ePD online survey competent authorities
Introduction to the survey
The European Commission, Directorate-General CONNECT has commissioned Deloitte to carry out an Evaluation and
review of Directive 2002/58 on privacy and the electronic communication sector (SMART 2016/0080).
This Directive is commonly referred to as the ePrivacy Directive (“ePD”). The ePD was adopted with a view to harmonising
national rules in relation to the processing of personal data in the electronic communications sector.
The main objectives of this study are to:
Support the Commission in gathering the evidence needed to evaluate the ePD; and
Assist the Commission in assessing the expected impacts of potential policy options/measures to address
current problems.
As part of this study, Deloitte is carrying out an online survey complementing the European Commission’s public
consultation concerning the ePD.
In contrast to the European Commission’s public consultation, this online survey is only targeted at the national
authorities involved in the implementation of the ePD. On this basis, it includes more detailed questions compared to the
public consultation.
This survey aims to gather your views around the following themes:
Scope of the ePD;
The application of individual provisions;
Obligations and costs for competent authorities;
Key strengths and challenges relating to the ePD; and
Potential policy options/measures to address current problems.
You are kindly invited to take part in this online survey which will take you around 15-20 minutes. However, you may need to
co-operate with other departments or services in your organisation to be able to provide input to the questions relevant to
you.
Your contribution is important for the European Commission in order to evaluate the legislative framework concerning the
protection of privacy in the electronic communications sector and assess whether and how the current framework needs to
be changed.
We will keep your answer confidential; the results of the survey will be only presented in an aggregated way with no
possibility to trace back the results to individual contributions to this survey.
In case of questions related to the substance or practicalities of the questionnaire, please contact Anna Siede
(
[email protected]).
Thank you for your time!
1
ePD online survey competent authorities
Basic information concerning the responding authority
* 1. Please indicate the type of the body/authority you represent.
Ministry
Data protection authority
Regulatory authority (Telecom)
Consumer protection authority
Other (please specify)
* 2. Please indicate the name of the authority you represent.
* 3. Which Member State do you represent?
* 4. Please indicate the geographic level of the authority.
National
Regional
Local
2
ePD online survey competent authorities
Scope of the ePD
* 5. Please indicate your level of agreement with the following statements
relating to the scope of the ePD.
Neither agree nor
Strongly disagree Disagree disagree Agree Strongly agree Cannot answer
The current scope has
ensured that the ePD has
made a significant positive
impact with regard to the
protection of privacy in the
electronic communications
sector in the past
The scope is still relevant
to ensure privacy in the
electronic communications
sector today
The ePD will continue to
have a significant positive
impact with regard to the
protection of privacy in the
electronic communications
sector in the future if the
current scope is kept
ePD online survey competent authorities
Scope of the ePD
3
* 6. Please indicate for the following items relating to the scope of the ePD
whether you consider them a problem and, if so, how serious the
problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
Over-the-top services
(OTTs)* are currently not
covered
* Voice-over IP or instant
messaging over the
internet such as
WhatsApp or Skype
There is a lack of clarity
whether a service
qualifies as a publicly
available electronic
communications services,
e.g. in relation to WIFI
access offered by airports
internet cafes and/or
shopping malls
Private networks are
currently not covered
The distinction between
information society
services and electronic
communication services is
not clear
The scope overlaps with
the newly adopted
General Data Protection
Regulation
The scope covers
services that should not
be covered (you may
specify in the comment
box below)
The list of definitions is
missing items that need to
be clarified, namely (you
may specify in the
comment box below)
Other problems and/or comments
4
ePD online survey competent authorities
Overall assessment of the individual provisions
5
* 7. Please indicate for the following provisions how well they function. For
example, you could consider the number of breaches and complaints
you have received.
