EU Commission study on the e-privacy Directive: Survey with competent authorities

Statistics relating to the application of the e-privacy Directive Introduction The European Commission, Directorate-General CONNECT has commissioned Deloitte to carry out an Evaluation and review of Directive 2002/58 on privacy and the electronic communication sector ( ePD ) . The main objectives of this study are to: Support the Commission in gathering the evidence-base needed to evaluate the ePD ; and Assist the Commission in assessing the expected impacts of potential policy options/measures to address current problems. You have been asked by Deloitte to complete an online survey on these aspects. In addition, Deloitte aims to gather available statistics on the application of the ePD , in particular on: Citizens’ and service providers’ requests and complaints ; Article 4 on the security of processing ; and Number of audits carried out . We would be very grateful, if you could fill in any figures available to you in the tables below. Please note that also partial information is helpful for us. You may also provide any additional statistics you deem relevant for the assessment of the functioning of the ePD in the form at that is most convenient to you . Your contribution is important for the European Commission in order to evaluate the legislative framework concerning the protection of privacy in the electronic communications sector and assess whether and how the current framework needs to be changed. P lease return your input to Anna Siede ( [email protected] ) , who is also available in case of any questions or comments. Thank you for your time! Citizens’ and service providers’ requests and complaints How many requests for information in relation to the following provisions and/or in total did your authority receive per year from citizens ? Table SEQ Table \* ARABIC 2 : Number of requests for information received from citizens 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total How many requests for information in relation to the following provisions and/or in total did your authority receive per year from service providers? Table SEQ Table \* ARABIC 3 : Number of requests for information received from service providers 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total How many complaints from citizens in relation to the following provisions and/or in total did your authority receive per year? Table SEQ Table \* ARABIC 4 : Number of complaints received from citizens 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total How many breaches did your authority detect, e.g. based on complaints from citizens or audits carried out, in relation to the following provisions and/or in total per year? Table SEQ Table \* ARABIC 5 : Number of breaches 2010 2011 2012 2013 2014 2015 Obligations for service providers on the security of processing (Article 4.1 and 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Specific rules location data other than traffic data (Article 9) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received though the Internet (Article 13) Total Article 4 on the security of processing How many notifications of personal data breaches on the basis of Article 4(3) did you receive for the specified years? How many individuals were concerned by these breaches? Table SEQ Table \* ARABIC 6 : Number of received notifications of personal data breaches and concerned individuals 2010 2011 2012 2013 2014 2015 Number of received notifications of personal data breach e s (Estimated) n umber of concerned individuals by these breaches ( please specify “E” after the number in case you provide us with an estimate ) In how many cases could the service provider demonstrate to the authority that, after a breach, sufficient technological protection measures were taken? Table SEQ Table \* ARABIC 7 : Number of cases where sufficient technological protection measures were taken by service providers after a breach Type of data 2010 2011 2012 2013 2014 2015 Cases where the service provider could demonstrate to have taken sufficient protection measures following a breach Number Estimated proportion compared to the total number of cases In how many cases did you require the provider to notify the affected individual(s) about a breach per year? Table SEQ Table \* ARABIC 8 : Number of cases requiring the provider to notify individual(s) affected by a breach Type of data 2010 2011 2012 2013 2014 2015 C ases requiring the provider to notify individual(s) affected by a breach Number Estimated proportion compared to the total number of cases Number of a udits carried out How many audits of individual service providers did your authority carry out in the years indicated ? How many companies were concerned by these audits? Table SEQ Table \* ARABIC 9 : Number of audits and companies concerned Type of data 2010 2011 2012 2013 2014 2015 Number of audits Actual data Estimate Number of companies concerned Actual data Estimate Saatja: Siede, Anna (DE - Hamburg) <[email protected]> Saatmisaeg: 27. juuli 2016. a. 17:26 Teema: EU Commission study on the e-privacy Directive: Survey with competent authorities Manused: Evaluation ePD_Deloitte Accreditation.pdf; Commission study on the ePD_Statistics on the application of the ePD.docx; Overview ePD online survey competent authorities .pdf J�reltegevuse lipp: J�reltegevus Olekulipp: Lipuga m�rgitud Dear Sir or Madam, We would kindly like to remind you of our survey relating to the evaluation and potential review of Directive 2002/58 on privacy and the electronic communication sector (ePD). We circulated this survey in the context of a study we are carrying out for