Article 6a ePrivacy Regulation [previous Art. 6(3)] – Permitted processing of electronic communications content

Electronic communications content may be processed by providers of electronic communications networks and services on the basis of Article 6a Sec. 1 lit. a) ePrivacy Regulation if this processing serves the provision of a service that has been requested by the affected end-user. Additionally, the end-user requesting the service must have effectively consented to the processing of electronic communications content (for a definition of consent and the requirements for its effectiveness see Art. 4a No. I.). Art. 6a Sec. 1 lit. a) ePrivacy Regulation requires the consent of only one of the communicating parties, provided that the other requirements of the permission are met. Thus, if two end-users are involved in a communications process and potentially affected by the exchanged content, processing can take place lawfully even if only one of them has effectively consented to it. Consent must meet the requirements set out in Art. 4a ePrivacy Regulation.

a) Another person concerned

The notion ‘another person concerned’ in Art. 6a Sec. 1 lit. a) ePrivacy Regulation, whose rights and interests are to be taken into account before processing electronic communications content is somewhat unclear. Due to the broad wording, it is conceivable here that not only communication partners, but also third parties who have not participated in the communication process but are nevertheless affected by its content are covered. Such interpretation is supported by the fact that the permission avoids the usual terminology of the ePrivacy Regulation, which normally refers to ‘end-users’ or the ‘parties involved in a communication’.^[4] Furthermore, it is conceivable that the interests of a third party uninvolved in the communications process are adversely affected by exchanged communications content, e.g. because private information of a person is disclosed and this person is also identified in the course of the communication.

Although the wording of the permission allows for such a broad interpretation, such interpretation would severely restrict the processing possibilities of providers and the possibilities of further service development and optimisation. Such restriction of the business operations of the latter would contradict one of the regulatory objectives of the ePrivacy Regulation (Art. 1 No. I.1.b). It is also questionable how providers are supposed to check and guarantee the protection of fundamental rights and interests of such uninvolved parties who might not be easily accessible to them in practice. The protection of third parties uninvolved in a communication process arguably also exceeds the protective scope of Art. 5 ePrivacy Regulation, which explicitly seeks to ensure the protection of electronic communications data relating to the communicating end-users. Recital 2, which emphasises the special need for protection of electronic communications content, refers only to the persons involved in the communication process and, thus, limits the personal scope of protection. Finally, Recital 16b, which refers to the permission of Art. 6a Sec. 1 lit. a) ePrivacy Regulation, deviates from the wording of the latter and is limited to the fundamental rights and interest of the end-user concerned. By definition, end-users are parties who use an electronic communications service, which implies application only to the communicating parties. Although the divergent wording of a Recital cannot be decisive for the application of a statutory provision, it will have a relevant effect on its interpretation. Thus, ‘another person concerned’ pursuant to Art. 6a Sec. 1 lit. a) ePrivacy Regulation refers to other parties involved in a communication process, but not to third parties.

b) Protection of fundamental rights and freedoms

Art. 6a Sec. 1 lit. a) ePrivacy Regulation refers to the necessary protection of fundamental rights and interests of persons other than the requesting end-users. The question arises as to which specific rights and interests are to be covered by this provision. In particular, it seems reasonable to assume that only privacy-related interests of these persons, as determined in Art. 7 CFR and relating to the confidentiality of communications should be included. These are the rights and interests that the ePrivacy Regulation primarily intends to protect (Art. 1 No. I.1.). However, this regulatory focus does not necessarily imply a general limitation of the protective functions of the ePrivacy Regulation. Rather, the protection of the confidentiality of electronic communications content has an impact on the effective exercise and enjoyment of various other fundamental rights (Art. 1 No. I.1.). The protection of the confidentiality of electronic communication content, therefore, inherently serves and implies the protection of other fundamental rights and freedoms and should therefore not be applied entirely separately from them.

In general, Art. 6a Sec. 1 lit. a) ePrivacy Regulation arguably ought to be interpreted restrictively and narrowly, i.e. in the sense of the broadest possible protection of affected end-users. This is because the ePrivacy Regulation is based on the premise that electronic communications content may only be processed with the consent of all end-users concerned.^[5] This concept is partially undermined within the permission of Art. 6a Sec. 1 ePrivacy Regulation. This, thus, not only represents an exception to the general prohibition of Art. 5 but also to the general commitment to consent. Due to this exceptional character, the permission must be applied with restraint and with the best possible respect for the end-user interests in order to retain necessary and adequate safeguards. Accordingly, all fundamental rights should be covered by the requirement of Art. 6a Sec. 1 lit. a) ePrivacy Regulation to provide for adequate protection and, thus, assessed by electronic communications service and network providers who are relying on this provision. This includes rights and interests that do not necessarily appear to be privacy-related, such as freedom of religion or expression.

