# data[].attributes.attachment_link.readable_text
As cookies continue to play a fundamental role in online tracking and data collection, understanding their intricacies and potential implications is crucial. It is vital for GDPR and privacy professionals to navigate this dynamic environment effectively, ensuring that organizations uphold privacy standards while leveraging cookies in a compliant manner.

Following a brief introduction of the legal framework governing cookies, namely, ePrivacy, GDPR and relevant ECJ as well as other current decisions, we will dive straight into the nitty-gritty. We will have a tech deep dive into online marketing analytics and cookie-technology in general, different types of website/app tracking and CMP design, finishing off with the most problematic (yet) common practices, such as real-time-bidding and dark patterns.

After introducing the technology behind the problem, we will examine what (lawful) options stand at the (desperate) advertiser's/publisher's disposal. In this context we will briefly analyze (informed) consent requirements for placing cookies in the first place. We will address legal exceptions to the necessity of consent and finally propose some alternatives that may lead to a reduction and consequently abolishment of the use of cookies and similar identifiers.

Key discussion points:

Starting from the bottom: ePrivacy vs GDPR

One small step for the user, one giant leap for the future of internet: jurisprudence and further developments

Handling the basics: deep dive into the world of online marketing, real-time bidding, and dark patterns

Into the cookieless future: Synthetic users, Data Clean Rooms, Tracking - proxies, on device ML based user segmentation via Anonymized etc.

# data[].attributes.attachment_link.title
DPO Session #21 - Navigating a Cookieless Future: Web Analytics and Tracking with and without Consent, a discussion with Peter Hense

# data[].attributes.attachment_link.description
As cookies continue to play a fundamental role in online tracking and data collection, understanding their intricacies and potential implications is crucial. It is vital for GDPR and privacy professionals to navigate this dynamic environment effectively, ensuring that organizations uphold privacy standards while leveraging cookies in a compliant manner.

# data[].attributes.headline
Peter Hense: How first-party data will kill CMPs

# data[].attributes.subject
Peter Hense: How first-party data will kill CMPs

# data[].attributes.attachment_link.readable_text
Why do we stand consent pop-ups? Do they help at all? Will first-party data render them obsolete?

Our guest:

Peter Hense is a partner at Spirit Legal, Germany. Peter advises well-known national and international companies in their implementation of digital business models in the areas of IT, data protection and competition law, especially in the e-commerce, automotive and travel industries. Peter specializes in data privacy litigation, particularly in the area of Advertising Technology.

In this episode we discuss the uselessness and potential demise of Consent Management Platforms (CMPs) in a first-party data future. We will also touch on Data Clean Rooms and whether they actually deserve the label.

References:

# data[].attributes.attachment_link.description
Why do we stand consent pop-ups? Do they help at all? Will first-party data render them obsolete? Our guest: Peter Hense is a partner at Spirit Legal, Germany. Peter advises well-known national and international companies in their implementation of digital business models in the areas of IT, data protection and competition law, especially in the e-commerce, automotive and travel industries.

# data[].attributes.headline
Cookies updates from French, German DPAs

# data[].attributes.subject
Cookies updates from French, German DPAs

# data[].attributes.attachment_link.title
Cookies updates from French, German DPAs

# data[].attributes.attachment_link.description
Data protection authorities in France and Germany provide updates on cookies developments.

# data[].attributes.headline
Aarhus researchers free users from annoying cookie dialogues! 

# data[].attributes.subject
Aarhus researchers free users from annoying cookie dialogues! 

# data[].attributes.attachment_link.readable_text
Researchers from Aarhus University have developed the browser extension Consent-O-Matic - a piece of software that automatically answers consent pop-ups for you. Experience shows that the time users spend responding to virtually the same consent pop-ups on different websites - every day - is drastically reduced with Consent-O-Matic installed. The browser extension already has 22,000 test users around the world, and now the browser extension is made publicly available for all interested users, and the developers expects a massive growth in number of Consent-O-Matic users.
These days, nearly all websites use tracking technologies to collect data about you. By law, they often need your permission, which is why many websites have "consent pop-ups". However, 90% of these pop-ups use so-called "dark patterns", which are designed to make it very difficult to say no, but very easy to say yes (Nouwens et al., 2020). Although getting someone's consent by using deception means it is not legally valid consent, the laws are not properly enforced, so many websites get away with it.

