Paul Voigt, Axel von dem Bussche: the EU ePrivacy Regulation – Preliminary Guidance and Commentary 

Article 13 ePrivacy Regulation – Exceptions to presentation and restriction of calling and connected line identification in relation to emergency communications

 

Art. 13 ePrivacy Regulation

Article 13 ePrivacy Regulation Exceptions to presentation and restriction of calling and connected line identification in relation to emergency communications

1. Regardless of whether the calling end-user has prevented the presentation of the calling line identification, where emergency communications are made to emergency services, providers of number-based interpersonal communications services shall override the elimination of the presentation of the calling line identification and the denial or absence of consent of an end-user for the processing of metadata, on a per-line basis for organisations dealing with emergency communications, including public safety answering points, for the purpose of responding to such communications.

1a. Regardless whether the called end-user rejects incoming calls where the presentation of the calling line identification has been prevented by the calling end-user, providers of number-based interpersonal communications services shall override this choice, where technically possible, when the calling end-user is an organisation dealing with emergency communications, including public safety answering points, for the purpose of responding to such communications.

2. 

3. Notwithstanding Article 8(1), regardless of whether the end-user has prevented access to the terminal equipment’s Global Navigation Satellite Systems (GNSS) capabilities or other types of terminal equipment based location data through the terminal equipment settings, when a call is made to emergency services, such settings may not prevent access to GNSS such location data to determine and provide the caller calling end-user’s location to emergency services an organisation dealing with emergency communications, including public safety answering points, for the purpose of responding to such calls.

Art. 13 ePrivacy Regulation

(28) There is justification for overriding the elimination of calling line identification presentation in specific cases. End-users’ rights to privacy with regard to calling line identification should be restricted where this is necessary to trace malicious or nuisance calls and with regard to calling line identification and location data where this is necessary to allow emergency services, such as eCall, to carry out their tasks as effectively as possible. Location information established by the terminal equipment, using its built-in Global Navigation Satellite Systems (GNSS) capabilities or other types of terminal equipment based location data, such as location data derived from the WiFi functionality, may supplement the location data supplied by providers of number-based interpersonal communications services when a call is made to emergency services. The temporary denial or absence of consent of an end-user to access location data provided by the terminal equipment GNSS, for example, because location settings are turned off, shall not prevent the transfer of such information to emergency services for the purposes of facilitating access to such services. Directive 2014/53/EU empowers the Commission to adopt delegated acts requiring that specific categories or classes of radio equipment support certain features ensuring access to emergency services.

Art. 13 ePrivacy Regulation obliges providers of number-based interpersonal communi-cations services[1] to override the restriction of calling line identification presentation (CLIR) and the absence of end-users´ consent into the processing of metadata or location data, in order to allow emergency services to answer calls and carry out theirs tasks effectively.[2] On the one hand, it results from the practical consideration that in emergencies, often both affected and assisting persons find themselves in a physically or psychologically exceptional situation. It cannot be guaranteed that callers are aware of all given device settings, in particular those, that would be required to determine their calling line identification. From the point of view of emergency services, however, these can be decisive to provide assistance in individual cases, e.g. to allow callbacks or, notwithstandingly, to prevent misuse. On the other hand, contact tracing in the course of an effective emergency assistance takes part at a state´s constitutional duty to protect and care for its citizens, which in respective cases outweighs the individual interest in privacy and data protection.[3]

In this respect, Art. 13 ePrivacy Regulation overrides privacy and defines a specific exception in favour of emergency services. It had already been stipulated within Art. 10 lit. b ePrivacy Directive, obliging member states to install transparent procedures, governing the way, in which these would acquire unhindered access to calling line identification. Art. 13 ePrivacy Regulation neither defines, which specific prerequisites, procedures or technical measures providers of number-based interpersonal communications shall observe. Rather, it only stipulates that opposing measures should be ignored, in order to allow for effective handling of emergency communications. Points of reference are found with regard to the sparse initial requirements of the provision. They pertain to an emergency communication with regard to an emergency service (including public safety answering points) and stipulate accordingly that services should override CLIR or a lack of consent to the processing of meta- or location data.

‘Emergency communication’ pursuant to Art. 2 Sec. 38 EECC Directive refers to any communication by means of interpersonal communications services between an end-user and the so-called Public Safety Answering Point (‘PSAP’) with the goal to request and receive emergency relief from emergency services. ‘Emergency services’, withal, mean such services, which are recognised by a Member State and provide immediate, rapid assistance in situations of direct risk to “life or limb, to individual or public health or safety, to private or public property, or to the environment, in accordance with national law”.[4] Art. 10 lit. b ePrivacy Directive exemplifies such services with regard to ambulance services, fire brigades or law enforcement agencies (e.g. the police). The PSAP defines a physical location, where an emergency communication is first received under the responsibility of a public authority or a private organisation recognised by the Member State.

All definitions eventually correlate to the single European emergency call number, which had first been installed by the Council´s decision of 29 July 1991 (91/396/EEC) and later consolidated within Art. 109 EECC Directive.[5] It describes a toll-free emergency call system, that can be reached throughout any Member State in the European Union via the unitary number ‘112’. Member States are free to define the means in order to guarantee access to respective services, however need to ensure that all calls to the number are appropriately answered and handled, at least as effectively as communications to national emergency numbers.[6]

[1] Definition, cf. Art. 2 Sec. 6 EECC Directive; in detail: Art. 4 No. I.2.d), Rec. 57 ff. and Art. 12 No. I.1.

[2] Cf. Rec. 28 ePrivacy Regulation.

