EDPB consultation on e-privacy article 5(3) - Dec 2023
31 Dec 2023
On 18 November 2023, the European Data Protection Board (EDPB) opened-up a consultation on Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive until the 18th of January 2024.
In these Guidelines, "the EDPB addresses the applicability of Article 5(3) of the ePrivacy Directive to different technical solutions. These Guidelines expand upon the Opinion 9/2014 of the Article 29 Working Party on the application of the ePrivacy Directive to device fingerprinting and aim to provide a clear understanding of the technical operations covered by Article 5(3) of the ePrivacy Directive. The emergence of new tracking methods to both replace existing tracking tools (for example, cookies, due to discontinued support for third-party cookies by some browser vendors) and create new business models has become a critical data protection concern. While the applicability of Article 5(3) of the ePrivacy Directive is well established and implemented for some tracking technologies such as cookies, there is a need to address ambiguities related to the application of the said provision to emerging tracking tools".
In its contribution, ID side observed that "not only have “tracking technologies” changed since a decade and the adoption of “Opinion 9/2014 of the Article 29 Working Party on the application of the ePrivacy Directive”, our team enhanced the ways in which consent could be requested, which are a central part of article 5(3) of the ePrivacy Directive. We also noted that these methods have evolved substantially and deserve being reassessed based on state-of-the-art technologies now available.
Our contribution relied on ID side solution (plugin + API), architected to empower individuals:
In these Guidelines, "the EDPB addresses the applicability of Article 5(3) of the ePrivacy Directive to different technical solutions. These Guidelines expand upon the Opinion 9/2014 of the Article 29 Working Party on the application of the ePrivacy Directive to device fingerprinting and aim to provide a clear understanding of the technical operations covered by Article 5(3) of the ePrivacy Directive. The emergence of new tracking methods to both replace existing tracking tools (for example, cookies, due to discontinued support for third-party cookies by some browser vendors) and create new business models has become a critical data protection concern. While the applicability of Article 5(3) of the ePrivacy Directive is well established and implemented for some tracking technologies such as cookies, there is a need to address ambiguities related to the application of the said provision to emerging tracking tools".
In its contribution, ID side observed that "not only have “tracking technologies” changed since a decade and the adoption of “Opinion 9/2014 of the Article 29 Working Party on the application of the ePrivacy Directive”, our team enhanced the ways in which consent could be requested, which are a central part of article 5(3) of the ePrivacy Directive. We also noted that these methods have evolved substantially and deserve being reassessed based on state-of-the-art technologies now available.
Our contribution relied on ID side solution (plugin + API), architected to empower individuals:
- to automatically share their individual privacy reasonable expectations wherever they browse,
- to receive a reduced number of consent requests from first-party and third-party cookie providers (and from providers using URL and pixel tracking, local processing, tracking based on IP only, intermittent and mediated Internet of Things (IoT) reporting, and unique identifiers),
- to assess, whenever they have time and interest to do so, each consent request, based on specific, intelligible and relevant information.