the European Commission (see email below for further details). We would still be very grateful if you could: * Participate in our online survey, which can be accessed under this link. For your convenience, I attach a PDF document with all questions. * Check whether you can provide any additional statistics on the application of the ePD, including e.g. on the number of citizens� complaints, number and type of breaches as well as the number of audits carried out. For this purpose, we kindly ask to fill in the attached word document as far as possible based on the information your authority holds and return it to me via email ([email protected]). You may also send other existing documents in any format you hold. Your time and efforts are highly appreciated and will be important for the success of this study. By sharing your experiences you may influence future policies in this field, including e.g. to address important challenges relating to the functioning of the ePD or to reduce the work load for competent authorities. Please feel free to contact me ([email protected]) in case you have any questions. Kind regards, Anna Siede From: Siede, Anna (DE - Hamburg) Sent: Dienstag, 12. Juli 2016 09:27 Subject: EU Commission study on the e-privacy Directive: Survey with competent authorities Dear Sir or Madam, The European Commission, DG CONNECT, has commissioned Deloitte to carry out the Evaluation and review of Directive 2002/58 on privacy and the electronic communication sector (ePD). Please find attached the European Commission�s accreditation letter for the study. The main objectives of this study are to: * Support the Commission in gathering the evidence needed to evaluate the ePD; and * Assist the Commission in assessing the expected impacts of potential policy options/measures to address current problems. For this purpose, Deloitte is carrying out an online survey with national competent authorities to gather information on the functioning of the ePD, obligations and costs for competent authorities and potential policy options/measures to address current problems. This survey complements the European Commission�s public consultation concerning the ePD. The survey can be accessed under this link and will be open until 31 July 2016. We would be very grateful, if you could take the time to participate in this survey. Please note that you may need to co-operate with other departments or services in your organisation to be able to provide input to the questions relevant to you. In case you do not deal with the ePD, we would be grateful if you could forward this email to colleagues who may be relevant in this regard. In addition to the online survey, Deloitte aims to gather available statistics on the application of the ePD, including e.g. on the number of citizens� complaints, number and type of breaches as well as the number of audits carried out. For this purpose, we kindly ask to fill in the attached word document as far as possible based on the information your authority holds. Your time and efforts are highly appreciated and will be important for the success of this study. By sharing your experiences you may influence future policies in this field, including e.g. to address important challenges relating to the functioning of the ePD or to reduce the work load for competent authorities. Please feel free to contact me ([email protected]) in case you have any questions. Kind regards, Anna Siede -- Anna Siede AERS | Audit and Advisory | Economic Consulting Deloitte GmbH Wirtschaftspr�fungsgesellschaft Dammtorstra�e 12, 20354 Hamburg, Deutschland Phone: +49 40 32080 4939 | Mobile: +49 151 58003870 [email protected] | www.deloitte.com/de -- LinkedIn | XING | Facebook | Twitter | Google+ | YouTube Please consider the environment before printing. ---------------------------------------------------------------------------- Vertraulichkeitshinweis Diese Nachricht und jeder uebermittelte Anhang beinhaltet vertrauliche Informationen und ist nur fuer die Personen oder das Unternehmen bestimmt, an welche sie tatsaechlich gerichtet ist. Sollten Sie nicht der Bestimmungsempfaenger sein, weisen wir Sie darauf hin, dass die Verbreitung, das (auch teilweise) Kopieren sowie der Gebrauch der empfangenen E-Mail und der darin enthaltenen Informationen gesetzlich verboten ist und gegebenenfalls Schadensersatzpflichten ausloesen kann. Sollten Sie diese Nachricht aufgrund eines Uebermittlungsfehlers erhalten haben, bitten wir Sie den Sender unverzueglich hiervon in Kenntnis zu setzen. Sicherheitswarnung: Bitte beachten Sie, dass das Internet kein sicheres Kommunikationsmedium ist. Obwohl wir im Rahmen unseres Qualitaetsmanagements und der gebotenen Sorgfalt Schritte eingeleitet haben, um einen Computervirenbefall weitestgehend zu verhindern, koennen wir wegen der Natur des Internets das Risiko eines Computervirenbefalls dieser E-Mail nicht ausschliessen. Confidentiality note This message (including any attachments) contains confidential information intended for a specific individual or entity as the intended recipient. If you are not the intended recipient, you are hereby notified that any distribution, any copying of this message in part or in whole, or any taking of action based on it, is strictly prohibited by law and may cause liability. In case you have received this message due to an error in transmission, we ask you to notify the sender immediately. Safety warning: Please note that the Internet is not a safe means of communication or form of media. Although we are continuously increasing our due care of preventing virus attacks as a part of our Quality Management, we are not able to fully prevent virus attacks