Poor Fair Good Very good Excellent Cannot answer
Obligations for service
providers on the security
of processing (Article 4.1)
Notifications in relation to
breaches of security
(Article 4.2)
Notification of personal
data breaches (Article 4.3
and 4.4)
Confidentiality of
electronic communications
(Article 5.1 and 5.2)
Confidentiality of
information stored on the
users’ terminal equipment
(Article 5.3)
Specific rules on traffic
data (Article 6)
Specific rules on location
data other than traffic data
(Article 9)
Itemised billing of invoices
(Article 7)
Presentation and
restriction of calling and
connected line (Article 8)
Automatic call forwarding
(Article 11)
Directories of subscribers
(Article 12)
Unsolicited marketing
communications sent and
received through the
Internet (Article 13)
Comments
6
* 8. Please indicate for the following provisions whether they should be
retained in case the ePD is amended in the future (irrespective of the
type of instrument that would be chosen).
Important to
Important to retain, but with Useful to retain Useful to retain, Does not need to
retain “as is” changes “as is” but with changes be retained Cannot answer
Obligations for service
providers on the security
of processing (Article 4.1)
Notifications in relation to
breaches of security
(Article 4.2)
Notification of personal
data breaches (Article 4.3
and 4.4)
Confidentiality of
electronic communications
(Article 5.1 and 5.2)
Confidentiality of
information stored on the
users’ terminal equipment
(Article 5.3)
Specific rules on traffic
data (Article 6)
Location data other than
traffic data (Article 9)
Itemised billing (Article 7)
Presentation and
restriction of calling and
connected line (Article 8)
Automatic call forwarding
(Article 11)
Directories of subscribers
(Article 12)
Unsolicited marketing
communications sent and
received through the
Internet (Article 13)
Comments
7
ePD online survey competent authorities
Security of processing and notification of personal data breaches (Article 4)
9. Does your authority deal with the rules on the security of processing
and notification of personal data breaches (Article 4)?
Yes
No
ePD online survey competent authorities
Security of processing and notification of personal data breaches (Article 4)
8
* 10. Please indicate for the following types of breaches how often they
occur.
Please provide an estimate based on the overall proportion of cases.
10 – less than 50 – less than
Never Less than 10% 50% 80% More than 80% Cannot answer
Personal data was
accessed by unauthorised
personnel and/or for
purposes that were not
legally authorised
Personal data stored or
transmitted was subject to
accidental, unauthorised
or unlawful destruction,
loss, alteration or
disclosure (incl. data
leakage, unlawful sharing
with third parties)
Personal data was subject
to accidental, unauthorised
or unlawful storage or
processing (e.g. storage
for a longer time period
than allowed)
No specific security policy
as referred to in Article
4(1a) was implemented by
the service provider
Consent options of data
subject/subscriber were
overlooked, not monitored
or not complied with
Users’ computers/laptops
were accessed without
their consent
Other (please specify)
Other (please specify)
9
* 11. Please indicate for the following items how often they occur in
relation to the obligation of service providers to notify the competent
authority and users about personal data breaches.
Please provide an estimate based on the overall proportion of cases.
10 – less than 50 – less than
Never Less than 10% 50% 80% More than 80% Cannot answer
The service provider fails
to notify the authority
The notification to the
authority is sent with delay
The content of the
notification to the authority
is incomplete/missing
relevant information
The service provider fails
to notify the user
The notification to the user
is sent with delay
The content of the
notification to the user is
incomplete/missing
relevant information
The service provider fails
to introduce adequate
protection measures
The service provider fails
to reply or replies with
delay in subsequent
requests for clarification
The service provider does
not provide a mitigation
plan
Other (please specify)
Other (please specify)
10
* 12. Has your authority adopted guidance on the implementation of
Article 4 of the ePD relating to the security of service?
The authority is not competent to adopt guidance
No guidance was adopted
Yes, guidelines
Yes, instructions for service providers
Yes, recommendations on best practices
Guidance was adopted in another format (please specify)
* 13. Please indicate for the following items whether you consider them a
problem in relation to the rules on the security of processing and, if so,
how serious this problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
The obligations for
competent authorities
relating to personal data
breaches are too
burdensome, e.g.
