Interview guide for competent authorities Introduction The European Commission, Directorate-General CONNECT has commissioned Deloitte to carry out an Evaluation and review of Directive 2002/58 on privacy and the electronic communication sector (SMART 2016/0080). This Directive is commonly referred to as the ePrivacy Directive (“ePD”). The ePD was adopted with a view to harmonising national rules in relation to the processing of personal data in the electronic communications sector. The main objectives of this study are to: Support the Commission in gathering the evidence-base needed to evaluate the ePD; and Assist the Commission in assessing the expected impacts of potential policy options/ measures to address current problems. As part of this study, Deloitte is carrying out different types of stakeholder consultations , including an online survey to which you have been invited. The aim of this interview is to discuss the functioning of the ePD and its future , including potential measures to address current problems . The interview will cover the following topics: The functioning of the ePD, including: Overall assessment The scope of the ePD The functioning of individual provisions of the ePD Institutional set-up in the Member States and tasks of national competent authorities Future outlook: Potential measures to address current problems . The expected length of the interview is maximum one hour. We will keep your answer s confidential; the results of the interview will be only presented in an aggregated way with no possibility to trace back the results to individual contributions to this survey. Thank you for your contributions! Background information N ame of Interviewee Institution Country Interview date and place Interviewer Please briefly describe your position and your role in relation to the implementation of the ePD. The functioning of the ePD Overall assessment How do you assess the overall functioning of the ePD (e.g. poor, fair, good, very good, excellent ) ? Please consider: T he content of the ePD and its practical application , including differences between Member States relating to the transposition and/or implementation, as well as the enforcement of the ePD ; Impacts on businesses and citizens / consumers, e.g. in terms of costs and benefits related to (if possible, please give concrete examples of actual cases to demonstrate this) : The protection of personal data and privacy in the electronic communications sector (and trust in this) ; The free movement of personal data; The free movement of technical equipment, e.g. divergent standards across Member States, level of trust of citizens and businesses . Has the relevance and overall functioning of the ePD changed over time, e.g. in light of external factors, such as other EU or national policy instruments (such as the GDPR), technological developments and / or initiatives by businesses ? Please compare the situation at the time of its adoption in 2002 and today. To what degree are citizens and bus inesses sufficiently aware that: T he ePD exists ; and O f its content (rights and obligations) ? The s cope of the ePD Is the scope of the ePD appropriate e.g. in view of the technological developments and data protection needs in the electronic communications sector? Please also consider the definitions provided in the ePD (Article 2). What are the main advantages and disadvantages in relation to the current scope, e.g. is the scope clear, to o broad or too narrow in relation to the types of services , data or communications covered? If there are aspects of the scope that are not appropriate, what are consequences (e.g. costs and benefits) for citizens and/or authorities ? P lease illustrate your reply with practical case examples based e.g. o n complaints you have received . W hat are your experiences with the application of the aspects of you national law which diverge from the content of the ePD (e .g. coverage of additional services such as OTTs) ? Please consider e.g. costs and benefits for citizens, businesses and the authority as well as any practical difficulties your authority may have experienced. The functioning of individual provisions of the ePD What are the main strengths and weaknesses (incl. costs and benefits for citizens and businesses as well as obligations of the national competent authorities ) relating to the following provisions ? Please consider any issues related to the content of the provisions (e.g. clarity, relevance) and their application (e.g . awareness of citizens and service providers, enforcement). Security of processing, concerning e.g. n otification of personal data breaches (Article 4) ; C onfidentiality of electronic communications , e.g. concerning the prevention of unlawful tapping, listening etc. (Article s 5.1 and 5.2) ; C onfidentiality of information stored on the users’ terminal equipment , e.g . concerning cookies (Article 5.3) ; Specific rules on traffic data (Article 6) ; Specific rules location data other than traffic data (Article 9); I temised billing of invoices , containing the possibility of users to opt for non-itemised billing (Article 7) ; Presentation and restriction of calling and connected line and the related exceptions (Article s 8 and 10 ) ; A utomatic call forwarding (Article 11) ; D irectories of subscribers , containing the possibility for users to be informed and decide about the inclusion in publicly available directories (Article 12) ; U nsolicited marketing