitly OTTs (see Annex 9). However, they represent a minority and it is hard to predict a similar evolution of national legislation regarding the totality of EU MS. In the medium term (5 years) there is therefore a strong risk of growing divergent approaches in the 28 MS. This increasingly fragmented approach would increase business costs, as it does not allow operators to plan centralised privacy policies for the whole of Europe (they instead have to check the laws applicable in 28 MS), create additional obstacles for businesses willing to operate across borders and thus undermine the completion of a Digital Single Market.

Tracking of surfing behaviour is expected to grow more pervasive in the coming years. Current trends in the technical literature show that companies are developing more subtle and latent methods of tracking people's online behaviour, such as for example device fingerprinting, Wi-Fi location tracking, near field communication 67 . Many of these methods differentiate from traditional cookies in the fact that they do not (always) consist in the storing or accessing of information already stored in people's terminal equipment. They are therefore much more difficult to detect as they do not leave traces in the individual's terminal equipment. The consequence could be to reduce trust in the digital economy and reinforce citizens' feeling of being powerless, i.e. not protected by the law.

In the absence of EU intervention, unsolicited calls are likely to continue at the current high rate or even increase. The problem of unclear, fragmented, and outdated provisions of the framework, moreover, is likely to persist and may worsen, in part because when new technologies and services emerge they lack the harmonisation that was historically required through EU legislation, and may not achieve adequate levels of harmonisation through voluntary standardisation/codes of conduct alone. Moreover, in the absence of a coordination mechanism, authorities will face problems in effectively enforcing the rules consistently at EU level. Lack of consistency with the GDPR would create legal uncertainty and costs for citizens and businesses.

The number of businesses affected by at least some provisions of the ePD is estimated to be growing steadily until 2030, in light of the increasing share of businesses using online communications, such as websites and online platforms. The number of businesses affected is projected to increase from 2.8 million to 3.7 million in 2030. The lion's share of this business will again consist of micro-enterprises (3.3 million) 68 . A Commission's external study calculated that the overall cost of the ePD for businesses operating in the EU through a website using cookies (i.e. around 50% of the total) in the period 2002-2015 has approximately been of EUR 1,861.7 million per year 69 . The increase in the overall number of websites means that the ePD will affect a growing portion of the population.

ECSs are expected to continue to lose ground vis-à-vis OTTs offering competing communication services. Due to the still increasing popularity of smartphones as well as the growing availability of stable mobile broadband services, a study funded by the European Parliament estimates that the usage of OTT communication services will continue to increase significantly in the coming years and would end up reaching a share of 90% of the total messaging market in 2020 70 :

Figure 2: projected evolution of OTT usage

Source: DG for Internal Policies, “Over-the-Top players (OTTs), Study for the IMCO Committee”, 2015, 31.

The fact that rules on communications services are ill-adapted to technology and market changes also affects new players in the current value chain and the future of the Internet of Things. These players may experience some uncertainty about whether or not they fall within the scope of the framework and this may hinder future planning and investments 71 .

2.Why should the EU act?

Legal basis

Article 16 and Article 114 of the Treaty on the Functioning of the European Union (TFEU) are the relevant legal bases for the review of the ePD.

Article 16 TFEU reaffirms the right to the protection of personal data, already enshrined in the EU Charter, and introduces a specific legal basis for the adoption of rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the MS when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. The GDPR was adopted on this precise legal basis. Since the in most of the cases both components of an electronic communication involving a natural person, i.e. "metadata" and "content", will normally qualify as personal data, the protection of natural persons with regard to the confidentiality of communications and processing of such data, also in view of ensuring the protection of privacy, should be based on Article 16 72 .

In addition, the proposal aims at protecting communications and related legitimate interests of legal persons. Article 7 of the Charter contains rights which correspond to those guaranteed by Article 8(1) of the European Convention for the Protection of Human Rights and Fundamental Freedoms ("ECHR"). In accordance with Article 52(3) of the Charter, Article 7 thereof is to be given the same meaning and the same scope of Article 8(1) of the ECHR, as interpreted by the case-law of the European Court of Human Rights. Concerning the scope of Article 7 of the Charter as concerns legal persons, case-law of the Court of Justice of the European Union and of the European Court of Human Rights confirm that professional activities of legal persons may not be excluded from the protection of the right guaranteed by both, Article 7 of the Charter and Article 8 of the ECHR. 

In line with settled case-law of the Court of Justice of the European Union, other components of the act concerning natural persons that are merely incidental to the main purpose have the effect that the act must be based on a single legal basis, namely that required by the main or predominant purpose, in this case Article 16 TFEU. Since the initiative pursues a twofold purpose and that the component concerning the protection of communications of legal persons and the aim of achieving the internal market for those electronic communications and ensure its functioning in this regard cannot be considered merely incidental, the initiative should, therefore, also be based on Article 114 of the TFEU.

Subsidiarity

The subsidiarity principle requires the assessment of the necessity and the added value of the EU action. The need for EU level legislation on the protection of the right to privacy and confidentiality and the protection of personal data in the electronic communications sector and the free movement of such data and electronic communication equipment and services was already recognized by the European legislator with the adoption of the ePD.

As electronic communications, especially those based on Internet protocols, have a global reach, the dimension of the problem goes well beyond the territory of single MS. MS cannot effectively solve the problems in the current situation. In order to achieve the internal market in the electronic communications sector, it is necessary to reduce the current fragmentation of national rules and ensure an equivalent level of protection across the whole EU. Moreover, the proper functioning of the internal market requires that the rules ensure a level playing field for economic operators.

The technological developments and the ambitions of the DSM strategy have strengthened the case for action at EU level. The success of the EU DSM depends on how effectively the EU will be on bringing down national silos and barriers and seize the advantages and economies of a truly European digital single market. Moreover, as the Internet and digital technologies know no borders, a level playing field for economic operators and equal protection of users at EU level are requirements for the DSM to work properly.

Respect for communications as a fundamental right recognised in the Charter. It is also in line with the constitutional traditions common to the MS: the majority of MS also recognise the need to protect communications as a distinct constitutional right and usually have a distinct body of national law regulating this area 73 . However, the protection of communications differs widely on scope and content. Whilst it is therefore possible for MS to enact policies which ensure that this right is not breached, this would not be achieved in a uniform way in the absence of EU rules and would create restrictions on cross-border flows of personal and non-personal data related to the use of electronic communications services to other MS that do not meet the same protection standards.

Finally, in order to maintain consistency with the general data protection rules (GDPR), it is necessary to review the current sector-specific rules on ePrivacy and adopt measures required to bring the two instruments in line.

3.What should be achieved?

Based on the problems identified in section 1, the following policy objectives for the review of the ePD have been established:

3.1.General objectives

The review of the ePD aims at, first of all, completing the achievement of the original objectives of the Directive, taking into account new technological and market developments in the electronic communications sector. These objectives are ensuring an equivalent level of protection of privacy and confidentiality in connection with the processing of personal data in the electronic communications sector and ensuring the free flow of such data and electronic communication equipment and services in the Union.

3.2.Specific objectives

With the general objectives in mind, the review of the ePD intends to achieve the following specific objectives:

1.Ensuring effective confidentiality of electronic communications;

2.Ensuring effective protection against unsolicited commercial communications;

3.Enhancing harmonisation and simplifying/updating the legal framework.

4.What are the various options to achieve the objectives?

The following five policy options were considered to achieve the policy objectives and to remedy the problems identified, on top of the baseline scenario ("Do-nothing"). The first four options identify measures to strengthen confidentiality and privacy in relation to electronic communications ("reinforcing privacy/confidentiality") and to remove the identified barriers for businesses created by fragmented, outdated or unnecessary provisions ("enhancing harmonisation and simplifying"). The measures are presented according to their level of growing ambition (i.e. option 1 is the least ambitious and option 4 is the most ambitious). Policy option 5 considers the option of the repeal of the ePD, as advocated by some stakeholders. To improve the visual understanding of the options, Annex 12 presents them in a table form. In addition, in that Annex, the various measures are visually grouped in relation to the problems that they intend to address.

All the options would apply to all businesses, irrespective of their size, thus including SMEs. Microenterprises are normally excluded from EU regulations. However, the ePD does not allow a total exclusion of these enterprises in that it is meant to protect a fundamental right recognised under the Charter. Generally speaking, compliance with fundamental rights cannot be made dependent on the size of the businesses concerned. A breach of confidentiality of communications perpetrated by a microenterprise would potentially cause the same harm as one caused by a larger player. Fundamental rights shall be respected by every operators and no fully-fledged derogation is therefore possible for micro-enterprises. Still, mitigation measures were considered and reported in Annex 7 in relation to the so-called SMEs Test.

4.1.Option 0: Do-nothing.

Under this option, the Commission would maintain the status-quo and not undertake any policy or legislative action. With regard to the three identified problems/objectives, the option would result in the following situation:

4.2.Option 1: Non-legislative ("soft law") measures.

Under this option, the Commission would make extensive use of its implementing powers and use soft policy instruments in order to improve the protection of users. This option would include the measures to address the problems identified in the problem definition, which are listed in the box below. The specific contents of the individual measures cannot be delineated with precision at this stage, as they will emerge as a result of the overall process within the Commission and with the stakeholders.

4.3.Option 2: Limited reinforcement of privacy/confidentiality and harmonisation

Under this option the Commission would propose minimum changes to the current framework with a view to adjust privacy and confidentiality provisions and to improve harmonisation and simplification of the current rules. In particular, under this Option the Commission would propose the extension of the scope of the ePD to functionally equivalent services (e.g. OTTs) and the extension of the rules on unsolicited marketing to all electronic communications irrespective of the technical means used:

4.4.Option 3: Measured reinforcement of privacy/confidentiality and harmonisation

Under this option, the Commission would propose additional measures further reinforcing the protection and enhancing harmonisation/simplification. This Option would, in particular, reinforce the protection of confidentiality of terminal equipment, by making such protection technologically neutral and enhancing users' control through general privacy settings.

4.5.Option 4: Far reaching reinforcement of privacy/confidentiality and harmonisation

Under this option, the Commission would propose more far reaching measures reinforcing the protection of privacy/confidentiality and guaranteeing greater simplification/harmonisation. In particular, under this Option the Commission would propose a general banning on the so-called "cookie walls" and specific Commission implementing powers for ensuring consistent enforcement across MS.

4.6.Option 5: Repeal of the ePD

Under this option, the Commission would propose the repeal of the ePD. Several stakeholders, especially in the ECS and OTT sector, have argued that ePD rules are no longer needed and that the objectives of the ePD would be achieved by the GDPR alone. With the repeal of the ePD, the confidentiality of electronic communications would fall under the general data protection regime as laid down in the Directive 95/46 and as of 2018 the GDPR. The objectives would be achieved as follows:

5.What are the impacts of the different policy options and who will be affected?

This section analyses the economic, environmental and social impact of the option in line with the Better Regulation Guidelines together with the coherence with other policy and the views of stakeholders. The description of the impact of the options included in this section is complemented by an in depth economic analysis conducted by an external contractor supporting the present impact assessment (see Annex 8). The detailed assessment of the impact of the policy option on different categories of stakeholders is included in Annex 7. As the external study makes clear, the economic assessment faced some limitations in the collection of data, whose impact was mitigated to a maximum possible extent (the limitation encountered are explained in Annex 8). The expected costs and benefits/cost-savings of each option are summarised and compared in Annex 13.

5.1. Baseline scenario: no policy change

See Section 1.5 in the problem definition.

5.2.Option 1: Non-legislative ("soft law") measures

5.3.Option 2: Limited reinforcement of privacy and harmonisation

5.4.Option 3: Measured reinforcement of privacy/confidentiality and harmonisation

5.5.Option 4: Far-reaching reinforcement of privacy/confidentiality and harmonisation

5.6.Option 5: Repeal of the ePD

6.How do the options compare?

6.1.Comparison of options

In this section, the comparison of the options in the light of the impacts identified is presented. The options are assessed against the three core criteria of effectiveness, efficiency and coherence. Annex 13 summarises and presents in table form the comparison of the policy options in terms of effectiveness, efficiency and coherence as well as comparison of impact on each category of stakeholder. It also presents a table comparing the overall expected costs and expected benefits/cost-savings of each options.

6.1.1.Effectiveness

The analysis of the baseline scenario (section 5.1) has shown that if no action is taken, the problems are likely to continue and grow more important as the time passes. While the measures identified in Option 1 may to a certain extent improve the quality of implementation, there is no guarantee that the objectives could be effectively achieved without a change in the law. Many of the issues identified can only partially and hypothetically be tackled by interpretative communications or standards.

Option 2 would partially achieve all the objectives. The extension of the scope of the ePD would fill important gaps in the protection and ensure a level playing field. The selective measures in the field of unsolicited communications would reinforce citizens' protection against nuisance calls. The clarification of certain provisions combined with the selective repeal of some others would also contribute to the objectives. However, the Option presents some limitations as it does not sufficiently address the weakness of the current cookie consent mechanisms. Finally, the option would not completely address the problem relating to the lack of cooperation and consistency in cross-border cases.

Option 3 achieves the objectives in a significant way. In addition to the benefits of Option 2, the introduction of clear transparency requirements with regard to e.g. tracking in public spaces would contribute to significantly increasing consumer awareness and would help them make informed decisions. By mandating privacy-friendly settings in browsers and/or similar software, this Option would greatly facilitate the user-centric management of privacy and security related permissions concerning online browsing. The generalisation of the opt-in requirement would further enhance the protection of users against unsolicited commercial communications. At the same time, the option would enhance harmonisation and simplification. The broadening of the exceptions for the consent requirement, with adequate privacy safeguards, would guarantee this flexibility. The repeal of redundant provisions would simplify the legal framework. Finally, the allocation of enforcement powers to a single category of authorities, the authorities competent to enforce the provisions of the GDPR, with the extension of the GDPR consistency mechanism shall support a uniformed interpretation of the rules and more effective enforcement.

By contrast, the introduction under this Option of a possibility to process communications data (e.g. traffic and location data) without users' consent to profile and deliver targeted advertisement (measure No 10(e)), albeit under strict privacy safeguards, undermines the effectiveness of the option vis-à-vis its objective of reinforcing the protection of confidentiality of communications. The possibility for OTTs and ECSs to interfere with the confidentiality of electronic communications without the consent of the users strongly reduces citizens' control over their communications and therefore constitutes a significant limitation in relation to the present objective. While the negative effects on privacy protection would be limited by strict safeguards, i.e. as approved by the competent authorities, the overall compatibility of this element with the general objective of reinforcing confidentiality of communications is questionable.

Option 4 contains most of the measures included in Option 3, but it goes further in the protection in a number of respects. Under this perspective, the ban on "cookie walls" would significantly limit online tracking. However, it should be noted that cookies/OBA allow to finance freely-accessible content. Websites may need to put in place paying subscriptions; if users are not willing to pay with money, this may affect their revenues. With respect to unsolicited commercial communications, the repeal of the exception to the opt-in rule would further strengthen the protection of users from unsolicited communications by electronic mail (e.g. email and SMSs). In conclusion, the option is expected to significantly enhance protection and thus achieve Objectives 1 and 2 (except for the measure allowing processing without consent), but also adversely affect business models financed on OBA and thus go, in part, against objective 3 aiming to simplify the legal framework.

Under Option 5, confidentiality of communications will decrease because operators would be allowed to process communications data in the absence of the user's consent. Communications not containing personal data which are not covered by the GDPR would not be covered. As far as unsolicited communications are concerned, the generalisation of the opt-out rule would be a step-back as today a large portion of communications is subject to an opt-in consent. By contrast, Option 5 would achieve to a great extent the simplification objective, by ensuring a single set of rules applicable across all services, the necessary flexibility and a strong system of enforcement.

In conclusion, Option 3 and 4 are the most effective options.

6.1.2.Efficiency

The baseline scenario would not entail any additional cost. A Commission's external study 135 calculated that the overall cost related to the ePD for businesses operating in the EU a website using cookies amounted to approximately EUR 1.8 billion in the period 2002-2015. However, this cost is projected to gradually decrease until 2030 to approximately EUR 1.4 billion per annum.

Options 1 and 2 would entail additional costs compared to the baseline 136 . The estimate of the magnitude of these costs has been quantified by a Commission external study 137 . According to the Study, Option 1 would entail additional costs for 5% compared to the baseline. The additional compliance costs of Option 2 are estimated to be higher (15% compared to the baseline). Option 3 would instead lead to a substantial reduction in overall compliance costs essentially thanks to the measures streamlining and simplifying the consent rules and greater harmonisation (up to 70% lower compliance costs in the best case scenario). Option 4 would finally lead to a much lower reduction in compliance cost by (5%). Options 2 and 4 are expected to present significant opportunity costs as well. Opportunity costs are expected to be present also in Option 3, although to a significantly lower extent.

Imposing a general opt-in requirement under Option 3 (and 4) implies, by contrast, some additional compliance costs for businesses, as they will have to review their business models and limit marketing only in respect to those subscribers for which they have received prior consent. This is expected to raise the costs of a marketing campaign, as businesses would have to review and update their practices. This effect will be felt only in those MS that have at present adopted the opt-out system. The analysis of the data concerning the situation in MS, however, has shown that the largest majority of traders would be affected by this change, especially as far as fixed line calls are concerned (88% of traders) but also for mobile phones (61%). Considering that the evidence collected during the REFIT evaluation did not lead to conclude unequivocally that the problems related to voice-to-voice unsolicited communications are caused by the opt-out systems, but rather as the result of its ineffective implementation, the proportionality of the option does not seem to be demonstrated.

Option 5 is considered to be the least expensive option. The repeal of the ePD would significantly simplify the legal framework, by abolishing the sector-specific regulation in the ECS sector. However, while these costs would no longer be based on the ePD, the sector-specific rules now laid down in the ePD would be replaced by corresponding provisions of the GDPR. For example, the GDPR also contains obligations in relation to personal data breach notifications. Thus, some of these costs would still be incurred even after the repeal of the ePD, but for other reasons.

In conclusion Option 5 and 3 are the most efficient options.