because there are several
obligations of the same
nature under different
instruments
Different authorities are
involved in dealing with
personal data breaches
My authority is not able to
issue sanctions in case of
personal data breaches
The rules on the
notification of personal
data breaches are no
longer needed, as this is
already dealt with in the
General Data Protection
Regulation and upcoming
regulation (i.e. Network
and Information Security
Directive)
Other problems and/or comments
11
ePD online survey competent authorities
Confidentiality of electronic communications (Article 5.1 and 5.2)
* 14. Please indicate for the following items relating to the confidentiality
of electronic communications whether you consider them a problem
and, if so, how serious this problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
The wording of this
provision is not in line with
modern technologies
It is not sufficiently clear
what type
of communications data is
in scope
The transposition of this
article varies across
Member States despite
the minimum standards
laid down in this Directive
It is not clear what the
type of consent should be
how this can/should be
obtained practically
The meaning of
“commercial transaction”
is not clear and it may be
interpreted differently by
Member States
Other problems and/or comments
12
ePD online survey competent authorities
Confidentiality of information stored on the users’ terminal equipment (Article 5.3)
13
* 15. Please indicate for the following items relating to the confidentiality
of information stored on the users’ terminal equipment whether you
consider them a problem and, if so, how serious this problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
The rules are vague and
leave a lot of room for
interpretation to the
competent authorities
It is not always clear
whether a given consent
is valid, e.g. if given via
the configuration of
browser settings
It is practically difficult to
our authority to give
guidance on how to
implement the consent
rules
If implemented, the rules
result in over-complicated
and lengthy user notices
The consequences of
giving consent is not clear
to all users (e.g. the
possibility of tracking)
Users do not have a real
choice, as websites often
deny access to websites if
cookies are refused
The rules are not
sufficiently broad to
capture new mechanisms,
such as “WiFi tracking”
It is not clear who needs
to comply with this
provision, the website
owner or the third parties
setting the cookies
Other problems and/or comments
14
ePD online survey competent authorities
Specific rules on traffic data (Article 6)
* 16. Please indicate for the following items relating to the rules on traffic
data whether you consider them a problem and, if so, how serious this
problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
There are cases where
traffic and location data
are used without consent,
e.g. email providers are
allowed to set up filtering
systems to safeguard the
security of their services
It is difficult to determine
how long traffic data
should be retained,
leading uncertainty for the
authority and/or
unnecessary storage of
traffic data by businesses
The relationship to other
instruments, such as
national data retention
laws, is not clear
Enforcement of the rules
on traffic data is not
effective
Other problems and/or comments
15
ePD online survey competent authorities
Location data other than traffic data (Article 9)
* 17. Please indicate for the following items relating to location data other
than traffic data whether you consider them a problem and, if so, how
serious this problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
The notice requirements
cannot be easily
implemented (e.g. cause
lengthy and detailed user
communications)
It is not clear how often
consent has to be
provided if the user asks
frequently the added-
value service
There is no need to have
detailed provisions about
location data and consent
requirements upon
providers who are
anyhow subject to the
General Data Protection
Regulation
Other problems and/or comments
ePD online survey competent authorities
Itemised billing (Article 7)
16
* 18. Please indicate for the following items relating to itemised billing
whether you consider them a problem and, if so, how serious this
problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
The rules pose problems
in relation to service
contracts concluded by
employers for their
employees, e.g. the right
to the employee’s privacy
may be endangered if the
employer needs itemised
billing
It is not specified in the
ePD whether service
providers are allowed to
charge subscribers for
changing the presentation
of bills (e.g. from non-
itemised billing to itemised
or vice versa)
It is unclear what type of
privacy enhancing
methodologies the ePD
implies
It is unclear if the privacy
enhancing examples
spelled out in the ePD
(Recital 33) are widely
implemented by service
providers
Other problems and/or comments
ePD online survey competent authorities
Presentation and restriction of calling and connected line (Article 8)
17
* 19. Please indicate for the following items relating to the presentation
and restriction of calling and connected line whether you consider them
a problem and, if so, how serious this problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
There is a lack of clarity
relating to how these
rules can be applied in
relation to service
contracts concluded by
employers for their