as a result of the nature of the Internet. Die Angaben nach � 37a HGB finden sich unter dem folgenden Link http://www.deloitte.com/de/Angaben37aHGB ---------------------------------------------------------------------------- ePD online survey competent authorities Introduction to the survey The European Commission, Directorate-General CONNECT has commissioned Deloitte to carry out an Evaluation and review of Directive 2002/58 on privacy and the electronic communication sector (SMART 2016/0080). This Directive is commonly referred to as the ePrivacy Directive (“ePD”). The ePD was adopted with a view to harmonising national rules in relation to the processing of personal data in the electronic communications sector. The main objectives of this study are to: Support the Commission in gathering the evidence needed to evaluate the ePD; and Assist the Commission in assessing the expected impacts of potential policy options/measures to address current problems. As part of this study, Deloitte is carrying out an online survey complementing the European Commission’s public consultation concerning the ePD. In contrast to the European Commission’s public consultation, this online survey is only targeted at the national authorities involved in the implementation of the ePD. On this basis, it includes more detailed questions compared to the public consultation. This survey aims to gather your views around the following themes: Scope of the ePD; The application of individual provisions; Obligations and costs for competent authorities; Key strengths and challenges relating to the ePD; and Potential policy options/measures to address current problems. You are kindly invited to take part in this online survey which will take you around 15-20 minutes. However, you may need to co-operate with other departments or services in your organisation to be able to provide input to the questions relevant to you. Your contribution is important for the European Commission in order to evaluate the legislative framework concerning the protection of privacy in the electronic communications sector and assess whether and how the current framework needs to be changed. We will keep your answer confidential; the results of the survey will be only presented in an aggregated way with no possibility to trace back the results to individual contributions to this survey. In case of questions related to the substance or practicalities of the questionnaire, please contact Anna Siede ([email protected]). Thank you for your time! 1  ePD online survey competent authorities Basic information concerning the responding authority * 1. Please indicate the type of the body/authority you represent. Ministry Data protection authority Regulatory authority (Telecom) Consumer protection authority Other (please specify) * 2. Please indicate the name of the authority you represent. * 3. Which Member State do you represent? * 4. Please indicate the geographic level of the authority. National Regional Local 2  ePD online survey competent authorities Scope of the ePD * 5. Please indicate your level of agreement with the following statements relating to the scope of the ePD. Neither agree nor Strongly disagree Disagree disagree Agree Strongly agree Cannot answer The current scope has ensured that the ePD has made a significant positive impact with regard to the protection of privacy in the electronic communications sector in the past The scope is still relevant to ensure privacy in the electronic communications sector today The ePD will continue to have a significant positive impact with regard to the protection of privacy in the electronic communications sector in the future if the current scope is kept ePD online survey competent authorities Scope of the ePD 3 * 6. Please indicate for the following items relating to the scope of the ePD whether you consider them a problem and, if so, how serious the problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer Over-the-top services (OTTs)* are currently not covered * Voice-over IP or instant messaging over the internet such as WhatsApp or Skype There is a lack of clarity whether a service qualifies as a publicly available electronic communications services, e.g. in relation to WIFI access offered by airports internet cafes and/or shopping malls Private networks are currently not covered The distinction between information society services and electronic communication services is not clear The scope overlaps with the newly adopted General Data Protection Regulation The scope covers services that should not be covered (you may specify in the comment box below) The list of definitions is missing items that need to be clarified, namely (you may specify in the comment box below) Other problems and/or comments 4 ePD online survey competent authorities Overall assessment of the individual provisions 5 * 7. Please indicate for the following provisions how well they function. For example, you could consider the number of breaches and complaints you have received. Poor Fair Good Very good Excellent Cannot answer Obligations for service providers on the security of processing (Article 4.1) Notifications in relation to breaches of security (Article 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Specific rules on location data other than traffic data (Article 9) Itemised billing of invoices (Article 7) Presentation and restriction of calling and connected line (Article 8) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received through the Internet (Article 13) Comments 6 * 8. Please indicate for the following provisions whether they should be retained in case the ePD is amended in the future (irrespective of the type of instrument that would be chosen). Important to Important to retain, but with Useful to retain Useful to retain, Does not need to retain “as is” changes “as is” but with changes be retained Cannot answer Obligations for service providers on the security of processing (Article 4.1) Notifications in relation to breaches of security (Article 4.2) Notification of personal data breaches (Article 4.3 and 4.4) Confidentiality of electronic communications (Article 5.1 and 5.2) Confidentiality of information stored on the users’ terminal equipment (Article 5.3) Specific rules on traffic data (Article 6) Location data other than traffic data (Article 9) Itemised billing (Article 7) Presentation and restriction of calling and connected line (Article 8) Automatic call forwarding (Article 11) Directories of subscribers (Article 12) Unsolicited marketing communications sent and received through the Internet (Article 13) Comments 7 ePD online survey competent authorities Security of processing and notification of personal data breaches (Article 4) 9. Does your authority deal with the rules on the security of processing and notification of personal data breaches (Article 4)? Yes No ePD online survey competent authorities Security of processing and notification of personal data breaches (Article 4) 8 * 10. Please indicate for the following types of breaches how often they occur. Please provide an estimate based on the overall proportion of cases. 10 – less than 50 – less than Never Less than 10% 50% 80% More than 80% Cannot answer Personal data was accessed by unauthorised personnel and/or for purposes that were not legally authorised Personal data stored or transmitted was subject to accidental, unauthorised or unlawful destruction, loss, alteration or disclosure (incl. data leakage, unlawful sharing with third parties) Personal data was subject to accidental, unauthorised or unlawful storage or processing (e.g. storage for a longer time period than allowed) No specific security policy as referred to in Article 4(1a) was implemented by the service provider Consent options of data subject/subscriber were overlooked, not monitored or not complied with Users’ computers/laptops were accessed without their consent Other (please specify) Other (please specify) 9 * 11. Please indicate for the following items how often they occur in relation to the obligation of service providers to notify the competent authority and users about personal data breaches. Please provide an estimate based on the overall proportion of cases. 10 – less than 50 – less than Never Less than 10% 50% 80% More than 80% Cannot answer The service provider fails to notify the authority The notification to the authority is sent with delay The content of the notification to the authority is incomplete/missing relevant information The service provider fails to notify the user The notification to the user is sent with delay The content of the notification to the user is incomplete/missing relevant information The service provider fails to introduce adequate protection measures The service provider fails to reply or replies with delay in subsequent requests for clarification The service provider does not provide a mitigation plan Other (please specify) Other (please specify) 10 * 12. Has your authority adopted guidance on the implementation of Article 4 of the ePD relating to the security of service? The authority is not competent to adopt guidance No guidance was adopted Yes, guidelines Yes, instructions for service providers Yes, recommendations on best practices Guidance was adopted in another format (please specify) * 13. Please indicate for the following items whether you consider them a problem in relation to the rules on the security of processing and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer The obligations for competent authorities relating to personal data breaches are too burdensome, e.g. because there are several obligations of the same nature under different instruments Different authorities are involved in dealing with personal data breaches My authority is not able to issue sanctions in case of personal data breaches The rules on the notification of personal data breaches are no longer needed, as this is already dealt with in the General Data Protection Regulation and upcoming regulation (i.e. Network and Information Security Directive) Other problems and/or comments 11  ePD online survey competent authorities Confidentiality of electronic communications (Article 5.1 and 5.2) * 14. Please indicate for the following items relating to the confidentiality of electronic communications whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer The wording of this provision is not in line with modern technologies It is not sufficiently clear what type of communications data is in scope The transposition of this article varies across Member States despite the minimum standards laid down in this Directive It is not clear what the type of consent should be how this can/should be obtained practically The meaning of “commercial transaction” is not clear and it may be interpreted differently by Member States Other problems and/or comments 12 ePD online survey competent authorities Confidentiality of information stored on the users’ terminal equipment (Article 5.3) 13 * 15. Please indicate for the following items relating to the confidentiality of information stored on the users’ terminal equipment whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer The rules are vague and leave a lot of room for interpretation to the competent authorities It is not always clear whether a given consent is valid, e.g. if