Thread by @WolfieChristl

Council proposal for the EU ePrivacy regulation:
data.consilium.europa.eu/doc/document/S…

This, brought to you by publisher lobbyists, is bad:

And this looks unclear and/or just broken.

What is an "equivalent offer"? Would this allow "tracking or pay"?

The other recital basically doesn't say anything, does it?

("consent directly expressed by an end-user should always prevail")

If so then bad. I want people to pay for content and quality journalism, but "tracking or pay" is unacceptable. Those who cannot afford to pay for myriads of subscriptions would continue being exposed to tracking. Acceptable: "non-intrusive ads or pay".

https://twitter.com/Gnppn/status/1359626185882427397

Generally, I lost track about the ePrivacy negotiations in recent years, unfortunately. I guess, it would be a full-time-job.

Anyway, I'm worried about the many occurrences of 'pseudonymization' as a safeguard.

And of course, articles 6 and 8 are key:

https://twitter.com/ErnaniCerasaro/status/1359495760300175368

So, communications metadata can be further processed for 'compatible' purposes other than the purposes it was initially collected for if there is "any link" between them, plus some considerations about the context, plus pseudonymization? And profiling is ok if no 'legal effects'?

I hope, the European Parliament will fight hard in the Trilogue negotiations.

https://twitter.com/SophieintVeld/status/1359486303478435842

I'd be willing to accept limited comms metadata analytics for specific limited purposes at aggregate levels in order to avoid high-frequency consent requests in certain cases.

But the industry will exploit every tiny little loophole, and I'm afraid the proposal contains several.

Did I ever mention that I am not a fan of mixing

- scientific research in the public interest
- research for commercial interests
- statistical purposes in general

...into one?

And what's that?

Do I get this right that this would mean that third-party network/cybersecurity/fraudprevention firms such as ThreatMetrix and Iovation, as well as CDNs, would be completely EXEMPT from ePrivacy?

When did this enter the Council's ePrivacy proposals?

There's a provision that requires measures that aim to ensure security etc to be "proportionate" and "performed in the least intrusive manner", which is VERY important.

But what if you're exempt from ePrivacy?

Even if exempt from ePrivacy, personal data processing is still subject to the GDPR, I know.

But I think it's crucial to make clear that data processing for network security and fraud prevention must be 'proportionate' and 'performed in the least intrusive manner' in ePrivacy.

Why? Just take a look at ThreatMetrix, only one of many vendors in the space:

https://twitter.com/WolfieChristl/status/1286385716948275206

"I tracked all relevant ePrivacy events since 2016. I also directly participated in the works as an expert ... The EP version is best for privacy, while the Council one is the weaker one, and even self-inconsistent in certain places, which is worrying"

https://twitter.com/lukOlejnik/status/1359907032527175684