6.1.3.Coherence 

The Baseline and Option 1 would not entirely solve the internal and external coherence issues identified. In particular, the asymmetric regulation of ECS and other forms of online communications would not be removed. Inconsistent enforcement would not be effectively addressed.

Option 5 would enhance the overall coherence of the system, as it would eliminate the dual regime of the protection of personal data in the electronic communications sector and make the GDPR the only legal instrument in the field of data protection. However, the repeal of the specific rules of confidentiality of communications would remove the specific protection of confidentiality of communications in line with the Charter, especially with regard to legal persons and communications not involving personal data, which are not protected under the GDPR.

Options 2, 3 and 4 do not present specific coherence issues, although they represent a significant deviation from the status quo and result in a significant expansion of the scope of the current ePrivacy instrument. The scope would be enlarged in relation to OTTs. While this may be seen as a significant extension, it is also a necessity given the need to ensure confidentiality of communications, irrespective of the technology used (i.e. technological neutrality). The same arguments apply as well to the clarification of the applicability of the confidentiality rules to publicly available private networks such as Wi-Fi and to IoT connected devices.

As far as the GDPR is concerned, the relationship with the general data protection rules will not change under Options 1, 2, 3 and 4. The ePrivacy instrument will remain a specific law aiming to protect confidentiality of electronic communications in accordance with Article 7 of the Charter. If personal data are involved, the GDPR rules will continue to apply on the top of the ePrivacy instrument for any matters that is not specifically regulated by the latter. In line with the expansion of the scope of the ePrivacy rules, some matters that were previously covered exclusively by the GDPR will be covered in the future also by the ePrivacy instrument. This is the case, as already mentioned, for OTTs, publicly accessible Wi-Fi networks and IoT connected devices related communications. Option 3 and 4 will further boost alignment with the GDPR, as they will provide for the application of the GDPR enforcement and consistency system.

While the basic relationship with the RED will not change, Options 3 and 4 will include the additional requirement for some software acting as "user agent" to set out specifically described privacy settings. User agent software would include, for example, Internet browsers. This requirement is considered coherent with the RED, which covers radio equipment and includes a requirement for such equipment to incorporate privacy safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected 138 . The options in question would not otherwise affect in any manner the operation of the RED and the power of the Commission to adopt delegated acts or European standards under that Directive to further specify the practical implementation of this requirement.

6.2.Outcome of the comparison

Based on the above comparison, it appears that Option 3 is the best option to achieve the objectives, while taking into account its efficiency and coherence.

Options 3 and 4 are the most effective options to achieve the objectives of the review, with Option 4 guaranteeing greater user protection and thus achieving the objectives 1 and 2 to a greater extent. However, in terms of efficiency, Option 4 is more expensive and thus less efficient, both in terms of compliance and opportunity costs. Under this perspective, Option 3 is considered a more proportionate, and thus preferable, solution compared to Option 4. By contrast, Option 3 has positive effects in terms of efficiency, as it is expected to drive compliance costs down (while potentially raising some non-insignificant opportunity costs). Option 3 is also coherent both internally and externally. Option 1 and 2 are much less effective options. While Option 5 would have very positive effects in terms of efficiency, it does not guarantee that the objectives are satisfactorily achieved.

Although Option 3 is the best option, while taking into account its efficiency and coherence, specific measures included in this option raise particular concerns in terms of effectiveness and efficiency (cost-effectiveness). In particular, the possibility to process communications data without consent of the users for marketing purposes (measure No 10(e)), albeit with privacy safeguards, would strongly limit the effectiveness of the option vis-à-vis the objective of ensuring effective confidentiality of electronic communications. In addition, the introduction of a mandatory opt-in regime for voice-to-voice live calls would generate costs, without offering sufficient guarantees that the underlying issues would be resolved by this measure.

In view of the above, the elimination of the measure of processing for marketing purposes without consent would ensure a better result in relation to Objective 1. At the same time, the elimination of the extension of the opt-in would ensure a better result in terms of efficiency. There is no sufficient evidence that this would significantly undermining objective 2. These two measures of Option 3 should therefore not be retained. The preferred option is, therefore, Options 3 without these specific measures (processing without consent for marketing purposes measure No 10(e) and mandatory opt-in for voice-to-voice marketing calls (measure No 4)).

6.2.1.REFIT Dimension of the preferred option: simplification and administrative burden reduction

The preferred policy option presents several elements of simplification and reduction of the administrative burden on businesses. These elements, which have all been explained in the context of the analysis of the impacts, are also listed below and, where possible, quantified:

Technological neutrality: The proposal would introduce a fully technologically neutral approach, thus ensuring that the rules are future proof and remain effective despite the evolution of technology;

Privacy by design and technological solutions to manage complex issues related to consent online: The proposal would require certain software providers (user agents) to enable general settings in a way that they can be used to manage privacy choices in a centralised way. This would greatly simplify the management of consent online for users, as the latter will be able to set their privacy choices once for all websites and applications (this does not exclude the possibility to derogate in specific instances). This would bring out significant savings for businesses having a website (up to -70% of the costs related to the ePrivacy as estimated in the external study 139 ). At the same time, it would greatly simplify Internet browsing, limiting the interference of invasive cookie banners.

More consistent enforcement: thanks to the streamlining of enforcement by means of the consistency mechanism, and in particular the allocation of enforcement to GDPR authorities, greater consistency and legal certainty in cases having cross-border dimension would be ensured.

Greater transparency of unsolicited marketing calls: thanks to the introduction of the prefix and other measures relating to the transparency of marketing calls, most users (unless their telephone equipment does not display the identity of the calling line) will be enabled to identify a marketing call before picking up the phone. This will increase transparency and allow users to reject particular calls. In perspective, this may reduce complaints against unsolicited marketing calls.

Clearer exceptions to the privacy of terminal equipment: the proposal would spell out more clearly and in a more comprehensive manner the cases where interferences with the privacy of terminal equipment are permitted. In this way, the proposal would identify permitted uses for specific legitimate purposes not presenting concrete privacy risks, thus reducing false positives caused by the over-inclusive character of the present rules.

Elimination of redundant or outdated provisions: the proposal would eliminate the provisions on security of the processing of personal data in the electronic communications sector, which strongly overlap with the corresponding provisions in the GDPR and the Telecom Framework, thus further simplifying the legal framework. Moreover, it would eliminate the provision on itemised billing, which has been judged as no longer necessary in view of the evolution of technology and market reality.

The external study supporting the present impact assessment attempted to estimate the impact on costs of the preferred policy option, on the basis of a pragmatic model based on a wide range of assumptions reflecting the general scarcity of data. Taking these limitations into account, the external study identified three distinct implementation scenarios, according to the entity who will establish the dialogue box between the user having chosen “reject third party cookies”/ "do-not-track" settings and websites visited wishing the Internet user to reconsider his/her choice 140 . The entities who could be put in charge of this technical task are three: 1) the software providers concerned; 2) the third party tracker (e.g. the advertising networks); 3) the individual publishing websites. According to the study, this option would lead to overall savings in terms of compliance cost compared to baseline scenario of 70% (948.8 million savings) in the first scenario (browser solution), 60% (813.2 million) in the second scenario (tracking company solution) and of 5% (67.8 million) in the third scenario (publisher solution). As overall savings largely derive from a very significant decrease of the number of affected businesses, the individual amount of compliance costs one business is expected to incur – on average – would be higher than today. Far from being precise figures, they give however a rough idea of what the magnitude of the impact on businesses could be. The tables including the calculations relating to the key quantitative findings are in Annex 8, together with an overall explanation of the model, the related assumptions and limitations.

Table 6: Overall impact of the various policy options. The symbols "✓" and "✗" indicate respectively positive (✓) and negative (✗) impacts, the number of the symbols is the net result of the summing-up of the respective individual ratings of the policy option as indicated in Annex 13 and indicates the magnitude of the change.

6.3.Choice of legal instrument

The preferred option entails EU legislative intervention as only a binding instrument can guarantee the translation into practice of the measures proposed and the achievement of the related specific objectives.

A regulation would be directly applicable and would not need to be implemented in national law as it would have immediate effect and is a particularly suitable instrument when the objective is the uniform application of rules in a certain area. This type of instrument would be the best to achieve the objective of ensuring a higher level of harmonisation and consistency, which is a main objectives of the ePD review. This would be particularly important for online services present in different territories. Moreover, the relationship of a revised Directive with the GDPR would be legally complicated and might lead to legal uncertainty, as it is not clear whether national laws implementing a directive can particularise or complement a general regulation.

The experience with the implementation of the ePD has shown that the minimum harmonisation approach has not guaranteed the level of harmonisation required to ensure the internal market objective. The principle of confidentiality of communications has been implemented differently across MS. This has given rise to fragmentation and created barriers in the internal market, as businesses operating cross-border have had to deal with several different national regimes. The future ePrivacy instrument would therefore adopt an approach aimed at ensuring a higher level of harmonisation by means of more detailed and precise rules than it is the case today. Nonetheless, Member States should be allowed to maintain or introduce national provisions to further specify the application of the rules of this Regulation where this is necessary to ensure an effective application and interpretation of such rules and to the extent that they do not conflict with any provisions of this Regulation.

Figure 3: Legislative intervention logic

7.Monitoring and evaluation

This section describes the monitoring and evaluation that could be applied to assess the impact of the objectives and the preferred option. The approach to monitoring and evaluation is outlined with respect to the three main objectives that the preferred policy option will address.

Monitoring will start right after the adoption of the legislative act. It will focus on how the future instrument is applied in the MS by the market participants in order to ensure a consistent approach. The Commission will organise meetings with MS representatives (e.g. group of experts) and the relevant stakeholders in particular to see how to facilitate transition to the new rules. A report on the implementation and application of the instrument will be prepared every year, taking stock of the state of play, the progress towards the achievement of the objectives and unresolved issues.

The following list of impact indicators could be used to monitor progress towards meeting the general objectives:

Table 7: implementation strategy

No later than 5 years after the date of application of the new legal instrument, and every five years thereafter, the Commission shall carry out an evaluation and submit the main findings to the European Parliament, the Council and the European Economic and Social Committee.

The evaluation report will include an assessment on the basis of the five evaluation criteria of the Better Regulation Guidelines, including on whether the operational objectives of the revised instument have been reached. A particular focus will be cast on the application of the provision on confidentiality of communications.

(1) https://ec.europa.eu/digital-agenda/sites/digital-agenda/files/FI3P%20Fact%20Sheet.pdf  

(2)  COM(2015) 192, p. 9.

(3) Directive 2002/58/EC, as modified by Directive 2009/136, OJ L 201, 31.07.2002, p. 37.

(4)  L 281 , 23/11/1995 P. 0031 – 0050.

(5)  A cookie is information saved by the user's web browser, the software program used to visit the web. When visiting a website, the site might store cookies to recognise the user's device in the future when he comes back on the page. By keeping track of a user over time, cookies can be used to customize a user's browsing experience, or to deliver targeted ads. First-party cookies are placed by the website visited to make experience on the web more efficient. For example, they help sites remember items in the user shopping cart or his log-in name. Third-party cookies are placed by someone other than the site one is visiting (e.g. an advertising network to deliver ads to the online user) for instance in the browser of the visitor with the purpose to monitor his/her behaviour over time.

(6) Regulation (EU) 2016/679,  OJ L 119, 4.5.2016, p. 1–87.

(7) The review aims, among others, to establish a strong, competitive and dynamic telecoms sector which is capable to carry out the necessary investments, to exploit innovations such as Cloud computing, Big Data tools or the Internet of Things.

(8)  Directive 2014/53/EC, OJ L 153, 22.5.2014, p. 62–106.

(9)  See Commission Staff Working Document, Ex-post REFIT evaluation of the ePrivacy Directive 2002/58/EC ("REFIT SWD").

(10) An electronic communication service (ECS) is defined by the current telecom regulatory framework as a service normally provided for remuneration which consists wholly or mainly in the conveyance of signals on electronic communications networks, including telecommunications services and transmission services in networks used for broadcasting, but excludes information society services, as defined in Article 1 of Directive 98/34/EC, which do not consist wholly or mainly in the conveyance of signals on electronic communications networks. Under the interpretation offered by the European Court of Justice (ECJ, 7 November 2013, C-518/11 – UPC Netherland BV; ECJ 30 April 2014, C-475/12 – UPC/Nemzeti Média), ECS cover communication services of providers that bear the responsibility for the conveyance of signals over the underlying electronic communication network vis-à-vis end-users. Being responsible implies that the service provider must have a certain degree of control over the conveyance of signals. Operators of traditional electronic communications services usually also own and run (parts of) the underlying network, which consequently puts them into a "controlling" position.

(11) An over-the-top (OTT) service is essentially a software application that allows communications to be exchanged by and among the members of the application, in the form of voice, text or data communications. OTT providers do not control the transmission of the messages, but rely on end-users' internet connections for the messages to be relayed.

(12) Article 5(3).

(13)  2016 Eurobarometer survey (EB) 443 on e-Privacy (SMART 2016/079).

(14) Deloitte, Evaluation and review of Directive 2002/58 on privacy and the electronic communication sector (SMART 2016/0080).

(15) http://www.cerre.eu/sites/cerre/files/141029_CERRE_MktDefMktPwrRegInt_ECMs_Final.pdf See C-518/1, C-475/12, cited above. See also Commission external study prepared by Ecorys-TNO Study on Future trends and business models in communication services, Final Report (SMART 2013/0019). The study concludes that end users regard OTT voice and text services as substitute for voice and SMS services offered by telecom operators. See also CERRE, Market Definition, Market Power and Regulatory Interaction in Electronic Communications Market, October 2014, .

(16)  Joined Cases C293/12 and C594/12.

(17)  Popular OTTs include Skype, Gmail, WhatsApp, Facebook Messenger, Viber, Telegram, Facetime.

(18) Case C-475/12, cited above, par. 43.

(19) Some of such OTT communications services make use of telephone numbers and can for this reason be considered to fall under the framework, but the point is contested and de facto the rules of the framework have not been applied to them. See ERG Common Position on VoIP adopted in December 2007.

(20) SMART 2016/0079, cited above.

(21)  SMART 2016/0079, cited above.

(22)

Question 17 of the Public Consultation.

(23) Article 29 Working Party, Opinion 03/2016 on the Evaluation and review of the ePrivacy Directive 2002/58/EC, WP 240.

(24)

BEREC Response to the EC questionnaire on the ePrivacy Directive: http://www.berec.europa.eu/eng/document_register/subject_matter/berec/opinions/6137-berec-response-to-the-ec-questionnaire-on-the-eprivacy-directive  

(25)

EDPS opinion 5/2016, on the Review of the ePrivacy Directive (2002/58/EC), 22.07.2016.

(26)

 International Working Group on Data Protection in Telecommunications (Berlin Group), Working Paper: Update on Privacy and Security Issues in Internet Telephony (VoIP) and Related Communication Technologies, 59th meeting, 24-25 April 2016, Oslo (Norway). In spite of the above, the Eurobarometer survey revealed only a minority (37%) of individuals know that it is false that instant messaging and online voice conversations are confidential and nobody can access them without their permission (SMART 2016/079). This is confirmed by another (less recent) survey showing that data subjects and consumers are not aware of the differences and inconsistencies in data protection standards between traditional voice and SMS services on the one hand and OTT voice and messaging services on the other hand; see ComRes, Digital consumer Survey, September 2015, https://www.etno.eu/datas/publications/studies/ComRes_ETNO_Final%20Report_LATEST%20FOR%20PUBLICATION.pdf .

(27)  SMART 2016/079.

(28) https://www.datatilsynet.no/globalassets/global/english/privacy-trends-2016.pdf See, e.g., the survey conducted by the Norwegian DPA, Personal data in exchange for free services: an unhappy relationship?, .

(29) ComRes, Digital consumer Survey, cited above.

(30) OBA is an online advertising technique aiming to provide adverts messages to users tailored to their preferences and needs, as determined on the basis of the tracking and profiling of their online activities.

(31) Such as IP or MAC addresses, cookie identifiers, IMEIs and others.

(32) http://ec.europa.eu/justice/data-protection/article-29/press-material/press release/art29_press_material/2015/20150217__wp29_press_release_on_cookie_sweep_.pdf A cookie sweep carried out by the Article 29 Data Protection Working Party (WP29) has shown that the largest majority of websites controlled used third party tracking cookies, that the information provided to users was not sufficient and that cookies have a very long or permanent duration: .

(33) http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2580411 https://www.edri.org/files/transparent-consumers-bits-of-freedom.pdf Acquisti-Taylor-Wagman point out that consumers' ability to make informed decisions about their privacy is hindered, because most of the time they are in a position of imperfect information regarding when their data is collected, with what purposes, and with what consequences: Acquisti A., Taylor C., Wagman L., The Economics of Privacy: , p. 1. See also survey conducted by the Norwegian DPA, cited above; Kreiken F., Bits of Freedom, Transparent Consumers, .

(34) cookies http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf  A device fingerprint or machine fingerprint or browser fingerprint is information collected about a remote computing device for the purpose of its identification. Fingerprints can be used to fully or partially identify individual users or devices even when are turned off. It is based on the combination of different sets of information about the user's device, which is isolation are not per se sufficient to identify a machine, but that combined together achieve the degree of entropy necessary that become unique and therefore identifying. According to the WP29, device fingerprinting presents serious data protection concerns for individuals. For example, a number of online services have proposed device fingerprinting as an alternative to HTTP cookies for the purpose of providing analytics or for tracking without the need for consent under Article 5(3) (Opinion 9/2014 on The application of Directive 2002/58/EC to device fingerprinting: ).

(35) https://ico.org.uk/media/for-organisations/documents/1560691/wi-fi-location-analytics-guidance.pdf https://iconewsblog.wordpress.com/2015/09/25/be-wary-of-public-wi-fi/ http://www.csoonline.com/article/2945044/cyber-attacks-espionage/ieee-groups-recommends-random-mac-addresses-for-wi-fi-security.html See, e.g., Information Commissioner's Office, Wi-Fi location analytics, February 2016: ; Rice S., Be wary of public Wi-Fi (ICO Blog), September 2015, ; Korolov M., IEEE group recommends random MAC addresses for Wi-Fi security, ; Hill S., How Dangerous is Public Wi-Fi? We Ask an Expert, http://arstechnica.com/tech-policy/2016/06/advertiser-that-tracked-100-million-phone-users-without-consent-pays-950000/.