[3] In German law, this principle emerges from an interpretation, in which fundamental rights not only serve as a means of defence towards the state, but also in the sense of objective values, which the state must guarantee in various respects, cf. German Federal Constitutional Court, judgement  of 25 February 1975, BVerfGE 39, 1 – Schwangerschaftsabbruch I; in this respect, Ogorek, in: Epping/Hillgruber, Beck OK GG (2021), Art. 10, Rec. 76, as well as with respect to emergency calls Schommertz/Gerhardus, in: Scheurle/Mayen, TKG (2018), § 108, Rec. 1.

[4] Cf. Art. 2 Sec. 39 EECC Directive.

[5] Recital 28 ePrivacy Regulation moreover mentions “eCalls” in this respect. According to Art. 3 Sec. 2 Regulation (EU) 2015/758 of the European Parliament and of the Council of 29 April 2015 concerning type-approval requirements for the deployment of the eCall in-vehicle system based on the 112 service and amending Directive 2007/46/EC, these refer to in-vehicle emergency calls to 112 via public mobile wireless networks, made either automatically via a respective sensor or manually by a passenger.

[6] Art. 109 Sec. 3 EECC Directive.

According to Art. 13 ePrivacy Regulation, services shall override the restriction of calling line identification (CLIR) by the end-user, as well as a possibly present denial of consent to the processing of meta- or location data. Consequently, the provision affects both Art. 12, Art. 5 and Art. 8 ePrivacy Regulation.[7] It is designed as a specific exception, yet not in the form of an authorisation, but rather as a stipulation. Using the word “shall” without additions (as opposed to the terminology within Arts. 6a – 6c and 8 ePrivacy Regulation using “shall be permitted” or “shall be prohibited, except”), the legislator clarifies that emergency services do not have discretion in overriding respective measures. Rather, services are obliged to suspend restrictions any time.

With regard to Art. 13 Sec. 1a ePrivacy Regulation it appears questionable, whether the rejection of calls under CLIR by the called emergency service has a significant scope of application. The provision rather represents an additional obligation to already existing statutory duties, pursuant to which emergency services have to answer calls any time, i.e. no matter, if CLIR is present or not.[8] Moreover, Art. 13 Sec. 1 ePrivacy Regulation already obliges services to decipher CLIR, so that there are only few cases left, in which rejection of calls will be conceivable (e.g., when an override of CLIR is technically unfeasible). Consequently, Art. 13 Sec. 1a ePrivacy Regulation is, if any, declaratory in nature.

Art. 13 Sec. 3 ePrivacy Regulation pertains to the privacy-wise sensitive issue of geolocalisation.[9] Technically, it refers to so called Global Navigation Satellite Systems (GNSS), such as GPS (USA), Beidou (China) and Galileo (European Union), allowing positioning accuracy to the centimetre.[10] In order to do so, the recipient´s device records the repeating signal of four different satellites and determines their respective orbit position.[11] Then, using a phase-locked loop, it measures time and frequency shifts of these signals. Multiplied by the signals´ speed, this generates three space coordinates concerning the distance to the measuring device.[12] Under consideration of a receiver-clock-deficiency, measured using the fourth satellite, this will produce an equation with four unknowns, that can be solved with reference to the respective GNSS coordinate system.[13] This procedure allows for an accurate, integer and continuous determination of positioning data and is used for a multitude of different applications.[14]

Here, locating terminal equipment will be of crucial importance to the performance of emergency help and is legally justified against this background. From a systematic perspective, however, implementation within Art. 13 ePrivacy Regulation is flawed, since it brakes up the specific thematic relation to Art. 8 Sec. 2 ePrivacy Regulation without at the same time offering any apparent advantage. It remains unclear, why emergency-related usage of processing and storage capabilities and the collection of information from end-users´ terminal equipment would find its legal basis in Art. 8 Sec. 1 lit. f ePrivacy Regulation, while justification of information emitted by such devices, as for instance location data, would be assigned to Art. 13 Sec. 3 ePrivacy Regulation. Not least with regard to the thematic correlation between Arts. 13 and 12 ePrivacy Regulation, a consequent systematic attribution to Art. 8 Sec. 2 ePrivacy Regulation would have been preferable.

Against this backdrop, a reallocation of the provision within the framework of the trilogue procedure was proposed. It remains to be seen, yet, whether this amendment will be retained in the final version. Also, changes would affect Sec. 1a, which in this opinion is superfluous anyway. The provision would be omitted without replacement. Instead, however, it is being considered, to implement an exception provision in favour of delegated acts on abusive calls under a new Sec. 2. This (also systematically dubious) proposition will be discussed within the second trilogue, being undertaken currently.

[7] For details see Art. 12 No. I.1., Art. 5 No. I. and Art. 8 No. I.

[8] Cf. § 6 Sec. 1 S. 6 f. Federal State of Baden-Wuerttemberg Emergency Services Act (RDG BW), and, in this respect, Land Baden-Württemberg, Ministerium für Inneres, Digitalisierung und Migration, Aufgaben einer Leitstelle – Aufgabensteckbriefe, Az.: 6-1522.0/19, 4. July 2017, p. 4; as opposed to § 8 Sec. 1 Federal Sate of Berlin Emergency Services Act (RDG Berlin), in which answering of emergency calls will only be guaranteed “regularly”.

[9] Cf. Art. 8 No. II and its corresponding Rec. 25 ePrivacy Regulation.

[10] Cf. EUSPA, The EU Space Programme – “What is GNSS”, https://www.euspa.europa.eu/european-space/eu-space-programme/what-gnss, last retrieved 28 February 2022.

[11] Bundesamt für Kartographie und Geodäsie, Global Navigation Satellite Systems (GNSS), https://www.bkg.bund.de/DE/Observatorium-Wettzell/Messverfahren/Global-Navigation-System/global-navigation-system_cont.html, last retrieved 28 February 2022.

[12] Ibid.

[13] Ibid.

[14] Ibid.

Comment