Kiri

Industry-wide Amendments on the Croatian Presidency’s proposal for a Regulation 6543/20 from 6 March 2020 Brussels, 18 March 2020 Article 8 Protection of end-users' terminal equipment information stored in and related to end-users’ terminal equipment 1. The use of processing and storage capabilities of terminal equipment and the collection of information from end-users’ terminal equipment, including about its software and hardware, other than by the end-user concerned shall be prohibited, except on the following grounds: (a) it is necessary for the sole purpose of carrying out the transmission of an electronic communication over an electronic communications network; or (b) the end-user has given his or her consent.; or (c) it is necessary for providing an information society service requested by the end- user; or (d) if it is necessary for web audience measuring, provided that such measurement is carried out by the provider of the information society service requested by the end- user or by a third party, or by third parties jointly, on behalf of the one or more providers of the information society service provided that conditions laid down in Article 28, or where applicable Article 26, of Regulation (EU) 2016/679 are met; or (da) it is necessary to maintain or restore the security of information society services or terminal equipment of the end-user, prevent fraud or detect technical faults for the duration necessary for that purpose; or (e) it is necessary for a software update provided that: (i) such update is necessary for security reasons and does not in any way change the privacy settings chosen by the end-user are not changed in any way, (ii) the end-user is informed in advance each time an update is being installed, and (iii) the end-user is given the possibility to postpone or turn off the automatic installation of these updates; or (f) it is necessary to locate terminal equipment when an end-user makes an emergency communication either to the single European emergency number ‘112’ or a national emergency number, in accordance with Article 13(3). (g) it is necessary for the purpose of the legitimate interests pursued by a service provider to use processing and storage capabilities of terminal equipment or to collect information from an end-user’s terminal equipment, except when such interest is overridden by the interests or fundamental rights and freedoms of the end-user. The end-user’s interests shall be deemed to override the interests of the service provider where the end user is a service is directly aimed to a child or where the service provider processes, stores or collects the information to specifically determine the nature and characteristics of the personally identified specific end-user or to build an individual profile attributed to of the end-user or the processing, storage or collection of the information by the service provider contains special categories of personal data as referred to in Article 9(1) of Regulation (EU) 2016/679. Where the service provider processes, stores or collects the information to determine the nature and characteristics of the end-user or to build an individual profile of the end-user , the data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her and shall have the right not to be subject to a decision based solely on automated processing, which produces legal effects concerning him or her or similarly significantly affects him or her in accordance with respectively article 21 and article 22 of Regulation (EU) 2016/679. Justification In the digital environment and specifically on the open web, it is difficult to asses whether amongts the readers of a publication which is freely available online there are children. As such, for a more practical approach and more legal certainty for digital players, we suggest that Member States consider the restriction regarding minors, as an alligment with the GDPR, by providing that the minors’ interest shall override when the services of the provider are aimed at children as their primary audience. Furthermore, regarding content providers and their capacity to personalise and adapt their offerings to an individual user by creating user profiles, the GDPR contains the necessary safeguards to ensure that users are sufficently protected, while allowing service providers enough flexibility in order to personalise their offerings. As such, we suggest an alligment with Articles 21 and 22 of the GDPR which ensure user with the same right to object to certain type of processing at any time during the process. 1a. Service providers using processing and storage capabilities of the end-user’s terminal equipment or collecting information from the end-user’s terminal equipment pursuant to paragraph 1(g) shall may share the information with any third party other than its processors, acting in accordance with Article 28 of Regulation (EU) 2016/679 mutatis mutandis, unless it has been made anonymous and provided that appropriate technical and organisational measures such as, but not limited to pseudonymisation and encryption are applied. Prior to any use of processing or storage facilities in, or collection of information from the end- user’s terminal equipment, the service provider shall: Justification The requirement to anonymise data before it is shared with third parties, as proposed by the Croatian Presidency, would go further than what the GDPR requires and unduly restrict the use of legitimate interest for the media industry online (e.g. in comparison with the