Art. 6a Sec. 1 lit. a) ePrivacy Regulation does not clarify how the providers of electronic communications networks and services that are addressed by the permission are supposed to ensure that such fundamental rights and interests are not adversely affected by the intended processing of electronic communications content.

One way to avoid a violation of fundamental rights and interests might be to inform the non-consenting parties about the intended processing and thereby give them the opportunity to object to it. However, this does not seem feasible. Informing all end-users will often involve an effort equivalent to obtaining consent. Based on Recital 19, the processing of electronic communications content should be facilitated in order to enable the effective use of certain services, which is why only the user requesting this service has to give consent. Also, in comparison to Art. 6 Sec. 1 lit. b) ePrivacy Regulation, the participation of other end-users is not necessarily required under the conditions of Art. 6 Sec. 1 lit. a) ePrivacy Regulation in order to render the permission applicable. It must therefore be possible for providers of electronic communications networks and services to process communication content on the basis of Art. 6a Sec. 1 lit. a) ePrivacy Regulation without being required to interact with all parties involved in the communication.

It will arguably not be possible to determine with certainty whether or not fundamental rights and interests of non-consenting parties involved in a communication process will be infringed and to guarantee that such infringements are avoided. However, there are measures that providers of electronic communications services and networks seeking to rely on the permission of Art. 6a Sec. 1 lit. a) ePrivacy Regulation can take in order to reduce the processing risks and mitigate harm. The need to introduce adequate safeguards is addressed in Recital 16a. First, it is advisable to introduce particularly strict deletion concepts with regard to electronic communications content (see Art. 6 No. III.1.). Recital 16b underlines that the processing of electronic communications content under the conditions of Art. 6 Sec. 1 lit. a) ePrivacy Regulation may be carried out strictly and exclusively to the extent necessary for the requested service. In many cases, this will mean that the processed communications content will have to be deleted immediately after the provision of the requested service and will not be retainable beyond that (e.g. in the case of translation assistants, no retention beyond or after translation).^[6]

Additionally, the implementation of highly sophisticated technical and organisational measures following the example of Art. 32 GDPR will be necessary to meet the requirement of sufficient protection of fundamental rights and freedoms within Art. 6a Sec. 1 lit. a) ePrivacy Regulation and in order to ensure a level of security that is appropriate to the high risk associated with the processing of electronic communications content.^[7] Another conceivable measure, also based on the model of the GDPR, might be the appointment of a data protection officer who is responsible for the risk assessment and management of any concerns and requests of affected end-users in connection with processing of electronic communications content. Finally, even in the context of Art. 6a Sec. 1 lit. a) ePrivacy Regulation, the performance of a data protection impact assessment might be reasonable in order to evaluate the risks posed by the intended processing for the rights and interests of non-consenting persons.

The data protection impact assessment as a necessary protection measure for the processing of electronic communications content is expressly provided for in Art. 6a Sec. 2 ePrivacy Regulation, but only for processing on the basis of Art. 6a Sec. 1 lit. b) and, thus, not for Art. 6a Sec. 1 lit. a) ePrivacy Regulation (Art. 6a No. III.). While this measure is not explicitly provided for as a necessary precondition, Art. 6a Sec. 2 ePrivacy Regulation does not exclude a data protection impact assessment in the context of Art. 6a Sec. 1 lit. b). Generally, a data protection impact assessment might be considered suitable for the classification of risks as required for non-consenting end-users in the context of Art. 6a Sec. 1 lit. a), as it is precisely a preventive measure designated to prevent the occurrence of violations of individual rights. Part of the minimum requirements for a data protection impact assessment as set out in Art. 35 Sec. 7 GDPR – as applicable in the context of the ePrivacy Regulation (Art. 6a No. III.) – is the assessment of the impact to the rights and freedoms of the data subjects, i.e. end-users respectively as within the scope of the ePrivacy Regulation (Art. 4 No. I.2.e).^[8] Depending on the specifics of the individual case, it may therefore be advisable to carry out such a data protection impact assessment in connection with the permission of Art. 6a Sec. 1 lit. a) as well (see in this regard at Art. 6 No. II.4.).