employees
It is unclear how the
providers should inform
the public about the
presentation of calling
and/or connected line
identification, where
offered (e.g. make explicit
reference of these
possibilities on providers’
privacy statement)
It is unclear how providers
or authorities should
respond to
users/subscribers who
want to know who gave a
call or through which line
the call came in if there is
a restriction to identify the
calling and connected line
The restrictions of this
article are not sufficient
now as they apply only to
telephony services
These obligations for
service providers are no
longer relevant, as some
of the aspects covered by
this provision are
available to users as
functions on modern cell
phones
Other problems and/or comments
18
ePD online survey competent authorities
Automatic call forwarding (Article 11)
* 20. Please indicate for the following item relating to automatic call
forwarding whether you consider them a problem and, if so, how serious
this problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
It is unclear which
safeguards should be
provided for subscribers
against the nuisance
caused by automatic call
forwarding by others
Other problems and/or comments
ePD online survey competent authorities
Directories of subscribers (Article 12)
19
* 21. Please indicate for the following items relating to directories of
subscribers whether you consider them a problem and, if so, how
serious this problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
The conditions under
which a consent is valid
and how the consent
should be delivered are
not clear
In practice, service
providers fail to inform
subscribers of their
inclusion in a public
directory or if they do so,
they are not transparent
enough (e.g. in privacy
statements)
The provision leaves it
open to Member States to
require additional consent
in some situations (Article
12.3), leading to divergent
practices and confusion
Other problems and/or comments
ePD online survey competent authorities
Unsolicited marketing communications sent and received through the Internet (Article 13)
20
* 22. Please indicate for the following items relating to unsolicited
marketing communications whether you consider them a problem and, if
so, how serious this problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
The conditions according
to which it is possible to
send direct marketing
emails to users are not
clear, e.g. whether it is
sufficient to simply
browse in an online shop
The content of direct
marketing emails is not
clear, e.g. because it is
not clear what is meant by
similar products and
services to those that
were bought and when
the “customer”
relationship starts
The ePD leaves it open to
Member States to decide
whether legal persons are
protected by an opt-in or
opt-out regime, leading to
divergent transposition
There are problems in
relation to marketing calls
to phone numbers that
have been ported
Other problems and/or comments
ePD online survey competent authorities
Enforcement
21
* 23. Please indicate for the following items relating to the enforcement of
the ePD whether you consider them a problem and, if so, how serious
this problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
The transposition of the
substantial rules varies
between the Member
States
The Member States have
designated different types
of authorities for the
implementation of the
ePD
In my country, more than
one authority has
responsibilities in relation
to the ePD
In other countries, more
than one authority has
responsibilities in relation
to the ePD
The Article 29 Working
Party and the future
European Data Protection
Board (EDPB) only
represent data protection
authorities and thus not
all national competent
authorities
The ePD does not yet
sufficiently address
potential cooperation
mechanisms for
complaints of cross-
border data processing
There is a lack of human
resources to deal with the
aspects related to the
ePD in my authority
There is a lack of financial
resources to deal with the
aspects related to the
ePD in my authority
Other problems and/or comments
22
ePD online survey competent authorities
Obligations and costs for competent authorities
* 24. What technical and organisational measures did your authority have
to carry out initially in order to fulfil your responsibilities in relation to the
ePD?
Issuing guidance
Setting up IT structures
Developing procedures to implement tasks, such as dealing with notifications
Other (please specify)
23
* 25. Which tasks does your authority carry out regularly in relation to the
ePD?
Preventive audits of individual service providers to check whether service providers comply with the security obligations
Preventive audits of individual service providers to check whether service providers comply with their notification obligations
Audits of individual service providers based on complaints
Dealing with a personal data breach of one service provider (Article 4), including reviewing notifications and reacting
Sanctioning of individual service providers
Drafting one new guidance document
Updating one existing guidance document
Developing recommendations on good practices
Delivering one training course on the application of the Directive
Organising an information campaign
Other (please specify)
ePD online survey competent authorities
Costs for competent authorities
* 26. How often does your authority carry out the previously selected
tasks in relation to the ePD?
