Paul Voigt, Axel von dem Bussche: the EU ePrivacy Regulation – Preliminary Guidance and Commentary
Menü
Paul Voigt, Axel von dem Bussche: the EU ePrivacy Regulation – Preliminary Guidance and Commentary
1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.
2. The power to adopt delegated acts referred to in Article 8(4) shall be conferred on the Commission for an indeterminate period of time from [the data of entering into force of this Regulation].
3. The delegation of power referred to in Article 8(4) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Inter-institutional Agreement on Better Law-Making of 13 April 2016.
5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.
6. A delegated act adopted pursuant to Article 8(4) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.
(41) In order to fulfil the objectives of this Regulation, namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the Union, the power to adopt acts in accordance with Article 290 of the Treaty should be delegated to the Commission to supplement this Regulation. In particular, delegated acts should be adopted in respect of the information to be presented, including by means of standardised icons in order to give an easily visible and intelligible overview of the collection of information emitted by terminal equipment, its purpose, the person responsible for it and of any measure the end-user of the terminal equipment can take to minimise the collection. It is of particular importance that the Commission carries out appropriate consultations and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 2016[1]. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. Furthermore, in order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission when provided for by this Regulation. Those powers should be exercised in accordance with Regulation (EU) No 182/2011.
Art. 25 ePrivacy Regulation confers the power to adopt delegated acts pursuant to Art. 8 Sec. 4 ePrivacy Regulation to the European Commission. This corresponds with Art. 290 Sec. 1 TFEU, pursuant to which a legislative act may delegate the power to adopt non-legislative acts of general application to the Commission.[1] Such acts are subordinate to primary and secondary legislation (i.e., regulations and directives) under Art. 288 Secs. 1 to 3 TFEU and, thus, qualify as so-called tertiary legislation.[2] They may serve to supplement or amend certain non-essential elements of the delegating legislation. This shall relieve both the European Parliament (Art. 14 TEU) and the Council (Art. 16 TEU) with respect to more detailed questions.[3]
Within Art. 25 ePrivacy Regulation, the legislator makes use of this possibility, delegating the specification of so-called standardized icons pursuant to Art. 8 Secs. 3, 4 ePrivacy Regulation to the Commission. Doing so, it merely stipulates the procedural requirement for the adoption of acts and their formal effects pursuant to Art. 290 Sec. 1 S. 2 TFEU. This namely concerns the temporal validity of the delegation (Sec. 2), the possibility and conditions for a revocation of the delegation (Sec. 3), the consultation of experts (Sec. 4), the notification of the European Parliament and Council (Sec. 5), as well as, finally, the entry into force of the delegated act (Sec. 6).
[1] Cf. also Rec. 41 S. 1 ePrivacy Regulation.
[2] Cf. Louven, in: Taeger/Gabel, DSGVO – BDSG – TTDSG (2022), Art. 92 Rec. 1; Pauly, in: Paal/Pauly, DS-GVO BDSG (2021), Art. 92 Rec. 1.
[3] Schiedermair, in: Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht (2019), Art. 92 Rec. 1; Pauly, in: Paal/Pauly, DS-GVO BDSG (2021), Art. 92 Rec. 1.
While Art. 25 ePrivacy Regulation specifies the formal and procedural requirements, Art. 8 Sec. 4 ePrivacy Regulation contains the actual delegation. Pursuant to Art. 8 Sec. 2 ePrivacy Regulation, the collection of information emitted by terminal equipment of the end-user, which enables it to connect to another device or to network equipment, is prohibited, except for cases of inter alia prior consent (Art. 8 Sec. 2 lit. b ePrivacy Regulation) or a necessity for statistical purposes (Art. 8 Sec. 2 lit. c ePrivacy Regulation).[4] In case of the latter, justification requires a clear and prominent notice, which shall be displayed on the edge of the area of coverage and inform end-users about the respective operation prior to entering the defined area (see Art. 8 Sec. 2a ePrivacy Regulation and its corresponding Rec. 25 S. 7 ePrivacy Regulation). This notice shall explain the purpose, the person responsible and the existence of any measure available to minimize the collection of end-user data (cf. also Rec. 41 S. 2 ePrivacy Regulation). In order to “give a meaningful overview of the collection in an easily visible, intelligible and clearly legible manner”, Art. 8 Sec. 3 ePrivacy Regulation, moreover, requires the collector to provide the information in combination with so-called standardized icons. These are subject to the delegation of Art. 8 Sec. 4 ePrivacy Regulation, which empowers the Commission to determine the required information to be displayed and the procedures for providing standardized icons.
The respective act must comply with the specific scope of delegation and not go beyond it.[5] Accordingly, the specification, can, e.g., only stipulate the design and content of respective icons, not, however, the obligation to display them per se. If the Commission does not respect these limitations, the delegated act violates the empowerment and is ineffective.[6]
[4] For details, see Art. 8 No. II.
[5] Schiedermair, in: Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht (2019), Art. 92 Rec. 6.
[6] Schiedermair, in: Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht (2019), Art. 92 Rec. 6.
The power to adopt delegated acts is valid for an indeterminate period of time, starting from the ePrivacy Regulation’s entry into force. Pursuant to Art. 29 Sec. 1 ePrivacy Regulation, this is defined as the twentieth day following its publication in the Official Journal of the European Union. The definition of an indeterminate period of time does not conflict with the obligation to determine the duration of the delegation pursuant to Art. 290 Sec. 1 S. 2 Var. 4 TFEU, since it only requires the definition as a such and does not stipulate a maximum in length.[7]
[7] Different argument with reference to the power to revoke the delegation made by Herbst, in: Kühling/Buchner, DS-GVO BDSG (2020), Art. 92 Rec. 8.
