14 November 2023
The EDPB have published their 'Guidelines 2/2023 on the Technical Scope of Art. 5(3) of ePrivacy Directive' for public consultation.
Although the Guidelines clarify CJEU caselaw and previous guidance, they have significant implications for online service providers, marketing firms and device manufacturers.
The Guidelines clarify that obligations to provide clear information to users/subscribers, and obtain consent to store or access information, are far broader than the use of cookies.
They do NOT give guidance on the circumstances in which the exemptions to obtaining consent may apply.
Responses should be provided by 28 December 2023, using the form on the EDPB website.
The Guidelines work through each of the four criteria for Art. 5(3) to apply.
Specific use cases discussed are:
URL and pixel tracking
Local processing
Tracking based on IP only
Intermittent and mediated IoT reporting
Unique identifiers (including unique IDs hashed on the device and accessed by any entity)
Key points include:
All information is within scope, not just personal data; this includes read-only data generated or inputted by the user/subscriber or manufacturer
"Terminal equipment” may “be comprised of any number of individual pieces of hardware” including smartphones, laptops, connected TVs, smart glasses, connected cars, IoT devices, SSD cards, flash drives and the CPU cache, whether or not the user/subscriber owns the device or shares it with others
“Public communications networks” may include services available to a limited sub-set of the public, for example subscription services (whether paid or not)
“Gaining access” to information and “storing information” are separate, standalone grounds for Art. 5(3) to apply: only one is required
The origin of information does not restrict Art. 5(3)'s application; distributing software that proactively calls an API, JavaScript code sending information via a browser, cookies and pixels are all examples of accessing information for Art. 5(3)
The user/subscriber does not have to be aware of the access or storage for Art. 5(3) to apply
Respondents have until 28 December 2023 to submit comments to EDPB, via the form on their website.