24
More than 15
times per year
1-5 times per 6-10 times per 11-15 times per (please specify
One-off year year year below) Cannot answer
Preventive audits of
individual service
providers to check
whether service providers
comply with the security
obligations
Preventive audits of
individual service
providers to check
whether service providers
comply with their
notification obligations
Audits of individual service
providers based on
complaints
Dealing with a personal
data breach of one service
provider (Article 4),
including reviewing
notifications and reacting
Sanctioning of individual
service providers
Drafting one new guidance
document
Updating one existing
guidance document
Developing
recommendations on good
practices
Delivering one training
course on the application
of the Directive
Organising an information
campaign
[Insert text from Other]
Comment(s)
25
* 27. Please indicate the time consumed for each of the elements
identified in the previous question.
2 weeks or more
Less than 1 1 day – less than 3 days – less 1 week – less (please specify
working day 3 days than a week than two weeks below) Cannot answer
Preventive audits of
individual service
providers to check
whether service providers
comply with the security
obligations
Preventive audits of
individual service
providers to check
whether service providers
comply with their
notification obligations
Audits of individual service
providers based on
complaints
Dealing with a personal
data breach of one service
provider (Article 4),
including reviewing
notifications and reacting
Sanctioning of individual
service providers
Drafting one new guidance
document
Updating one existing
guidance document
Developing
recommendations on good
practices
Delivering one training
course on the application
of the Directive
Organising an information
campaign
[Insert text from Other]
Comment(s)
26
* 28. What are the main cost factors in relation to the ePD?
Please select up to three items.
Preventive audits of individual service providers to check whether service providers comply with the security obligations
Preventive audits of individual service providers to check whether service providers comply with their notification obligations
Audits of individual service providers based on complaints
Dealing with a personal data breach of one service provider (Article 4), including reviewing notifications and reacting
Sanctioning of individual service providers
Drafting one new guidance document
Updating one existing guidance document
Developing recommendations on good practices
Delivering one training course on the application of the Directive
Organising an information campaign
[Insert text from Other]
* 29. How many FTE* are working with tasks related to the ePD in your
authority?
* FTE stands for full time equivalent and equals to the hours worked by one employee on a full-time basis. In practice, one FTE position may be shared by
more than one person (e.g. two persons working 20 hours per week equal one FTE).
Less than 1 FTE
1-2 FTE
3-5 FTE
6-9 FTE
10 or more, please specify
Other (please specify)
27
* 30. What is the annual budget available for your authority to deal with
the tasks related to the ePD? Please indicate an estimated average or
the actual amount for the year 2015 in Euro.
Estimated average amount
Actual amount (2015)
ePD online survey competent authorities
Key strengths and challenges relating to the ePD
28
* 31. Please indicate your level of agreement with the following
statements.
The specific rules on privacy in the electronic communications sector
introduced by the ePD:
Neither agree nor
Strongly disagree Disagree disagree Agree Strongly agree Cannot answer
Have significantly helped
to ensure the protection of
personal data
Have significantly helped
to ensure the free
movement of personal
data within the internal
market
Have significantly helped
to ensuring the free
movement of electronic
communication terminal
equipment and services in
the EU
Comment(s)
29
* 32. Please indicate for the following items whether you consider them a
problem hindering the success of the ePD and, if so, how serious this
problem is.
Not at all a problem Minor problem Moderate problem Serious problem Cannot answer
The scope of the ePD is
too narrow
The scope of the ePD is
too broad
The ePD is not coherent
with other legal
instruments, such as the
GDPR
The legal framework on
privacy in the electronic
communications sector is
too complex, as the rules
are contained in different
instruments (e.g. GDPR,
Framework Decision)
Divergences in
transposition between the
Member States
There is lack of clarity of
individual provisions
Enforcement are not
effective
There is lack of
awareness among service
providers
There is lack of
awareness among
users/subscribers
Other problems and/or comments
ePD online survey competent authorities
Potential policy options/measures to address current problems
30
* 33. Please indicate which policy measures you consider useful with a
view to solving the challenges you identified.
