ePrivacy Directive Compliance

The ePrivacy Directive (also known as the Directive on Privacy and Electronic Communications) is a directive of the European Union that sets out specific rules regarding the processing of personal data in the electronic communications sector. It is intended to protect the privacy of individuals in the context of electronic communications, such as telephone calls, faxes, and emails. The directive applies to all electronic communications service providers, including internet service providers, mobile phone operators, and email service providers, as well as companies that process personal data in connection with the provision of these services.

It requires these companies to take appropriate measures to protect the privacy of their users, including obtaining their consent before collecting or processing their personal data.

What Are the Differences between the ePrivacy Directive and GDPR?

The ePrivacy Directive is separate from the General Data Protection Regulation (GDPR), which is a broader EU regulation that applies to the processing of personal data in general, including in the electronic communications sector.

The ePrivacy Directive is distinct from the General Data Protection Regulation (GDPR), which is a broader piece of legislation that applies to the processing of personal data in general. While the ePrivacy Directive focuses specifically on the electronic communications sector, the GDPR applies to all sectors and all types of personal data processing.

One of the main differences between the ePrivacy Directive and the GDPR is that the ePrivacy Directive applies to the processing of data in the context of electronic communication, while the GDPR applies to the processing of personal data in general. This means that the ePrivacy Directive may have additional requirements for the processing of personal data in the electronic communications sector, such as the use of cookies or other tracking technologies.

Additionally, the ePrivacy Directive and the GDPR have different enforcement mechanisms. While the GDPR grants data protection authorities the power to impose fines for non-compliance, the ePrivacy Directive grants national authorities the power to impose sanctions for non-compliance. Overall, the ePrivacy Directive and the GDPR work together to provide a comprehensive framework for the protection of personal data in the EU.

Does Proxima Comply with the ePrivacy Directive?

The directive is currently under review and is expected to introduce stronger rules and simpler rules on cookies, as well as provide protection against spam. In terms of our analytics, the ePrivacy Directive will likely strongly prohibit fingerprinting, which is a technique used to uniquely identify a device or browser through various characteristics and data points.

Specifically, the directive in Article 5 requires that personal data processed in the electronic communications sector be processed in a manner that is "lawful, fair, and transparent," and that it be collected for "specified, explicit, and legitimate purposes." It also requires that personal data be "adequate, relevant, and limited to what is necessary" for the purpose for which it is being collected.

In addition, Article 5 sets out a number of rights for individuals in relation to the processing of their personal data, including the right to be informed about how their data will be used, the right to access and rectify their data, and the right to object to the processing of their data for certain purposes. It also requires that appropriate technical and organisational measures be put in place to protect personal data from unauthorised access, use, or disclosure.

This means that businesses must obtain the explicit consent of users before collecting, using, or sharing their “electronic communications data”. This provision is intended to protect the privacy of users and ensure that they are aware of how their data is being used. It applies to a wide range of data processing activities, including the use of cookies, the collection of IP addresses, and the tracking of user behaviour online.

Proxima Analytics is fully compliant with the proposed ePrivacy Directive and takes steps to ensure that personal data is processed in a manner that is "lawful, fair, and transparent." In order to achieve this, we have implemented the following measures:

• We do not store raw personal data, but rather use hashing/encryption techniques to anonymise the data. This means that users cannot be linked across websites or devices.
• We do not store IP addresses or user agents, and instead rely on a dataset to extract visitor information. This prevents us from using "fingerprinting" techniques to identify users.
• We do not track any IP addresses in our infrastructure, and do not have any logs or additional services that track personal information.
• We use MaxMind's reverse geocoding service to obtain location information, but this is limited to cities and cannot be used to pinpoint a specific user.
• We have implemented robust security measures to ensure that personal data is protected and not accessed by unauthorised parties.
• We regularly review and update our privacy policies and practices to ensure compliance with all relevant laws and regulations.

Is Google Analytics Compliant with the ePrivacy Directive?

It is unclear whether Google Analytics fully complies with the ePrivacy Directive, as it is still under discussion. However, it is likely that the use of cookies and the collection of personal data for advertising purposes would fall under the scope of the directive.

In order to comply with the directive, it may be necessary to obtain user consent before setting cookies or collecting personal data through Google Analytics. It is important to carefully review the provisions of the ePrivacy Directive and seek legal guidance to ensure compliance.

The Road Ahead

As the current ePrivacy Directive is set to be replaced by the ePrivacy Regulation, it is important to consider the potential changes that this new EU law will bring. Once implemented, the ePrivacy Regulation will be fully applicable to all EU member states and EEA countries, providing a consistent and uniform framework for the protection of personal data in the electronic communications sector. Some of the key changes that businesses and individuals can look forward to with the ePrivacy Regulation include:

• Simplified and strengthened rules for the processing of personal data in the electronic communications sector, ensuring that data is collected and processed in a lawful, fair, and transparent manner, and only for specified, explicit, and legitimate purposes.
• Enhanced privacy protection for online tracking technologies, including cookies, which may no longer require consent in certain circumstances, depending on the nature and purpose of their use. This could potentially allow for the use of privacy-friendly tracking methods, such as those that do not persistently track users over an extended period of time.
• Improved spam protection, including stricter rules on the use of electronic direct marketing techniques, such as unsolicited emails and text messages.

Overall, the ePrivacy Regulation is set to bring significant changes to the way personal data is collected, used, and protected in the electronic communications sector. It is important for businesses and individuals to stay informed about these changes and ensure compliance with the new rules.