(36)  Based on existing communications technologies like the Internet, the IoT represents the next step towards digitisation where all objects and people can be interconnected through communication networks, in and across private, public and industrial spaces, and report about their status and/or about the status of the surrounding environment (Commission SWD(2016) 110/2 Advancing the Internet of Things in Europe, p. 6).

(37)  See the findings of the REFIT SWD.

(38)  SMART 2016/079.

(39)

ICO-OFCOM, Tackling Nuisance Calls and messages (December 2015): http://stakeholders.ofcom.org.uk/binaries/consultations/silentcalls/JAP_Update_Dec2015.pdf . A survey conducted on UK customers revealed that more than four in five (86%) of participating UK adults reported experiencing unsolicited communications in the observed period. The majority of the calls (89%) were considered to be annoying by participants across all ages, socio-economic group and working status.

(40)

Step Change Debt Charity, Combating Nuisance Calls and Texts, by Claire Milne, https://www.stepchange.org/Portals/0/documents/media/reports/additionalreports/Nuisance_Calls_Report_FINAL.pdf .

(41) http://stakeholders.ofcom.org.uk/binaries/consultations/silentcalls/JAP_Update_Dec2015.pdf  .

(42)

A Commission external study concluded that "All else being equal, there does not seem to be a valid reason for treating ECS and OCS differently in terms of the applicable rules relating to unsolicited communications and, consequently, for providing a different level of legal protection to end users depending on whether the service qualifies as an ECS or not"; see SMART 2013/0019, cited above.

(43) https://www.etno.eu/datas/publications/studies/DPTS_Study_DLA_04082016_ePrivacy_Final.pdf See DLA Piper, Study on the revision of the ePrivacy Directive (study prepared for ETNO), 2016, .

(44) SMART 2013/0019, cited above.

(45)

See REFIT SWD, e.g. p. 20-21.

(46) https://www.theguardian.com/technology/2014/apr/15/gmail-scans-all-emails-new-google-terms-clarify In some cases, tracking may extend even to the content of our communications as demonstrated by the reported cases of email scanning. See, e.g, Gibbs S., Gmail does scan all emails, new Google terms clarify: .

(47) cited See Acquisti A., Taylor C., Wagman, cited above. See also survey conducted by the Norwegian DPA, cited above; Kreiken F., Bits of Freedom, Transparent Consumers, above.

(48)

The Working Party 29, the EDPS and EDRI all underline in their respective opinions on the review of the ePD the limits of current implementation of the cookie consent mechanism (based on "cookie walls") under the ePD: Working Party 29, cited above, p. 16, EDPS, cited above, p. 14; EDRI, e-Privacy Directive Revision, https://edri.org/files/epd-revision/EDRi_ePrivacyDir-final.pdf . See also SMART 2013/0071; Acquisti-Taylor-Wagman, cited above, p. 41; DLA Piper, cited above, p. 29.

(49)

See the REFIT SWD for detailed description of these shortcomings. See also SMART 2013/0071, cited above.

(50)  SMART 2013/0071, see in particular the information on enforcement included in the country reports.

(51) On the risks for other fundamental rights, like the freedom of speech and freedom of association, see Van Hoboken J. and Borgesius F., Scoping Electronic Communication Privacy Rules: Data Services and Values, JIPITEC, 6, 2015, 198, p. 207-208. Acquisti-Taylor-Wagman, cited above, note, however, that citizens' attitude towards privacy is not uniform as privacy sensitivities may differ greatly across the population, based on subjective feelings, class, status, time, and other contextual factors etc. Moreover, it is not always clear how people value personal data. Therefore, they conclude that there is no unequivocal impact of privacy protection (or of sharing information) on welfare. Depending on the context, privacy protection can either increase or decrease individual as well as societal welfare. Empirical evidence exists both for scenarios in which privacy can slow down innovation or decrease economic growth or where the contrary is true.

(52) http://www.ccianet.org/wp-content/uploads/2016/06/Next-Gen-Comm-Level-Playing-Field.pdf Williamson B., Next Generation communications & the level playing field – what should be done, June 2016, .

(53) SMART 2016-0080, cited above.

(54)  SMART 2016/079, cited above.

(55) http://stakeholders.ofcom.org.uk/binaries/telecoms/nuisance-calls-2015/Nuisance_calls_W3_report.pdf  OFCOM (April 2015): Landline nuisance calls panel Wave 3 (January-February 2015), , p. 9.

(56) DLA Piper, cite above.

(57) SMART 213/0019.

(58) See CERRE, cited above, p. 15. See also DLA Piper, p. 11.

(59)  SMART 2016/0080, cited above.

(60) SMART 2013/0019, cited above.

(61) http://adage.com/article/datadriven-marketing/24-billion-data-business-telcos-discuss/301058/ Open Rights group, Cashing in on your mobile? How phone companies are exploiting their customers’ data, 2015: https://www.openrightsgroup.org/assets/files/pdfs/reports/mobile-report-2016.pdf. See also Kaye K., The $24 Billion Data Business That Telcos Don't Want to Talk About,  

(62)  See Commission Staff Working Document, A digital single market strategy for Europe – Analysis and evidence, SWD (2015) 100 final.

(63) In this context, the UK authority Ofcom explained that the enforcement of Article 13 is challenging. Ofcom highlighted that it is particularly difficult to trace the source of such calls including based on the large number of different sources. For example, during May to October 2015 Ofcom identified nearly 8,000 different telephone numbers as the source of silent and abandoned calls. In some cases, authorities are not able to manage effectively all the workload related to complaints, with the result that either not all complaints are answered on time or some are not answered at all.

(64) http://www.reuters.com/article/us-facebook-belgium-idUSKCN0ZF1VV Fioretti J, Facebook wins privacy case against Belgian data protection authority,  

(65) The GDPR was not conceived to replace the ePrivacy rules. Quite to the contrary, it was designed by the EU legislator with the future review of the ePD in mind, as made clear for example in the preamble of this Regulation. Recital 173 of the GDPR read as follows: "This Regulation should apply to all matters concerning the protection of fundamental rights and freedoms vis-à- vis the processing of personal data which are not subject to specific obligations with the same objective set out in Directive 2002/58/EC of the European Parliament and of the Council, including the obligations on the controller and the rights of natural persons. In order to clarify the relationship between this Regulation and Directive 2002/58/EC, that Directive should be amended accordingly. Once this Regulation is adopted, Directive 2002/58/EC should be reviewed in particular in order to ensure consistency with this Regulation."

(66) See Article 7 of the GDPR.

(67) Opinion 9/2014 on device fing See, e.g. WP29 erprinting, cited above.

(68)  SMART 2016/0080, cited above.

(69) SMART 2016/0080, cited above.

(70) http://www.europarl.europa.eu/RegData/etudes/STUD/2015/569979/IPOL_STU(2015)569979_EN.pdf European Parliament, Directorate-General for Internal Policies, Over-the-Top players (OTTs), Study for the IMCO Committee, 2015, 31, .

(71) https://www.rathenau.nl/en/publication/beyond-control Rathenau Instituut, Beyond Control, Exploratory study on the disclosure in Silicon Valley about consumer privacy in the Internet of Things, April 2016, .

(72) The need for dual legal basis is stressed by the EDPS, cited above, p. 8.

(73) EDPS, cited above, p. 7 and fn 11.

(74) The subject potentially covered would include 1) the notion of "electronic communications services" and of "publicly available" (clarify, e.g., that the current rules apply to WiFi and IoT devices, which is currently unclear); 2) the cookie provision (clarify, e.g., the extent to which the current rules cover also alternative tracking technologies to cookies); 3) clarify what positive actions constitute consent and the value of consent in situations of economic unbalance.

(75) The Commission would lead and coordinate industry efforts to promote standards and codes of conduct in crucial areas such standard information notices related to the use of location data by ECS providers, online tracking, standardised icons and labels, an EU-wide OBA code of conduct and/or an EU DNT standard.

(76) Article 14(3) and RED.

(77) Such as setting-up an ad-hoc website and an Internet based advertising campaign, ad-hoc conferences, events (e.g., online communications day) and training for national officials

(78) For example, the issues around the scope of the provision, silent or abandoned calls, the implementation of Robinson lists.

(79) This would cover issues such as the scope of the ePD (e.g., publicly available WiFi networks, IoT devices); modalities to provide consent for tracking, the exceptions to the consent rules under the ePD.

(80) Concerning, for instance, the provision of information and consent mechanisms, thus facilitating a uniform and clear implementation of the current rules.

(81) Working Party 29 Opinion on the ePD review, cited above, p. 8.

(82) See Recital 42 of the GDPR: "Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided."

(83)  Article 13(2).

(84)  This would cover in particular more detailed rules on the scope of the ePrivacy instrument, applicable law, the protection of terminal equipment privacy, the exceptions to the consent requirements and the scope of the unsolicited communications provisions.

(85)  Article 4.

(86)  Article 5(1).

(87)  All or some of the following safeguards may be included: 1) no data relating to the specific content of the communications is collected; 2) the data stay anonymised or pseudonymised and that no effort or technique will be applied to re-identify the users; 3) the processing complies with the principle of proportionality and subsidiarity; 4) access and further information are guaranteed upon request; 5) the data processed do not constitute special categories of personal data as defined under the GDPR; (6) the entity concerned has carried out a data protection impact assessment under Article 35 of the GDPR; (7) prior authorisation from a supervisory authority. Additional safeguards may be specified, including the differentiation on the basis of the risk, in Commission's delegated acts.

(88) Article 13(2).

(89) Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance

(90)  See Article 21 of the GDPR.

(91) ECJ, C-518/11, C-475/12, cited above.

(92) This means that costs will be lower in case e.g. only an online campaign would be launched. In case e.g. an EU-wide awareness-raising campaign is launched with printed materials, informative events, discussion rounds etc., the costs will of course be higher than this estimate.

(93) Regulation (EU) No 1291/2013, ANNEX II, O.J. L 347, 20.12.2013, p. 104.

(94) http://ec.europa.eu/rea/pdf/2_security_societies_calls.pdf See: .

(95) This is based on assuming that between one and two persons per MS might join, that they need to spend time on travel, the meeting itself and preparation considering the hourly salary quoted by the Commission and that they need to pay for flight and in some cases for one night accommodation.

(96)

Familiarisation/training costs= 3 staff-members per authority needing training * hours spent on training per staff (8 hours) *staff costs per hour (hourly wage rate EUR 41.5, Eurostat data 2012).

(97)

An example is a German self-regulation initiative relating to online advertisement and the use of cookies of the Deutschen Datenschutzrat Online-Werbung (DDOW). See: http://www.iqm.de/digital/nutzungsbasierte-onlinewerbung/

(98) DLA Piper, cited above.

(99) SMART 2016/0080, cited above.

(100) https://www.brookings.edu/wp-content/uploads/2016/06/Wittes-and-Liu_Privacy-paradox_v10.pdf  On the so-called privacy paradox, see e.g.: .

(101) Question 17 of the Public Consultation.

(102) More than nine in ten (92%) participants say it is important that the confidentiality of their e-mails and online instant messaging is guaranteed: SMART 2016/079, cited above.

(103) Working Party 29, Opinion on the ePD review, cited above.

(104) EDPS, cited above.

(105) EDRI, cited above.

(106) DLA Piper, cited above.

(107) http://www.digitaleurope.org/Digital-Headlines/Story/newsID/501 DIGITALEUROPE response to Commission ePrivacy Directive Consultation, .

(108) Based on the 2014 Cookie Sweep, 74 out of 474 websites only used first party cookies. In addition, 15 out of 474 only used session cookies (first and third party). Article 29 Data Protection Working Party (2015), Cookie Sweep Combined Analysis – Report, WP 229.

(109) https://ec.europa.eu/digital-single-market/en/news/public-consultation-evaluation-and-review-eprivacy-directive European Commission (2016). Background to the public consultation on the evaluation and review of the ePrivacy Directive, (), p. 11.

(110) SMART 2016/0080, cited above.

(111) Commission Staff Working Paper on Impact Assessment on the General Data Protection Regulation proposal, 25.01.2012, SEC 2012(72), p 103.

(112)  This reflects as well the current situation with respect to the ePD and the DPD where the WP29 already carries out its tasks with regard to matters covered by the ePD, namely the protection of fundamental rights and freedoms in the electronic communications sector.

(113)  Castro, D. and Mcquinn, A. (2014), The Economic Costs of the European Union’s Cookie Notification Policy, ITIF, p. 5.

(114) Given that the estimated average lifetime of a website is of 3 years, the study supporting the impact assessment has assumed a financial cost of 300 per year. See SMART 2016/0080, cited above.

(115) SMART 2016/0080, cited above.

(116)

Article 29 Working Party, Opinion 04/2012 on Cookie Consent Exemption, WP 194.

(117) For the assessment of opportunity costs, see SMART 2016/0080, cited above.

(118) http://gs.statcounter.com/ Data for geographic Europe only, based on visitors of a sample of 3 million websites globally accessible on

(119) See Annex 10 and SMART 2016/0080.

(120) It was estimated that currently 3,000 data breach notifications take place in the EU for the telecoms sector every year, calculated on the basis of 319 data protection breaches reported to the UK DPA in 2008/2009 and extrapolated for the EU28. The average cost for businesses for dealing with these notifications was assumed to be 400 Euro. Commission Staff Working Paper on Impact Assessment on the General Data Protection Regulation proposal, 25.01.2012, SEC 2012(72), Annex 9 and p. 101.

(121) The web site may decide to set tracking as a condition for accessing the content. In case users wish to access the content in the "tracking" website they would receive a request to authorise the tracking for that specific website (or for all the web sites that are related to a third party tracking) and then would have to decide whether to accept or refuse.

(122) SMART 2016/0080, cited above.

(123)  SMART 2016/079, cited above.

(124) Working Party 29, cited above, p. 17

(125) See e.g., Working Party 29, Opinion on the ePD review, cited above, p. 5, EDPS, cited above, p. 8, EDRI, cited above; DLA Piper, cited above, p. 39.

(126)  Ibidem.

(127) See Working Party 29, Opinion on the ePD review, cited above, p. 20, EDPS, cited above, p. 20.

(128) SMART 2016/0080, cited above.

(129) SMART 2016/0080, cited above.

(130) DLA Piper, cite above; DIGITALEUROPE, cited above.

(131) Cited above.

(132) Question 6 of the Public Consultation.

(133) Question 6 of the Public Consultation.

(134) http://www.gsma.com/newsroom/press-release/empowering-trust-innovation-repealing-e-privacy-directive/ http://www.cerre.eu/sites/cerre/files/160125_CERRE_Privacy_Final.pdf DLA Piper, cited above and Joint Industry Statement signed by 12 associations representing telecom and tech businesses; . See also CERRE, Consumer Privacy in Network Industries, , p. 15.

(135)  SMART 2016-0080, cited above.

(136)  We take into account here essentially compliance costs, as costs stemming from administrative burden are much less significant overall according to the study.

(137) Id.

(138) Article 3(e) of the RED.

(139)  SMART 2016-0080, cited above.

(140) The web site may decide to set tracking as a condition for accessing the content. In case users wish to access the content in the "tracking" website they would receive a request to authorise the tracking for that specific website (or for all the web sites that are related to a third party tracking) and then would have to decide whether to accept or refuse.

EUROPEAN COMMISSION

Brussels, 10.1.2017

SWD(2017) 3 final

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT

Accompanying the document

Proposal for REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)

{COM(2017) 10 final}
{SWD(2017) 4 final}
{SWD(2017) 5 final}
{SWD(2017) 6 final}

Annex 1: Procedural information    2

Annex 2: REFIT evaluation of the E-Privacy Directive executive summary…….......…..6

Annex 3: Stakeholder consultation………………………………………………………..9

Annex 4: Legal and socio-economic context………………………………………….…17

Annex 5: Basics of the online advertising market (technical and economic)……………32

Annex 6: DRAFT DG-JRC Contribution to the revision of the ePrivacy Directive…….34

Annex 7: Who is affected by the initiative and how……………………………………..94

Annex 8: Draft Economic Analysis Report by Deloitte (smart 2016/0080)………...…107

Annex 9: Coverage of OTTs within the scope of national implementing legislation…..135

Annex 10: Opt-in and opt-out regimes per Member State…………………………...…137

Annex 11: Table of competent authorities………………………………………...……139

Annex 12: Mapping of the policy options……………………………………...……….142

Annex 13: Detailed comparison of policy options……………………………………...152

Annex 14: Glossary……………………………………………………….…………….156

1.1. Identification

This Staff Working Document was prepared by Directorate H "Digital Society, Trust & Cybersecurity" of Directorate General "Communications Networks, Content and Technology". The RWP reference of the initiative "reform of the e-Privacy Directive" is 2016/CNECT/007.

This Staff Working Document is accompanied by the Fitness Check SWD for the current ePrivacy Directive, conducted in the context of the REFIT programme. The reference of the "REFIT evaluation of the E-Privacy Directive" is 2016/CNECT/013. The ePrivacy Directive is assessed not only in terms of achievement of the original goals, but also in view of potential simplification and reduction of the regulatory burden.

1.2. Organisation and timing

Several other services of the Commission with a policy interest in the review of the ePrivacy Directive (ePD) have been associated in the development of this analysis. The ePD Inter-Service Steering Group ("ISSG") met for the first time on the 24 February.

A second ePD Inter-Service Steering Group meeting took place on, 26 July 2016.

A third ePD Inter-Service Steering Group took place on and 26 August 2016.

A fourth and final meeting took place on 12 December 2016.

In the ISSG, chaired by SG, DG CONNECT, was flanked by DG CNECT, DG COMP, DG JUST, DG GROW, DG ECFIN, DG FISMA, DG TAXUD, DG TRADE, DG RTD, DG JRC, DG EMPL, DG EAC, DG HOME, DG ENV, DG REGIO, DG HOME, DG ENER, DG MOVE, EUROSTAT, EPSC, together with the Legal Service.