Additional guidance at EU level
Exchange of good practices in relation to enforcement mechanisms
Practical support to the competent authorities
Additional financial resources to the competent authorities
Amendment of the ePD to clarify aspects that are not clear (no substantial changes)
Amendment of the ePD to clarify and change substantial aspects
Replacing the ePD with a Regulation with minor changes to solve lack of clarity (no substantial changes)
Replacing the ePD with a Regulation to solve lack of clarity and change substantial aspects
Repeal of the ePD
Other (please specify)
ePD online survey competent authorities
Potential policy options/measures to address current problems
31
* 34. Of the policy options you consider useful, please indicate up to three
options that should be addressed with priority.
Additional guidance at EU level
Exchange of good practices in relation to enforcement mechanisms
Practical support to the competent authorities
Additional financial resources to the competent authorities
Amendment of the ePD to clarify aspects that are not clear (no substantial changes)
Amendment of the ePD to clarify and change substantial aspects
Replacing the ePD with a Regulation with minor changes to solve lack of clarity (no substantial changes)
Replacing the ePD with a Regulation to solve lack of clarity and change substantial aspects
Repeal of the ePD
[Insert text from Other]
ePD online survey competent authorities
Conclusion
35. Would you like to add any other important points that we have not
covered as part of this survey?
36. Does your authority hold reports or other information sources that
the study team should take into account?
32
* 37. We would be grateful if you could provide your name and contact
details (incl. telephone number and email address) so we can contact
you if needed to follow up.
ePD online survey competent authorities
End of survey
Thank you for your participation in the survey!
33
Saatja: Siede, Anna (DE - Hamburg) <
[email protected]>
Saatmisaeg: 4. august 2016. a. 13:16
Teema: FW: EU Commission study on the e-privacy Directive: Survey with competent
authorities
Manused: Evaluation ePD_Deloitte Accreditation.pdf; Commission study on the
ePD_Statistics on the application of the ePD.docx; Overview ePD online
survey competent authorities .pdf
J�reltegevuse lipp: J�reltegevus
Olekulipp: Lipuga m�rgitud
Dear Sir or Madam,
We would be very grateful if you could forward this request to the person/department dealing with
Directive 2002/58 on privacy and the electronic communication sector (ePD).
This concerns a survey relating to the evaluation and potential review of the ePD. We circulated
this survey in the context of a study we are carrying out for the European Commission (see email
below for further details).
Please note that we extended the deadline mentioned below. We can still accept responses and can
integrate these into our analyses. Thus, we would still be very grateful if you could:
* Participate in our online survey, which can be accessed under this link. For your
convenience, I attach a PDF document with all questions.
* Check whether you can provide any additional statistics on the application of the ePD,
including e.g. on the number of citizens� complaints, number and type of breaches as well as
the number of audits carried out. For this purpose, we kindly ask to fill in the attached word
document as far as possible based on the information your authority holds and return it to me
via email (
[email protected]). You may also send other existing documents in any format you
hold.
It would be very helpful, if you could submit your inputs by August 12.
Your time and efforts are highly appreciated and will be important for the success of this study. By
sharing your experiences you may influence future policies in this field, including e.g. to address
important challenges relating to the functioning of the ePD or to reduce the work load for competent
authorities.
Please feel free to contact me (
[email protected]) in case you have any questions.
Kind regards,
Anna Siede
From: Siede, Anna (DE - Hamburg)
Sent: Dienstag, 12. Juli 2016 09:27
Subject: EU Commission study on the e-privacy Directive: Survey with competent authorities
Dear Sir or Madam,
The European Commission, DG CONNECT, has commissioned Deloitte to carry out the Evaluation and
review of Directive 2002/58 on privacy and the electronic communication sector (ePD).
Please find attached the European Commission�s accreditation letter for the study.
The main objectives of this study are to:
* Support the Commission in gathering the evidence needed to evaluate the ePD; and
* Assist the Commission in assessing the expected impacts of potential policy
options/measures to address current problems.
For this purpose, Deloitte is carrying out an online survey with national competent authorities to
gather information on the functioning of the ePD, obligations and costs for competent authorities and
potential policy options/measures to address current problems. This survey complements the
European Commission�s public consultation concerning the ePD.
The survey can be accessed under this link and will be open until 31 July 2016.