offline world). The inherent limitations to the use of legitimate interest under GDPR, coupled with the additional requirements introduced by this new Regulation (see following subparagraphs (a), (b) and (c)) already provide strong safeguards for users’ privacy. In particular, pseudonomysation and encryption ensure an adequate level of privacy for the user while providing an enforceable solution for service providers that would produce warranted results, while the obligation to carry out a DPIA would ensure that users’ rights are duly considered and protected, and that publishers can be held accountable. Alternative propsal Art. 8 para 1 a: 1a. Service providers using processing and storage capabilities of the end-user’s terminal equipment or collecting information from the end-user’s terminal equipment pursuant to paragraph 1(g) shall may share the information with any third party other than its processors, provided that conditions laid down in acting in accordance with Article 28 or where applicable Article 26, of Regulation (EU) 2016/679 are met mutatis mutandis, unless it has been made anonymous and appropriate technical and organisational measures such as, but not limited to, pseudonymisation and encryption are applied. Prior to any use of processing or storage facilities in, or collection of information from the end-user’s terminal equipment, the service provider shall: Justification While the reasoning behind our alternative proposal remains the same as for our first proposal. Nonetheless, because Article 26 relates to joint controllership, it could imply substantial challanges in practice for the press sector. (a) carry out an assessment of the impact of the use of the processing and storage capabilities or the collection of information from the end-users’ terminal equipment and of the envisaged processing on the confidentiality of communications and the privacy of end-users in accordance with Article 35 of Regulation (EU) 2016/679, which may result in the prior consultation of the supervisory authority in accordance with Article 36(1) to (3) of Regulation (EU) 2016/679; (b) inform the end-user of the envisaged processing operations based on paragraph 1(g) and of the end-user’s right to object to such processing, free of charge, at any time, and in an easy and effective manner; and c) implement appropriate technical and organsational measures, such as pseudonymisation and encryption. 1b. For the purposes of paragraph 1 point (b), consent may be expressed by continuing the use of an information society service, having been provided with  clear and comprehensive information that this action by the end-user signifies consent. Access to website content may still be made conditional on the well- informed acceptance of a cookie or similar device, technologies if it is used for a legitimate purpose Justification It is becoming increasingly clear that the fragmented interpretations of the GDPR by the DPAs in Member States are creating uncertainty for content producers. As such, we find it necessary to use the opportunity given by the introduction of an ePrivacy Regulation to harmonise the interpretation of consent across MS, in order to acquire MS, the judiciary, bussinesses and consumers with more legal certainty. Furthermore, the possibility to condition access to services remains of utmost importance to the media sector. We remain concerned with the deletion of any reference to conditionality in recital 20. Conditionality should be acknowledged as a full right for the media sector and therefore placed in the body of the legislation. 2. The collection of information emitted by terminal equipment of the end-user to enable it to connect to another device and, or to network equipment shall be prohibited, except if on the following grounds: (a) it is done exclusively in order to, for the time necessary for, and for the purpose of establishing or maintaining a connection; or (b) the end-user has given his or her consent; or (c) it is necessary for the purpose of statistical counting that is limited in time and space to the extent necessary for this purpose and the data is made anonymous or erased as soon as it is no longer needed for this purpose, (d) it is necessary for providing a service requested by the end-user. (b)2a. For the purpose of paragraph 2 points (b) and (c), a clear and prominent notice is shall be displayed informing of, at least, the modalities of the collection, its purpose, the person responsible for it and the other information required under Article 13 of Regulation (EU) 2016/679 where personal data are collected, as well as any measure the end-user of the terminal equipment can take to stop or minimise the collection. 2b. For the purpose of paragraph 2 points (b) and (c), Tthe collection of such information shall be conditional on the application of appropriate technical and organisational measures to ensure a level of security appropriate to the risks, as set out in Article 32 of Regulation (EU) 2016/679, have been applied. 3. The information to be provided pursuant to point (b) of paragraph 2a may be provided in combination with standardized icons in order to give a meaningful overview of the collection in an easily visible, intelligible and clearly legible manner. 