DG CONNECT also benefited from the support received by the JRC Cyber & Digital Citizens' Security Unit for the assessment of technical aspects relating to online tracking and security and ENISA on the assessment of the ePD provisions relating to security and privacy of terminal equipment.

1.3. Consultation of the Regulatory Scrutiny Board

The Impact Assessment Report was examined by the Regulatory Scrutiny Board on 28 September 2016. The Board gave a positive opinion on the understanding that the report shall be adjusted in order to integrate the Board's recommendations with respect to the following key aspects:

1.4. Evidence used

(1)The contributions to the ePD review public consultation, a summary of which is attached in Annex 2 to this report.

(2)A Eurostat community survey on ICT usage by households and individuals of December 2015, (specific questions on citizens' level of awareness of cookie tracking) 1 ;

(3)A Eurobarometer on e-Privacy (Flash Eurobarometer 443) was conducted on 7th and 8th of July throughout the 28 Member States over the phone with in total 26,526 respondents which specifically enquired about citizens' views on online privacy and the relevance of existing provisions of and possible changes to the ePrivacy Directive.

(4)Ad hoc consultations of (and discussions with) relevant EU expert groups: BEREC 2 , ENISA 3 , the Article 29 Working Party 4 , the European Data Protection Supervisor, the REFIT stakeholder platform, Europol 5 , COCOM and the CPC Network between January and July 6 .

(5)Targeted consultations with EU expert groups which led to the following contributions:

I.Article 29 Working Party Opinion 7

II.EDPS 8

III.BEREC 9

IV.ENISA 10

V.JRC 11  

VI.CPC network 12  

(6)Two workshops and two roundtables organised by the Commission: one workshop was open to all stakeholders (12 April 2016) and one was limited to the national competent authorities (19 April 2016). The roundtables were chaired by Commissioner Oettinger; included stakeholders representing different interests.

(7)Ad hoc meetings with representatives of the affected industry, public authorities and civil society organisations as well as written input received from these stakeholders.

(8)Evidence gathered through COCOM: Already as of September 2014, the Commission sent a questionnaire through the Communications Committee (COCOM), which gathers the representatives of authorities responsible for electronic communication, requesting Member States to detail how they have implemented Article 4.2 of the ePrivacy Directive. More generally speaking, regular discussions took place with the COCOM committee on the implementation of the ePD in the context of COCOM meetings. 13  

(9)Literature review of relevant reports. This includes among others Opinions of Article 29 Working Party, Opinions of BEREC, Opinions of the Berlin Group on Telecommunications, Opinions of the EDPS 14 as well as reports and studies from the industry 15 , many sent in the context of the public consultation.

(10)Desk research and literature review done in-house by DG CONNECT;

(11)External expertise collected in three studies:

- Study "ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation" (SMART 2013/0071 16 ). The study examined whether the ePrivacy Directive has achieved its intended effects and puts forward recommendations for future revision and also assesses how the ePrivacy Directive and the proposed Data Protection Regulation (GDPR) will operate together.

- Study "Evaluation and review of Directive 2002/58 on privacy and the electronic communication sector" (SMART 2016/0080 under Framework Contract SMART 2013/0065 Lot 2). The study supports the Commission in gathering the evidence base needed to evaluate the ePrivacy Directive (and covering the provisions not evaluated in the first study). It also assists the Commission in assessing the various policy options, notably from an economic perspective. The final report of the study will be published in the fourth quarter of 2016.

- Study on "future trends and business models in communications services and their regulatory impact" (SMART 2013/0019). The Study assesses future trends and business models in the communications services markets, with particular focus on the relationship between electronic communication services providers and the so-called over-the-top providers.

executive summary

The ePrivacy Directive (2002/58/EC) sets forth rules guaranteeing the protection of privacy in the electronic communications sector. It aims to ensure that the protection of confidentiality of communications, in line with the fundamental right to the respect of private and family life enshrined in Article 7 of the EU Charter of Fundamental Rights, is guaranteed.

The ePrivacy Directive requires providers of electronic communications services such as internet Access and fixed and mobile telephony to:

(1)take appropriate measures safeguarding the security of electronic communications services (specific objective);

(2)ensure confidentiality of communications and related traffic data in public networks (specific objective).

The Directive also provides protection for users and subscribers 17 of electronic communications services against unsolicited communications.

In 2015 the Commission considered it necessary to assess whether the rules of the ePrivacy Directive have achieved their main objectives, namely ensuring an adequate protection of privacy and confidentiality of communications in the EU, and whether these rules are still fit for purpose in the regulatory and technological context. The Regulatory Fitness and Performance (REFIT 18 ) evaluation assessed the Directive against a number of indicators pursuant to the Better Regulation guidelines, namely: effectiveness, efficiency, relevance, coherence and EU added-value. The Commission also sought scope for simplification of the rules, whenever appropriate, without undermining the objectives of the ePrivacy Directive.

The evaluation covers the whole EU and the period from 2009 to 2016. The assessment is based on evidence gathered by a public consultation, a Eurobarometer, structured dialogues, external studies, monitoring reports, policy documents of the Commission and other relevant literature. Robust economic data to support the assessment have been difficult to find. Statistics and other quantitative data on the compliance costs stemming from the ePrivacy Directive either do not exist, or are not disclosed by the entities subject to the obligations. To corroborate the findings of the evaluation, the evaluation process has therefore built on the sources mentioned before.

Findings

The provisions of the Directive remain fully relevant to meet the objectives of ensuring privacy and confidentiality of communications but some of its rules are no longer fit for purpose in light of technological and market developments and changes in the legal framework. This is the case for the rules on security and notification of personal data breaches which are entirely mirrored in the General Data Protection Regulation adopted in April 2016, making them redundant. As regards confidentiality of communications, the rules have achieved their objectives vis-à-vis providers of electronic communication services, but have failed to ensure an adequate protection of citizens when they use 'Over-the-Top services' (e.g. voice over IP or instant messaging), given that the Directive does not apply to such services. This regulatory asymmetry has placed electronic communication service providers at a competitive disadvantage vis-à-vis these new players and led to varying degrees of protection according to the means of communications used.

Overall, the Directive appears to have provided an appropriate framework for protecting privacy and confidentiality of communications in the EU; but a series of issues were encountered with respect to its effectiveness.

The practical application and enforcement of the principles (e.g. confidentiality of communications and of terminal equipment) set forth in the Directive has proven to be challenging in a number of ways. A majority of Member States have established multiple authorities competent for the ePrivacy Directive, sometimes with overlapping competences, thereby creating confusion as to which body is responsible for enforcement. The evaluation also found that the application of the consent rules on the confidentiality of terminal equipment 19 , often referred to as the "cookie rule" and aimed at empowering individuals, has not been fully effective. Citizens are presented with requests to accept tracking cookies without understanding their meaning because of complex language and in some cases, are even exposed to cookies being set without their consent. Furthermore, the consent rule has been assessed as being over-inclusive, as it also applies to non-privacy intrusive practices such as first party analytic cookies, and under-inclusive, as it does not clearly cover some tracking techniques (e.g. device fingerprinting) which may not entail access/storage in the device. In the context of unsolicited commercial communications the sheer number of complaints from citizens indicates that the rules may not deliver its intended goals.

As regards the efficiency, it is necessary to acknowledge the difficulty to obtain reliable and representative quantitative data. The majority of stakeholders consulted were not able to estimate relevant figures for the provisions of the Directive such as for example the costs related to the requirement to set up security measures and the requirement to place cookie banners (to collect consent). According to the supporting study to this REFIT, it appears that the compliance costs would be around EUR 658 per business 20 .

The evaluation found no evidence of major inconsistencies between the Directive and the other relevant EU piece of legislation with which it interacts. However, a series of redundancies have been identified in particular with the General Data Protection Regulation (e.g. the security rule). Finally, the evaluation concludes that the ePrivacy has EU added-value as it imposes harmonised provisions on confidentiality of communications and traffic data which, in the light of an increasingly transnational electronic communications market, are becoming ever more important.

Lastly, based on the fact that the quantitative evidence remain scarce, the evaluation also shows that an effective system for monitoring the application of the Directive is currently lacking and should be put in place in the future.

3.1. Stakeholder strategy

In order to ensure that the general public interest of the Union - as opposed to special interests of a narrow range of stakeholder groups - is well reflected in the review of the ePrivacy Directive, the Commission developed a stakeholder strategy with the view to ensure the widest possible consultation.

The aim of the stakeholder consultation was (i) to deliver a high quality and credible evaluation of the ePD by allowing interested parties to provide feedback and (ii) to invite stakeholders to contribute with suggestions for possible policy options to revise the directive. This also ensures transparency and accountability in the Commission's work.

The stakeholder consultation process took place through two main activities. On the one hand, we ran an online public consultation (Section 3.2) and on the other hand, we organized targeted consultations with key EU expert groups, workshops and informal meetings (see Section 3.3). In addition, we ran a Eurobarometer survey in order to receive citizens views (see Section 3.4).

In view of the wide variety of sources and stakeholders consulted and the relatively high degree of responses and input received from all stakeholders' group, the stakeholders views hereby discussed are considered as representative.

3.2. Results of the Public consultation

The public consultation on the review of the ePrivacy Directive took place between 12 April 2016 and 5 July 2016. The consultation aimed to gather input for the REFIT evaluation of the Directive and to seek views on the possible changes to the ePD.

The consultation gathered a total of 421 replies, 162 contributions from citizens, 33 from civil society and consumer organisations; 186 from industry and 40 from public bodies, including competent authorities to enforce the ePD.

The key findings of the public consultation as to the way forward are the following:

Are special privacy rules for the electronic communications sector still necessary?

83% of the responding citizens and civil society believe that there is a clear added value in having special rules for the electronic communications sector to ensure the confidentiality of electronic communications, which is a basic element underpinning trust in technological developments and the digital society and economy.73% believe this is the case also for traffic and location data. They also support the need for special rules on billing, calling and connected line identification, automatic call forwarding and directories, but these areas seem to be less essential to them than the other areas mentioned. Industry responses were much more sceptical on the need for special rules; 31% see a need for rules on confidentiality and 26% see a need for rules on traffic data. Almost all public authorities responding to the consultation see the need for special rules in all of the areas listed.

Should a new instrument cover new communication services (instant messaging, VoIP)?

76% of citizens and civil society believe that the scope of the rules should be broadened to cover the so-called over-the-top service providers (OTT) when they offer communications services such as VoIP or instant messaging. 43% of respondents from industry also believe that the rules should be extended, 42% of the industry are against extension, while 5% do not have an opinion. 93% of public authorities believe that some or all of the provisions should be broadened to cover over-the-top players.

Is there a need to allocate enforcement to one single authority? Which one?

Close to 70% of the combined total responses from industry, citizens and civil society say that one single national authority should be entrusted to enforce the rules, while half of the public bodies who responded to the consultation are not convinced that this is needed. For respondents who consider that one single authority should enforce ePrivacy rules, a majority, across all categories, find that the national data protection authority is the best suited authority.

How to deal with tracking cookies?

77% of citizens and civil society and 70% of public authorities believe that information service providers should not have the right to prevent access to their services if users refuse the storing of identifiers, such as tracking cookies, in their terminal equipment. Three quarters of industry on the other hand disagree with this statement.

Opt-in or opt-out for direct marketing calls?

All groups of respondents agree that Member States should not retain the possibility to choose between a prior consent (opt-in) and a right to object (opt-out) regime for direct marketing calls to citizens. The stakeholder groups are however split on which regime should apply: close to 90% of citizens, civil society and public authorities favour an opt-in regime whereas 73% of industry favour an opt-out regime.

2.3 Ad hoc consultations of EU expert groups and workshops

In parallel to the public consultation, the European Commission conducted ad hoc consultations of the following EU expert groups in the course of the summer 2016. It also organised a series of workshops to receive additional inputs from stakeholders.

3.3.1. REFIT platform groups

On 29 June 2016, the REFIT platform groups advising the European Commission adopted 2 opinions on the review of the ePrivacy Directive: one from the REFIT stakeholder group and one from the REFIT governance group.

a) – REFIT stakeholder group

The opinion, which was led by the Danish Business Forum (DBF), overall recommended that the rule should be amended in a manner which will both decrease industry costs of implementation and raise awareness of privacy among users. The Commission, Member States and Data Protection Authorities should ensure that the future instrument is aligned and consistent with the GDPR, in terms of approach and of choice of legal instrument.

The Commission and Member States should seek greater harmonisation in the implementation and enforcement of the rules, including the provisions related to cookies and the enforcement mechanisms, while promoting the use of European standards. The rules related to cookies and tracking technologies, as well as the rules on unsolicited communications, should be reviewed to ensure that they are future proof. Reforming the legislation should not open any back doors for tracking users and any exceptions to the consent rule should only affect cookies which do not create any privacy risks.

b) – REFIT governance group

The opinion of the REFIT governance group, which was led by Spain, drew a special attention to the so called "cookie" provision. It stressed the importance of assessing whether that rule has achieved its specific objective of raising citizens' awareness, in the light of the costs incurred by businesses. In this respect, the group underlined the importance of taking into account the feedback gathered throughout the consultation exercise. The opinion recommends that the Commission amend Article 5.3 when putting forward a legislative proposal; while other institutions are invited to speed-up the legislative process on this file and competent authorities to share best practices on enforcement.

3.3.2. Article 29 Working Party

The Article 29 Working Party was expressly consulted by the Commission. The latter adopted an opinion on the evaluation and review of the ePrivacy Directive (2002/58/EC) 21 . The key findings of this opinion are the following:

It supports maintaining specific rules on confidentiality of communications;

It clarifies that the GDPR will not apply "in cases where the ePrivacy Directive contains specific obligations with the same objective";

The new ePrivacy instrument should at least maintain and reinforce its current principles, to guarantee the confidentiality of electronic communications;

The scope of the rules on geolocation and traffic data should be extended to all parties;

The new instrument must seek to protect the confidentiality of functionally equivalent electronic communication services (such as, for example, WhatsApp, Google, GMail, Skype and Facebook Messenger);

The broad scope of the consent requirement under Article 5(3) should be clarified while there is a need to create more specific exceptions to allow for the processing of data that causes little or no impact on the privacy of users;

It acknowledges the high intrusiveness of tracking over time of traffic and location data and call on a uniformed regime suggesting the merger of the current Articles 6 and 9 and the introduction of more exceptions to the consent rule;

When consent is the applicable legal basis, users must be provided with truly easy (user friendly) means to provide and revoke consent.

3.3.3. European Data Protection Supervisor

The views of the EDPS were expressly requested by the European Commission.

In his opinion on the review, the EDPS expresses similar views than those of the Article 29 Working Party, of which he is a member. In particular, the EDPS also endorses the need to keep specific rules to ensure confidentiality of communications at EU level that would complement the GDPR. In this respect, he made the following recommendations:

The scope of new ePrivacy rules needs to be broad enough to cover all forms of electronic communications irrespective of network (public or private 22 ) or communication services used;

Individuals must be afforded the same level of protection for all types of communications regardless of the technology used (e.g. telephone, Voice over IP, services, mobile phone messaging app, Internet of Things);

No communications should be subject to unlawful tracking and monitoring without freely given consent, whether by cookies, device-fingerprinting, or other technological means. This means that the so called cookie rule should be revised to address any tracking techniques;

Users must also have user-friendly and effective mechanisms to give their consent. In this respect cookie walls (where users are forced to give their consent to access a webpage) should be prohibited;

In order to increase confidentiality and security of electronic communications, the consent requirement for traffic and location data must be strengthened and apply horizontally (i.e. to any processing of such data);

The new rules should complement, and where necessary, specify the protections available under the GDPR;

The rules should also maintain the existing, higher level of protection in those instances where the ePrivacy Directive offers more specific safeguards than in the GDPR. In this respect, the EDPS supports maintaining the rules on subscribers' directories and calling and connected line identification;

The rules protecting against unsolicited communications, such as advertising or promotional messages, should be updated, made technology neutral and strengthened by mandating the recipient's prior consent for all forms of unsolicited electronic communications.

3.3.4. CPC Network

The European Commission also specifically consulted the Consumer Protection Cooperation Network through a tailored questionnaire. The network was not in a position to provide a coordinated reply and invited its members to reply individually.

Replies were received from consumer authorities from Spain, Romania, Norway, and Denmark. The key points of their replies are summarised below:

All respondents considered that the ePD only partially achieved its objectives;

As to which provision in particular is problematic, several authorities refer to Article 13. Some considered that the high number of complaints received on unsolicited calls show the need to review. Others emphasised some flaws of the rules, such as difficulties to apply the rules to new technological development such as social media; difficulties to prove unsubscribing to a mailing list and difficulties for companies to understand the rules;

One authority considered that Article 5.3 failed to achieve its objectives in the light of diverging interpretation and enforcement;

Overall the respondents agreed that the wide diversity of competent authorities has created difficulties that have led to diverging interpretation and/or fragmented enforcement. One authority specifically referred to the uncertainty that this created among competent authorities as to which authority should act. Another considered that this may cause a concurrent action of authorities leading to increased cost of enforcement;

A majority of respondents agreed that a regulation would be the better suited instrument to achieve the objectives of the current ePD;

They all agreed that the rule on unsolicited communications should be reviewed and that the choice left to Member States between opt-in and opt-out is not coherent under Article 13.3 with the opt-in rule under Article 13.1. While a majority of them considered that opt-in should apply to all situations for unsolicited communications towards individuals; the position is not clearly defined for legal persons. A majority support the opt-in rule to apply to social media;

All respondents that expressed a view, considered that member states should not retain the possibility to choose between opt-in and opt-out for individuals (under Article 13.3), while 2 out of 3 considered that they should not retain this possibility for legal person as well 23 .

3.3.5. BEREC

BEREC, the EU body gathering NRAs (competent telecom authorities) was expressly consulted by the Commission and sent its views on the 31st of July.