We would be very grateful, if you could take the time to participate in this survey. Please note that you
may need to co-operate with other departments or services in your organisation to be able to provide
input to the questions relevant to you.
In case you do not deal with the ePD, we would be grateful if you could forward this email to
colleagues who may be relevant in this regard.
In addition to the online survey, Deloitte aims to gather available statistics on the application of
the ePD, including e.g. on the number of citizens� complaints, number and type of breaches as well as
the number of audits carried out. For this purpose, we kindly ask to fill in the attached word document
as far as possible based on the information your authority holds.
Your time and efforts are highly appreciated and will be important for the success of this study. By
sharing your experiences you may influence future policies in this field, including e.g. to address
important challenges relating to the functioning of the ePD or to reduce the work load for competent
authorities.
Please feel free to contact me (
[email protected]) in case you have any questions.
Kind regards,
Anna Siede
--
Anna Siede
AERS | Audit and Advisory | Economic Consulting
Deloitte GmbH Wirtschaftspr�fungsgesellschaft
Dammtorstra�e 12, 20354 Hamburg, Deutschland
Phone: +49 40 32080 4939 | Mobile: +49 151 58003870
[email protected] | www.deloitte.com/de
--
LinkedIn | XING | Facebook | Twitter | Google+ | YouTube
Please consider the environment before printing.
----------------------------------------------------------------------------
Vertraulichkeitshinweis
Diese Nachricht und jeder uebermittelte Anhang beinhaltet vertrauliche Informationen und ist nur
fuer die Personen oder das Unternehmen bestimmt, an welche sie tatsaechlich gerichtet ist.
Sollten Sie nicht der Bestimmungsempfaenger sein, weisen wir Sie darauf hin, dass die
Verbreitung, das (auch teilweise) Kopieren sowie der Gebrauch der empfangenen E-Mail und der
darin enthaltenen Informationen gesetzlich verboten ist und gegebenenfalls
Schadensersatzpflichten ausloesen kann. Sollten Sie diese Nachricht aufgrund eines
Uebermittlungsfehlers erhalten haben, bitten wir Sie den Sender unverzueglich hiervon in
Kenntnis zu setzen.
Sicherheitswarnung: Bitte beachten Sie, dass das Internet kein sicheres Kommunikationsmedium
ist. Obwohl wir im Rahmen unseres Qualitaetsmanagements und der gebotenen Sorgfalt Schritte
eingeleitet haben, um einen Computervirenbefall weitestgehend zu verhindern, koennen wir
wegen der Natur des Internets das Risiko eines Computervirenbefalls dieser E-Mail nicht
ausschliessen.
Confidentiality note
This message (including any attachments) contains confidential information intended for a
specific individual or entity as the intended recipient. If you are not the intended recipient, you
are hereby notified that any distribution, any copying of this message in part or in whole, or any
taking of action based on it, is strictly prohibited by law and may cause liability. In case you have
received this message due to an error in transmission, we ask you to notify the sender
immediately.
Safety warning: Please note that the Internet is not a safe means of communication or form of
media. Although we are continuously increasing our due care of preventing virus attacks as a part
of our Quality Management, we are not able to fully prevent virus attacks as a result of the nature
of the Internet.
Die Angaben nach � 37a HGB finden sich unter dem folgenden Link:
http://www.deloitte.com/de/Angaben37aHGB
----------------------------------------------------------------------------
EUROPEAN COMMISSION
Directorate-General for Communications Networks, Content and Technology
Digital Society, Trust and Security
Trust and Security
Brussels, ¿4 (<%(£<*(,
DG CONNECT/H4/RB/jl
Ares cnect.ddgl .h.4(2016)3693365
Letter of recommendation
TO WHOM IT MAY CONCERN
Subject: Invitation to collaborate with Deloitte in the context of the evaluation and
review of the ePrivacy Directive
Dear Madam/Sir,
I hereby confirm that Deloitte is currently under contract with the European Commission,
Directorate-General Connect, to gather evidence on the transposition and implementation of
the ePrivacy Directive (Directive 2002/58/EC).