given via the configuration of browser settings It is practically difficult to our authority to give guidance on how to implement the consent rules If implemented, the rules result in over-complicated and lengthy user notices The consequences of giving consent is not clear to all users (e.g. the possibility of tracking) Users do not have a real choice, as websites often deny access to websites if cookies are refused The rules are not sufficiently broad to capture new mechanisms, such as “WiFi tracking” It is not clear who needs to comply with this provision, the website owner or the third parties setting the cookies Other problems and/or comments 14  ePD online survey competent authorities Specific rules on traffic data (Article 6) * 16. Please indicate for the following items relating to the rules on traffic data whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer There are cases where traffic and location data are used without consent, e.g. email providers are allowed to set up filtering systems to safeguard the security of their services It is difficult to determine how long traffic data should be retained, leading uncertainty for the authority and/or unnecessary storage of traffic data by businesses The relationship to other instruments, such as national data retention laws, is not clear Enforcement of the rules on traffic data is not effective Other problems and/or comments 15  ePD online survey competent authorities Location data other than traffic data (Article 9) * 17. Please indicate for the following items relating to location data other than traffic data whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer The notice requirements cannot be easily implemented (e.g. cause lengthy and detailed user communications) It is not clear how often consent has to be provided if the user asks frequently the added- value service There is no need to have detailed provisions about location data and consent requirements upon providers who are anyhow subject to the General Data Protection Regulation Other problems and/or comments ePD online survey competent authorities Itemised billing (Article 7) 16 * 18. Please indicate for the following items relating to itemised billing whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer The rules pose problems in relation to service contracts concluded by employers for their employees, e.g. the right to the employee’s privacy may be endangered if the employer needs itemised billing It is not specified in the ePD whether service providers are allowed to charge subscribers for changing the presentation of bills (e.g. from non- itemised billing to itemised or vice versa) It is unclear what type of privacy enhancing methodologies the ePD implies It is unclear if the privacy enhancing examples spelled out in the ePD (Recital 33) are widely implemented by service providers Other problems and/or comments ePD online survey competent authorities Presentation and restriction of calling and connected line (Article 8) 17 * 19. Please indicate for the following items relating to the presentation and restriction of calling and connected line whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer There is a lack of clarity relating to how these rules can be applied in relation to service contracts concluded by employers for their employees It is unclear how the providers should inform the public about the presentation of calling and/or connected line identification, where offered (e.g. make explicit reference of these possibilities on providers’ privacy statement) It is unclear how providers or authorities should respond to users/subscribers who want to know who gave a call or through which line the call came in if there is a restriction to identify the calling and connected line The restrictions of this article are not sufficient now as they apply only to telephony services These obligations for service providers are no longer relevant, as some of the aspects covered by this provision are available to users as functions on modern cell phones Other problems and/or comments 18  ePD online survey competent authorities Automatic call forwarding (Article 11) * 20. Please indicate for the following item relating to automatic call forwarding whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer It is unclear which safeguards should be provided for subscribers against the nuisance caused by automatic call forwarding by others Other problems and/or comments ePD online survey competent authorities Directories of subscribers (Article 12) 19 * 21. Please indicate for the following items relating to directories of subscribers whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer The conditions under which a consent is valid and how the consent should be delivered are not clear In practice, service providers fail to inform subscribers of their inclusion in a public directory or if they do so, they are not transparent enough (e.g. in privacy statements) The provision leaves it open to Member States to require additional consent in some situations (Article 12.3), leading to divergent practices and confusion Other problems and/or comments ePD online survey competent authorities Unsolicited marketing communications sent and received through the Internet (Article 13) 20 * 22. Please indicate for the following items relating to unsolicited marketing communications whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer The conditions according to which it is possible to send direct marketing emails to users are not clear, e.g. whether it is sufficient to simply browse in an online shop The content of direct marketing emails is not clear, e.g. because it is not