52002SC0124

COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT pursuant to the second subparagraph of Article 251 (2) of the EC Treaty concerning the common position of the Council on the adoption of a Directive of the European Parliament and of the Council on processing of personal data and the protection of privacy in the electronic communications sector

2000/0189 (COD)

COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT pursuant to the second subparagraph of Article 251 (2) of the EC Treaty concerning the common position of the Council on the adoption of a Directive of the European Parliament and of the Council on processing of personal data and the protection of privacy in the electronic communications sector

1. Background

On 12 July 2000 the Commission submitted a proposal for a Directive of the European Parliament and the Council on processing of personal data and the protection of privacy in the electronic communications sector COM(2000) 385 final - C5-0439/2000 - 2000/0189(COD) for adoption by the co-decision procedure laid down in Article 251 of the Treaty establishing the European Community [1].

[1] OJ C 365 E, 19.12.2000, p. 223.

The Economic and Social Committee delivered its opinion on 24 January 2001 [2].

[2] OJ C 123, 25.4.2001, p. 53.

On 13 November 2001, the European Parliament adopted a legislative resolution including a series of amendments at its first reading (A5-0374/2001).

The Council reached political agreement on a common position at the Telecommunications Council meeting of 6 December 2001. The Council, in accordance with Article 251 of the EC Treaty, adopted its common position on this proposal for a Directive on 28 January 2002 [3].

[3] Not yet published

This Communication sets out the Commission's opinion on the common position of the Council, pursuant to the second subparagraph of Article 251(2) of the EC Treaty.

2. Aim of the Commission Proposal

The proposed Directive is part of a package of five Directives and one Decision intended to reform the existing regulatory framework for electronic communications services and networks in the Community. One of the aims of this overall reform is to create rules which are technology neutral. The legal framework must try to ensure that services are regulated in an equivalent manner, irrespective of the technological means by which they are delivered.

This also implies that consumers and users should get the same level of protection regardless of the technology used by particular service. Maintaining a high level of data protection and privacy for citizens is one of the declared aims of the current review.

The proposed Directive is intended to replace Directive 97/66/EC concerning the processing of personal data and the protection of privacy in the telecommunications sector, which was adopted by the European Parliament and the Council on 15 December 1997. It will adapt and update the existing provisions to new and foreseeable developments in electronic communications services and technologies.

3. Commentary on the Common position of the Council as compared with the opinion of the European parliament

3.1. Summary of the position of the Commission

The Commission welcomes the fact that the Council in its common position has taken over the majority of EP amendments in their entirety or in a modified form. The resulting text is balanced and solid, takes very well account of the EP opinion and can be fully supported by the Commission.

3.2. Modifications introduced by the Common Position of the Council as compared to the opinion of the European Parliament in 1st reading

3.2.1 Recitals

Recital 11 [ex - recital 10] - (national measures limiting rights ad obligations)

The Commission supports the addition of a reference to the European Convention on Human Rights as proposed in EP amendment 4 and included in the common position. It also clarifies that any national measures limiting rights and obligations as set out in the Directive, must be necessary in a democratic society and proportional to their intended purpose.

The EP had also proposed a statement that under the European Convention on Human Rights (ECHR) and pursuant to rulings issued by the ECHR Court, any form of wide-scale general or exploratory electronic surveillance is prohibited. The Council has not accepted this. Arguably, an interpretation of ECHR case law would be misplaced in the context of this Directive nor would the suggested statement do justice to the full set of criteria which the Court has consistently applied. The Commission can therefore accept the drafting as proposed in the common position.

New Recitals 2, 13-18, 22, 23, 26-28, 31, 32 and 39, additions to recitals 20 and 33

Numerous new recitals have been added, most of them following amendments by the European Parliament, to clarify meaning and scope of the various definitions and terms used in the directive, to provide examples to facilitate their application and to explain the background of the legal provisions. The Commission considers these recitals as an important improvement of its original proposal :

* EP amendment 1 introduced a new recital, including a reference to the Nice charter on Fundamental Rights. The Council has included this useful clarification of the context of the Directive in recital 2 with some minor drafting changes.