Overall, BEREC considered that:

There is still a need to have data protection rules and privacy rules addressing the electronic communications sector;

The rule on confidentiality of communications should apply equally to ECS and new OTT players (so called OCS) while its wording should be adapted to technological changes;

There is a still a special interest to regulated traffic and location data over the GDPR given the sensitiveness of these data 24 ;

So called consumer provisions (on itemised bill, calling & connected line identification etc.) should be maintained and extended to new OTT players;

The security rule including notification requirement should be maintained and aligned with the ones of the GDPR;

Regarding the question of extending the protection of the rules to semi-private network (e.g. airport, cafes etc.), the authority underlined the need to ensure that the rules should be adjusted so that they do not act as a detriment to the further development of non-commercial Wi-Fi-access;

Regarding Article 5.3 the authority underlines that the current system does not allow a meaningful consent and that the rules need to be revised and focus more on the purpose of tracking rather than on the access and storing of information.

3.3.6. Workshops and meetings with stakeholders

The European Commission organised two workshops in April 2016 to collect further views of stakeholders, using participatory techniques.

The first workshop was open to all stakeholders and took place on 12 April. There were around 120 participants, representing industry, competent authorities and civil society. The main views that were expressed are summarised below:

Representatives of the telecom industry argued for the need to push for the economic growth, emphasising job opportunities and innovation by removing specific provisions of the ePD, such as those on traffic and location data;

Representatives from the OTT industry underlined the difficulties for these companies operating across border to comply with different national rules on access to communications by law enforcement authorities;

Representatives from consumer organizations argued for keeping the requirement for user consent on tracking, location and traffic data while promoting privacy by design/default;

Representatives from competent authorities underlined the benefit of supporting user friendly measures such as Do-Not-Track (DNT) to protect privacy and called for fully harmonising privacy rules in a regulation;

Academics supported an extension of the ePrivacy rules to OTT services, while stressing the interdependence of privacy with other fundamental rights like the freedom of expression or right to private property.

The second workshop gathered the national competent authorities in order to receive their specific inputs to the review. The discussions focused on Article 5.3, the rules on traffic and location data, the need of a security provision and the provisions on subscribers directories and unsolicited communications. At the meeting with the competent authorities of 19th April no specific policy options were presented by the Commission, but it enabled national competent authorities (DPAs, NRAs or other) to give their views on the review and to highlight the problems they encounter. The meeting allowed them to give input at an early stage. On top of the stakeholder meeting, the Commission consulted the Article 29 Working Party, which encompasses all DPAs, and BEREC, which encompasses all NRAs – the authorities of the stakeholders meeting of 19th April. Both bodies gave an extensive contribution in which they presented their views on the review. A summary of these contributions, representing broadly the views of Member States, is provided above.

3.4. The Eurobarometer on e-Privacy

Between the 7th and 8th July 2016, around 27,000 citizens from different social and demographic groups were interviewed throughout the EU via telephone (mobile and fixed line) on questions related to the protection of their privacy. Below is a summary of the results of this Eurobarometer survey 25 .

Citizens' use of tools to protect their privacy online:

A 60% of the respondents acknowledge that they have changed their privacy settings of their internet browser for instance to delete browsing history or delete cookies;

41% of respondents avoid certain websites because they are worried their online activities would be monitored while roughly a third of the respondents acknowledge using software that protects them from seeing online adverts and/or being monitored online.

Citizens' assessment of importance of measures protecting their privacy online and confidentiality of their communication

More than nine in ten respondents throughout the EU consider the following as important:

Personal information (e.g. photos, calendar, contacts) on their computer, smartphone or tablet can only be accessed with their permission 26 ;

The confidentiality of their emails and online instant messaging is guaranteed 27 ;

Tools for monitoring their activities online (such as cookies) can only be used with their permission 28 .

Almost nine in ten respondents (89%) agree with the proposal that the default settings of their browser should stop their information from being shared.

Nine in ten agree they should be able to encrypt their messages and calls, so they are only read by the recipient (90%), with 65% saying they totally agree with this.

Citizens' views on the acceptability of business models around access to information:

A strong majority of respondents do consider it not really acceptable or not acceptable at all to:

Have their online activities monitored (for example what they read, the websites they visit) in exchange for unrestricted access to a certain website (i.e. 67%);

Have companies sharing information about them without their permission (even) if this helps these companies to provide them with new services they may like (i.e. 71%).

76% of respondents do not want to pay as an alternative not to be monitored when being on a website.

Citizens' views on unsolicited communications

61% of respondents agree they receive too many unsolicited calls offering them goods or services;

Respondents in the UK (78%), Italy (76%) and France (74%) are the most likely to agree they receive too many unsolicited calls offering them goods or services, where the regime of these calls is under opt-out;

Respondents who use a landline or mobile phone were asked their preferred approach for people telephoning them to sell goods or services 29 . The majority of respondents think commercial calls should always display a special prefix (59%), while just over one in five (22%) think these calls should be allowed as long as they display their phone number.

4.1. Legal context

4.1.1. Historical background

The ePrivacy Directive lays down a framework governing the protection of privacy and personal data in the electronic communications sector in the EU. It complements and particularises the Data Protection Directive 95/46/EC ("DPD") 30 , which is the central legislative instrument in the protection of personal data in Europe 31 . The General Data Protection Regulation ("GDPR") will replace the DPD in 2018 with new modernised rules fit for the digital age.

Following the adoption of the DPD in 1995, more detailed rules were considered necessary for the protection of privacy and data protection in the electronic communications sector, which led in 1997 to the adoption of the first incarnation of the ePD. 32

The EU legislator considered that the new technologies in public telecommunications networks gave rise to specific requirements concerning the protection of personal data and privacy of the user, which in turn required specific protection of the fundamental right of confidentiality of communications 33 .

With the same objectives in mind, in 2002 the EU legislator adopted a new ePD, considering that the old ePD had to be adapted to developments in markets and technologies in order to provide an equal level of protection of users, regardless of the technology used, broadening its application from traditional voice telephony to include data transmission and use of the Internet. In 2009, the ePD was amended by Directive 2009/136/EC 34 .

4.1.2. Objectives, scope and main content

The ePD sets forth rules concerning the protection of privacy in the electronic communications sector. One of the main elements of the ePD is to ensure protection of confidentiality of communications, in line with the fundamental right to the respect of private and family life (including communications) enshrined in Article 7 of the EU Charter of Fundamental Rights (hereinafter the "Charter").

Objectives

According to its Article 1, the ePD provides for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data and the electronic communications sector and to ensure the free movement of such data and of electronic communications equipment and services in the EU. Moreover, it provides for protection of the legitimate interests of subscribers who are legal persons.

The ePD serves therefore three main objectives. First, it seeks to ensure respect of fundamental rights set out in Articles 7 on the respect for private life and communications 35 and 8 of the Charter on the protection of personal data 36 . In particular, one of its main objectives is the protection of the right to privacy and confidentiality with respect to the electronic communications sector, as guaranteed under Article 7 of the Charter, Article 8 of the European Convention on Human Rights as well as under other international instruments relating to human rights.

Next to the fundamental rights aim, the ePD pursues also important internal market objectives. The second objective of the ePD is to ensure free movement of data processed in the electronic communications sector. Just as Directive 95/46/EC, the ePD aims to harmonise legal, regulatory and technical provisions adopted by the Member States ("MS") concerning the protection of personal data, privacy and legitimate interests of legal persons, in order to avoid obstacles to the internal market for electronic communications.

The third main objective of the ePD, which is also connected with the EU internal market, is ensuring the free movement of electronic communication terminal equipment and services in the EU. The ePD pursues this objective by harmonising the rules on privacy and confidentiality in the electronic communication sector in the EU, but also by providing specific rules on technical features and standardisation. For example, Article 14 of the ePD provides that in implementing the provisions of the ePD, MS may not impose mandatory requirements for specific technical features on terminal or other electronic communication equipment which could hinder the free circulation of such equipment in the EU.

Scope

The ePrivacy Directive applies to “the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the Community” 37 . In particular, its provisions apply to providers of “electronic communications networks and services” 38 .

To be covered by the Directive:

(1)the service should be an electronic communications service,

(2)the service should be offered in an electronic communications network,

(3)the aforementioned service and network should be public(ly available), and

(4)the network or service should be provided in the Community.

Therefore, the Directive applies to electronic communication services such as voice telephony, access to the Internet, etc., provided by ECS providers, i.e., traditional telecommunication operators. On the basis of the above definition, information society services providing communication services over the Internet are not subject to the ePD, as the latter have no control and responsibility of the conveyance of signals over the networks (a function which is performed by ECS).

Furthermore, as the ePD only applies to publicly available electronic communications networks, this means that closed (private) user groups and corporate networks are in principle excluded from the scope of the ePD. In this context, there is a lack of clarity as to which services qualify as a publicly available electronic communications services in public communications networks. Indeed, MS have diverging views on whether Wi-Fi Internet access offered at airports, in internet cafes or shopping malls qualifies as publicly available electronic communications services in public communications networks 39 .

Finally, it remains unclear to which extent the electronic communications of the Internet of Things 40 ("IoT") are covered by the ePD as its Article 3 expressly refers to "public communication networks supporting identification devices" 41 . According to the European Data Protection Supervisor ("EDPS"), this seeks to clarify that the protection of communications privacy is not dependent on whether humans speak or listen, type or read the content of a communication, but that they may rely on the increasingly smart features of their terminal devices to communicate content on their behalf, enjoying the expected level of protection 42 . Moreover, Recital 56 of Directive 2009/136/EC provides that the provisions of the ePD, in particular those on security, traffic and location data and on confidentiality of communications apply to RFID. 

Main content

The main content of the ePD can be summarised as follows:

1.It requires Member States to ensure confidentiality of communications in public communication networks and extends this principle to users' terminal equipment by requiring prior informed consent to store or access information in the users' terminal equipment (phones, tablets, etc.). This applies, for example, to the storage of cookies 43 .

2.It requires that traffic 44 and location data be erased or made anonymous when they are no longer required for the conveyance of a communication or for billing, except if the subscriber has given their consent for another use and to the extent that processing of these data is necessary for providing a value-added service.

3.It requires mandatory opt-in rules for unsolicited marketing by means of automated calling machines, telefaxes, and e-mails, including SMS messages. This means that commercial communications can only be sent if the recipient has taken an affirmative action indicating his consent to receiving marketing emails  (for example, by clicking an unclicked box on a web form).

4.1.3. Relationship with other existing legal instruments

Data protection legislation

The Data Protection Directive 95/46/EC (hereinafter "Data Protection Directive" or "Directive 95/46/EC") 45 is the central legislative instrument in the protection of personal data in Europe.

Directive 95/46/EC is the legislative basis for two long-standing aims of European integration: the Internal Market (in this case the free movement of personal data) and the protection of fundamental rights and freedoms of individuals. In the Directive, both objectives are equally important. The General Data Protection Regulation ("GDPR") will replace Directive 95/46/EC in 2018 with new modernised rules fit for the digital age. 46

Directive 95/46 protects the rights and freedoms of persons with respect to the processing of personal data by laying down the key criteria for making processing lawful and the principles of data quality. It sets out specific rights of data subjects, including the right to be informed of the processing and the right to access their personal data, and obligations of data controllers.

The ePD particularises and complements Directive 95/46/EC by, among others, setting up specific rules concerning the processing of personal data in the electronic communication sector. It does so, for example, by requiring users’ consent before their phone numbers can be listed in a public directory.

The relationship between Directive 95/46 and the ePD is that existing between a lex generalis (Directive 95/46) and a lex specialis (the ePD). All matters concerning the protection of personal data in the electronic communications sector which are not specifically addressed by the provisions of the ePD are covered by Directive 95/46 (and in the future by the GDPR). For example, this covers the rights of individuals such as the right to obtain access to their personal data.

Telecom Regulatory Framework

The ePD is part of the Telecom Framework, which comprises a Framework Directive 2002/21/EC ("FD") and four specific directives. The Telecom Framework was last amended in 2009 47 and it is currently under revision. The ePD borrows from the telecom framework a number of crucial elements, including the definition of its main scope and some important definitions. The scope of the ePD and the FD coincides in that they both apply to the ECS providers, as defined above. Moreover, the FD provides the definition for some very important terms which are used in the ePD, such as "electronic communication service", "electronic communication network", "user" and "subscriber".

It can be argued that the ePD has somewhat a dual nature, given its close links on the one hand with the data protection legislation and, on the other hand, with the telecom regulatory framework. While from a functional perspective, the ePD can be considered to be closer to the data protection legislation, in that his main objective is to protect fundamental rights, from a technical/sectorial perspective it can be considered closer to the Telecom Framework, as it regulates a specific economic sector/activity.

In 2015, the Commission initiated a review of the Telecom Framework which led in September 2016 to the adoption of a Commission's legislative a proposal for a Directive establishing the European Electronic Communications Code. 48 In this context, and in view of the close links of this instrument with the data protection legislation, it was decided that the ePrivacy Directive would have been subject to a separate review, following the final approval of the GDPR. The rationale of having a separate initiative for the ePrivacy review reflects, in particular, the dual nature of the ePrivacy rules and the need to ensure full consistency with the GDPR.

Radio Equipment Directive

The RED ensures a single market for radio equipment by setting out essential requirements for safety and health, electromagnetic compatibility and the efficient use of the radio spectrum. This applies to all products using the radio frequency spectrum and thus includes mobile electronic communication terminal equipment, such as smartphones, tablets, Wi-Fi devices etc. There are strong synergies between the ePD and the RED.

Several aspects of the RED are relevant in relation to the ePD and the objective of protecting privacy and confidentiality of electronic communications. In particular, the RED establishes that, before being put into the market, radio equipment must comply with certain essential requirements. One of these requirements is that radio equipment incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected. The Commission may adopt delegated acts specifying the categories or classes of radio equipment subject to the above requirement.

Compliance with the above requirement is presumed for radio equipment which is in conformity with harmonised standards the references of which have been published in the Official Journal of the European Union. Moreover, in accordance with Regulation (EU) No 1025/2012 on European standardisation ("Regulation 1025/2012"), the Commission may request European standardisation bodies to issue a standard for the purpose of ensuring conformity with the above essential requirement.

The above delegated acts and technical standards are particularly relevant for the ensuring the effective implementation of the ePD provisions. The interaction between the two instruments is explicitly reflected in Article 14(3) of the ePD, which empowers the Commission to adopt measures under the RED and Regulation 1025/2012 to ensure that terminal equipment is constructed in a way that is compatible with the right of users to protect their personal data. No such measure has been adopted so far by the Commission.

The former Data Retention Directive

The former Data Retention Directive 2006/24/EC harmonised national laws concerning the obligations of the providers of publicly available electronic communications services or of public communications networks with respect to the retention of certain data which are generated or processed by them, in order to ensure that the data are available for the purpose of the investigation, detection and prosecution of serious crime, as defined by each MS in its national law.

The Data Retention Directive was annulled by the Court of Justice of the European Union in its judgment of 8 April 2014 in the Digital Rights Ireland case. The Court found, in particular, that the Directive did not comply with Articles 7 and 8 of the Charter on privacy and data protection. The Directive was not considered by the Court as a proportionate interference with the above fundamental rights because it did not specify in sufficient detail the limits and the conditions of the interference and did not provide for adequate safeguards against abuse.

In the current absence of EU legislation in the field of data retention, MS may still establish or maintain national data retention legislation, based on Article 15(1) of the ePD so far as they comply with the general principles of Union law. Article 15 of the ePD allows MS to derogate to some ePrivacy rules 49  (e.g. the confidentiality of electronic communications) for the purposes of "safeguard(ing) national security, defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorized use of the electronic communication system". It also provides that these measures must constitute a necessary, appropriate and proportionate measure within a democratic society, in accordance with the jurisprudence of the Court of Justice of the EU and the European Court of Human Rights ("ECtHR").

In line with the European Agenda on Security 50 , the Commission does not envisage coming forward with any new initiative on data retention for the time being. Instead, the Commission will continue monitoring legislative developments at national level.

4.2 Market context

4.2.1. Main socio-economic drivers

The past 5-10 years have been characterised by a series of very significant and correlated developments in the field of privacy and electronic communications. The main developments are summarised below:

The rise of new business models, the so called over-the-top service providers (OTTs) providing communication functions free of charge essentially through an Internet software platform. As outlined above, these providers do not convey the signals over the network and are therefore normally considered outside the scope of the Telecom Framework and the ePD.

The exponential growth of the information processed globally, estimated to be in the region of 1.2 zettabytes, or 1,200,000,000,000,000,000 bytes) and growing by 60% every year. 51 A big contribution to this big data is made by online services that track users' online communications in order to build detailed commercial data-banks, which can be used for online behavioural advertising, marketing campaign or other purposes.

The rise of free online services has enticed a shift in citizens' attitude to share information related to their surfing behaviour. While citizens generally value privacy and confidentiality very much, they are prepared to give up part of their privacy for convenience and performance 52 .

Information asymmetry in the online sphere. Users are very often not aware of what is done with the information about their surfing behaviour and related profiles 53 . Cookie policies are normally complex, long and unclear. Citizens have grown increasingly irritated by the continuous requests for consent online and most likely click them away to get rid of them. Internet has become so widespread that users are virtually obliged to use certain online services, even if they do not want to be tracked. Nevertheless, they overwhelmingly want to be asked for their permission before their personal information is accessed from their smart devices or before being monitored online 54 .

Lack of technical knowledge to control tracking and protect the content of one’s equipment. While surveys of consumers' attitudes consistently show that individuals value their privacy and consider that monitoring their online activities should only occur with their permission, many do not seem to be able to set up the appropriate tools to protect themselves against tracking and to protect the content of their equipment 55 .

The increasing social and economic importance of online communications. Citizens are increasingly dependent on these services. Communicating online, sharing pictures, videos, links or other information has become a primary social need. Having a phone number, an Internet connection and an email address is an indispensable requirement for working and communicating with others. Certain schools require their students to have a social account.

The prevalence of the "free-of-charge" model. The largest majority of online services are offered to consumers free of charge, but data about consumer surfing behaviour and preferences are collected in order to monetise this information in the online advertising market. Over time, people have got used to accessing these services for free, i.e. without paying any monetary fees, thinking almost that having free access would be a natural right 56 .

The changing notion of privacy in an evolving digital environment. While citizens are generally concerned about their privacy, they are not prepared to reconsider or limit their online behaviour or to pay a fee for accessing online services 57 . Recent statistics say that especially young people have a different perception of privacy and share information about themselves voluntarily much more than the rest of the age range 58 .