To deal with these deceptive pop-ups, a team from Aarhus University consisting of assistant professor Midas Nouwens ( Department of Digital Design & Information Studies), associate professor Clemens Nylandsted Klokmose ( Department of Computer Science), and programmers Rolf Bagge & Janus Bager Kristensen ( CAVI) have developed an open-source browser extension they call Consent-O-Matic, which automatically fills in your preferences when a consent pop-up appears.

'People should have control over their personal data, but the way these consent pop-ups are designed make it difficult. Clicking through multiple screens and toggling hundreds of sliders for every website you visit gets exhausting and annoying, so it's easier to just hit the big green button. We built Consent-O-Matic to let people exercise their digital rights, and make it as easy as possible,' one of the developers, Midas Nouwens, explains.

When you install Consent-O-Matic, you must set your preferences for the kind of data collection you are comfortable with (everything is off by default). Data can for example be collected for advertising, performance monitoring, or personalization. Then, when you visit a website, the extension detects if there is a consent pop-up, and automatically clicks on the correct buttons based on your preferences.

Does Consent-O-Matic work for all websites?

Many websites use the same pop-ups (for example, 90% of Danish websites use the same two pop-ups), and Consent-O-Matic currently works with ~50 different pop-ups. However, there might be other pop-ups out there that the browser extension is not yet able to recognize and interact with.

'The way it works is that we manually analyze a pop-up to see how it is designed, and then we write the code to click on buttons and check boxes. Sometimes a website might have done things differently, and in that case, we will always try to submit the most privacy preserving settings. Websites might also use a pop-up that we haven't seen yet, which means Consent-O-Matic can't detect it. But the user can report the page to us, and then we can add it' Clemens Nylandsted Klokmose explains and continues; 'The code for Consent-O-Matic is available open-source on Github (see: https://github.com/cavi-au/Consent-O-Matic), so if anyone want to have a look, or contribute with new rules for a pop-up, they can do that.'

Download Consent-O-Matic today

Consent-O-Matic is a free and open source browser extension, which is available to all interested users in the world, and it can be used on both mobile devices (iOS Safari) and desktop (Chrome, Firefox, Edge & Safari). Download Consent-O-Matic for Google Chrome, Mozilla Firefox, and Apple Safari for iOS and macOS.

# data[].attributes.attachment_link.title
Wish you could automatically answer pop-ups?

# data[].attributes.attachment_link.description
Researchers from Aarhus University have developed the browser extension Consent-O-Matic - a piece of software that automatically answers consent pop-ups for you. Experience shows that the time users spend responding to virtually the same consent pop-ups on different websites - every day - is drastically reduced with Consent-O-Matic installed.

# data[].attributes.headline
Mattia Fosci: The publisher’s dilemma in a first-party data world

# data[].attributes.subject
Mattia Fosci: The publisher’s dilemma in a first-party data world

# data[].attributes.attachment_link.readable_text
What should publishers prioritize to survive as a business in the face of powerful browsers and colossal competitors?

Our guest:

As a lawyer turned entrepreneur, Dr. Mattia Fosci combines privacy and AdTech expertise. He is the founder and CEO of Anonymised, an advertising platform that helps publishers understand and monetise their audiences at scale across all browsers and devices, using only anonymous data.

We have covered or touched on:

The many limitations of contextual advertising and why it will not solve the most pressing issues

How ID-based alternatives are worse than cookies

The manner in which browsers are exercising greater control over the open web

The deafening noise in the AdTech market when it comes to cookieless solutions, and how overwhelming this is for publishers with limited technical resources

The competitive issues arising from cross-site interest-based cohorts (à la Topics API in the Google Privacy Sandbox)

How to get advertisers and their media agencies to dare turn their backs on a highly defective status quo - thus allowing publishers to move away from their own mouse wheel.

References:

# data[].attributes.attachment_link.description
What should publishers prioritize to survive as a business in the face of powerful browsers and colossal competitors? Our guest: As a lawyer turned entrepreneur, Dr. Mattia Fosci combines privacy and AdTech expertise. He is the founder and CEO of Anonymised, an advertising platform that helps publishers understand and monetise their audiences at scale across all browsers and devices, using only anonymous data.