In the framework of this study, Deloitte will approach stakeholders and experts in the field
to gather information and solicit inputs for all aspects of the study. We would very much
appreciate any assistance you can provide to Deloitte in this regard, assuring you that the
information you will provide will be treated confidentially.
Please note that this exercise is a complement to the public consultation, which is running
until 5 July 2016 and of which you may be aware.
If you require any further information, please contact the Deloitte Project Manager, Anna
Lauridsen (
[email protected]) or Rosa Darcelo, Head of Sector at DG CNECT
(
[email protected]).
We thank you in advance for your contribution.
Yours sincerely,
Head of Unit
Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIë - Tel. +32 22991111
Office: BU25 03/131 - Tel. direct line +32 229- 88182 - Fax +32 229-20125
Email:
[email protected]
Statistics relating to the application of the e-privacy Directive Introduction The European Commission, Directorate-General CONNECT has commissioned Deloitte to carry out an Evaluation and review of Directive 2002/58 on privacy and the electronic communication sector ( ePD ) . The main objectives of this study are to: Support the Commission in gathering the evidence-base needed to evaluate the ePD ; and Assist the Commission in assessing the expected impacts of potential policy options/measures to address current problems. You have been asked by Deloitte to complete an online survey on these aspects. In addition, Deloitte aims to gather available statistics on the application of the ePD , in particular on: Citizens’ and service providers’ requests and complaints ; Article 4 on the security of processing ; and Number of audits carried out . We would be very grateful, if you could fill in any figures available to you in the tables below. Please note that also partial information is helpful for us. You may also provide any additional statistics you deem relevant for the assessment of the functioning of the ePD in the form at that is most convenient to you . Your contribution is important for the European Commission in order to evaluate the legislative framework concerning the protection of privacy in the electronic communications sector and assess whether and how the current framework needs to be changed. P lease return your input to Anna Siede (
[email protected] ) , who is also available in case of any questions or comments. Thank you for your time! Citizens’ and service providers’ requests and complaints How many requests for information in relation to the following provisions and/or in total did your authority receive per year from citizens ? Table SEQ Table \* ARABIC 2 : Number of requests for information received from citizens 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total How many requests for information in relation to the following provisions and/or in total did your authority receive per year from service providers? Table SEQ Table \* ARABIC 3 : Number of requests for information received from service providers 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total How many complaints from citizens in relation to the following provisions and/or in total did your authority receive per year? Table SEQ Table \* ARABIC 4 : Number of complaints received from citizens 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total How many breaches did your authority detect, e.g. based on complaints from citizens or audits carried out, in relation to the following provisions and/or in total per year? Table SEQ Table \* ARABIC 5 : Number of breaches 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total Article 4 on the security of processing How many notifications of personal data breaches on the basis of Article 4(3) did you receive for the specified years? How many individuals were concerned by these breaches? Table SEQ Table \* ARABIC 6 : Number of received notifications of personal data breaches and concerned individuals 2010 2011 2012 2013 2014 2015 Number of received notifications of personal data breach e s (Estimated) n umber of concerned individuals by these breaches ( please specify “E” after the number in case you provide us with an estimate ) In how many cases could the service provider demonstrate to the authority that, after a breach, sufficient technological protection measures were taken? Table SEQ Table \* ARABIC 7 : Number of cases where sufficient technological protection measures were taken by service providers after a breach Type of data 2010 2011 2012 2013 2014 2015 Cases where the service provider could demonstrate to have taken sufficient protection measures following a breach Number Estimated proportion compared to the total number of cases In how many cases did you require the provider to notify the affected individual(s) about a breach per year? Table SEQ Table \* ARABIC 8 : Number of cases requiring the provider to notify individual(s) affected by a breach Type of data 2010 2011 2012 2013 2014 2015 C ases requiring the provider to notify individual(s) affected by a breach Number Estimated proportion compared to the total number of cases Number of a udits carried out How many audits of individual service providers did your authority carry out in the years indicated ? How many companies were concerned by these audits? Table SEQ Table \* ARABIC 9 : Number of audits and companies concerned Type of data 2010 2011 2012 2013 2014 2015 Number of audits Actual data Estimate Number of companies concerned Actual data Estimate