* Recital 13 clarifies that pre-paid cards must also be regarded as contract in the terms of the Directive.

* Recital 14 provides some examples of types of data that are covered by the definition of location data for clarification.

* Recital 15 explains that in electronic communications networks today, the distinction between the content of a communication and traffic data related to that communication is no longer as clear as it used to be for traditional voice telephony networks. This is important to note in view of the implementation of the Directive.

* Recital 16, as proposed by EP amendment 2, clarifies that broadcasting content as such is not covered by the definition of a communication for the purposes of this Directive, because it is by nature destined for an unlimited audience. However, where it is possible to determine which broadcasting content is received by an individual recipient the protection of the recipient's privacy is guaranteed by this Directive.

* Recital 17 introduces EP amendment 8, clarifying that also in the case of a user or subscriber being a legal person, the definition of consent as determined by Directive 95/46/EC applies. This recital also explains that on the Internet consent may be obtained by ticking a box.

* Recital 18, following EP amendment 7, provides some examples of value added services for clarification.

* In Recital 20 (former recital 13) EP amendment 5 has been included. The example of analogue mobile telephony was added and a clarification that service providers are always bound to guarantee a normal security level for their services at their own expenses and that they cannot discharge themselves of this obligation by informing the users and subscribers of particular risks.

* Recital 22 copies EP amendment 9 and is intended to explain that the transmission of communications may involve temporary technical storage and that this is not contrary to Article 5 of the Directive provided that the confidentiality of the communication is maintained. The recital also clarifies that so-called 'caching' is allowed provided that the cached information cannot be linked to individual previous users.

* Recital 23 follows EP amendment 10 clarifying that where communications are recorded for legitimate business purposes in conformity with Article 5 of the Directive, the user should be informed about this. Also the record should not be kept for longer than needed for the initial purpose.

* In Recital 26 the scope of processing of traffic data with consent of the user or subscriber for the marketing of a providers own electronic communications services has been extended to cover all electronic communications services, also those of others to avoid discrimination. This change follows EP amendment 7.

* Recital 27 clarifies that the moment of completion of the transmission of a communication by which traffic data must be erased can vary for different services.

* Recital 28 provides a further clarification that certain forms of storage of traffic data that are necessary for the provision of a service over the Internet are not affected by the obligation to erase traffic data .

* Similarly, recital 29 underlines that the detection of technical failures may in individual cases require the further processing of traffic data. Moreover, for the detection of billing fraud that consists of illegal unpaid use of a service, monitoring of billing data may be necessary.

* Recital 30 stresses that systems should be based on the principle of data minimisation and that activities related to the provision of an electronic communication service beyond what is strictly necessary for the provision of the service, should either be based on aggregated data or require the consent of the data subject.

* Recital 31 follows EP amendment 12 and addresses whether the consent referred to in the Directive should be that of the subscriber or the user. The recital explains that this will depend on the type of service and on the possibilities to distinguish between subscribers and users.

* EP amendments 14 and 15 have been combined in recital 32 , clarifying certain aspects of transfer of traffic or location data to third parties where this is necessary for the provision of a value added service.

* At the end of existing recital 33 (ex-recital 16) EP amendment 11 has been included in a modified form. The EP had proposed to enable Member States to require the deletion of digits from itemised bills in order to protect the privacy of individual callers and called parties towards the subscriber of the electronic communications service. The Council has chosen to clarify that Member States may ask operators to offer such deletion of digits to their customers instead of imposing it upon them. The Commission prefers the Council approach.

* Recital 36 is a redrafted version of former recital 23 on overruling privacy options in case of nuisance calls or for the benefit of emergency services, but contains no changes of substance.

* Recital 39 introduces EP amendment 17 and explains the nature of the information obligation imposed on parties collecting personal data for inclusion in public subscriber directories.