Corresponding to the legislative power of the European Parliament and Council to authorize the Commission in adopting delegated acts, the delegation pursuant to Art. 8 Sec. 4 ePrivacy Regulation may, conversely, be revoked at any time. Pursuant to Art. 290 Sec. 2 TFEU in conjunction with Art. 231 TFEU the Parliament decides by simple majority. Art. 16 Sec. 3, 4 TEU in conjunction with Art. 238 Sec. 2 TFEU requires the Council to decide by a qualified majority of at least 72 % of its members (as long as the latter represent a minimum of 65 % of the total population of the European Union).[8]
By revocation, the underlying power of the Commission to adopt the act ends and prohibits any further acts or changes to already existing ones. Art. 25 Sec. 3 S. 4 ePrivacy Regulation explicitly states that the revocation, however, does not affect the validity of any of such adopted acts due to a prior exercise of the delegation. Such might be changed or overridden later by the European Parliament or Council.
[8] Herbst, in: Kühling/Buchner, DS-GVO BDSG (2020), Art. 92 Rec. 9.
Due to Rec. 41 S. 4 and Art. 25 Sec. 4 ePrivacy Regulation, it is considered particularly important for the Commission to carry out appropriate consultations in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 2016 (‘Agreement’).[9] This sets out the practical arrangements, clarifications and preferences applicable to delegations of legislative power under Art. 290 TFEU. On the same token, it constitutes the basis for any implementation of provisions on the exercise of delegations within European law-making.[10] Due to No. II.1. of the Annex to the Agreement, the Commission initiates the consultation, whereas the Member States send out their respective experts. The choice of experts is subject to the discretion of the Member States. Experts either meet within the framework of existing groups or via ad hoc meetings, for which the Commission sends respective invitations. These shall include the draft of the delegated act, an agenda and determine a sufficient frame of time for preparation. Pursuant to No II.5. of the Annex to the Agreement, the Commission has discretion about how they will take experts’ views into consideration and how they intend to proceed subsequent to the consultation. A summary of the process shall, eventually, be included in the explanatory memorandum accompanying the delegated act.
[9] Interinstitutional Agreement between the European Parliament, the Council of the European Union and the European Commission on better law-making of 13 April 2016, available at https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016Q0512(01)&from=EN, last retrieved 28 June 2022.
[10] Cf. Annex to the Agreement No. I.1.
In order to allow for an equal participation in the preparation of delegated acts and to prevent a temporal shift in the rights to objection and revocation between institutions, the Commission shall notify the European Parliament and the Council simultaneously and provide all documents at the same time.[11] The notification initiates a deadline of two months for objections under Art. 25 Sec. 6 ePrivacy Regulation. What is more, the Parliament’s and the Council’s experts shall have access to meetings of the Commission’s expert groups pursuant to Art. 25 Sec. 4 ePrivacy Regulation, when dealing with the preparation of the delegated act.[12] This stipulation bases on the Framework Agreement on relations between the European Parliament and the European Commission pursuant to Art. 295 TFEU.[13] It stipulates that the Commission shall invite experts of the Parliament on request to meetings. This invitation is now regulated mandatorily within Art. 25 Sec. 5 ePrivacy Regulation in conjunction with Rec. 41 S. 4 ePrivacy Regulation.
[11] Rec. 41 S. 4 ePrivacy Regulation; see also Pauly, in: Paal/Pauly, DS-GVO BDSG (2021), Art. 92 Rec. 21, referencing Council of the European Union, Common Understanding on delegated acts of 10 April 2011, 8753/11, Rec. 14 et seqq.
[12] Rec. 41 S. 4 ePrivacy Regulation.
[13] Framework Agreement on relations between the European Parliament and the European Commission of 20 November 2011, L 304/47, available at https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?
uri=OJ:L:2010:304:0047:0062:EN:PDF, last retrieved 28 June 2022.
Starting with the notification by the Commission under Art. 25 Sec. 5 ePrivacy Regulation, the European Parliament and Council are provided with a period of two months to object to the proposal for a delegated act under Arts. 8 Sec. 4, 25 ePrivacy Regulation. If the provided time frame does not suffice an adequate preparation, the Parliament or Council can initiate an extension of the period by two other months (Art. 25 Sec. 6 S. 2 ePrivacy Regulation). If no objection is expressed or the proposal is confirmed, the act enters into force pursuant to Art. 25 Sec. 6 ePrivacy Regulation. In deciding on the respective opinion, stipulations on the simple and qualified majority apply, as mentioned above, pursuant to Art. 231 TFEU and Arts. 16 Secs. 3, 4 TEU in conjunction with Art. 238 Sec. 2 TFEU.[14]
The right to object represents a second form of limiting the power to adopt delegated acts besides the option of revocation as per Art. 25 Sec. 3 ePrivacy Regulation.[15] However, in contrast to the right to revocation, an objection does not aim at completely taking away the power to adopt delegated acts.[16] Rather, it only hinders the entry into force of a particular proposal, which may later be replaced by a new one, following the procedure under Art. 25 ePrivacy Regulation.
[15] Pauly, in: Paal/Pauly, DS-GVO BDSG (2021), Art. 92 Rec. 22.
[16] Pauly, in: Paal/Pauly, DS-GVO BDSG (2021), Art. 92 Rec. 22.