4. The Commission shall be empowered to adopt delegated acts in accordance with Article 257 determining the information to be presented by the standardized icon and the procedures for providing standardized icons. (20a) End-users are often requested to provide consent to the storage and access to stored data in their terminal equipment, due to the ubiquitous use of tracking cookies and similar tracking technologies. As a result, end-users may be overloaded with requests to provide consent. This can lead to a situation where consent request information is no longer read and the protection offered by consent is undermined. Implementation of technical means in electronic communications software to provide specific and informed consent through transparent and user-friendly settings, can be useful to address this issue. Where available and technically feasible, an end user may therefore grant, through software settings, consent to a specific provider for the use of processing and storage capabilities of his or her terminal equipment for one or multiple specific purposes across one or more specific services of that provider. For example, an end-user can give consent to the use of certain types of cookies by whitelisting one or several providers for their specified purposes. Providers of software are encouraged to include settings in their software which allows end-users, in a user friendly and transparent manner, to manage consent to the storage and access to stored data in their terminal equipment by easily setting up and amending whitelists and withdrawing consent at any moment.(21) Exceptions to the obligation to obtain consent to make uUse of the processing and storage capabilities of terminal equipment or to access to information stored in terminal equipment without the consent of the end-user should be limited to situations that involve no, or only very limited, intrusion of privacy. For instance, consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of providing a specific service explicitly requested by the end-user. This may include the storing of cookies for the duration of a single established session on a website to keep track of the end-user’s input when filling in online forms over several pages, authentication session cookies used to verify the identity of end-users engaged in online transactions or cookies used to remember items selected by the end-user and placed in shopping basket. In the area of IoT services which rely on/deploy connected devices (such as connected thermostats, connected medical devices, smart meters or automated and connected vehicles), the use of the processing and storage capacities of those devices and access to information stored therein should not require consent to the extent that such use or access is necessary for the provision of the service requested by the end-user. For example, storing of information in or accessing information from a smart meter might be considered as necessary for the provision of a requested energy supply service to the extent the information stored and accessed is necessary for the stability and security of the energy network or for the billing of the end-users' energy consumption In some cases the use of processing and storage capabilities of terminal equipment and the collection of information from end-users' terminal equipment may also be necessary for providing an information society service, requested by the end-user, such as services provided to safeguard freedom of expression and information including for journalistic purposes, such as online newspaper or other press publications as defined in Article 2(4) of Directive (EU) 2019/790, that is wholly or mainly financed by advertising provided that, in addition, the end-user has been provided with clear, precise and user-friendly information about the purposes of cookies or similar techniques and has accepted such use To the extent that use is made of processing and storage capabilities of terminal equipment and information from end-users’ terminal equipment is collected for other purposes than for what is necessary for the purpose of carrying out the transmission of an electronic communication over an electronic communications network or for the provision of the service requested, consent should be  required. In such a scenario, consent should normally be given by the end-user who requests the service from the provider of the service. (21a) Cookies can also be a legitimate and useful tool, for example, in assessing the effectiveness of a delivered information society service, for example of website design and advertising or by helping to measureing web traffic to the numbers of end-users visiting a website, certain pages of a website or the number of end- users of an application. This is not the case, however, regarding cookies and similar identifiers used to determine the nature of who is using the site, which always require the consent of the end-user. Information society providers that engage in configuration checking to provide the service in compliance with the end- user's settings and the mere logging of the fact that the end-user’s device is unable to receive content requested by the end-user should not constitute access to such a device or use of the device processing capabilities. (21b) The legitimate interests of a service provider could provide a legal basis to use processing and storage capabilities of terminal equipment or to collect information from an end-user’s terminal equipment, provided that such interests are not overridden by the interests or the fundamental rights and freedoms of the end-user, taking into consideration the reasonable expectations of end-users based on her or his their relationship with the provider. The demonstration of a legitimate interest requires