# data[].attributes.attachment_link.readable_text
Euractiv reports a German citizen brought a lawsuit against the European Commission alleging violations of the EU General Data Protection Regulation. The plaintiff claims the Commission illegally transfers data to the U.S. against the Court of Justice of the European Union's "Schrems II" ruling while also alleging insufficient transparency around data processing practices. Europäische Gesellschaft für Datenschutz founder Thomas Bindl, whose group is representing the plaintiff, said the case will act as "a clear sign that everyone must adhere to the data protection requirements."
Full Story

# data[].attributes.attachment_link.title
European Commission sued over EU GDPR claims

# data[].attributes.attachment_link.description
A German citizen brought a lawsuit against the European Commission alleging violations of the EU GDPR.

# data[].attributes.attachment_link.description
Necessity toolkit on assessing the necessity of measures that limit the fundamental right to the protection of personal data

# data[].attributes.headline
DIRECTIVE 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector

# data[].attributes.subject
DIRECTIVE 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector

# data[].attributes.attachment_link.readable_text
2002L0058 - EN - 19.12.2009 - 002.003

This document is meant purely as a documentation tool and the institutions do not assume any liability for its contents

Amended by:

Corrected by:

DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 12 July 2002

concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty establishing the European Community, and in particular Article 95 thereof,

Having regard to the proposal from the Commission (),

Having regard to the opinion of the Economic and Social Committee (),

Having consulted the Committee of the Regions,

Acting in accordance with the procedure laid down in Article 251 of the Treaty (),

Whereas:

HAVE ADOPTED THIS DIRECTIVE:

Article 1

Scope and aim

1. This Directive provides for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in the Community.

2. The provisions of this Directive particularise and complement Directive 95/46/EC for the purposes mentioned in paragraph 1. Moreover, they provide for protection of the legitimate interests of subscribers who are legal persons.

3. This Directive shall not apply to activities which fall outside the scope of the Treaty establishing the European Community, such as those covered by Titles V and VI of the Treaty on European Union, and in any case to activities concerning public security, defence, State security (including the economic well-being of the State when the activities relate to State security matters) and the activities of the State in areas of criminal law.

Article 2

Definitions

Save as otherwise provided, the definitions in Directive 95/46/EC and in Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) () shall apply.

The following definitions shall also apply:

(a)'user' means any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to this service;

(b)'traffic data' means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof;

(c)'location data' means any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service;

(d)'communication' means any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service. This does not include any information conveyed as part of a broadcasting service to the public over an electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information;

(f)'consent' by a user or subscriber corresponds to the data subject's consent in Directive 95/46/EC;

(g)'value added service' means any service which requires the processing of traffic data or location data other than traffic data beyond what is necessary for the transmission of a communication or the billing thereof;

(h)'electronic mail' means any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient;

(i)'personal data breach' means ◄ a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a publicly available electronic communications service in the Community.

Article 3

Services concerned

This Directive shall apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the Community, including public communications networks supporting data collection and identification devices.

Article 4

1. The provider of a publicly available electronic communications service must take appropriate technical and organisational measures to safeguard security of its services, if necessary in conjunction with the provider of the public communications network with respect to network security. Having regard to the state of the art and the cost of their implementation, these measures shall ensure a level of security appropriate to the risk presented.

1a. Without prejudice to Directive 95/46/EC, the measures referred to in paragraph 1 shall at least:

-ensure that personal data can be accessed only by authorised personnel for legally authorised purposes,

-protect personal data stored or transmitted against accidental or unlawful destruction, accidental loss or alteration, and unauthorised or unlawful storage, processing, access or disclosure, and,

-ensure the implementation of a security policy with respect to the processing of personal data,

Relevant national authorities shall be able to audit the measures taken by providers of publicly available electronic communication services and to issue recommendations about best practices concerning the level of security which those measures should achieve.

2. In case of a particular risk of a breach of the security of the network, the provider of a publicly available electronic communications service must inform the subscribers concerning such risk and, where the risk lies outside the scope of the measures to be taken by the service provider, of any possible remedies, including an indication of the likely costs involved.

3. In the case of a personal data breach, the provider of publicly available electronic communications services shall, without undue delay, notify the personal data breach to the competent national authority.

When the personal data breach is likely to adversely affect the personal data or privacy of a subscriber or individual, the provider shall also notify the subscriber or individual of the breach without undue delay.