These contextual factors are crucial for the understanding of the complexity of the problem and for the assessment of the policy options. In particular, they show that the protection of privacy of online communications is a complex, multifactorial zero sum game where every gain from a market participant is normally balanced by losses of other participants.

4.2.2 The market covered by the ePD (source: Deloitte 59 )

Within the European Union, the telecommunication sector 60 is one of the crucial industries for the completion of the Digital Single Market. The table below provides an overview of the:

Number of enterprises (2014);

Number of persons employed (2014); and

Annual turnover in 2014 of the EU telecommunications sector. 61

The statistics provided in the table serve as a first high-level entrance point for the further analysis of the market covered by the ePD.

Source: Eurostat.

According to Eurostat, around 44.7 thousand enterprises are active in this market, accounting for a share of 0.2% of all businesses active in the EU. Around 90% of these enterprises are micro-enterprises, 99% are SMEs. Around 52% of all EU telecommunication enterprises were established in the United Kingdom, Poland, the Netherlands, Germany and France in 2014.

Overall, approx. one million citizens are employed in the telecommunications sector of which roughly 20% are active in SMEs. 64 In total, 56% of all employees in the EU telecommunications sector worked for enterprises in United Kingdom, France, Germany, Poland, and the Netherlands in 2014. When putting the number of persons employed in the telecommunications sector in relation to the overall number of citizens per Member State, it can be seen that Luxembourg, Cyprus, Denmark, Estonia, and the United Kingdom have comparatively high shares of citizens working in the telecommunications sector. None of these Member States, however, exceeds a share of 0.9%. 65

The sector generates an annual turnover of 385 EURb. The United Kingdom, France, Germany, Poland, and the Netherlands accounted for 59% of the entire EU28 turnover in the telecommunications sector in 2012 (overall roughly 227 EURb). In terms of contribution of the telecommunication sector to the annual GDP pf each Member State, Eurostat data shows that the sector is largest in Luxembourg (9.5% of overall annual GDP in 2012), Estonia (4.5%), Bulgaria (4.3%), Croatia (4.1%), and the United Kingdom (3.8%). 66

A 2016 global forecast of the market for Over The Top (OTT) providers 67 shows that market is estimated to grow from USD 28.04 Billion in 2015 to USD 62.03 Billion by 2020 with a CAGR of 17.2%. 68 The report argues that market is in the growing stage in Europe and therefore OTT platforms in these regions have immense scope for enhancement. Overall, the North American region is expected to contribute the maximum market share to the overall OTT market. 69 As can be seen below, around 40% of primaries in the OTT market are expected to be established in North America by 2020 while 25% are expected to be European.

Figure 1 – Expected breakdown of profiles of primaries (in 2020)

Source: MarketsandMarkets

The report also acknowledges that diversified government regulations and policies present across domestic and international borders are restraining the growth of the OTT market.

According to the report, the European market is expected to grow at a similar pace (i.e. with a similar CAGR) as the North American market – albeit with a smaller overall market size. The Asian-Pacific, Middle East and African, and Latin American markets are smaller the the European and North American markets in terms of absolute size but are expected to grow faster than these two until 2020. This is depicted in the following figure.

Figure 2 – OTT market size and growth by region (in 2020)

Source: MarketsandMarkets

Most provisions of the ePD do not apply to online communication services. This includes communication services that are not covered by the definition of electronic communication services employed by the ePD. Examples include Skype or WhatsApp.

Recent Eurobarometer data shows that mobile phones to make calls or send text messages are used by 74% of consumers every day while more traditional fixed phone line services are used by 38% each day. However, a large part of consumers also uses services every day that are not covered by the ePD: E-mail is used by 46% of consumers every day, OTTs for the purpose of instant messaging (e.g. WhatsApp) are used by 41% every day 70 , and online social networks are used by 38% every day. 71

The results of the public consultation on the evaluation and review of the regulatory framework for electronic communications demonstrate that consumers increasingly recognise a functional equivalence between traditional SMS/MMS services and OTT services like WhatsApp or traditional voice calls and OTT Voice-over-IP (VoIP) services like Skype and a potential for their substitution. 72  

The majority of popular OTT social network services was launched around 2010, notable exceptions being Skype (2003) and LinkedIn (2003), Facebook (2004) or Twitter (2006). Among these OTT services, there seems to be no imperative that older services necessarily have larger user bases than more recent market entrants: A recent survey from 2015 reports the most popular OTT call and messaging services among respondents from EU MS to be Skype (49%), Facebook Messenger (49%), WhatsApp (48%) and Twitter (23%). 73

From a macro perspective, the number of OTT subscribers has grown in two waves since 2000. First on desktop devices from 2000 to 2010, and again with the increasing adoption of smartphones after 2009/2010. 74 Regarding adoption patterns from a micro perspective, OTT messaging and voice call services often experience growth in form of an s-shaped curve: After up to two years needed to gain a critical mass of users, the service frequently experiences exponential growth rates until the market is saturated. 75 Nevertheless, adoption and usage patterns may vary significantly in cross-country comparison for individual apps. In addition, there seem to be country-specific preferences for certain OTT messaging and VoIP services and the number of parallel services used (depending on the MS, more than one third to half of respondents use multiple OTT social networks).

Considering actual traffic volumes, the use of OTT services has increased considerably: The OTT’s share of overall messaging traffic has already increased from 8.31% (2010) to 66.96% (2013) and is projected to rise to 90% until 2020. 76

Conversely, the use of SMS continues to decrease in almost all EU MS since 2010, albeit at a different pace: In Finland and Germany, SMS volumes have dropped to levels of 2006, while the decline has been slower in countries like Spain and France. Few countries observed stagnant volumes (Poland) or even a growth from previously low levels (Estonia). 77

On the individual level, the average WhatsApp user is reported to send approximately 40 (while receiving around 80) messages per day as opposed to an estimated number of 4.5 SMS. This ratio of approximately 1:10 for daily SMS versus OTTs messages is likely to be much higher in practice, due to the reported parallel use of multiple messaging apps.  78

Turning from messaging to voice call services, the developments appear to be similar but less pronounced in their magnitude. In general, European Electronic Communications Services (ECS) providers have been observing a steady decline in fixed line calls and steady increase of mobile calls (that have overtaken fixed line traffic shares ever since 2010). Despite this general trend, considerable variance across EU MS remains concerning the popularity or volume of fixed line phone calls. 79 The relationship of ECS and OTT providers offering voice calls is hard to ascertain. With regard to international calls, ETNO reports a rapidly growing popularity of VoIP services – despite still lagging behind traditional voice calls and their advantage of any-to-any connectivity with other providers, higher end-to-end quality and more reliable emergency services. The traffic volume of Skype increased by 36% in 2013, while traditional voice calls grew by 7%. During that same period, Skype calls amounted to a total of 214 billion minutes whereas traditional voice calls reached a total of 547 billion minutes. 80

Based on these numbers, ETNO conclude that the OTT market presence and substitution of traditional telecommunication services can no longer be ignored. 81 While, this is certainly true, it is still questionable as to whether the presence for OTT service providers offering alternative services is the only cause for EU users changing their communication means as per figures above.

A recent study on behalf of the EC examines not only the rise of OTT services but also possible effects of changes in technology, the regulatory environment and economic growth. 82 Using the development of WhatsApp messages as an indicator, the rise of OTT displays no significant effect on the development of revenue, costs and profits for fixed line calls (rather changes in technology and regulation seem to have fostered competition and driven down prices).

In the mobile communications market, on the other hand, the rise of OTTs seems to have had a significant influence in reducing revenues and profits of ECS. Thus, while it is tempting to conclude that decreasing revenues and profits from mobile calls and SMSs are solely driven by the rise of OTTs, some of the developments had already been foreshadowed by increases in competition through the rise of broadband internet and smartphones, triggering changes in consumer behaviour and ensuing updates in business models (e.g. flat rate pricing). 83  

Yet ECS so far compete in one ecosystem that is owned and operated by a large number of providers bound by standards of interoperability, serving an interconnected subgroup of end-users (i.e. services based on the E.164 numbering plan). OTT providers, on the other hand, compete between ecosystems and for subscribers using multiple similar services of competitors and without the need to follow standards of interoperability. 84

In this section, we present some information on the EU and US advertising markets. The two markets differ with regard to the presence of regulation: In the U.S. case, there are no strict laws explicitly aimed at Online Behavioural Advertisement (OBA) and transparency towards users. In the European Union, several laws and regulations apply to the OBA industry. The ePD has an indirect link to both markets through its provisions concerning the tracking of consumers and their online behaviour by means of cookies on websites (e.g. for the purpose of targeted online advertising), as well as – subsequently – sending consumers commercial communications containing marketing material. The purpose of the section is to give the reader a high-level overview of the relevance of online tracking and targeted advertisement for the sector and the size of both markets. Article 5(3) of the ePD affects the advertisement market via its rules on cookies.

5.1. Snapshot of behavioural advertising practices with an impact on individual’s privacy 85

What is behavioural advertisement? A number of technologies and techniques exist to observe the website browsing behaviour of individuals over time (e.g., the pages that they have visited or searched). From this observation, a profile is made of each user (e.g. male v female, age, interests, likes and dislikes, wealth), which is used to show him/her advertisement that match this profile. This type of advertisement is often called ‘behavioural advertisement’ or targeted advertisement.

To be able to build profiles and send targeted advertisement, it is necessary to identify individuals when they move from a website to another. There are a number of technologies and techniques available. The use of cookies is the most widespread. A cookie is a small file sent from a website and stored in the users’ web browser while he or she is browsing the Internet. However, other techniques are increasingly being used, such as for example, browser fingerprinting.

Companies and players involved. Many companies/players are involved in delivering behavioural advertising, including: (a) Publishers: are the website owners looking for revenues by selling space to display ads on their website (e.g. an online newspaper); (b) Advertisers who want to promote a product or service to a specific audience (company X producer of shoes) and (c) Advertising networks providers (also referred to as "ad network providers" and “ad exchanges”), they are technology companies which connect publishers with advertisers. They place advertisements in publishers websites (they decide that a given add will be shown in a given website). Ad networks are becoming ad exchangers and increasingly act as real time marketplaces for the purchase and the sale of advertising space. In addition, companies that conduct market analysis of users’ data are also active in this space.

How does it work? The following is based on the use of cookies as tracking technology. A publisher reserves space on its website to display an ad. The ad network provider places a tracking cookie on the data subject's' browser, when he/she first accesses a website serving an ad of its network. The cookie will enable the ad network provider to recognise a former visitor who returns to that website or visits any other website that is a partner of the advertising network. Such repeated visits will enable the ad network provider to build a profile of the visitor which will be used to deliver personalised advertising. Because these tracking cookies are placed by a third party that is distinct from the web server that displays the main content of the webpage (i.e. the publisher) they are often referred to as "third party cookies”.

The larger the advertising network, the more resources it has to monitor users and "track" their behaviour.

What are the economic implications? Online advertising in general and more specifically behavioural advertising is a driver of the digital economy that promotes business and economic growth. The most important players are Google (DoubleClick) and Facebook. According to newspapers report, in the second quarter of 2016 the two companies together made $13.1 billion profits 86 . However, many more companies are active in the ad ecosystem. For example, according to HIS/ IAB Europe report, publishers active in Europe generated revenues of €30.7 billion from online advertising (this is not exclusively behavioural advertisement as it may include other contextual advertisement), this represents 30.4% of all advertising revenue. The same report estimates that 0.9 million European jobs (or 0.4% of the EU-28 total) are directly supported by online advertising.

Table of contents

Abstract    

1    Introduction    

2    Setting the Scene    

3    User Applications    9

3.1    Malicious Applications    9

3.1.1    Android (Google)    9

3.1.2    iOS (Apple)    9

3.1.3    Mobile Apps (General)    10

3.1.4    Desktop Operating Systems    11

3.1.4.1    Windows    12

3.1.4.2    Linux\Unix    12

4    Mobile App Ecosystem (a detailed look)    13

4.1    Android    13

4.1.1    Operating System Structure    13

4.1.2    App Execution Environment    14

4.1.3    Permission Management    15

4.1.4    App Distribution and Code Protection    17

4.1.5    App Data Protection    17

4.2    iOS    18

4.2.1    Operating System Structure    18

4.2.2    App Execution Environment    19

4.2.3    Permission Management Model    19

4.2.4    App Distribution and Code Protection    20

4.2.5    App Data Protection    20

4.3    Threats to Users    21

4.3.1    Threats to Users' Privacy    22

4.3.2    Threats to the OS Update Model    23

4.4    Comparison of iOS and Android Security Features    23

4.5    General User Guidelines for Applications    25

4.6    Considerations on privacy vs mobile OS    26

5    Web Applications    29

5.1    Web Cookies and Trackers    29

5.2    Redirection to Unencrypted Content    36

5.3    Private Browsing Modes    36

5.4    Reputation and Certification of Websites    37

5.5    Tracking User Location using IP Addresses    37

5.6    Software/Browser Metadata Fingerprinting    38

5.7    Device Hardware Fingerprinting    39

5.8    Locally and Remotely Saved Web Browser User Data    40

5.9    Data Leaks due to breaches in server’s or client’s policy settings    40

5.10    Information Leakage to Third party components    41

5.11    Data Mining and Correlation    41

6    Conclusion    43

References     47

Appendix A. List of definitions    50

Appendix B. List of abbreviations    51

List of figures    52

List of tables    53

Abstract

Scope of this report is that of supporting DG-CNECT during the early stages of the ePrivacy revision with evidences and technological options for what concerns cyber-security and privacy of mobile and web services.

The report analyses the main privacy threats rising from the use of new communication services, mobile technologies and web-applications.

The major concern emerged in the study, when speaking of privacy of telecommunication/online services is related to the lack of end-users’ free will with regards to their sensitive information.

If we take as an example the cookies, we can undoubtedly claim that the previous implementation of the ePrivacy directive failed in promoting transparency and privacy awareness in digital services. Hence, the identification of a new, efficient, and effective way to give back the control of personal information to the end-user is needed, and the review of the ePrivacy directive is the best occasion to elaborate on this challenge.

The problem is in a way not trivial due to the fact that even if formally the concept of privacy has a clear definition, in practice, it is often in contraposition to the need of certain information to enable the delivery of a service.

The adoption of very prescriptive and stringent measures forbidding access to all possibly sensitive information of an individual has been proved to be a bad option, as modern datamining and inference techniques can easily be used to infer from explicit, completely depersonalized information, implicit sensitive information, circumventing in this way every type of legislative limitation.

If we look to the roadmap of the Digital Single Market, it is evident that the digital privacy will have to coexist with the more and more pressing need of opening up the free flow of data in the DSM, to boost innovation and new economic opportunities.

The key to allow the coexistence of these two needs (or principles) lays on the ability of the ePrivacy revision to ensure two key principles:

1)Trust in the services provided

2)Full knowledge about which data is shared with whom

Under this perspective the report presents several technical recommendations which could be taken into consideration to enable a more privacy friendly digital space.

1Introduction

In the past years, the Commission has started a major modernisation process of the data protection framework; as part of this reform, the Digital Single Market Strategy prescribes that the Commission should also review the rules on ePrivacy directive and deliver a legislation that is fit for the digital age.

The objectives of the review are:

1.Ensuring consistency between the ePrivacy rules and the new General Data Protection Regulation

2.Updating the scope of the ePrivacy Directive in light of the new market and technological reality

3.Enhancing security and confidentiality of communications

Scope of this report is that of supporting DG-CNECT during the early stages of the ePrivacy revision with evidences and technological options for what concerns objectives 2 and 3 in the area of mobile devices and web-applications.

The report analyses the main privacy threats rising from the use of new communication services, mobile technologies and web-applications.

In particular, after having set the scene for what concerns the technological elements involved in modern digital interactions, the report presents a description of the Mobile App ecosystem with a particular emphasis on Android and iOS systems (which together account for the majority of the Mobile Operating Systems market).

An analysis of the relevant threats to which the end-users are exposed in the mobile world is provided, together with a set of guidelines which should be streamlined in the mobile app life cycle to enhance the level of privacy and security of the digital ecosystem.

The report addresses also the “web-application” environment, with a strong emphasis on the so called cookies (one of the targets of the old ePrivacy directive) and tracking, analysing how they evolved in the last years, identifying some technical solutions today in place and putting in evidence how a new policy package would be needed to enforce the privacy of the end-user.

Finally, technological and policy options are proposed in the conclusions of this document.

2Setting the Scene

The scope of this section is that of “Setting the Scene” with regard to the possible source of “privacy” weaknesses for what concerns the ecosystem which should be taken into consideration in reviewing the ePrivacy directive (2002/58 amended with Directive 2009/136). The potential surface of analysis of the digital privacy domain is extremely wide, it is therefore important to set the boundaries which can be considered pertinent to the ePrivacy directive, to avoid dispersion of resources and efforts (for a definition of the terms used in this document, please refer to Appendix A).

Figure 3 depicts a reference architecture diagram to assist the definition of the boundaries of the ePrivacy Directive study. The lines represent interactions between components and the dashed lines indirect interactions, which may be carried out using a supporting networking mechanism (e.g., telecom network). This figure shows a scenario where a user accesses an application running in the end-user device, and an Internet of Things (IoT) device that monitors the user environment and exchanges data with and IoT hub located in the user vicinity. Both application and IoT hub communicate with backend services through a telecom network. Both end-user device and server may be implemented using a virtualization infrastructure.

Figure 3 – Abstract architecture diagram

In order to clarify the focus of the study a set of blue ellipses numbered from 1 to 8 representing security and privacy mechanisms are depicted in Figure 3 , with the following meaning:

1)User-centric: user-centric security and privacy mechanisms accessible through their devices that inform users about their privacy settings including preferences (e.g., cookies) and information regarding the collected data about them by the different entities such as native apps, web browsers, and web applications. The study should detail the mechanisms considering the scope chosen, for example, if the focus is decided to be on Android apps then user-centric privacy mechanisms should be included.

2)Application Runtime Environment: mechanisms provided by the operating system to control rights and obligations of native applications, for example, which resources can be accessed and how the stored application data is managed.