careful assessment, in particular whether an end- users can reasonably expect that the use of processing and storage capabilities of her or his their terminal equipment or the collection of information from it, may take place. Only if the results of the balancing test undertaken by the service provider demonstrate that its legitimate interest is not overridden by the interests and the fundamental rights and freedoms of the end-user, can the service provider rely on that legal basis. A legitimate interest could be relied upon where the end-users could reasonably expect such storage, processing or collection of information in or from her or his their terminal equipment in the context of an existing customer relationship with the service provider. For instance, maintaining or restoring the security of information society services or of the end-user’s terminal equipment, or  preventing fraud or detecting technical faults might consititute a legitimate interest of the service provider. Similarly, using the processing storage capabilities of terminal equipment is to fix security vulnerablities and other security bugs, provided that such updates do not in any way change the functionality of the hardware or software or the privacy settings chosen by the end-user and the end-user has the possibility to postpone or turn off the automatic installation of such updates. Software updates that do not exclusively have a security purpose, for example those intended to add new features to an application or improve its performance, should not be considered as a legitimate interest. A legitimate interest could also be relied upon by a service provider whose website content or services are accessible without direct monetary payment and wholly or mainly financed by advertising, provided that these services safeguard the freedom of expression and information including for journalistic purposes, such as online newspaper or other press publications as defined in Article 2(4) of Directive (EU) 2019/790, or audiovisual media services as defined in Article 1(1)(a)(i) of Directive 2010/13/EU1, or radio programmes as mentioned in Directive 2019/789/EU, and the end-user has been provided with clear, precise and user-friendly information about the purposes of the cookies or similar techniques used and has accepted been given the right to object. Making access to website content provided without direct monetary payment dependent on the consent of the end-user to the storage and reading of cookies or similar devices for additional purposes would normally not be considered as depriving the end-user of a genuine choice if the end-user is able to choose between services, on the basis of clear, precise and user-friendly information about the purposes of cookies and similar techniques. Conversely, in some cases, making access to website content dependent on consent to the use of such cookies may be considered, in the presence of a clear imbalance between the end-user and the service provider as depriving the end-user of a genuine choice. This would normally be the case for websites providing certain services, such as those provided by public authorities 1 As amended by Directive (EU) 2018/1808  Conversely, a provider should not be able to rely upon legitimate interests if the storage or processing of information in the end-user’s terminal equipment or the information collected from it were to be used to determine the nature or characteristics on an specific end-user or to build an individual profile of for attribution to an specific end-user. In such cases, the end-user’s interests and fundamental rights and freedoms override the interest of the service provider, as such processing operations can seriously interfere with one's private life, for instance when used for segmentation purposes, to monitor or segment the behaviour of a specific end-user or to draw conclusions concerning his or her private life. A legitimate interest should not exist if the information stored or processed in, or collected from, an end-user’s terminal equipment includes special categories of personal data, as referred to in Article 9 (1) of Regulation (EU) 2016/679. Consent should not be necessary either when the purpose of using the processing storage capabilities of terminal equipment is to fix security vulnerablities and other security bugs, provided that such updates do not in any way change the functionality of the hardware or software or the privacy settings chosen by the end-user and the end-user has the possibility to postpone or turn off the automatic installation of such updates. Software updates that do not exclusively have a security purpose, for example those intended to add new features to an application or improve its performance, should not fall under this exception. Justification Recital 21b rightly recognizes services which safeguard the freedom of expression and information, including for journalistic purpose. Press publications, audiovisual media services but also radio should be able to rely on a legitimate interest for the processing of data. In order to align Recital 21b with the introduction of legitimate interest as a basis for processing the user “has been given the right to object", in order to ensure consistency with the balance of interest test and the language used in Recital 21c. We also propose wording which clarifies the possibility for service providers to make access to their content conditional to the acceptance of cookies, aligning the Recital with our proposal in Article 