Notification of a personal data breach to a subscriber or individual concerned shall not be required if the provider has demonstrated to the satisfaction of the competent authority that it has implemented appropriate technological protection measures, and that those measures were applied to the data concerned by the security breach. Such technological protection measures shall render the data unintelligible to any person who is not authorised to access it.

Without prejudice to the provider's obligation to notify subscribers and individuals concerned, if the provider has not already notified the subscriber or individual of the personal data breach, the competent national authority, having considered the likely adverse effects of the breach, may require it to do so.

The notification to the subscriber or individual shall at least describe the nature of the personal data breach and the contact points where more information can be obtained, and shall recommend measures to mitigate the possible adverse effects of the personal data breach. The notification to the competent national authority shall, in addition, describe the consequences of, and the measures proposed or taken by the provider to address, the personal data breach.

4. Subject to any technical implementing measures adopted under paragraph 5, the competent national authorities may adopt guidelines and, where necessary, issue instructions concerning the circumstances in which providers are required to notify personal data breaches, the format of such notification and the manner in which the notification is to be made. They shall also be able to audit whether providers have complied with their notification obligations under this paragraph, and shall impose appropriate sanctions in the event of a failure to do so.

Providers shall maintain an inventory of personal data breaches comprising the facts surrounding the breach, its effects and the remedial action taken which shall be sufficient to enable the competent national authorities to verify compliance with the provisions of paragraph 3. The inventory shall only include the information necessary for this purpose.

5. In order to ensure consistency in implementation of the measures referred to in paragraphs 2, 3 and 4, the Commission may, following consultation with the European Network and Information Security Agency (ENISA), the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC and the European Data Protection Supervisor, adopt technical implementing measures concerning the circumstances, format and procedures applicable to the information and notification requirements referred to in this Article. When adopting such measures, the Commission shall involve all relevant stakeholders particularly in order to be informed of the best available technical and economic means of implementation of this Article.

Those measures, designed to amend non-essential elements of this Directive by supplementing it, shall be adopted in accordance with the regulatory procedure with scrutiny referred to in Article 14a(2).

Article 5

Confidentiality of the communications

1. Member States shall ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation. In particular, they shall prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than users, without the consent of the users concerned, except when legally authorised to do so in accordance with Article 15(1). This paragraph shall not prevent technical storage which is necessary for the conveyance of a communication without prejudice to the principle of confidentiality.

2. Paragraph 1 shall not affect any legally authorised recording of communications and the related traffic data when carried out in the course of lawful business practice for the purpose of providing evidence of a commercial transaction or of any other business communication.

3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

Article 6

Traffic data

1. Traffic data relating to subscribers and users processed and stored by the provider of a public communications network or publicly available electronic communications service must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication without prejudice to paragraphs 2, 3 and 5 of this Article and Article 15(1).

2. Traffic data necessary for the purposes of subscriber billing and interconnection payments may be processed. Such processing is permissible only up to the end of the period during which the bill may lawfully be challenged or payment pursued.

3. For the purpose of marketing electronic communications services or for the provision of value added services, the provider of a publicly available electronic communications service may process the data referred to in paragraph 1 to the extent and for the duration necessary for such services or marketing, if the subscriber or user to whom the data relate has given his or her prior consent. Users or subscribers shall be given the possibility to withdraw their consent for the processing of traffic data at any time.

4. The service provider must inform the subscriber or user of the types of traffic data which are processed and of the duration of such processing for the purposes mentioned in paragraph 2 and, prior to obtaining consent, for the purposes mentioned in paragraph 3.

5. Processing of traffic data, in accordance with paragraphs 1, 2, 3 and 4, must be restricted to persons acting under the authority of providers of the public communications networks and publicly available electronic communications services handling billing or traffic management, customer enquiries, fraud detection, marketing electronic communications services or providing a value added service, and must be restricted to what is necessary for the purposes of such activities.

6. Paragraphs 1, 2, 3 and 5 shall apply without prejudice to the possibility for competent bodies to be informed of traffic data in conformity with applicable legislation with a view to settling disputes, in particular interconnection or billing disputes.

Article 7

Itemised billing

1. Subscribers shall have the right to receive non-itemised bills.

2. Member States shall apply national provisions in order to reconcile the rights of subscribers receiving itemised bills with the right to privacy of calling users and called subscribers, for example by ensuring that sufficient alternative privacy enhancing methods of communications or payments are available to such users and subscribers.