3)IoT communication with Cloud: mechanisms to enable control over the flow of information between IoT hub devices and server-side components that may retrieve/store IoT device data, and maybe also include firmware updates.

4)Device Network Gateway: mechanisms available for users to evaluate their connection to the network, for example, to use restricted configurations for public/private access network hotspots (e.g., open WiFi networks).

5)Telecom Network User Access: mechanisms to prevent user tracking/traffic monitoring by telecom network providers (e.g., Tor). This should also include a security and privacy analysis of different protocols used, for example, for VoIP (Voice Over IP), instant messaging, etc.

6)Telecom Network Server Access: same as 5, but from a server-side infrastructure point of view, for example, cloud computing platform providers (e.g., Amazon cloud) could also monitor users.

7)User/server-side Virtualization: mechanisms implemented using virtualization that could offer an advantage from a security/privacy perspective, for example, client-side sandboxing of apps. From a server-side it is unclear if any virtualization approach could offer an advantage.

Figure 4 describes instead the different interactions between applications and services running respectively in the end-user device and server. More in details, we consider any type of applications that run directly under control of the respective operating system including those particular types of applications that use a runtime environment inside of a web browser, namely web apps (a.k.a. websites). Web browsers typically also support an extension mechanism based on add-ons or plugins that allow any 3rd party to extend their functionalities, for example, to allow visualization of particular types of content (e.g., Flash) or to include extended security management functionality (e.g., cookie management). In the server side we depict software distribution and management platforms to distributed applications including updates (e.g., Google Play for Android mobile devices) and the backend components of web apps. We distinguish between the end-user and server side components of web apps since they have different implications in the user privacy: the end-user side may include executable code to collect user information that is further communicated to the server side part for processing. Similarly to Figure 3 , the set of blue ellipses to Figure 4 represents security and privacy mechanisms with the following meaning (the list of examples in the yellow boxes is indicative and not exhaustive):

Figure 4 – User Applications and Server Services

8)Web Applications (end-user side): mechanisms provided by the web browser in order to protect users from data collection on the client side, for example, private browsing modes and cookie management. It also includes mechanisms to enable control of the resources and local cached data of web applications.

9)Mashups of Web Apps: mechanisms used to manage the flow of data between complex web apps that are in fact a composition of many apps. For example, some apps may embed social networking functionalities (Facebook/LinkedIn like buttons) in their pages, use external services (embedded Google Maps) that enable flow of sensitive user data, or even use a single-sign-on mechanism (Facebook/Google account) to access different web applications. The focus is on the analysis of permissions and security mechanisms that allow users to control their flow of data, as well as information about this flow for a scenario like the ones described above.

10)Web Browser Add-ons: mechanisms used by browsers to control the permissions of add-ons that can be installed by users in their web browsers. Add-ons are particularly dangerous since they may allow the installation of executable code that may indiscriminately have access to all user sessions and web app data.

11)Web Applications (server-side): mechanisms used to control flows and management of user data by the server-side part of web applications, including privacy preferences that regulate the access and future use of this information. Detailed user tracking data stored for advertisement and analytics purposes should also be covered.

12)Software Installation and Updates: represent mechanisms that support users in the installation or update of software including native apps, web browsers and their add-ons, operating system components, etc. A main point of interest is app markets currently deployed for different platforms, which may be able to track users since they are aware of the precise software stack configuration and can be used for device fingerprinting.

From this list of security and privacy mechanisms, points 1, 5, and 8 are already addressed in the current Directive, but the advent of new technologies requires revising them together with further investigation on all other points.

As claimed before, the surface composed by these elements is too wide and a prioritization is needed to allow an effective support to the ePrivacy revision process.

With reference to the previous domains, here below is a prioritization list of the areas addressed in this document:

1)Operating Systems

2)Privacy settings including preferences (e.g., cookies) of modern Internet services.

3)Web Applications (end-user side)

4)Web Applications (server-side)

5)Software Installation and Updates

In the following sections we develop these topics starting from the ground (operating systems).

3User Applications

User applications refer to applications that are installed on the users’ device. They provide all possible functionalities to the users, boosting their experience with their device and allowing them to personalize it in order to meet their demands. Applications are usually downloaded from the associated application market of the device but, especially on desktop computers, can also be downloaded freely from any source.

3.1Malicious Applications

The aim of malware found on applications is mainly to steal personal user information that could be later used on the advantage of the attacker. Such information can be for example, credit card numbers, user biographic information, user activities, etc. The most common way that malware reaches the users’ device is through an infected application. In the next sections we explain the appearance of malware in different platforms and the reasons for the diversity between different operating systems.

While analysing the privacy issues of malicious applications, it is in any case important, especially in the context of this document, to take into consideration that the same problems, are valid also for perfectly licit applications, which might fall somehow on the “malicious side” due to their invasiveness in term of privacy. What we mean with that is that privacy breaches are not the exclusive domain of software developed by hackers, but also of applications downloaded through licit channels which pay little attention to the privacy rights of the citizens and that gather more information than what they indeed need to operate, without asking the consent to end users.

3.1.1Android (Google)

The vast majority of the malware written for mobile devices is targeting Android, reaching 97% [1]. The main reason for this is the very big market share of Android (around 80% [2]), which makes it the preferable target, as well as the business model that Android uses. Android gives the users the possibility to download applications from any market, even if they do recommend using the official download channel of Google Play. Moreover, as Android is open source, it is used by many different manufacturers, each of which implements and maintains it in a different way. For example, if a security vulnerability is found and Google fixes it with a patch, a new update will have to be downloaded on the Android devices with the same OS version. This happens almost directly for the Google devices (i.e. all Nexus/Pixel devices) but for the rest, the manufacturer (e.g., Samsung, HTC, Motorola, etc.) will have to first receive the update, integrate it with their customized OS and then release it to the users. This procedure takes usually a lot of time, and sometimes does not happen at all, thus leaving users vulnerable to known threats. Moreover, the customized OS that each manufacturer provides, may be vulnerable to even more threats compared to the native Android OS as it has more services built on top of it (a detailed description of Android’s update model is given in 4.1.1).

3.1.2iOS (Apple)

iOS on the other hand is a closed environment and Apple is the only manufacturer. The procedure of “publishing” an application on the App store goes through an extended review which among others controls the application for malicious content. Even with these measures in place, there have been cases where malware applications have reached the App store [3].

Moreover, in contrast with Android, if a user wants to install an application from another market he/she will have to jailbreak his/her device. That means that he/she will voluntarily remove security measures from the device in order to give access to other markets. Of course by doing so, the risk of being infected with malware is highly increased. Apple is trying to prevent this from happening and after each release of iOS jailbreaking is becoming more and more difficult. Furthermore, users that jailbreak their device automatically void the phone guarantee and cannot download and install any OS updates.

3.1.3Mobile Apps (General)

In 2015, the Kaspersky Lab detected almost 3.000.000 malicious installation packages, 900.000 new malicious mobile applications, and 7000 mobile banking trojans. In general, there is an increase of malware compared to the last years [3].The most common malware categories are Trojans, Adware and PUA (Potentially Unwanted Applications) [1].

According to OWASP (Open Web Application Security Project), the top 10 Mobile Risks are the following [4]:

1)Weak Server Side Controls: Refers to vulnerabilities found on the backend of the application, e.g., backend API service, web server, etc. Even if this risk is not specific to mobile applications, it is also very relevant in a mobile environment.

2)Insecure Data Storage: Most of the applications that handle data input save data locally on the device. It is important to keep such data protected and prohibit access from unauthorized actors. This is even more important with sensitive data such as passwords, credit cards, etc.

3)Insufficient Transport Layer Protection: Many of the applications communicate with a service over the Internet. It is thus very important to control if the connection is properly encrypted, if the certificates used are valid and make sure that the connection is made towards the intended party.

4)Unintended Data Leakage: Unintended data leakage refers to data leaking due to vulnerabilities that are external to the application itself. For example, data that leak because of vulnerabilities of the underlying operating system, of the hardware, of frameworks that interact with the application, etc. In such cases, it is important that the developers of the application have sufficient documentation to all the services that interact with the application in order to limit such leakage.

5)Poor Authorization and Authentication: The applications that require authentication, should make sure that the authentication is equivalent to the one used when browsing from a computer. It is also important to avoid authenticating on the mobile device but instead perform authentication on the server side.

6)Broken Cryptography: This risk underlines the dangers of using cryptography in an insecure way. This may mean that either a process is using well-known cryptographic algorithms in an improper way that make them insecure or that the cryptographic algorithms are not secure themselves or are outdated.

7)Client Side Injection: Client side injection occurs when a source of the application’s input has been tampered with and is used to insert malicious code inside the application. Such inputs can be the data found on the local storage of the device, e.g., though a database or local files, user sessions on the browser, etc. All the inputs of a mobile application should be well known and protected accordingly.

8)Security Decisions Via Untrusted Inputs: An application exchanges data with many different actors through a process called Inter Process Communication (IPC). This risk concerns the implications of handling in an insecure way such communications. All input received should undergo validation and the use of IPC should be in general restricted to the only absolutely necessary cases.

9)Improper Session Handling: This risk refers to handling in an insecure way a session once a user has been authenticated. Several attacks can take place at a session level, and it is therefore important to take the appropriate precautions in order to avoid them.

10)Lack of Binary Protections: Binary executions refer to alterations of the original application after it has been released. These can happen at the mobile device, for example, if an attacker modifies on purpose a part of the app in order to misbehave for his/her own benefit. Secure coding techniques are the most common countermeasure for this threat.

As it can be concluded from the threats above, most of them (2, 3, 5, 6, 7, 8, 9, 10) can be dealt with during the development phase. Introducing security and privacy by design is a key factor in reducing such risks. In general it should be pointed out that software security is a system-wide issue that takes into account both security mechanisms and security design [5]. It is therefore important to remind developers of this, since security design is neglected (usually in the favour of functionality) as there is the belief that its lack can be later replaced by using security mechanisms.

Risks found on the backend and not on the user device (1, 4, 5, 9) should also be considered starting from the design phase of the application’s architecture. As these interactions occur outside the mobile device, they may often be neglected or left to be considered in a later stage. Dealing with them is sometimes not the application’s developer role, since third party services are mostly used for the backend. Nonetheless, the developers should adhere to the codes of practice for secure programming and minimize potentials risks by paying attention to common and well-known security issues. Finally, some of the threats (4, 10) cannot be completely controlled by the application. In such case developers should make sure that they have used all possible mitigations and security mechanisms on their side and should monitor the application dependencies for any new security updates and patches in order to ensure that any new threats will be dealt with immediately.

3.1.4Desktop Operating Systems

In principle, desktop operating systems traditionally designed to run on desktop machines and servers should not be taken into consideration in the context of the ePrivacy directive, which deals with telecommunication services and the security of terminal devices. However, two new elements recently emerged which might change this statement:

1)Operating system convergence: terminal devices are becoming more and more as powerful as desktops. Operating systems producers, in an attempt, on one side, to provide a homogeneous user experience, and on the other to optimize the resource investments, are pushing for a fast convergence in operating systems. The last version of Windows 10 running on Windows phones for example, is the same that today runs on every desktop, notebook in the market. The same is happening for the Linux world, where new raising distributions are able to work both on mobile phones and on desktops.

2)Telecommunication layer convergence: with the advent of VOIP, and the delivery of application layer communication services, the definition of “terminal device” most probably needs to be updated and expanded to the domain of portable devices and desktop.

New services providing similar functionalities available previously only by means of dedicated telecommunication services in portable devices and desktops are now available including:

Instant messaging services like Hangouts, WhatsApp, Facebook Messenger, and Skype.

Mashups of social networking and advertisement networks that are able to track fine-grain users’ activities and collect information about their preferences for marketing purposes. For example, some web pages and mobile apps introduce advertisement banners and embed their own code (e.g., Facebook like button or comment box) in all different locations in order to track users and provide personalized content/ads.

Video Broadcasting: service providers broadcasting video and collecting preferences, traffic, and location data of end users such as YouTube, Netflix, SkyGo. In these services users are also able to manage their own channels and provide their own customized content in partnership with advertisement services.

For these reasons we also include in the following sections some reflections on the security of desktop operating systems, without pretending to be exhaustive, but with the intention to remark the fact that the distinction between the desktop world and the mobile world is quickly fading and blurring.

3.1.4.1Windows

Windows is the most common target of malware in the domain of desktop operating systems. There are many different reasons for this.

First of all, and probably most importantly, Windows is by far the most used operating system. So, as a natural consequence, most of the malware are specifically targeted for Windows, reaching directly the vast majority of desktop users, trying to exploit known vulnerabilities of the different Windows versions.

Moreover, the first versions of Windows (i.e. 3x, 95, 98) did not distinguish between users. All users had the same privileges on the system, which actually meant that all users were administrators. As a result, a malicious application once executed could immediately gain permission to sensitive data and functions. Moreover, there was neither an antivirus nor a firewall installed by default. The majority of the Windows users had no interest or knowledge of the need of such applications and the OS was left without any protection. In general, Windows was initially developed without having security in mind and this affected largely its future versions.

With the latest versions of Windows the situation changed, as Microsoft introduced UAC (User Account Control), which prompted the user for permission when an application was requesting admin rights. Moreover, by default the users where not set directly with admin rights and they were asked every time an application requested admin access. Additionally, an antivirus program and a firewall came preinstalled with Windows.

Another important reason for Windows to be a common target of malware is the fact that there is no central store where users can download applications. The users can download an executable from any place on the internet and execute it on their computer. As a result, many websites contain malicious applications and trick users in downloading them. Another popular approach is to infect the operating system through a third application. For example, use a malicious PDF or MS Word document that will exploit a security vulnerability on Acrobat Reader or MS Office and then affect the operating system.

3.1.4.2Linux\Unix

Few malwares exist for Linux (Ubuntu, Debian, Fedora, Red Hat, CentOS, etc.) and Unix (OS X, BSD, Solaris, etc.) systems, compared to the quantity of malware for Windows. One of the main reasons for this is that unlike Windows, you download software from trusted software repositories (something similar to the App Store and Play Google for mobile devices). As a result, the software found in such repositories has been checked and can be trusted.

Moreover, users on Linux and Unix are given only the basic user rights. They perform most of their actions as normal users and only when a sensitive action that requires more rights is needed, they temporarily switch to becoming root.

Finally, Linux and Unix have a very limited share on the computer market and consequentially attract less attackers. Even more, most of the users of such operating systems are advanced users and are well familiar with the system they are using and with the consequences of their actions.

OS X, the operating system that Apple computers use, is a Unix distribution. It has the same and in some cases enhanced security features compared to other Unix OS. Moreover, like iOS, it has a dedicated App Store and mechanisms that control that the applications installed come from verified producers and do not include malware.

4Mobile App Ecosystem (a detailed look)

The key element for the security of any IT device is the operating system controlling the way in which hardware operate. In this section we review the Android and iOS mobile operating systems (the two dominating OS of the market). We discuss the operating system structure, the app execution environment, the permission management model, the app distribution and code protection approaches, the app data protection model, and threats for users of both operating systems.

In Android and iOS app permissions are requested when specific resources and information found at the operating system/device level are needed for the app to function. These requests are handled differently on each OS and it is the user that in the end decides whether to grant or reject the access. Permission management plays an extremely relevant role when speaking of privacy, since it is only because of the granted permissions that an application is allowed to gather a certain type and amount of information from a terminal device. Until the version 6.0 of Android, Android and iOS had a quite different approach for handling application permissions, but this situation has now changed as it will be discussed in the following subsections.

The final goal of this chapter is to have an overview of the structure and security mechanisms of the two most common mobile operating systems.

4.1Android

Android is the dominant operating system for mobile devices; it currently has the largest installed base mainly because it is supported by many different mobile phone manufacturers. Moreover, it supports a huge variety of different devices such as watches, tablets, TV sets, etc.

Due to its large adoption and everyday use to perform on-line tasks, malicious developers/hackers are increasingly targeting this operating system. Even if the Google Bouncer [6] security service scrutinizes applications before allowing them to be published in Google Play, there are evidences [7] showing that malicious software (malware) can be found among legitimate applications as well. In most cases, the main goal of these malware apps is to access sensitive phone resources e.g., personal data, the phone billing system, geo-location information, home banking info, etc.

4.1.1Operating System Structure

The security of the Android OS is mainly achieved by its subdivision into layers, which provide platform flexibility and separation of resources at the same time. This separation is reflected in the whole software implementation, shown in Figure 5 . Each level of the stack assumes that the level below is secured. In this section we focus on the security of apps, which run in the Dalvik Virtual Machine (DVM), and have their own security environment and dedicated file system (every mobile app runs into a completely separated virtual environment, emulating the underlying real hardware). The DVM has been completely replaced by the new Android Runtime (ART) from Android version 5.0 (Lollipop) on.

Figure 5 – Android software stack

One of the aspects which characterized the Android OS since its first deployment is the possibility given to Original Equipment Manufacturers (OEMs) to perform “heavy” customisations. This has an effect on the chain mechanism to deliver the security patches related to the operating system:

When a vulnerability is identified, Google releases a patch for the stock version of Android (i.e. the version released by Google without any type of skin, bloatware etc.) to the OEMs;

The OEMs, if needed, work on the patch to adapt it to their phones. Moreover, they release the new version to the telecommunication carriers for the cases where the update is performed through the carrier and not the OEM (i.e. SIM-locked devices, carrier specific devices, etc.);

The carriers, if needed, work on the patch to adapt it to their branded phones, and release it to the end-users.

This approach has two negative effects on the security of the OS:

1)The time between the moment in which the vulnerability/problem is discovered and the moment in which all the systems are patched can be considerably long;

2)The OEM can decide to stop the support to a given OS version at any time, making virtually impossible to those terminals mounting this OS version to get the update.

The second point is indeed extremely critical from a security point of view, since it leaves a huge portion of the active smartphones in the world un-protected against the last discovered threats.

4.1.2App Execution Environment

The security mechanism for app isolation, which is also in place for native code invoked by the apps 87 is called the Android Application Sandbox. This sandbox is set up in the kernel, thus propagating the isolation on all the layers above and on all kinds of applications. All apps running in the Android OS are assigned a low-privilege user ID, are only allowed access to their own files, cannot directly interact with each other, and have a limited access to the OS resources. The isolation is a protection against inter-process security flaws, meaning that a security problem in a given app will not interfere with the resources of other apps.