8.1b. (21c) Where a service provider invokes a legitimate interest, certain additional conditions should be met and safeguards should be respected, including an impact assessment and where appropriate the consultation of the supervisory authority by the service provider. In addition, the service provider may not share the information with third parties other than its processors, only in accordance with Article 28 of Regulation (EU) 2016/679, unless it has been previously anonymised provided that appropriate technical and organisational measures such as pseudonymisation and encryption are applied. The service provider should, where necessary, implement appropriate security measures, such as encryption and pseudonymisation to ensure privacy of the end-users. Moreover, the end-user should be provided with information about these processing operations taking place and be given the right to object to such operations. Justification The changes brought to Recital 21 c are to ensure coherence with our suggested changes for Article 8.1a. Alternative Proposal Recital 21 c (21c) Where a service provider invokes a legitimate interest, certain additional conditions should be met and safeguards should be respected, including an impact assessment and where appropriate the consultation of the supervisory authority by the service provider. In addition, the service provider should not share the information with third parties other than its processors, only in accordance with Article 28, or where applicable Article 26, of Regulation (EU) 2016/679, unless it has been previously anonymised provided that appropriate technical and organisational measures such as pseudonymisation and encryption are applied. The service provider should, where necessary, implement appropriate security measures, such as encryption and pseudonymisation to ensure privacy of the end-users. Moreover, the end-user should be provided with information  about these processing operations taking place and be given the right to object to such operations. Justification The changes brought to the alternative proposal for a Recital 21 c are to ensure coherence with our suggested alternative changes for Article 8.1a, while providing for a clear alignment with the provisions in the GDPR. Yours sincerely, Ilias Konteas Ilias Konteas Angela Mills Wade Matt Payton EMMA ENPA EPC AER Ilias.konteas@magazi [email protected] Angela.Mills- matt.payton@aer nemedia.eu [email protected] europe.org Dr. Bernd Nauen Mathilde Fiquet Agata Nowacka Conor Murray AIG FEDMA AMC EGTA [email protected] [email protected] [email protected] [email protected] u m Jana Břeská Amélien Delahaie Townsend Feehan SPIR Geste IAB Europe [email protected] [email protected] [email protected] To the Attention of Mr. Butković, Croatian Minister Maritime Transport, Infrastructure Brussels, 04 March 2020 Dear Mr. Butković We write to you on behalf of the associations EMMA (European Magazine Media Association), ENPA (European Newspaper Publishers’ Association), EPC (European Publishers’ Council), AER (Association of European Radios), ACT (Association of Commercial Televisions), AIG (Advertising Information Group), AMC (Audience Measurement Coalition), FEDMA (Federation of European Direct and Interactive Marketing), EGTA (Association of television and radio sales houses), GESTE (Les editeurs de contenus et services en ligne), EACA (European Association of Communications Agencies) and SPIR (The Association for Internet Progress) and IAB Europe (Interactive Advertising Bureau Europe), which together represent a large array of interests of the European digital media market, concerning the Croatian Presidency’s proposal on the ePrivacy Regulation amending Articles 6 and 8 and corresponding Recitals. The undersigned associations welcome the introduction of the possibility to access the terminal equipment on the basis of a legitimate interest of the service provider in Article 8, thereby recognising the legitimate interests of advertising-financed digital media. This clearly demonstrates the intention of the Croatian Presidency to ensure proper conditions for the media sector to thrive in the digital environment. Nonetheless, the provisions in Article 8 and corresponding recitals are unfortunately undermined by substantial limitations which go far beyond the standards laid out in the GDPR and deprive the text from the intended benefits of the concept of legitimate interest, as well as its accompanying safeguards already enshrined in the GDPR. In addition, the new provision does not contain all the necessary safeguards to ensure a competition neutral regulation. Therefore, the undersigned associations conclude that while the introduction of legitimate interest as a legal basis is well-intended, its restrictions render it unusable for the European media sector. Unlike many large platforms, the wider ecosystem, including large publishers, rely on third parties as they cannot provide all services in-house. Limiting legally the use of such third parties, puts news and media publishers into a competitive disadvantage. After an analysis of the Croatian Presidency’s latest proposal, we found that the following provisions are the ones which would impede the good intention behind the changes brought in the Croatian Presidency’s proposal from providing financial sustainability of a free and independent media ecosystem in Europe: ● The new Article 8.1(g) authorizes processing to first parties and their processors while excluding joint controllership. The involvement of