communications , including relevant restrictions making such marketing activities subject to the user’s consent (Article 13 ); Technical features and standardisation relating to terminal or other electronic communications equipment (Article 14); and Implementation and enforcement (Article 15a). Institutional set-up in the Member State and tasks of national competent authorities The role and responsibilities of the competent authority/ies in your Member State Please describe the institutional set-up in your country: What authorities have been appointed as competent authorities in your Member State? Do you know the reasons for involving these different authorities (if more than one authority has been appointed)? How are the responsibilities in relation to the application of the ePD shared between the different competent authorities and/or departments involved , and why? What types of exchanges or cooperation procedures take place between the different authorities and/or departments within your Member State? Do they take place on an ad hoc basis, or do you have regular meetings / discussions? What are the main strengths and weaknesses of the institutional set-up in in your Member State? Auditing Which tools to audit service providers exist in your Member State? How do you select the businesses to be audited? Do you consider that you cover a sufficiently large sample with your current resources? Are the audits effective in terms of detect ing breaches? Are any improvements necessary? Guidance documents and t raining Which types of guidance documents have been developed in your Member State concerning the implementation and enforcement of the ePD? What type of training is provided in your Member State concerning the implementation and enforcement of the ePD? Please comment on the usefulness of the guidance documents and training provided: Which types of guidance documents and /or training do you consider as particularly useful? Why? In which areas in relation to guidance documents and/or training do you see room for improvement, e.g. need to improve existing offer or need to introduce new types of guidance/training? Costs for the national competent authorities [ If not provided in the online survey : ] What is the overall annual budget that is available for your authority in relation to the ePD? What are the main cost factors for your authority in relation to the implementation of the ePD? Please consider: Transaction costs, incl. implementation of legislation (incl. drafting of legislation and admin. guidance), development and provision of training, communication with businesses and other relevant stakeholders ; Administrative and enforcement costs, incl. monitoring of the compliance with legislation at national level ; and Technical compliance, incl. costs for developing, adapting, and/or procuring the necessary hard- and/or software . Other costs Would you have to carry out any of these tasks anyway based on other national or EU legislation? Are the current human and financial resources sufficient? Specificities of c ross-border cases Please describe the procedures your authority follows in cross-border cases : On which basis do you decide whether your authority is competent or whether the citizen should contact an authority in a different Member State (e.g. nationality of the citizen, seat of the business concerned, etc.)? If you are not competent, what types of information or support do you offer to the citizen (e.g. relevant contact details, language support)? In what ways do you cooperate with authorities from other Member States? Please explain in what cases, how frequently, if they are focused on certain Member States and how you assess the functioning of the contacts. How do cross-border cases differ from national cases in terms of: Time spent by citizens and costs for citizens; and Time spent by authorities and costs for authorities. Future outlook: Potential measures to address current problems Please comment on the need for and usefulness of the following types of action for improving of the current situation (what are the main advantages and disadvantages of each type of action, taking into account recent and ongoing technological developments?) : Additional guidance at EU level; Exchange of good practices in relation to enforcement mechanisms ; Practical support to the competent authorities ; Additional financial resources to the competent authorities ; Amendment of the ePD to clarify aspects that are not clear (no substantial changes) ; Amendment of the ePD to clarify and change substantial aspects ; Replacing the ePD with a Regulation with minor changes to solve lack of clarity (no substantial changes) ; Replacing the ePD with a Regulation with to solve lack of clarity and change substantial aspects ; Repeal of the ePD ; Other . What future evolutions/trends do you expect concerning the electronic communications sector in your Member State and/or at Community level? What will the impact of the evolutions be on the type of action taken at EU level? Conclusion Would you like to raise any additional points? Does your authority hold reports or other information sources that the study team should take into account? Thank you ! Your contribution is important for the European Commission in order to evaluate the legislative framework concerning the protection of privacy in the electronic communications sector and assess whether and how the current framework needs to be changed.