Article 8

Presentation and restriction of calling and connected line identification

1. Where presentation of calling line identification is offered, the service provider must offer the calling user the possibility, using a simple means and free of charge, of preventing the presentation of the calling line identification on a per-call basis. The calling subscriber must have this possibility on a per-line basis.

2. Where presentation of calling line identification is offered, the service provider must offer the called subscriber the possibility, using a simple means and free of charge for reasonable use of this function, of preventing the presentation of the calling line identification of incoming calls.

3. Where presentation of calling line identification is offered and where the calling line identification is presented prior to the call being established, the service provider must offer the called subscriber the possibility, using a simple means, of rejecting incoming calls where the presentation of the calling line identification has been prevented by the calling user or subscriber.

4. Where presentation of connected line identification is offered, the service provider must offer the called subscriber the possibility, using a simple means and free of charge, of preventing the presentation of the connected line identification to the calling user.

5. Paragraph 1 shall also apply with regard to calls to third countries originating in the Community. Paragraphs 2, 3 and 4 shall also apply to incoming calls originating in third countries.

6. Member States shall ensure that where presentation of calling and/or connected line identification is offered, the providers of publicly available electronic communications services inform the public thereof and of the possibilities set out in paragraphs 1, 2, 3 and 4.

Article 9

Location data other than traffic data

1. Where location data other than traffic data, relating to users or subscribers of public communications networks or publicly available electronic communications services, can be processed, such data may only be processed when they are made anonymous, or with the consent of the users or subscribers to the extent and for the duration necessary for the provision of a value added service. The service provider must inform the users or subscribers, prior to obtaining their consent, of the type of location data other than traffic data which will be processed, of the purposes and duration of the processing and whether the data will be transmitted to a third party for the purpose of providing the value added service. Users or subscribers shall be given the possibility to withdraw their consent for the processing of location data other than traffic data at any time.

2. Where consent of the users or subscribers has been obtained for the processing of location data other than traffic data, the user or subscriber must continue to have the possibility, using a simple means and free of charge, of temporarily refusing the processing of such data for each connection to the network or for each transmission of a communication.

3. Processing of location data other than traffic data in accordance with paragraphs 1 and 2 must be restricted to persons acting under the authority of the provider of the public communications network or publicly available communications service or of the third party providing the value added service, and must be restricted to what is necessary for the purposes of providing the value added service.

Article 10

Exceptions

Member States shall ensure that there are transparent procedures governing the way in which a provider of a public communications network and/or a publicly available electronic communications service may override:

(a)the elimination of the presentation of calling line identification, on a temporary basis, upon application of a subscriber requesting the tracing of malicious or nuisance calls. In this case, in accordance with national law, the data containing the identification of the calling subscriber will be stored and be made available by the provider of a public communications network and/or publicly available electronic communications service;

(b)the elimination of the presentation of calling line identification and the temporary denial or absence of consent of a subscriber or user for the processing of location data, on a per-line basis for organisations dealing with emergency calls and recognised as such by a Member State, including law enforcement agencies, ambulance services and fire brigades, for the purpose of responding to such calls.

Article 11

Automatic call forwarding

Member States shall ensure that any subscriber has the possibility, using a simple means and free of charge, of stopping automatic call forwarding by a third party to the subscriber's terminal.

Article 12

Directories of subscribers

1. Member States shall ensure that subscribers are informed, free of charge and before they are included in the directory, about the purpose(s) of a printed or electronic directory of subscribers available to the public or obtainable through directory enquiry services, in which their personal data can be included and of any further usage possibilities based on search functions embedded in electronic versions of the directory.

2. Member States shall ensure that subscribers are given the opportunity to determine whether their personal data are included in a public directory, and if so, which, to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory, and to verify, correct or withdraw such data. Not being included in a public subscriber directory, verifying, correcting or withdrawing personal data from it shall be free of charge.

3. Member States may require that for any purpose of a public directory other than the search of contact details of persons on the basis of their name and, where necessary, a minimum of other identifiers, additional consent be asked of the subscribers.

4. Paragraphs 1 and 2 shall apply to subscribers who are natural persons. Member States shall also ensure, in the framework of Community law and applicable national legislation, that the legitimate interests of subscribers other than natural persons with regard to their entry in public directories are sufficiently protected.

Article 13

Unsolicited communications

1. The use of automated calling and communication systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent.

2. Notwithstanding paragraph 1, where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details at the time of their collection and on the occasion of each message in case the customer has not initially refused such use.