digital ad-tech would not be possible due to the test established by the CJEU in “Fashion ID GmbH & Co.KG vs Verbraucherzentrale NRW eV” case that provides that the involvement of digital ad-tech parties will trigger joint controllership. The proposal which is intended to align to the GDPR should take this into account and reflect the GDPR standard duly. ● Article 8.1a. provides that the data shared with third parties must be anonymised. Anonymising data cannot be technically fulfilled with regard to the use of identifiers and markers. Instead, it should be sufficient to pseudonymize the data to provide a workable solution while also ensuring a high level of protection for processing operations. ● Recital 21b rightly recognizes services which safeguard the freedom of expression and information, including for journalistic purpose. Press publications, audiovisual media services but also radio should be able to rely on a legitimate interest for the processing of data. We are concerned however with the requirement in the same recital for the end-user to “accept such use”. Instead, it should read “has been given the right to object", in order to ensure consistency with the balance of interest test and the language used in Recital 21c. The possibility to condition access to the services remains of utmost importance to the media sector. We are concerned with the deletion of any reference to conditionality in recital 20. Conditionality should be acknowledged as a full right for the media sector. We welcome the intention of the Presidency to provide a more balanced Regulation in line with the GDPR, while also acknowledging the digital realities of the European media sector. Nonetheless, a more thorough reflection and further discussions are needed to ensure coherence with the GDPR as well as competition neutral solutions. We look forward to constructive discussions with the Council to address the remaining deficiencies of the proposal. Yours sincerely, Ilias Konteas Ilias Konteas Angela Mills Wade Matt Payton EMMA ENPA EPC AER Ilias.konteas@magazine [email protected] matt.payton@aereuro media.eu [email protected] pe.org u Greg Polad di Spadoni Dr. Bernd Nauen Mathilde Fiquet Agata Nowacka ACT AIG FEDMA AMC [email protected] [email protected] [email protected] [email protected] Conor Murray Jana Břeská Amelien Delahaie Tamara Daltroff EGTA SPIR Geste EACA [email protected]@spir.cz [email protected] Tamara.daltroff@eaca. eu Townsend Feehan IAB Europe [email protected] To the Attention of Mr. Tõnis Lukas, Estonian Minister of Culture Brussels, 04 March 2020 Dear Minister, We write to you on behalf of the associations EMMA (European Magazine Media Association), ENPA (European Newspaper Publishers’ Association), EPC (European Publishers’ Council), AER (Association of European Radios), ACT (Association of Commercial Televisions), AIG (Advertising Information Group), AMC (Audience Measurement Coalition), FEDMA (Federation of European Direct and Interactive Marketing), EGTA (Association of television and radio sales houses), GESTE (Les editeurs de contenus et services en ligne), EACA (European Association of Communications Agencies) and SPIR (The Association for Internet Progress) and IAB Europe (Interactive Advertising Bureau Europe), which together represent a large array of interests of the European digital media market, concerning the Croatian Presidency’s proposal on the ePrivacy Regulation amending Articles 6 and 8 and corresponding Recitals. The undersigned associations welcome the introduction of the possibility to access the terminal equipment on the basis of a legitimate interest of the service provider in Article 8, thereby recognising the legitimate interests of advertising-financed digital media. This clearly demonstrates the intention of the Croatian Presidency to ensure proper conditions for the media sector to thrive in the digital environment. Nonetheless, the provisions in Article 8 and corresponding recitals are unfortunately undermined by substantial limitations which go far beyond the standards laid out in the GDPR and deprive the text from the intended benefits of the concept of legitimate interest, as well as its accompanying safeguards already enshrined in the GDPR. In addition, the new provision does not contain all the necessary safeguards to ensure a competition neutral regulation. Therefore, the undersigned associations conclude that while the introduction of legitimate interest as a legal basis is well-intended, its restrictions render it unusable for the European media sector. Unlike many large platforms, the wider ecosystem, including large publishers, rely on third parties as they cannot provide all services in-house. Limiting legally the use of such third parties, puts news and media publishers into a competitive disadvantage. After an analysis of the Croatian Presidency’s latest proposal, we found that the following provisions are the ones which would impede the good intention behind the changes brought in the Croatian Presidency’s proposal from providing financial sustainability of a free and independent media ecosystem in Europe: ● The new Article 8.1(g) authorizes processing to first parties and their processors while excluding joint controllership. The involvement of digital ad-tech would not be possible due to the test established by the CJEU in “Fashion ID GmbH & Co.KG vs Verbraucherzentrale NRW eV” case that provides that the involvement of digital ad-tech parties will trigger joint controllership. The proposal which is