ePri­va­cy Regu­la­ti­on: Agree­ment in the Council

On Febru­ary 10, 2021, the EU mem­ber sta­tes agreed in the Coun­cil of the Euro­pean Uni­on on a ver­si­on of the ePri­va­cy Regu­la­ti­on sui­ta­ble (cf. Media release and Coun­cil ver­si­on; a com­pa­ri­son of the Commission’s ori­gi­nal pro­po­sal and the ver­si­on now adopted by the Coun­cil can be found here).

This means that the tri­lo­gue can begin, i.e. the vote bet­ween the Coun­cil, the Com­mis­si­on and the Par­lia­ment. If an agree­ment is rea­ched befo­re the end of 2021, the ePri­va­cy Regu­la­ti­on could be 2023 at the ear­liest – enter into force after a tran­si­tio­nal peri­od of two years.

The pro­vi­si­on to the spa­ti­al scope has the fol­lo­wing con­tent in the ver­si­on of the Coun­cil – with a Tri­via­li­ty thres­hold in favor of com­pa­nies out­side the EEA:

Artic­le 3 – Ter­ri­to­ri­al scope and representative

1. this regu­la­ti­on applies to:

(a) the pro­vi­si­on of elec­tro­nic com­mu­ni­ca­ti­ons ser­vices to end-users who are in the Union,

(aa) the pro­ce­s­sing of elec­tro­nic com­mu­ni­ca­ti­ons con­tent and of elec­tro­nic com­mu­ni­ca­ti­ons meta­da­ta of end-users who are in the Union;

(b) [omit­ted]

(c) the pro­tec­tion of ter­mi­nal equip­ment infor­ma­ti­on of end-users who are in the Union.

(cb) the offe­ring of publicly available direc­to­ries of end-users of elec­tro­nic com­mu­ni­ca­ti­ons ser­vices who are in the Union;

(cc) the sen­ding of direct mar­ke­ting com­mu­ni­ca­ti­ons to end-users who are in the Union.

2. whe­re the pro­vi­der of an elec­tro­nic com­mu­ni­ca­ti­ons ser­vice, the pro­vi­der of a publicly available direc­to­ry, or a per­son using elec­tro­nic com­mu­ni­ca­ti­ons ser­vices to send direct mar­ke­ting com­mu­ni­ca­ti­ons, or a per­son using pro­ce­s­sing and sto­rage capa­bi­li­ties or coll­ec­ting infor­ma­ti­on pro­ce­s­sed by or emit­ted by or stored in the end-users’ ter­mi­nal equip­ment is not estab­lished in the Uni­on it shall desi­gna­te in wri­ting, within one month from the start of its acti­vi­ties, a repre­sen­ta­ti­ve in the Uni­on and com­mu­ni­ca­te it to the com­pe­tent Super­vi­so­ry Authority.

2a. The requi­re­ments laid down in para­graph 2 shall not app­ly if acti­vi­ties listed in para­graph 1 are occa­sio­nal and are unli­kely to result in a risk to the fun­da­men­tal rights of end-users taking into account the natu­re, con­text, scope and pur­po­se of tho­se activities.


Howe­ver, accor­ding to the wor­ding, the excep­ti­on in Art. 3(2a) only refers to the obli­ga­ti­on to appoint a repre­sen­ta­ti­ve in the EEA, not to the appli­ca­ti­on of the regu­la­ti­on its­elf.

The reci­tals do not pro­vi­de a basis for a dif­fe­rent inter­pre­ta­ti­on. Reci­tal 8aaa, on the con­tra­ry, sta­tes the appli­ca­ti­on of the Regu­la­ti­on to under­ta­kings out­side the EEA wit­hout refer­ring to an exception:

(8aaa) Fur­ther­mo­re, this Regu­la­ti­on should app­ly regard­less of whe­ther the pro­ce­s­sing of elec­tro­nic com­mu­ni­ca­ti­ons data or per­so­nal data of end-users who are in the Uni­on takes place in the Uni­on or not, or of whe­ther the ser­vice pro­vi­der or per­son pro­ce­s­sing such data is estab­lished or loca­ted in the Uni­on or not.

It must the­r­e­fo­re curr­ent­ly be assu­med that Swiss com­pa­nies are also appli­ca­ble if they only occa­sio­nal­ly and not spe­ci­fi­cal­ly per­form an act that falls within the mate­ri­al scope of the Regu­la­ti­on (e.g., send an adver­ti­sing e‑mail to a natu­ral person).




Rela­ted articles