3. Member States shall take appropriate measures to ensure that unsolicited communications for the purposes of direct marketing, in cases other than those referred to in paragraphs 1 and 2, are not allowed either without the consent of the subscribers or users concerned or in respect of subscribers or users who do not wish to receive these communications, the choice between these options to be determined by national legislation, taking into account that both options must be free of charge for the subscriber or user.

4. In any event, the practice of sending electronic mail for the purposes of direct marketing which disguise or conceal the identity of the sender on whose behalf the communication is made, which contravene Article 6 of Directive 2000/31/EC, which do not have a valid address to which the recipient may send a request that such communications cease or which encourage recipients to visit websites that contravene that Article shall be prohibited.

5. Paragraphs 1 and 3 shall apply to subscribers who are natural persons. Member States shall also ensure, in the framework of Community law and applicable national legislation, that the legitimate interests of subscribers other than natural persons with regard to unsolicited communications are sufficiently protected.

6. Without prejudice to any administrative remedy for which provision may be made, inter alia, under Article 15a(2), Member States shall ensure that any natural or legal person adversely affected by infringements of national provisions adopted pursuant to this Article and therefore having a legitimate interest in the cessation or prohibition of such infringements, including an electronic communications service provider protecting its legitimate business interests, may bring legal proceedings in respect of such infringements. Member States may also lay down specific rules on penalties applicable to providers of electronic communications services which by their negligence contribute to infringements of national provisions adopted pursuant to this Article.

Article 14

Technical features and standardisation

1. In implementing the provisions of this Directive, Member States shall ensure, subject to paragraphs 2 and 3, that no mandatory requirements for specific technical features are imposed on terminal or other electronic communication equipment which could impede the placing of equipment on the market and the free circulation of such equipment in and between Member States.

2. Where provisions of this Directive can be implemented only by requiring specific technical features in electronic communications networks, Member States shall inform the Commission in accordance with the procedure provided for by Directive 98/34/EC of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on information society services ().

3. Where required, measures may be adopted to ensure that terminal equipment is constructed in a way that is compatible with the right of users to protect and control the use of their personal data, in accordance with Directive 1999/5/EC and Council Decision 87/95/EEC of 22 December 1986 on standardisation in the field of information technology and communications ().

Article 14a

Committee procedure

1. The Commission shall be assisted by the Communications Committee established by Article 22 of Directive 2002/21/EC (Framework Directive).

2. Where reference is made to this paragraph, Article 5a(1) to (4) and Article 7 of Decision 1999/468/EC shall apply, having regard to the provisions of Article 8 thereof.

3. Where reference is made to this paragraph, Article 5a(1), (2), (4) and (6) and Article 7 of Decision 1999/468/EC shall apply, having regard to the provisions of Article 8 thereof.

Article 15

Application of certain provisions of Directive 95/46/EC

1. Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.

1a. Paragraph 1 shall not apply to data specifically required by Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks () to be retained for the purposes referred to in Article 1(1) of that Directive.

1b. Providers shall establish internal procedures for responding to requests for access to users' personal data based on national provisions adopted pursuant to paragraph 1. They shall provide the competent national authority, on demand, with information about those procedures, the number of requests received, the legal justification invoked and their response.

2. The provisions of Chapter III on judicial remedies, liability and sanctions of Directive 95/46/EC shall apply with regard to national provisions adopted pursuant to this Directive and with regard to the individual rights derived from this Directive.

3. The Working Party on the Protection of Individuals with regard to the Processing of Personal Data instituted by Article 29 of Directive 95/46/EC shall also carry out the tasks laid down in Article 30 of that Directive with regard to matters covered by this Directive, namely the protection of fundamental rights and freedoms and of legitimate interests in the electronic communications sector.

Article 15a

Implementation and enforcement

1. Member States shall lay down the rules on penalties, including criminal sanctions where appropriate, applicable to infringements of the national provisions adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for must be effective, proportionate and dissuasive and may be applied to cover the period of any breach, even where the breach has subsequently been rectified. The Member States shall notify those provisions to the Commission by 25 May 2011, and shall notify it without delay of any subsequent amendment affecting them.

2. Without prejudice to any judicial remedy which might be available, Member States shall ensure that the competent national authority and, where relevant, other national bodies have the power to order the cessation of the infringements referred to in paragraph 1.