intended to align to the GDPR should take this into account and reflect the GDPR standard duly. ● Article 8.1a. provides that the data shared with third parties must be anonymised. Anonymising data cannot be technically fulfilled with regard to the use of identifiers and markers. Instead, it should be sufficient to pseudonymize the data to provide a workable solution while also ensuring a high level of protection for processing operations. ● Recital 21b rightly recognizes services which safeguard the freedom of expression and information, including for journalistic purpose. Press publications, audiovisual media services but also radio should be able to rely on a legitimate interest for the processing of data. We are concerned however with the requirement in the same recital for the end-user to “accept such use”. Instead, it should read “has been given the right to object", in order to ensure consistency with the balance of interest test and the language used in Recital 21c. The possibility to condition access to the services remains of utmost importance to the media sector. We are concerned with the deletion of any reference to conditionality in recital 20. Conditionality should be acknowledged as a full right for the media sector. We welcome the intention of the Presidency to provide a more balanced Regulation in line with the GDPR, while also acknowledging the digital realities of the European media sector. Nonetheless, a more thorough reflection and further discussions are needed to ensure coherence with the GDPR as well as competition neutral solutions. We look forward to constructive discussions with the Council to address the remaining deficiencies of the proposal. Yours sincerely, Ilias Konteas Ilias Konteas Angela Mills Wade Matt Payton EMMA ENPA EPC AER Ilias.konteas@magazine [email protected] matt.payton@aereuro media.eu [email protected] pe.org u Greg Polad di Spadoni Dr. Bernd Nauen Mathilde Fiquet Agata Nowacka ACT AIG FEDMA AMC [email protected] [email protected] [email protected] [email protected] Conor Murray Jana Břeská Amelien Delahaie Tamara Daltroff EGTA SPIR Geste EACA [email protected]@spir.cz [email protected] Tamara.daltroff@eaca. eu Townsend Feehan IAB Europe Saatja: Damian Flisak <[email protected]> Saaja: [email protected], KUL min Teema: RE: E-privacy regulation - EMMA-ENPA Position on the the Croatian Presidency’s proposal on Articles 6 and 8 and the corresponding Recitals Dear Ms. Hommik, I hope this email finds you all well. Although we realize that the current state of affairs creates special circumstances that demand appropriate responses, I took the liberty once again to contact you regarding the Croatian Presidency’s latest ePrivacy proposal. As I have previously communicated, the Croatian Presidency’s proposal was a historical step forward in the right direction. Nonetheless, the press publishers' associations found that the proposed provisions, specifically on legitimate interest, are affected by several restrictions that would have the unwanted effect of rendering the proposal unenforceable in practice. As such, we would like to raise your attention to our suggested improvements to the Croatian Presidency’s proposed text. We strongly believe that our suggestions would allow for a balanced regulation which would satisfy the need for robust privacy rules for consumers on one hand, while maintaining a financially sustainable media sector, on the other. With kind regards and by wishing you all the best, Damian Flisak dr Damian Flisak, LL.M. Head of Group Public Affairs RASM AG Ringier Axel Springer Polska ul. Domaniewska 49 02-672 Warszawa tel (+48) 690 112 045 [email protected] Ringier Axel Springer Polska sp. z o.o. z siedzibą w Warszawie (02-672), ul. Domaniewska 52, zarejestrowana w rejestrze przedsiębiorców Krajowego Rejestru Sądowego prowadzonym przez Sąd Rejonowy dla m. st. Warszawy Wydział XIII Gospodarczy Krajowego Rejestru Sądowego pod numerem KRS 0000420780, z kapitałem zakładowym w kwocie 106.000 zł, NIP: 5272677009, REGON: 146127300. Treść tej wiadomości jest poufna i prawnie chroniona. Odbiorcą może być jedynie jej adresat z wyłączeniem dostępu osób trzecich. Jeżeli nie jesteś adresatem niniejszej wiadomości, jej rozpowszechnianie, kopiowanie, rozprowadzanie lub inne działanie o podobnym charakterze jest prawnie zabronione i może być karalne. Jeżeli wiadomość ta trafiła do Ciebie omyłkowo, uprzejmie prosimy o odesłanie jej na adres nadawcy i usunięcie kopii. From: Damian Flisak Sent: Thursday, February 27, 2020 7:00 PM To: '[email protected]' <[email protected]> Cc: '[email protected]' <[email protected]> Subject: E-privacy regulation - EMMA-ENPA Position on the the Croatian Presidency’s proposal on Articles 6 and 8 and the corresponding Recitals, dated 21 February 2020 Dear Ms. Hommik, I am contacting you again as a member of EMMA and ENPA, which together represent the vast majority of European press sector. Please find enclosed our position concerning the Croatian Presidency’s proposal on Articles 6 and 8 and the corresponding Recitals, dated 21 February 2020. The inclusion of legitimate interest as a legal basis for data processing is a crucial step in the right direction. However, we fear that the various restrictions included in the text create a situation where the provisions fail to achieve a genuine alignment with the GDPR and therefore a workable result for the European press sector. On the contrary, the proposed provisions would de facto favour the platforms with log-in models to the detriment