c) Services requested by the consenting end-user

Art. 6a Sec. 1 lit. a) ePrivacy Regulation does not specify what kind of service must be concerned by the request of the consenting end-user in order for the permission to apply. In particular, the wording is not limited to electronic communications services as defined in Art. 4 Sec. 1 lit. b) ePrivacy Regulation. It is therefore conceivable that the permission of Art. 6 Sec. 1 lit. a) ePrivacy Regulation applies even if other services are requested from providers of electronic communications services or networks.^[9] Recital 16b refers to services facilitating end-users’ everyday life such as a personal assistant, translation services and services enabling the inclusion of persons with disabilities. The ‘services’ referred to in Art. 6a Sec. 1 lit. a) ePrivacy Regulation are therefore expressly not limited to electronic communications services.

Art. 6a Sec. 1 lit. a) requires that the requested service must be provided for purely individual use of the end-user only. This excludes services that are used commercially, industrially or on a large scale by the end-users, and exceed the average individual use in everyday life. In most cases, this restriction is likely to exclude legal persons as requesting end-users in terms of Art. 6a Sec. 1 lit. a) ePrivacy Regulation.

[4] Cf. recital 1, Art. 6a Sec. 1 lit. b) ePrivacy Regulation.

[5] Recital 16a.

[6] Cf. Kiparski in: Specht/Mantz, Handbuch Europäisches und Deutsches Datenschutzrecht (2019), § 18 para. 72.

[7] This is also explicitly provided for in Art. 8 Sec. 2b) for data collections from end-user terminal equipment that are considered particularly risk-prone, Art. 8.

[8] Cf. Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 49.

[9] Cf. Kiparski in: Specht/Mantz, Handbuch Europäisches und Deutsches Datenschutzrecht (2019), § 18 para. 72.

On the basis of Art. 6a Sec. 1 lit. b) ePrivacy Regulation, providers of electronic communications services or networks may process electronic communications content regardless of the underlying purpose if the processing purposes are clearly predetermined and all end-users concerned have consented to the processing. Thus, in contrast to Art. 6a Sec. 1 lit. a) ePrivacy Regulation, consent must be obtained from all end-users and not only of the end-user initiating the processing. However, there is freedom to determine the purposes of processing. These purposes only need to be specified and defined prior to the beginning of the processing activities.

All parties to a communication process are regarded as end-users. Consequently, providers relying on the permission of Art. 6a Sec. 1 lit. b) ePrivacy Regulation are required to obtain the consent of all communicating parties.^[10] Such consent must meet all general validity requirements and, in particular, must be informed, voluntary and withdrawable at any time (Art. 4a No. VIII.).^[11] The relevant purposes of the processing must be defined before the start of the processing activity in question. In order to meet the validity requirements of consent and, in particular, sufficient information, it will be necessary to determine the processing purposes when consent is obtained, at the latest, as the processing purposes must be covered by the information to be provided to the end-users prior to obtaining their consent (Art. 4a IV.4.). These purposes must not be subsequently changed – this would require obtaining new consent from all end-users involved in the communications process. Other than for the processing of electronic communications metadata in Art. 6c, the ePrivacy Regulation does not provide for a possibility to process electronic communications content for further compatible purposes.^[12]

Recital 16a suggests that the processing of communications content in cases of Art. 6a Sec. 1 lit. b) is limited to content in transit, i.e. may not continue beyond the communication process. As an example for processing of electronic communications content in transit, Recital 16a  refers to services that entail the scanning of emails to remove certain pre-defined material.^[13] It is questionable whether this implication can genuinely be interpreted as a mandatory restriction. Such interpretation would limit the scope of application of the permission of Art. 6a Sec. 1 lit. b) ePrivacy Regulation significantly.

[10] Recital 16a.

[11] Recital 16a.

[12] Here, again, a similarity between the means of protection of electronic communications content in the ePrivacy Regulation and the protection of special categories of personal data pursuant to Art. 9 GDPR can be observed. The latter categories of personal data are also to be excluded from the possibility of further processing pursuant to Art. 6 Sec. 4 lit. c) GDPR.

[13] Recital 16a.