Relationship with the Data Retention and ePrivacy Directives
Under the proposed Data Protection Regulation, the e-Privacy Directive and the Data Retention Directive (which is directly linked to the e-Privacy Directive) would remain in force, independent from the Regulation. Our analysis has shown that this would, if anything, amplify the existing problems with these two Directives:
- to the extent that one could derive at least some clarification and guidance on the interpretation of the e-Privacy Directive and the DRD from the provisions in the main Directive, this would be removed;
- the differences between the regimes for “ordinary” service providers and providers of e-communication service providers (in particular in respect of [geo]location data) would become even greater; and
- any flexibility in the Regulation to adapt to new technologies would be denied to processing under the e-Privacy Directive.
- Most crucially, the dis-application under the Data Retention Directive of the caveat in Article 13 of the main Directive relating to respect for fundamental rights, would become even more serious and sinister.
We propose two simple steps:
- That the e-Privacy Directive and the Data Retention Directive, to the extent that they will continue in force for the time being, be explicitly made subsidiary to the rules in the Regulation (including the exception and derogation clauses in the Regulation), and,
- That within a very limited period, they be replaced by new rules that fit in with the new Regulation and that expressly and explicitly make the application of those new, subsidiary rules subject to the fundamental rights requirements of the Treaties.
This would mean first of all that ambiguous provisions in the two Directives can be simply applied in a manner consistent with the application of the main rules in the Regulation, and with the new guidance that will be provided under the Regulation by the Data Protection Board and the delegated acts of the Commission. Secondly, we believe that this would require the urgent replacement of the Data Retention Directive with a new legal instrument mandating only a Charter- and ECHR-compliant system of compulsory data preservation, of the kind we have long asked for. We believe the above would provide for major improvements in the overall EU data protection regime as currently applied to processing (and retention) of various types of communication and similar data.