of the free press and all other services in the digital market. In addition, please find enclosed our proposal based on the Croatian Presidency’s text which would allow for a balanced and enforceable provision through a genuine alignment with the GDPR to the benefit of the European press sector. I remain at your disposal for any other information and maintain availability to discuss constructive and workable solutions meant to safeguard and uphold the European press. If you were not the person responsible for contacting as regards the e-privacy regulation, please contact me with the competent person. I'm also ready for a phone call if you let me make one. Yours sincerely, Damian Flisak dr Damian Flisak, LL.M. Head of Group Public Affairs RASM AG Ringier Axel Springer Polska ul. Domaniewska 49 02-672 Warszawa tel (+48) 690 112 045 [email protected] <mailto:[email protected]> Ringier Axel Springer Polska sp. z o.o. z siedzib± w Warszawie (02-672), ul. Domaniewska 52, zarejestrowana w rejestrze przedsiębiorców Krajowego Rejestru S±dowego prowadzonym przez S±d Rejonowy dla m. st. Warszawy Wydział XIII Gospodarczy Krajowego Rejestru S±dowego pod numerem KRS 0000420780, z kapitałem zakładowym w kwocie 106.000 zł, NIP: 5272677009, REGON: 146127300. Tre¶ć tej wiadomo¶ci jest poufna i prawnie chroniona. Odbiorc± może być jedynie jej adresat z wył±czeniem dostępu osób trzecich. Jeżeli nie jeste¶ adresatem niniejszej wiadomo¶ci, jej rozpowszechnianie, kopiowanie, rozprowadzanie lub inne działanie o podobnym charakterze jest prawnie zabronione i może być karalne. Jeżeli wiadomo¶ć ta trafiła do Ciebie omyłkowo, uprzejmie prosimy o odesłanie jej na adres nadawcy i usunięcie kopii. From: Damian Flisak Sent: Wednesday, February 12, 2020 12:30 PM To: [email protected] <mailto:[email protected]> Subject: Deletion of art. 8 - 10 e-Privacy Regulation - position of European Publishers Dear Ms. Hommik, I have been provided with your contact details by EMMA & ENPA, the pan-European organisations of press publishers. Please allow me to contact you as regards the latest developments regarding the e-Privacy Regulation and more concrete: the deletion of Articles 8 - 10. As it is commonly known, the Croatian Presidency – after issuing the non-paper – preferres to align the Regulation with GDPR and therefore to delete Article 8. We support this direction. First, there is no rational justification for further delay in implementing the very important, other parts of the E-privacy regulation to be caused by divergences between Member States as regards the Articles 8 - 10. We also support Croatia's position that the presence of these provisions - and this regardless of their final wording - will in any case lead to undesirable difficulties in determining their relationship with the GDPR. The latter is an act that comprehensively regulates the protection and use of personal data. Such a situation of regulatory dualism would mean a state of permanent legal uncertainty, which is obviously undesirable. It should be beyond dispute that the GDPR provides the highest possible level of protection of personal data and contains a broad legal instrumentation to balance the need for privacy on the one hand, but also to create favourable conditions for a further ecosystem of innovative business solutions on the other. At the same time, should the need for further adaptation to the conditions of use of personal data be identified in the future, GDPR contains appropriate adaptation mechanisms. Another argument in favour of a complete abandonment of the provisions indicated above is that making the user's consent as a basic condition for data processing ("consent-centred") additionally favours today's Internet giants in the competitive struggle. Large Internet platforms which require login for use have their own data resources ("wallet gardens") which are also used for advertising purposes. The implementation of Articles 8 to 10 will only strengthen their supremacy to the online market. As a result, the idea of a digital single market based on equal competition will suffer To summarise the above we – as European Publishers - strongly believe that an alignment with the GDPR is warranted and therefore a deletion of Articles 8-10 is possible and necessary. I remain at your disposal for any additional clarifications regarding our concerns on this file that is one of the keys for the future of a digital economy in Europe. Please let me know if I can meet you in person, or if I can call you. Yours sincerely, Damian Flisak dr Damian Flisak, LL.M. Head of Group Public Affairs RASM AG Ringier Axel Springer Polska ul. Domaniewska 49 02-672 Warszawa tel (+48) 690 112 045 [email protected] <mailto:[email protected]> Ringier Axel Springer Polska sp. z o.o. z siedzib± w Warszawie (02-672), ul. Domaniewska 52, zarejestrowana w rejestrze przedsiębiorców Krajowego Rejestru S±dowego prowadzonym przez S±d Rejonowy dla m. st. Warszawy Wydział XIII Gospodarczy Krajowego Rejestru S±dowego pod numerem KRS 0000420780, z kapitałem zakładowym w kwocie 106.000 zł, NIP: 5272677009, REGON: 146127300. Tre¶ć tej wiadomo¶ci jest poufna i prawnie chroniona. Odbiorc± może być jedynie jej adresat z wył±czeniem dostępu osób trzecich. Jeżeli nie jeste¶ adresatem niniejszej wiadomo¶ci, jej rozpowszechnianie, kopiowanie, rozprowadzanie lub inne działanie o podobnym charakterze jest prawnie zabronione i może być karalne. Jeżeli wiadomo¶ć ta trafiła do Ciebie omyłkowo, uprzejmie prosimy o odesłanie jej na adres nadawcy i usunięcie kopii.