EU Commission study on the e-privacy Directive: Survey with competent authorities. Audit and Advisory Economic Consulting

Lea Baumann Saatja: Siede, Anna (DE - Hamburg) <[email protected]> Saatmisaeg: 12. juuli 2016. a. 10:27 Teema: EU Commission study on the e-privacy Directive: Survey with competent authorities Manused: Evaluation ePD_Deloitte Accreditation.pdf; Commission study on the ePD_Statistics on the application of the ePD.docx Dear Sir or Madam, The European Commission, DG CONNECT, has commissioned Deloitte to carry out the Evaluation and review of Directive 2002/58 on privacy and the electronic communication sector (ePD). Please find attached the European Commission’s accreditation letter for the study. The main objectives of this study are to:  Support the Commission in gathering the evidence needed to evaluate the ePD; and  Assist the Commission in assessing the expected impacts of potential policy options/measures to address current problems. For this purpose, Deloitte is carrying out an online survey with national competent authorities to gather information on the functioning of the ePD, obligations and costs for competent authorities and potential policy options/measures to address current problems. This survey complements the European Commission’s public consultation concerning the ePD. The survey can be accessed under this link and will be open until 31 July 2016. We would be very grateful, if you could take the time to participate in this survey. Please note that you may need to co-operate with other departments or services in your organisation to be able to provide input to the questions relevant to you. In case you do not deal with the ePD, we would be grateful if you could forward this email to colleagues who may be relevant in this regard. In addition to the online survey, Deloitte aims to gather available statistics on the application of the ePD, including e.g. on the number of citizens’ complaints, number and type of breaches as well as the number of audits carried out. For this purpose, we kindly ask to fill in the attached word document as far as possible based on the information your authority holds. Your time and efforts are highly appreciated and will be important for the success of this study. By sharing your experiences you may influence future policies in this field, including e.g. to address important challenges relating to the functioning of the ePD or to reduce the work load for competent authorities. Please feel free to contact me ([email protected]) in case you have any questions. Kind regards, Anna Siede -- Anna Siede AERS | Audit and Advisory | Economic Consulting Deloitte GmbH Wirtschaftsprüfungsgesellschaft Dammtorstraße 12, 20354 Hamburg, Deutschland Phone: +49 40 32080 4939 | Mobile: +49 151 58003870 [email protected] | www.deloitte.com/de -- LinkedIn | XING | Facebook | Twitter | Google+ | YouTube Please consider the environment before printing. 1 ---------------------------------------------------------------------------- Vertraulichkeitshinweis Diese Nachricht und jeder uebermittelte Anhang beinhaltet vertrauliche Informationen und ist nur fuer die Personen oder das Unternehmen bestimmt, an welche sie tatsaechlich gerichtet ist. Sollten Sie nicht der Bestimmungsempfaenger sein, weisen wir Sie darauf hin, dass die Verbreitung, das (auch teilweise) Kopieren sowie der Gebrauch der empfangenen E-Mail und der darin enthaltenen Informationen gesetzlich verboten ist und gegebenenfalls Schadensersatzpflichten ausloesen kann. Sollten Sie diese Nachricht aufgrund eines Uebermittlungsfehlers erhalten haben, bitten wir Sie den Sender unverzueglich hiervon in Kenntnis zu setzen. Sicherheitswarnung: Bitte beachten Sie, dass das Internet kein sicheres Kommunikationsmedium ist. Obwohl wir im Rahmen unseres Qualitaetsmanagements und der gebotenen Sorgfalt Schritte eingeleitet haben, um einen Computervirenbefall weitestgehend zu verhindern, koennen wir wegen der Natur des Internets das Risiko eines Computervirenbefalls dieser E-Mail nicht ausschliessen. Confidentiality note This message (including any attachments) contains confidential information intended for a specific individual or entity as the intended recipient. If you are not the intended recipient, you are hereby notified that any distribution, any copying of this message in part or in whole, or any taking of action based on it, is strictly prohibited by law and may cause liability. In case you have received this message due to an error in transmission, we ask you to notify the sender immediately. Safety warning: Please note that the Internet is not a safe means of communication or form of media. Although we are continuously increasing our due care of preventing virus attacks as a part of our Quality Management, we are not able to fully prevent virus attacks as a result of the nature of the Internet. Die Angaben nach § 37a HGB finden sich unter dem folgenden Link http://www.deloitte.com/de/Angaben37aHGB ---------------------------------------------------------------------------- 2 Statistics relating to the application of the e-privacy Directive Introduction The European Commission, Directorate-General CONNECT has commissioned Deloitte to carry out an Evaluation and review of Directive 2002/58 on privacy and the electronic communication sector ( ePD ) . The main objectives of this study are to: Support the Commission in gathering the evidence-base needed to evaluate the ePD ; and Assist the Commission in assessing the expected impacts of potential policy options/measures to address current problems. You have been asked by Deloitte to