On July 14, 2017, the Impact Assessment Institute (“IAI”) (an independent institute committed to impartial impact assessment and scientific evaluation of policy and legislation in the EU) published a study assessing the impact assessment carried out by the European Commission in connection with the Commission’s proposal for a new E-Privacy Regulation (“EPR”).  The IAI study is critical of the Commission’s impact assessment, and – by extension – the Commission’s case for the new EPR itself.

Background on the Impact Assessment and EPR

The EPR is the Commission’s proposed update to the existing EU E-Privacy Directive, and is intended to complement the EU’s broader data protection regime (as set out in the General Data Protection Regulation, “GDPR”).  The EPR would introduce a number of rules, including a provision protecting the confidentiality of communications that would regulate traditional telecoms services, and new “over-the-top” (“OTT”) services such as VoIP, web email, and instant messaging, among others.  The Commission EPR proposal is currently progressing through the legislative process in both the European Parliament and Council.

When formulating new proposals for regulations such as the EPR, the Commission prepares impact assessments in accordance with the Better Regulation Guidelines (detailed guidance intended to improve the quality of the Commission’s law-making).  The Commission duly prepared an impact assessment for the EPR, which was published alongside the text of the EPR legislative proposal on January 10, 2017 (the “Impact Assessment”).

Faults Identified by the IAI in the Impact Assessment

The IAI’s study highlights a number of key issues with the Commission’s Impact Assessment for the EPR – and by extension the Commission’s case for the new EPR itself.  Issues identified by the study include:

• A rushed legislative process. The Better Regulation Guidelines state that the Commission should publish an impact assessment at least 12 months after the Commission completes its “inception” impact assessment – but the IAI noted that the Commission published the Impact Assessment and the proposed text of the EPR after only 3 months.  The IAI questioned whether this was enough time to enable the Commission to thoroughly analyse the matter.

• Insufficient evidence for a problem that requires new regulation. The Better Regulation Toolbox (practical guidance, plans and templates to assist with the implementation of the Better Regulation Guidelines) requires an impact assessment to verify the existence of a problem that must be addressed by a new law.  However, the IAI’s view was that there is “no clear link” between the problems identified in the Impact Assessment and the EPR’s ability to address those problems.  The IAI highlighted, in particular, a lack of evidence justifying an extension of the scope of the EPR to OTT services.

• Lack of transparency. The IAI concluded that the Commission’s data-gathering process for the Impact Assessment “lack[ed] essential transparency,” damaging, in the IAI’s view, the legitimacy of the conclusions reached in the Impact Assessment.

• Inadequate assessment of major effects of the EPR. The IAI found that the Impact Assessment took insufficient account of the potential impact of the EPR on fundamental human rights, competition, and market distribution.  The IAI also concluded that the Impact Assessment failed to identify, and determine how to resolve, potential incompatibilities between the EPR and other EU legislation – particularly the GDPR and the proposal for a new Directive on the European Electronic Communications Code (“EECC”).

Recommendations

The IAI recommended that the Commission reconsider (i) the alignment of the EPR with the provisions of the GDPR, and (ii) the potential repercussions of the EPR on the EU’s internal market and Digital Single Market policy agenda.

In addition, the IAI also recommended that the existing shortcomings of the Impact Assessment’s evidence be taken into account in the ongoing legislative process, and that “new robust evidence” be collected to better corroborate the results of the Impact Assessment.

Rosie Klement contributed to this post.