clear what is meant by similar products and services to those that were bought and when the “customer” relationship starts The ePD leaves it open to Member States to decide whether legal persons are protected by an opt-in or opt-out regime, leading to divergent transposition There are problems in relation to marketing calls to phone numbers that have been ported Other problems and/or comments ePD online survey competent authorities Enforcement 21 * 23. Please indicate for the following items relating to the enforcement of the ePD whether you consider them a problem and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer The transposition of the substantial rules varies between the Member States The Member States have designated different types of authorities for the implementation of the ePD In my country, more than one authority has responsibilities in relation to the ePD In other countries, more than one authority has responsibilities in relation to the ePD The Article 29 Working Party and the future European Data Protection Board (EDPB) only represent data protection authorities and thus not all national competent authorities The ePD does not yet sufficiently address potential cooperation mechanisms for complaints of cross- border data processing There is a lack of human resources to deal with the aspects related to the ePD in my authority There is a lack of financial resources to deal with the aspects related to the ePD in my authority Other problems and/or comments 22  ePD online survey competent authorities Obligations and costs for competent authorities * 24. What technical and organisational measures did your authority have to carry out initially in order to fulfil your responsibilities in relation to the ePD? Issuing guidance Setting up IT structures Developing procedures to implement tasks, such as dealing with notifications Other (please specify) 23 * 25. Which tasks does your authority carry out regularly in relation to the ePD? Preventive audits of individual service providers to check whether service providers comply with the security obligations Preventive audits of individual service providers to check whether service providers comply with their notification obligations Audits of individual service providers based on complaints Dealing with a personal data breach of one service provider (Article 4), including reviewing notifications and reacting Sanctioning of individual service providers Drafting one new guidance document Updating one existing guidance document Developing recommendations on good practices Delivering one training course on the application of the Directive Organising an information campaign Other (please specify) ePD online survey competent authorities Costs for competent authorities * 26. How often does your authority carry out the previously selected tasks in relation to the ePD? 24  More than 15 times per year 1-5 times per 6-10 times per 11-15 times per (please specify One-off year year year below) Cannot answer Preventive audits of individual service providers to check whether service providers comply with the security obligations Preventive audits of individual service providers to check whether service providers comply with their notification obligations Audits of individual service providers based on complaints Dealing with a personal data breach of one service provider (Article 4), including reviewing notifications and reacting Sanctioning of individual service providers Drafting one new guidance document Updating one existing guidance document Developing recommendations on good practices Delivering one training course on the application of the Directive Organising an information campaign [Insert text from Other] Comment(s) 25 * 27. Please indicate the time consumed for each of the elements identified in the previous question. 2 weeks or more Less than 1 1 day – less than 3 days – less 1 week – less (please specify working day 3 days than a week than two weeks below) Cannot answer Preventive audits of individual service providers to check whether service providers comply with the security obligations Preventive audits of individual service providers to check whether service providers comply with their notification obligations Audits of individual service providers based on complaints Dealing with a personal data breach of one service provider (Article 4), including reviewing notifications and reacting Sanctioning of individual service providers Drafting one new guidance document Updating one existing guidance document Developing recommendations on good practices Delivering one training course on the application of the Directive Organising an information campaign [Insert text from Other] Comment(s) 26 * 28. What are the main cost factors in relation to the ePD? Please select up to three items. Preventive audits of individual service providers to check whether service providers comply with the security obligations Preventive audits of individual service providers to check whether service providers comply with their notification obligations Audits of individual service providers based on complaints Dealing with a personal data breach of one service provider (Article 4), including reviewing notifications and reacting Sanctioning of individual service providers Drafting one new guidance document Updating one existing guidance document Developing recommendations on good practices Delivering one training course on the application of the Directive Organising an information campaign [Insert text from Other] * 29. How many FTE* are working with tasks related to the ePD in your authority? * FTE stands for full time equivalent and equals to the hours