4.1.3Permission Management

In the Android Software Development Kit (SDK), the functionalities an application can use are categorized and grouped in APIs that give access to resources normally accessible only by the OS. For example, among the protected APIs there are functions for SMS and MMS management, access to location information, camera control, network access, etc. The access to the protected APIs is regulated by a permission mechanism, in which a specific permission should be granted to an app at installation time in order to allow access to a particular API. Unprotected APIs do not require any special permission to be executed by the app.

More specifically, permissions in the Android OS are grouped in four different levels considering the risk level introduced to the user: normal, dangerous, signature, and signature-or-system. Normal permissions are considered of low risk to other apps, the system, or the end-user [8]. Dangerous permissions have a high risk of negative consequences for the users' personal data and experience. Signature permissions are used to protect exported interfaces accessible only by apps signed with the same developer key. Signature-or-system permissions are used to protect core resources available only to trusted system apps signed with the firmware key. When installing an app users are notified only about the dangerous permissions required by an app; normal permissions are granted by default.

The mapping of permissions to methods in the Android APIs is one to many, a characteristic that contributes to make less clear/deterministic which kind of and the actual functionalities an app actually uses. All permissions required by an app are declared in the app Manifest file. Previous to Android version 6.0 (Marshmallow), when installing an app the user was notified about the permissions needed by the application itself and then he/she had to decide if the permissions should be granted or not. In case the user did not agree to grant one or more permissions, the app could not be installed. Instead, only if the user agreed on granting all the requested permissions the app could be installed, and as a consequence would be allowed to use of all the APIs and functionalities related to those permissions.

In the Android version 6.0 (Marshmallow) release runtime or time-of-use permissions were included as well [9], in addition to install-time permissions, which were already supported in the previous versions. Time-of-use permissions give users the possibility of denying a permission request at runtime, or permanently revoking an install-time permission already granted. This new privacy feature shows that the Android community recognizes the need for more advanced privacy and anonymity control for end-users.

Even though time-of-use permissions allow end-users to better control over the restricted resources, one drawback introduced is the additional overhead for end-users because they may be asked multiple times to decide about an app permission request during runtime. However, this usually occurs during the first time the app is executed, or if the user manually changes the permission from the device’s settings. If he/she does not want to be asked all the time, it is possible to select the option to never ask again about the same permission. Nevertheless, the lack of protection of many sensitive API functions, the possibility of manipulating apps' features and services, as well as the lack of a restrictive policy-based approach that allows end-users to automate decisions with respect to the protection of their data, privacy, and anonymity, indicate that complementary research work is needed in the Android platform.

In Android, upon selecting the application you wanted to download and install from Play Google, you were shown with a comprehensive list of all the permissions that the application requested. There was no choice to select some of them; you either had to accept them all or simply not install the application ( Figure 6 ). However, from version 6.0, after the installation you are prompted to grant access each time a special permission is required by the application ( Figure 7 ). Moreover, you can manually change all the applications’ permissions after installation from the App Permission settings ( Figure 8 ). A more detailed description of the permission model is given in 4.1.3.

Figure 7 – An app is asking for a permission to use the device’s location (Android 6.0)

Figure 8 – The user can manually change the permissions of all apps (Android 6.0)

4.1.4App Distribution and Code Protection

All Android apps should be signed by the developer using his/her private key. In their default configuration Android phones only allow the installation of apps from the Google Play, but this security setting can be changed in order to allow the installation of apps from any sources. Other sources of app distribution are e-mail or any arbitrary website, however, updates of apps that are not installed from the official app store are not automatically managed by the phone, so users need to update the apps manually.

4.1.5App Data Protection

Android apps have a default directory in the internal memory file system of the mobile device to store their data (i.e. any data that the application needs in order to operate, as well as user data relative the app that is created during the app use), identified by their package name under the folder “/data/data/<name>”. This folder contains all the app data including created databases, settings, libraries, cached data, etc. An alternative directory in external memory (e.g., SD card) is also available under the folder “/Android/data/<name>”, which can be used in case the app expects to store a relatively large amount of data that may not fit in the internal memory space. The external memory can in fact be used indiscriminately by all apps, and they are allowed to create their own folder structure. System or root apps are allowed to read and store data anywhere in the device’s internal memory as well, including access to the default directory of all installed apps. By default, the app data is stored in plain unencrypted format and is only protected by the OS standard file permissions.

Android supports also full disk encryption using the “dm-crypt” kernel feature that is available to all block devices including SD cards. If supported by the specific device the encryption key can be stored using a hardware Trusted Execution Environment (TEE).

4.2iOS

iOS is a mobile operating system developed by Apple to be run exclusively in hardware also developed by Apple including iPhone, iPod, and iPad devices. Since the hardware of the devices is designed in parallel to the software there is a high level of optimization and customization as no other hardware manufacturers need to be supported. In this regard, this section summarizes many low level details about the iOS design and implementation considering the integration between hardware and software, which in Android would be only possible by analysing hardware details of many manufacturers.

4.2.1Operating System Structure

Figure 9 depicts the iOS security architecture[10]. In the bottom of the picture the kernel, crypto engine, and boot ROM are part of the hardware and firmware parts providing secret and tamper proof storage of security keys, dedicated crypto engine, and kernel with secure enclaves and elements. The upper part shows the software deployment including the file system, the OS partition, and the user partition that contain the app sandboxes assigned to specific data protection classes. Both OS and file system partitions are also encrypted in the device flash memory.

Figure 9 – iOS Security Architecture

iOS devices implement a secure/trusted boot chain where only code signed by Apple is allowed to be loaded and executed. The secure boot starts with the boot ROM, which is the first executable immutable code written in the hardware during chip manufacturing and contains the Apple root CA public key. This codes verifies the Low-level Bootloader (LLB) is signed by Apple and only passes execution control to it in case the signature is verified. The LLB executes, performs the device initialization, and only passes control to the next-stage bootloader if the signature matches again. This chain of trusted starting by the boot ROM, acting as the hardware root of trust, guarantees that only signed code by Apple executes in the devices running iOS.

By default, iOS is a stripped down OS as it does not include many binaries found in standard unix distributions (e.g., /bin/sh shell), and other utilities such as ls, rm, ps, etc. Therefore, attackers cannot use these utilities to perform analysis of the running system and in case an exploit is found for code execution no shell code can be launched and there is a limited number of activities that can be run by an attacker.

In the same way as Android, iOS implements privilege separation and most processes run as a “mobile” user, for example, “MobileSafari”, etc. Access to many system resources requires superuser/root privileges, and in some cases even the superuser is not allowed to perform some tasks (for example to modify the OS executables without breaking the signature).

All iOS devices include a dedicated AES 256 crypto engine built into the Direct Memory Access (DMA) path between the flash storage and the main memory, allowing for highly efficient data encryption at runtime. The encryption keys are generated using a device unique ID and group ID created during manufacturing and are not visible to Apple or to any other system component. All data is therefore protected in memory using these tamper proof encryption keys. Files in the device’s flash storage are also protected using encryption by assigning each file a class, where the accessibility is determined by the unlocking of a particular data protection class by any given application.

Vulnerabilities have been found in iOS allowing users to overwrite the OS code allowing the execution of code not signed by Apple. These vulnerabilities allowed users to jailbreak their devices, usually in untethered or tethered mode. An untethered jailbreak allows permanent violation of the chain of trust, while a tethered jailbreak required the phone to be plugged to a computer and the exploit has to be re-applied every time the phone is restarted to keep the device jailbroken. iOS also enforces a system software authorization process preventing users from downgrading their iOS devices, after a newer or updated version is installed it is impossible to roll back to the older and possibly vulnerable version.

Jailbreaking an iOS device essentially breaks all the security architecture since it disables code signing requirements, disables many memory protection mechanisms, usually adds user shell and remote shell access (sshd server), and adds many other user utilities with the objective of increasing the system’s functionality and customization. On one hand users benefit significantly of jailbreaking their devices, however, on the other hand they also increase significantly the attack surface of their devices.

4.2.2App Execution Environment

All apps are signed and only signed code may be executed at runtime. This feature prevents the introduction of arbitrary code and any change to the executable, allowing only code that has been reviewed by Apple to run in the mobile device.

The runtime data areas of an iOS app (e.g., stack and heap) are marked non-executable and at runtime no writable memory area can become executable. This low-level protection scheme prevents attackers from writing executable code in the memory and exploiting vulnerabilities in order to make the processor execute this code.

When loading an app the iOS execution environment implements Address Space Layout Randomization (ASLR) for the app execution artefacts including binary, libraries, dynamic loader, heap, stack, etc. Furthermore, it also supports Position Independent Executable (PIE) code, meaning that the app execution artefacts can be randomly positioned in the memory in order to prevent certain attacks, for example, a buffer overflow that could allow an attacker to selectively redirect the program to specific instructions in memory since their memory location would always be the same.

All user-installed apps run in a sandbox with a limited set of permissions and restricted file system access. Apple-developed applications have a less restrictive sandbox since they are compiled in the kernel and can, for instance, open the SMS database but are not allowed to fork their process or send SMS messages.

4.2.3Permission Management Model

The list of permissions associated with an app are called “entitlements” in iOS. iOS apps may also set specific entitlements representing specific capabilities or security permissions. Entitlements may be set for iCloud data storage or push notifications to alert the user even when the app is not running. In iOS, when you download and install an application you are not shown a list of the permissions it requires. Instead, all applications by default are granted the basic permissions as defined by iOS. Later on, when the application is running and a special/sensitive permission is required by the app, the user is prompted in order to grant or deny the permission request (see Figure 10 ). Moreover, from the settings and the privacy tab the user can see a list of all the permissions, the applications that use them, and can change the desired settings directly from there by granting/denying the permission for each respective app (see Figure 11 ).

Figure 11 – Just as on Android 6.0, the user can manually change all permissions in iOS

4.2.4App Distribution and Code Protection

In iOS apps can only be downloaded and installed through the App Store, which acts as an anti-virus against malicious developers. Apple verifies the real-world identities of all developers that are allowed to publish apps in the App Store. All apps are reviewed by Apple before they are made available and only apps signed by Apple are allowed to be installed in iOS devices.

Apps can also be packaged and provisioned to be installed on specific devices without going through the App Store. In order to be installed these apps must include the list of all device IDs they will be provisioned to, which may be a solution for enterprise apps that should not go through the App Store.

4.2.5App Data Protection

For every new file created a data protection class is assigned to it by the respective app. If a file is not assigned a data protection class, it is still stored in encrypted form (as is all data on an iOS device). Each class has a different policy with respect to key generation and security, which is summarized in the following list:

Complete Protection: The encryption key for this class of data protection is derived from the user passcode and the device UID, and is removed from the memory when the device is locked so all data is inaccessible until the user unlocks the device by entering the passcode or using fingerprint authentication (Touch ID);

Protected Until First User Authentication (default): the same as Complete Protection, except that the decrypted class key is not removed from memory when the device is locked. The data is not accessible when the device boots before the user unlocks the device for the first time;

Protected Unless Open: Some files may need to be written while the device is locked. A good example of this is a mail attachment downloading in the background. This behaviour is achieved by using asymmetric elliptic curve cryptography (ECDH over Curve25519) that generates a per-file key wiped from memory when the file is closed. To open the file again, the shared secret is re-created using this same class;

No Protection: This class key is protected only with the device Unique ID (UID), and is kept in a short time volatile memory called Effaceable Storage. Since all the keys needed to decrypt files in this class are stored on the device, the encryption only affords the benefit of fast remote wipe.

The iOS SDK provides a full suite of APIs to support 3rd party apps in the implementation of data protection primitives for data encryption of files, configuration data, and databases. In case an app does not choose an encryption scheme, the “Protect Until First User Authentication” data protection class is chosen by default for all installed user apps.

4.3Threats to Users

The goal of the iOS and Android permission models is to protect system resources from indiscriminate and unauthorized use by apps. However, this model has some inherent problems that might affect end-users’ privacy and anonymity. The following paragraphs describe the types of threats we have identified targeting the permission model for both operating systems, i.e. threats related to: pre-installed apps, permission management, permission granularity, permission notification, unused permissions, and lack of security.

First of all, pre-installed or OEM apps in Android are automatically granted all required permissions and are considered trusted since they are part of the OS firmware. Therefore, users are not informed about the required permissions of these apps, since consent is normally granted by users for an app’s required permissions during the installation process. This means that end-users do not have any indication which resources are accessed by these apps, and are vulnerable to privacy invasive behaviour by them. In the case of Android 6.0 and iOS, however, the permissions are granted at runtime when the app is used for the first time and the user can check and change these permissions from the permission settings later on to revoke a specific permission.

The second important point is the way permissions are managed and granted during the app’s life-cycle. As described previously, if an end-user would like to successfully install and use an app, he/she is obliged to grant all the requested permissions. As a result, a common end-user behaviour while installing an app is just to accept all permission requests to reach the end of the installation process as soon as possible. This approach is not adopted in iOS and on Android from 6.0, where the user is prompted for special permissions during the use of the app. However, also in the latter case, a reluctant user will simply grant the permissions in order to proceed and use the app. Besides, most of the end-users do not have knowledge about possible risks the requested permissions introduce towards their personal data, while the information prompted during the installation process are not really informative about the real functionalities the app is going to access and with what frequency (e.g., fine grain location tracking, access to microphone when app is executing in background, etc.).

More knowledgeable end-users might try to evaluate the list of requested permissions, but even for experts it is often unclear how permissions are used. This is a consequence of the fact that permissions are not a one-to-one mapping scheme with the corresponding method calls to Android framework API that implements the actual functionality. Indeed, their granularity is quite coarse, and, considering the 197 permissions of Android version 4.2 associated to the 1310 methods, one permission is associated on average to 7 API methods. For instance, a mobile app granted the CAMERA permission is allowed to take pictures or to capture videos using the takePicture and MediaRecorder methods respectively. This means that an end-user after grating this permission is not aware of the precise action performed by the app at any specific time since it can give access to a wider group of more or less sensitive functionalities. In iOS this is also the case, since the number of permissions is much smaller, for example, in the privacy settings users can grant/deny 11 permission groups and also additional permissions to specific functionalities introduced by 3rd party apps (e.g., post in Facebook timeline). The main issue for iOS and Android is the lack of personalized control and customization from the user perspective since permissions can only be managed using a restricted set of options.

When revoking permissions to an app users have no guarantees that the application will function in a normal way. Some of these permissions may be crucial to the functionality of the application and disabling them may lead to malfunctioning or not being able to execute at all the application. Android developers until now were not concerned about permissions being denied since their assumption was always that all permissions needed were granted at install time, however, with the change in the permission management model from Android version 6.0 on, the recommendation now is for developers to account for the situation where not all permissions are granted in order to prevent their apps from malfunctioning or stop working in this case.

Another threat to users are the normal level permissions in Android or default entitlements in iOS, which are considered of lower risk and are automatically granted to apps without asking end-users explicitly for consent. Even if end-users have the possibility to review this automatic granting, this a priori categorization as low risk may not be perceived by all users in the same way. As a result, though the permission granting mechanism is in place, from the end-user perspective this approach may be wrongly understood as if the apps are not accessing sensitive resources at all. For example, in iOS all apps are granted access to the network by default and there is no mechanism for users to revoke the access after the app is installed.

Some apps may also request permissions that are not used in the app implementation, and that are not actually needed for accomplishing their task (unused permissions). These apps are usually labelled as over-privileged, and could lead to privilege escalation problems in terms of sensitive resources they can access after an update. Privilege escalation may also lead to confused deputy attacks, when an app that has been granted a specific permission is exploited by other apps that do not have this permission in order to perform sensitive tasks. A classic example is an app that is allowed to send SMS messages and allows other apps to use its interfaces to send SMS messages as well. Previous studies of JRC [11] [12] [13] demonstrated that the majority of the existing mobile applications can be considered today over-privileged. The reason is in general not linked to malicious purposes, but rather due to bad software development habits: the design of mobile apps with the largest set of permission is indeed a way to ensure the largest space of options when developing future software updates. Unfortunately, this behaviour even if licit, exposes the end-user to several risks. In iOS unused permissions are not an issue since permissions are only granted the first time the app tries to use it.

Finally, some methods in the Android API are still not protected by specific permissions and introduce a lack of security with respect to the sensitive resources they may allow access to. For instance, an app might use the exec(String prog) method to execute the process prog passed as parameter. This means any app could silently execute unprotected system commands in order to read system information from the proc filesystem, retrieve the list of installed and running apps, read the SD card contents, etc.

4.3.1Threats to Users' Privacy

Threats to users' privacy may be posed not only by malware apps but also by legitimate apps. Many legitimate apps are characterized by a certain degree of privacy invasiveness, which is related to the permissions they request and to which use they make out of the protected methods. In this direction, TaintDroid for Android as well as other papers in the literature demonstrate the type of end-users' personal data manipulation performed by mobile apps.

Examples of privacy-invasive behaviour apps are, for instance, games that request access to unique identifiers or user location that are not needed by the app to function. Ultimately, it is up to each mobile device’s user to judge if an app’s behaviour is privacy-invasive according to his/her personal perceptions. In this direction, the Android OS and iOS provides security services that verify apps distributed in the respective app stores before installation, and in Android also to periodically scan the OS for harmful apps.

Unfortunately, these services themselves are also privacy-invasive because, according to the Android documentation, the device “may send information to Google identifying the app, including log information, URLs related to the app, device ID, your OS version, and IP address” 88 . Therefore, the user-desired functionality is bound to a privacy-invasive behaviour, and users have no choice when using these services to control or restrict the personal data shared with Google. Furthermore, Google, in the Android developers documentation 89 , suggests as apps distribution options alternative to the Google Play Store, e-mail and websites, thus exposing packages to the risk of malicious code injection. As a consequence, the existing features aimed at protecting end-users from privacy-invasive applications is quite limited. On the other hand, in iOS all apps must be distributed through the certified Apple app store and only jailbroken devices can install apps from other sources.