Recitals 24 and 25 (cookies and other invisible tracking devices)

The common position includes two new recitals explaining in detail how the new provision of Article 5(3) addressing the use of invisible tracking devices (see below) should be applied in practice. The recitals usefully distinguish between legitimate use and non-legitimate use. The Commission can support the approach adopted by the Council.

Recitals 40 until 45 (unsolicited e-mail)

In line with the approach chosen by the Council regarding unsolicited e-mail for direct marketing purposes (see below), six new recitals explain the reasons motivating the legal provisions. The Commission welcomes these clarifications as they will help in understanding and implementing the Directive.

3.2.2 Articles

Article 2 - Definitions

Redrafting of Article 2(b) and 2(d) in the common position follows EP amendments 19 and 21 subject to some minor drafting changes and new paragraphs (f), (g) and (h) include EP amendment 22. The Commission supports these useful drafting changes

Article 4 - Security

The drafting of paragraph 2 has been slightly modified to respond to EP amendment 23.

Article 5 - Confidentiality of communications

In paragraph 1, EP amendment 24 was included to clarify that the requirement to prohibit storage of communications does not refer to technical storage necessary for the transmission of such communications, for instance for electronic mail, provided that the confidentiality is guaranteed.

A new paragraph 3 was added in response to EP amendment 26. That amendment proposed to require prior consent for the use of invisible tracking devices such as so-called cookies. The Council has agreed to insert a new provision covering this problem but changed the consent requirement into an information obligation and a right to refuse such devices for the users. The Council held the view that since the use of tracking devices is in many cases intended to facilitate the provision of services over electronic communications networks, prior consent might create an unjustified obstacle for that type of use. If users are fully informed about the purposes of tracking devices and are given a right to refuse such devices on their terminal equipment the objective of safeguarding users' rights to privacy would also be met. Two new recitals 24 and 25 were added to explain in more detail how the new provision should be applied to various tracking devices, also making a distinction between devices for legitimate purposes and devices such as spyware and web bugs that clearly serve no legitimate purpose. The Commission can accept the approach adopted in the common position and considers that it strikes the right balance between the EP amendment and the concerns that were raised by economic operators regarding that amendment.

Article 6 - Traffic data

In paragraph 1, a cross reference has been added to Article 15(1) to clarify that derogations from the principle of erasure of traffic data are possible under the conditions of that Article. The Commission considers this cross reference to be superfluous since Article 15(1) already contains a reference to Article 6 and potentially confusing since similar cross-references do not exist in other articles from which derogations are possible. Nevertheless, in a spirit of compromise, the Commission is willing to accept the cross-reference.

In paragraphs 3, 4, 5 and 6 of Article 6 various drafting changes have been made following EP amendments 28, 29 and 30. In paragraph 3 it has been clarified that users or subscribers should have the possibility to withdraw an earlier given consent for the processing of their traffic data for value added services or marketing purposes at any time.

Article 8 - Presentation and restriction of calling and connected line identification

The common position has introduced a small drafting change in paragraphs 1 to 4, where the passive tense of the obligation to offer privacy options has been redrafted into active tense in order to clarify that the operators are responsible for offering these options. This does not entail a change of substance, it merely facilitates understanding of the text. The Commission welcomes this improvement.

Article 9- Location data other than traffic data

Following EP amendment 32, the common position introduces a few drafting changes in paragraph 1 as well as a clarification that users or subscribers should be able to withdraw their consent at any time as for traffic data.

Article 12 and Article 16(2) - Directories of subscribers and transitional arrangements

The Council has not accepted EP amendment 34 regarding directories that would return to the provisions in the existing Directive 97/46/EC, but followed instead the Commission proposal to update and adapt the existing rules to new services and new forms of directories. The common position does however take account of concerns regarding traditional fixed voice telephony directories in Article 16(1). Here the Council has agreed on a transitional arrangement to ensure that it will not be necessary for directory publishers to request consent from all subscribers already included in such fixed voice telephony directories. The obligation will only apply for electronic communications services other than fixed voice telephony and for new subscribers. The Commission fully supports the common position with regard to directories which will result in a balanced approach that is applicable to all services alike and takes account of user rights to privacy in view of new far reaching linkage possibilities that exist with electronic directories.