3. Member States shall ensure that the competent national authority and, where relevant, other national bodies have the necessary investigative powers and resources, including the power to obtain any relevant information they might need to monitor and enforce national provisions adopted pursuant to this Directive.

4. The relevant national regulatory authorities may adopt measures to ensure effective cross-border cooperation in the enforcement of the national laws adopted pursuant to this Directive and to create harmonised conditions for the provision of services involving cross-border data flows.

The national regulatory authorities shall provide the Commission, in good time before adopting any such measures, with a summary of the grounds for action, the envisaged measures and the proposed course of action. The Commission may, having examined such information and consulted ENISA and the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC, make comments or recommendations thereupon, in particular to ensure that the envisaged measures do not adversely affect the functioning of the internal market. National regulatory authorities shall take the utmost account of the Commission's comments or recommendations when deciding on the measures.

Article 16

Transitional arrangements

1. Article 12 shall not apply to editions of directories already produced or placed on the market in printed or off-line electronic form before the national provisions adopted pursuant to this Directive enter into force.

2. Where the personal data of subscribers to fixed or mobile public voice telephony services have been included in a public subscriber directory in conformity with the provisions of Directive 95/46/EC and of Article 11 of Directive 97/66/EC before the national provisions adopted in pursuance of this Directive enter into force, the personal data of such subscribers may remain included in this public directory in its printed or electronic versions, including versions with reverse search functions, unless subscribers indicate otherwise, after having received complete information about purposes and options in accordance with Article 12 of this Directive.

Article 17

Transposition

1. Before 31 October 2003 Member States shall bring into force the provisions necessary to comply with this Directive. They shall forthwith inform the Commission thereof.

When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. The methods of making such reference shall be laid down by the Member States.

2. Member States shall communicate to the Commission the text of the provisions of national law which they adopt in the field governed by this Directive and of any subsequent amendments to those provisions.

Article 18

Review

The Commission shall submit to the European Parliament and the Council, not later than three years after the date referred to in Article 17(1), a report on the application of this Directive and its impact on economic operators and consumers, in particular as regards the provisions on unsolicited communications, taking into account the international environment. For this purpose, the Commission may request information from the Member States, which shall be supplied without undue delay. Where appropriate, the Commission shall submit proposals to amend this Directive, taking account of the results of that report, any changes in the sector and any other proposal it may deem necessary in order to improve the effectiveness of this Directive.

Article 19

Repeal

Directive 97/66/EC is hereby repealed with effect from the date referred to in Article 17(1).

References made to the repealed Directive shall be construed as being made to this Directive.

Article 20

Entry into force

This Directive shall enter into force on the day of its publication in the Official Journal of the European Communities.

Article 21

Addressees

This Directive is addressed to the Member States.

# data[].attributes.attachment_link.readable_text
Backgroud information

Following a complaint about the conditions for depositing cookies on "bing.com", the CNIL carried out several investigations on the website in September 2020 and May 2021.

It found that when users visited this site, cookies were deposited on their terminal without their consent, while these cookies were used, among others, for advertising purposes. It also observed that there was no button allowing to refuse the deposit of cookies as easily as accepting it.

As a result, the restricted committee, the CNIL body responsible for issuing sanctions, fined MICROSOFT IRELAND OPERATIONS LIMITED €60 million, which was made public.

It justified this amount by the scope of the processing, the number of data subjects and the profits the company made from advertising profits indirectly generated from the data collected via cookies.

In addition to the administrative fine, the restricted committee also issued an order with periodic penalty payment requiring that the company collects, on the website "bing.com", the consent of individuals residing in France, within three months, before depositing cookies and tracers with advertising purposes on their terminal. Otherwise, the company may pay a penalty of 60,000 euros per day overdue.

Breaches of the French Data Protection Act

The restricted committee found breaches of Article 82 of the French Data Protection Act.

The deposit of cookies without prior consent of the user

When users visited the search engine "bing.com", a cookie with several purposes, including the fight against advertising fraud, was automatically deposited on their terminal without any action on their part.

Furthermore, when they kept browsing the search engine, a cookie with an advertising purpose was placed on their terminal, again without their consent being collected.

However, the law requires that this type of cookies be deposited only after the users have expressed their consent.

