The coalition strongly believes in the technology-neutral principles of EU legislation to ensure a high level of data protection and fully welcomes initiatives intended to clarify in practice which requirements may apply to new technologies and allow companies to innovate with legal certainty and towards privacy forward practices. 

However, the undersigned associations have grave reservations that the proposed guidelines 2/2023 as currently drafted are likely to produce the opposite effect, as they entail significant risks of discrepancies in their application by organisations and regulators, defeating thereof the purpose to remove ambiguities related to the material scope of Article 5(3) of the ePrivacy Directive.

- Firstly, it is unclear whether the proposed guidelines adequately capture the perspectives of authorities that are effectively entrusted with the power to enforce national ePrivacy rules. This raises questions as to whether the proposed guidelines reflect the views of such authorities and might aggravate legal uncertainty across the Union.

- Secondly, the proposed guidelines prescribe an expanded interpretation of how the ePrivacy Directive applies to existing technologies, in particular of the Transmission Control Protocol (TCP/IP) and ephemeral storage mechanisms such as RAM. This is not only misaligned with the objectives of the ePrivacy Directive to protect users’ private sphere but also contradicts established positions adopted by local regulators - raising the prospect of inconsistent enforcement and economic disparities for organisations across Europe.

- Thirdly, the proposed guidelines eliminate all distinction between operations that involve tracking users’ activities and those which do not, such as the delivery of contextual advertising or the prevention of fraud. By failing to provide guidance on how the two exemptions provided by the ePrivacy Directive might apply to the novel positions taken by the EDPB, a large number of operations that are fundamental to the way Internet works could become subject to consent. This would have the detrimental effects of worsening the so-called consent fatigue phenomenon and acting as a deterrent for companies to favour where possible privacy forward practices.

Recommendations

The undersigned associations recommend the EDPB to revise the proposed guidelines in a way that reflects their competences, tasks and powers, and to align their analysis with both the ePrivacy Directive’s primary objective to protect the private sphere of users as well as the interpretative guidance that has been issued by competent authorities over the last years. 

Additionally, it is essential for any new guidance or recommendations provided by the EDPB on the matter to concomitantly cover which situations may qualify for exemption from the consent requirement under Article 5(3) of the ePrivacy Directive, to take into account real-life technical and business considerations. 

The response to the public consultation can be found here. For more information, please contact Ninon Vagner, Privacy Director, IAB Europe - vagner@iabeurope.eu / Helen Mussard, CMO, IAB Europe - mussard@iabeurope.eu

IAB Europe welcomes the Market Court’s decision to seek guidance from the CJEU. “The interpretation of the notions of personal data and controllership embraced by the APD is unnecessarily broad from a consumer protection point of view and has significant negative implications for the development of open standards and the Codes of Conduct foreseen in the GDPR,” noted Townsend Feehan, IAB Europe’s CEO. “It would place an unacceptable financial burden on host organisations, discouraging the development of these important compliance tools”.

An updated FAQ on the case may be consulted on IAB Europe's website here.