Privacy watchdogs concerned about Wi-Fi tracking protection in new EU law
The organization that brings together all European privacy regulators, the Article 29 Working Group, has expressed its concerns about various topics in new EU legislation. For example, the body doubts whether there is sufficient protection against WiFi tracking.
In an opinion published Monday, the working group writes that in addition to Wi-Fi tracking, there are “serious concerns” about the processing of metadata, cookie walls and default privacy settings. The new EU rules laid down in the ePrivacy Regulation can still be improved on these points. In general, the organization is positive about the regulation and writes that it was a good move to extend the applicable telecom rules to services such as WhatsApp.
On the subject of Wi-Fi tracking, the working group reports that the current text of the regulations gives the impression that companies may track the location of people without their permission using this technology, or, for example, Bluetooth tracking. All that seems to be needed is a warning indicating this. The supervisors write that this cannot be the intention and that the rules must correspond to the General Data Protection Regulation, which will come into effect in 2018.
For example, it follows from that regulation that keeping the location is only allowed if the data is immediately deleted or anonymised, and if permission has been obtained. In addition, the data may only be collected for statistical purposes, it must be necessary data and there must be an opt-out.
The second point where the current version of the ePrivacy Regulation falls short is in the area of metadata analysis. For example, the basic principle should be that there is a ban on processing the content and metadata of messages from recipients and senders. Only consent would make this processing legal. The working group also argues in favor of including an exception for services that people request themselves, such as search functionality in mail and text-to-speech.
Furthermore, the Article 29 working group criticizes the rules about cookie walls. This wants to completely ban the organization in the event that access to a service is completely dependent on the granting of permission. Finally, the organization does not agree with the state of the rules on privacy by default. For example, devices and software should be provided with privacy-friendly settings as standard. Users should be able to indicate whether they want to be tracked via the browser and this should not only apply to third parties and cookies. The ePrivacy Regulation is due to come into effect in May 2018.