Article 13 - Unsolicited communications

EP amendment 35 proposed to only single out SMS messages and include them in paragraph 1 of this article requiring prior consent of recipients while leaving the approach to other forms of e-mail for the Member States to decide. The Council preferred a harmonised approach on the basis of prior consent for all forms of electronic mail. The Commission is very satisfied that the Council has chosen a uniform single market approach as the best solution for unsolicited electronic mail for direct marketing purposes.

The Council did however include EP amendment 44 in redrafted form. With new paragraph 2, communication details obtained from existing customers who have already purchased a product or service may be used for direct marketing, provided that a clear and easy opt-out possibility is offered at the time of collection of the data and with each direct marketing message. Moreover, the use of the communication data should be limited to the initial collector of these data. The Commission can accept this provision as drafted in the common position as a compromise solution.

The Council also incorporated part of EP amendment 35 in new paragraph 4, prohibiting the disguise of the identity of the sender of an unsolicited commercial e-mail or the use of a non-valid return address. The Commission considers this to be an improvement of the text.

Finally the Council has followed the European Parliament in its amendment 42 by inserting a reporting obligation in new paragraph 6 of Article 13, asking the Commission to examine experience with the new rules on unsolicited electronic mail after three years.

The Council has not taken over the EP proposal to impose certain technical solutions on providers of e-mail services (part of EP amendment 35). The Commission had also opposed this approach that is not technology neutral, very difficult to implement in a uniform way and likely to be ineffective in solving the problem of unsolicited electronic mail.

Article 14 - Technical features and standardisation

As proposed by the EP in amendment 36, the common position has redrafted paragraph 3 of Article 14 following concerns raised by industry. Council has made some further drafting changes to the EP text to ensure full compatibility with Directive 1999/5/EC.

Article 15 - Application of certain provisions of Directive 95/46/EC

Lengthy and difficult debates have taken place in Council on the question of the retention of traffic data for law enforcement purposes. The Commission has held the view that the present Directive based on Article 95 of the Treaty cannot include substantive provisions on law enforcement measures. It should neither prohibit nor approve any particular measure Member States may deem necessary. Article 15(1) of the proposed Directive provides a general basis for Member States to take such measures while respecting their obligations under Community law, including obligations under the European Convention on Human Rights.

Nevertheless, the Council has decided to introduce a new sentence in Article 15(1) that reads : "To this end Member States may inter alia provide for the retention of data for a limited period justified on the grounds laid down in this paragraph, in accordance with the general principles of Community law."

In a formal statement for the minutes of the Council meeting of ministers of 6 December 2001 the Commission has stated that it "(..) interprets the second sentence of Article 15, paragraph 1 (...) as merely adding a possible example of measures that Member States may take under the circumstances and conditions laid down under Article 15, paragraph 1. This phrase does not legally alter the substance of, or add any element to, the first sentence of Article 15. Nor does it exempt any measures that Member States may take from verification of their respect for their obligations under the Directive and under Community law generally, including the obligation to respect fundamental rights and general principles of Community law such as those enshrined in the European Union Charter of Fundamental Rights and the European Convention on Human Rights."

On the basis of this statement and bearing in mind that recital 11 has clarified the obligations under the European Convention on Human Rights that Member States must respect under all circumstances, the Commission can accept the added sentence in Article 15(1).

4. Conclusion

The common position, including numerous EP amendments has introduced important clarifications and improvements to the original Commission text. The Commission can therefore support the new text and recommend it to the European Parliament.

For the second reading it is important to note that the present draft Directive is part of a wider electronic communications regulatory package consisting of four other Directives and a Decision. Since full agreement has been reached between the institutions on the rest of the package on 13 December 2001, it is very important to try and achieve rapid agreement on this draft Directive too, in order minimise the delay and hopefully still allow a streamlined date of application for all 6 new legal instruments.

Table of correspondence

>TABLE POSITION>