complete an online survey on these aspects. In addition, Deloitte aims to gather available statistics on the application of the ePD , in particular on: Citizens’ and service providers’ requests and complaints ; Article 4 on the security of processing ; and Number of audits carried out . We would be very grateful, if you could fill in any figures available to you in the tables below. Please note that also partial information is helpful for us. You may also provide any additional statistics you deem relevant for the assessment of the functioning of the ePD in the form at that is most convenient to you . Your contribution is important for the European Commission in order to evaluate the legislative framework concerning the protection of privacy in the electronic communications sector and assess whether and how the current framework needs to be changed. P lease return your input to Anna Siede ( [email protected] ) , who is also available in case of any questions or comments. Thank you for your time! Citizens’ and service providers’ requests and complaints How many requests for information in relation to the following provisions and/or in total did your authority receive per year from citizens ? Table SEQ Table \* ARABIC 2 : Number of requests for information received from citizens 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total How many requests for information in relation to the following provisions and/or in total did your authority receive per year from service providers? Table SEQ Table \* ARABIC 3 : Number of requests for information received from service providers 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total How many complaints from citizens in relation to the following provisions and/or in total did your authority receive per year? Table SEQ Table \* ARABIC 4 : Number of complaints received from citizens 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total How many breaches did your authority detect, e.g. based on complaints from citizens or audits carried out, in relation to the following provisions and/or in total per year? Table SEQ Table \* ARABIC 5 : Number of breaches 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total Article 4 on the security of processing How many notifications of personal data breaches on the basis of Article 4(3) did you receive for the specified years? How many individuals were concerned by these breaches? Table SEQ Table \* ARABIC 6 : Number of received notifications of personal data breaches and concerned individuals 2010 2011 2012 2013 2014 2015 Number of received notifications of personal data breach e s (Estimated) n umber of concerned individuals by these breaches ( please specify “E” after the number in case you provide us with an estimate ) In how many cases could the service provider demonstrate to the authority that, after a breach, sufficient technological protection measures were taken? Table SEQ Table \* ARABIC 7 : Number of cases where sufficient technological protection measures were taken by service providers after a breach Type of data 2010 2011 2012 2013 2014 2015 Cases where the service provider could demonstrate to have taken sufficient protection measures following a breach Number Estimated proportion compared to the total number of cases In how many cases did you require the provider to notify the affected individual(s) about a breach per year? Table SEQ Table \* ARABIC 8 : Number of cases requiring the provider to notify individual(s) affected by a breach Type of data 2010 2011 2012 2013 2014 2015 C ases requiring the provider to notify individual(s) affected by a breach Number Estimated proportion compared to the total number of cases Number of a udits carried out How many audits of individual service providers did your authority carry out in the years indicated ? How many companies were concerned by these audits? Table SEQ Table \* ARABIC 9 : Number of audits and companies concerned Type of data 2010 2011 2012 2013 2014 2015 Number of audits Actual data Estimate Number of companies concerned Actual data Estimate EUROPEAN COMMISSION Directorate-General for Communications Networks, Content and Technology Digital Society, Trust and Security Trust and Security Brussels, ¿4 (<%(£<*(, DG CONNECT/H4/RB/jl Ares cnect.ddgl .h.4(2016)3693365 Letter of recommendation TO WHOM IT MAY CONCERN Subject: Invitation to collaborate with Deloitte in the context of the evaluation and review of the ePrivacy Directive Dear Madam/Sir, I hereby confirm that Deloitte is currently under contract with the European Commission, Directorate-General Connect, to gather evidence on the transposition and implementation of the ePrivacy Directive (Directive 2002/58/EC). In the framework of this study, Deloitte will approach stakeholders and experts in the field to gather information and solicit inputs for all aspects of the study. We would very much appreciate any assistance you can provide to Deloitte in this regard, assuring you that the information you will provide will be treated confidentially. Please note that this exercise is a complement to the public consultation, which is running until 5 July 2016 and of which you may be aware. If you require any further information, please contact the Deloitte Project Manager, Anna Lauridsen ([email protected]) or Rosa Darcelo, Head of Sector at DG CNECT ([email protected]). We thank you in advance for your contribution. Yours sincerely, Head of Unit Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIë - Tel. +32 22991111 Office: BU25 03/131 - Tel. direct line +32 229- 88182 - Fax +32 229-20125 Email: [email protected]