Saatja: Linden, Celine (BE - Brussels) <
[email protected]>
Saatmisaeg: 9. august 2016. a. 18:03
Adressaat: TJA - Avalik
Koopia: De Castro Fernandes Abreu Gon?alves, Ant�nio (BE - Brussels); Lauridsen,
Anna (BE - Brussels)
Teema: RE: INVITATION for INTERVIEW | European Commission | ePrivacy Directive
2002/58 Evaluation
Manused: ePD_Interviews_Competent Authorities.docx
J�reltegevuse lipp: J�reltegevus
Olekulipp: Lipuga m�rgitud
Dear Sir or Madam,
This is a gentle reminder for the invitation to an interview in relation to the evaluation and review
of the Personal Data Directive in the electronic communications sector (ePrivacy Directive,
2002/58) for DG Justice (see initial message below). We would appreciate if you or someone else from
your team, would be available for an interview with our team.
Please find attached the questionnaire intended to serve as guidance throughout the interview.
Your input is highly appreciated and will be crucial for the success of this study. By sharing your
experiences you may influence future policies in this field, which may address important challenges
relating to the ePD or improve the work for competent authorities. The expected length of the
interview is maximum one hour, and your answers will be kept under strict confidentiality (the results
will be only presented in an aggregated way with no possibility to trace back the results to individual
contributions).
With regard to the above, we would appreciate it if you could suggest a date and a time of your
convenience for the interview in the coming one-two weeks.
Thank you in advance for your time, and please do not hesitate to contact us should you have any
questions.
Kind regards,
Celine
Celine Linden
D: +32 2 800 29 87 | M: +32 492 57 21 02
From: Linden, Celine (BE - Brussels)
Sent: woensdag 27 juli 2016 16:35
To: '
[email protected]' <
[email protected]>
Cc: De Castro Fernandes Abreu Gon?alves, Ant�nio (BE - Brussels) <
[email protected]>
Subject: Study ePrivacy Directive - request for interview
Dear Sir or Madam,
The European Commission, DG CONNECT, has commissioned Deloitte to carry out the evaluation
and review of Directive 2002/58/EC on privacy and the electronic communication sector
(the ePrivacy Directive or �ePD�).
The main objectives of this study are to:
* Support the Commission in gathering the evidence needed to evaluate the ePD; and
* Assist the Commission in assessing the expected impacts of potential policy options/measures to
address current problems.
As part of this study, Deloitte has carried out an online survey complementing the European
Commission�s public consultation concerning the ePD. As a next step, Deloitte is also carrying out
telephone interviews with national competent authorities in order to:
* Gather more details concerning the evaluation of the ePD in relation to its transposition,
effectiveness, efficiency, relevance, coherence, and EU added value;
* Go into further detail concerning the most interesting aspects of the survey findings;
* Challenge the findings of the online survey with the practical knowledge and experiences of
competent authorities; and
* Discuss success factors and good practices, as well as obtaining an understanding of practical
problems faced by businesses and citizens.
We would therefore be very grateful if you could take the time to schedule an interview with our
team. Your input is highly appreciated and will be crucial for the success of this study. By sharing
your experiences you may influence future policies in this field, which may address important
challenges relating to the ePD or improve the work for competent authorities. The expected length of
the interview is maximum one hour, and your answers will be kept under strict confidentiality (the
results will be only presented in an aggregated way with no possibility to trace back the results to
individual contributions).
With regard to the above, we would appreciate it if you could suggest a date and a time of your
convenience for the interview. If necessary, we shall be pleased to send you an accreditation letter
for this study from the Commission.
Thank you in advance for your time, and please do not hesitate to contact us should you have any
question.
Kind regards,
Celine
Celine Linden
Consultant | Enterprise Risk Services | Privacy
Deloitte Bedrijfsrevisoren � Reviseurs d�Entreprises
Berkenlaan 8B, B-1831 Diegem, Belgium
D: +32 2 800 29 87 | M: +32 492 57 21 02
[email protected] | www.deloitte.com
Please consider the environment before printing.
This email and any files transmitted with it are confidential and intended solely for the use of the
individual or entity to whom they are addressed.
If you are not the named addressee or an employee or agent responsible for delivering this
message to the named addressee, you are hereby notified that you are not authorized to read,
print, retain, copy or disseminate this message or any part of it.
If you have received this email in error we request you to notify us by reply e-mail and to delete
all electronic files of the message.
E-mail transmission cannot be guaranteed to be secure or error free as information could be
intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender
therefore does not accept liability for any errors or omissions in the content of this message, and
shall have no liability for any loss or damage suffered by the user, which arise as a result of e-
mail transmission.