worked by one employee on a full-time basis. In practice, one FTE position may be shared by more than one person (e.g. two persons working 20 hours per week equal one FTE). Less than 1 FTE 1-2 FTE 3-5 FTE 6-9 FTE 10 or more, please specify Other (please specify) 27 * 30. What is the annual budget available for your authority to deal with the tasks related to the ePD? Please indicate an estimated average or the actual amount for the year 2015 in Euro. Estimated average amount Actual amount (2015) ePD online survey competent authorities Key strengths and challenges relating to the ePD 28 * 31. Please indicate your level of agreement with the following statements. The specific rules on privacy in the electronic communications sector introduced by the ePD: Neither agree nor Strongly disagree Disagree disagree Agree Strongly agree Cannot answer Have significantly helped to ensure the protection of personal data Have significantly helped to ensure the free movement of personal data within the internal market Have significantly helped to ensuring the free movement of electronic communication terminal equipment and services in the EU Comment(s) 29 * 32. Please indicate for the following items whether you consider them a problem hindering the success of the ePD and, if so, how serious this problem is. Not at all a problem Minor problem Moderate problem Serious problem Cannot answer The scope of the ePD is too narrow The scope of the ePD is too broad The ePD is not coherent with other legal instruments, such as the GDPR The legal framework on privacy in the electronic communications sector is too complex, as the rules are contained in different instruments (e.g. GDPR, Framework Decision) Divergences in transposition between the Member States There is lack of clarity of individual provisions Enforcement are not effective There is lack of awareness among service providers There is lack of awareness among users/subscribers Other problems and/or comments ePD online survey competent authorities Potential policy options/measures to address current problems 30 * 33. Please indicate which policy measures you consider useful with a view to solving the challenges you identified. Additional guidance at EU level Exchange of good practices in relation to enforcement mechanisms Practical support to the competent authorities Additional financial resources to the competent authorities Amendment of the ePD to clarify aspects that are not clear (no substantial changes) Amendment of the ePD to clarify and change substantial aspects Replacing the ePD with a Regulation with minor changes to solve lack of clarity (no substantial changes) Replacing the ePD with a Regulation to solve lack of clarity and change substantial aspects Repeal of the ePD Other (please specify) ePD online survey competent authorities Potential policy options/measures to address current problems 31 * 34. Of the policy options you consider useful, please indicate up to three options that should be addressed with priority. Additional guidance at EU level Exchange of good practices in relation to enforcement mechanisms Practical support to the competent authorities Additional financial resources to the competent authorities Amendment of the ePD to clarify aspects that are not clear (no substantial changes) Amendment of the ePD to clarify and change substantial aspects Replacing the ePD with a Regulation with minor changes to solve lack of clarity (no substantial changes) Replacing the ePD with a Regulation to solve lack of clarity and change substantial aspects Repeal of the ePD [Insert text from Other] ePD online survey competent authorities Conclusion 35. Would you like to add any other important points that we have not covered as part of this survey? 36. Does your authority hold reports or other information sources that the study team should take into account? 32 * 37. We would be grateful if you could provide your name and contact details (incl. telephone number and email address) so we can contact you if needed to follow up. ePD online survey competent authorities End of survey Thank you for your participation in the survey! 33 EUROPEAN COMMISSION Directorate-General for Communications Networks, Content and Technology Digital Society, Trust and Security Trust and Security Brussels, ¿4 (<%(£<*(, DG CONNECT/H4/RB/jl Ares cnect.ddgl .h.4(2016)3693365 Letter of recommendation TO WHOM IT MAY CONCERN Subject: Invitation to collaborate with Deloitte in the context of the evaluation and review of the ePrivacy Directive Dear Madam/Sir, I hereby confirm that Deloitte is currently under contract with the European Commission, Directorate-General Connect, to gather evidence on the transposition and implementation of the ePrivacy Directive (Directive 2002/58/EC). In the framework of this study, Deloitte will approach stakeholders and experts in the field to gather information and solicit inputs for all aspects of the study. We would very much appreciate any assistance you can provide to Deloitte in this regard, assuring you that the information you will provide will be treated confidentially. Please note that this exercise is a complement to the public consultation, which is running until 5 July 2016 and of which you may be aware. If you require any further information, please contact the Deloitte Project Manager, Anna Lauridsen ([email protected]) or Rosa Darcelo, Head of Sector at DG CNECT ([email protected]). We thank you in advance for your contribution. Yours sincerely, Head of Unit Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIë - Tel. +32 22991111 Office: BU25 03/131 - Tel. direct line +32 229- 88182 - Fax +32 229-20125 Email: [email protected]