The absence of a compliant means of collecting consent for the deposit of cookies

While the search engine offered a button to accept cookies immediately, it did not offer an equivalent solution (button to refuse or other) to allow the Internet user to refuse them as easily. Two clicks were needed to refuse all cookies, while only one was needed to accept them.

The restricted committee noted that making the refusal mechanism more complex actually discourages users from refusing cookies and encourages them to prefer the ease of the consent button in the first window. It considered that such a procedure infringed the freedom of consent of Internet users.

The restricted committee concluded that the conditions for obtaining consent that were offered to users until the introduction of a " Refuse All" button on 29 March 2022, constituted a breach of the law.

Jurisdiction of the CNIL

The CNIL is materially competent to verify and sanction operations related to cookies deposited by the company on the terminals of Internet users located in France. The cooperation mechanism provided for by the GDPR (the "one-stop shop" mechanism) is not intended to apply in these procedures insofar as the operations linked to the use of cookies fall within the scope of the " ePrivacy " directive, transposed in Article 82 of the French Data Protection Act.

The restricted committee considered that the CNIL is also territorially competent because the use of cookies is carried out within the "framework of the activities" of the company MICROSOFT FRANCE, which constitutes the "establishment" on French territory of the MICROSOFT group.
Note: MICROSOFT IRELAND OPERATIONS LIMITED, whose head office is in Ireland, presents itself as the controller of the "bing.com" search engine in the European region. MICROSOFT FRANCE is the establishment in France of the Microsoft group.

# data[].attributes.attachment_link.title
Cookies: MICROSOFT IRELAND OPERATIONS LIMITED fined 60 million euros

# data[].attributes.attachment_link.description
Backgroud information Following a complaint about the conditions for depositing cookies on "bing.com", the CNIL carried out several investigations on the website in September 2020 and May 2021. It found that when users visited this site, cookies were deposited on their terminal without their consent, while these cookies were used, among others, for advertising purposes.

# data[].attributes.attachment_link.readable_text
Why a reform of ePrivacy legislation?

European legislation needs to keep up with the fast pace at which IT-based services are developing and evolving.

The Commission has started a major modernisation process of the data protection framework over the past few years, which culminated in the adoption of the General Data Protection Regulation (GDPR). The ePrivacy legislation needs to be adapted to align with these new rules.

Key points of the Commission's proposal

The Commission adopted the ePrivacy Regulation proposal in 2017. In the same year, the European Parliament adopted a report and gave the mandate to the rapporteur to begin interinstitutional negotiations.

The proposal for a regulation for ePrivacy rules for all electronic communications includes:

New players: privacy rules will in the future also apply to new players providing electronic communications services such as WhatsApp, Facebook Messenger and Skype. This will ensure that these popular services guarantee the same level of confidentiality of communications as traditional telecoms operators.

Stronger rules: all people and businesses in the EU will enjoy the same level of protection of their electronic communications through this directly applicable regulation. Businesses will also benefit from one single set of rules across the EU.

Communications content and metadata: privacy is guaranteed for communications content and metadata. Metadata - data that describes other data, such as author, date created and location- has a high privacy component and should be anonymised or deleted if users did not give their consent, unless the data is needed for billing.

New business opportunities: once consent is given for communications data to be processed, traditional telecoms operators will have more opportunities to provide additional services and to develop their businesses. For example, they could produce heat maps indicating the presence of individuals. These could help public authorities and transport companies when developing new infrastructure projects.

Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies that improve internet experience, such as cookies to remember shopping-cart history or to count the number of website visitors.

Protection against spam: this proposal bans unsolicited electronic communications by email, SMS and automated calling machines. Depending on national law people will either be protected by default or be able to use a do-not-call list to stop marketing phone calls. Marketing callers will need to display their phone number or use a special prefix that indicates a marketing call.

More effective enforcement: the enforcement of the confidentiality rules in the Regulation will be the responsibility of data protection authorities, already in charge of the rules under the GDPR.

The review process

Ahead of preparing the new proposal, the Commission organised a series of workshops with stakeholders and ran an online public consultation. A full report of the public consultation has been published and is available to the public for more information.

A survey was conducted in July 2016 to gather the views of citizens. An impact assessment, supported by a study, was carried out and the resulting draft regulation was adopted.

# data[].attributes.attachment_link.description
The European Commission's proposal for a Regulation on ePrivacy aims at reinforcing trust and security in the digital world.