3.3 Legal Framework
The basic rule is provided for in Article 5 of the ePrivacy Regulation which
establishes that electronic communications data shall be confidential and prohibits
any interference with electronic communications data, such as by listening, monitoring or any kind of interception or processing of electronic communications data,
by persons other than the end-users, except when permitted by the Regulation.
Article 6 of the ePrivacy Regulation establishes the restrictive conditions under
which providers of electronic communications networks and services may process
electronic communications data (6.1), electronic communications metadata (6.2) and
electronic communications content (6.3). Moreover, pursuant to Article 7 of the
ePrivacy Regulation providers of electronic communications services are under strict
obligations to erase electronic communications content and metadata or make that
data anonymous when it is no longer needed for the purpose of the transmission of a
communication or billing.
Providers of electronic communications services are obliged to inform end-users
of measures they can take to protect the security of their communications, such as
using specific types of software or encryption technologies. Moreover, they are also
obliged to take, at their own costs, appropriate and immediate measures to remedy
any new, unforeseen security risks and restore the normal security level of the service.
Pursuant to article 10 of the ePrivacy Regulation, software placed on the market
permitting electronic communications shall offer the option to prevent third parties
from storing information on the terminal equipment of an end-user or processing
information already stored on that equipment. Upon installation, the software shall
inform the end-user about the privacy settings options and, to continue with the
installation, require the end-user to consent to a setting. Additionally, specific obligations on the protection of information stored in and related to end-users’ terminal
equipment are laid down in Article 8. The use of processing and storage capabilities
of terminal equipment, the collection of information from end-users’ terminal equipment and the collection of information emitted by terminal equipment to enable it to
connect are prohibited except on the grounds provided for in Article 8(1) and (2).
The enforcement of the provisions of the ePrivacy Regulation is entrusted to the
same authorities competent for the enforcement of the GDPR (see this chapter, Sect.
1.4, supra). The tasks and powers of those supervisory authorities are also basically
those established in the GDPR, but they have the additional task of monitoring the
application of the ePrivacy Regulation regarding electronic communications data for
legal entities. The ePrivacy Regulation confirms expressly the power of each supervisory authority to impose penalties including administrative fees for any infringement of the Regulation and indicates infringements and the upper limit and criteria to
be followed by the supervisory authority when setting administrative fines.
According to Article 23, infringements of the principle of confidentiality of communications, permitted processing of electronic communications data, time limits for
erasure pursuant are subject to administrative fines up to €20,000,000, or in the case
of an undertaking, up to 4% of the total worldwide annual turnover of the preceding
financial year, whichever is higher.
470
P. A. de Miguel Asensio
The basic rule is provided for in Article 5 of the ePrivacy Regulation which
establishes that electronic communications data shall be confidential and prohibits
any interference with electronic communications data, such as by listening, monitoring or any kind of interception or processing of electronic communications data,
by persons other than the end-users, except when permitted by the Regulation.
Article 6 of the ePrivacy Regulation establishes the restrictive conditions under
which providers of electronic communications networks and services may process
electronic communications data (6.1), electronic communications metadata (6.2) and
electronic communications content (6.3). Moreover, pursuant to Article 7 of the
ePrivacy Regulation providers of electronic communications services are under strict
obligations to erase electronic communications content and metadata or make that
data anonymous when it is no longer needed for the purpose of the transmission of a
communication or billing.
Providers of electronic communications services are obliged to inform end-users
of measures they can take to protect the security of their communications, such as
using specific types of software or encryption technologies. Moreover, they are also
obliged to take, at their own costs, appropriate and immediate measures to remedy
any new, unforeseen security risks and restore the normal security level of the service.
Pursuant to article 10 of the ePrivacy Regulation, software placed on the market
permitting electronic communications shall offer the option to prevent third parties
from storing information on the terminal equipment of an end-user or processing
information already stored on that equipment. Upon installation, the software shall
inform the end-user about the privacy settings options and, to continue with the
installation, require the end-user to consent to a setting. Additionally, specific obligations on the protection of information stored in and related to end-users’ terminal
equipment are laid down in Article 8. The use of processing and storage capabilities
of terminal equipment, the collection of information from end-users’ terminal equipment and the collection of information emitted by terminal equipment to enable it to
connect are prohibited except on the grounds provided for in Article 8(1) and (2).
The enforcement of the provisions of the ePrivacy Regulation is entrusted to the
same authorities competent for the enforcement of the GDPR (see this chapter, Sect.
1.4, supra). The tasks and powers of those supervisory authorities are also basically
those established in the GDPR, but they have the additional task of monitoring the
application of the ePrivacy Regulation regarding electronic communications data for
legal entities. The ePrivacy Regulation confirms expressly the power of each supervisory authority to impose penalties including administrative fees for any infringement of the Regulation and indicates infringements and the upper limit and criteria to
be followed by the supervisory authority when setting administrative fines.
According to Article 23, infringements of the principle of confidentiality of communications, permitted processing of electronic communications data, time limits for
erasure pursuant are subject to administrative fines up to €20,000,000, or in the case
of an undertaking, up to 4% of the total worldwide annual turnover of the preceding
financial year, whichever is higher.
470
P. A. de Miguel Asensio