The ePrivacy Regulation and the EU Charter of Fundamental Rights

An important focus in the legislative discussions on the proposed ePrivacy Regulation is the fact that the proposal (mainly the articles 5 and 6 thereof) aims to protect the confidentiality of communications of individuals and legal persons, and in particular addresses the confidentiality of content data and metadata, implementing Article 7 of the EU Fundamental Rights Charter (“right to privacy”). In contrast, the GDPR implements Article 8 of the Charter (“right to data protection”).
The attached legal note argues that the difference between Articles 7 and 8 of the Charter has limited relevance, in connection to the ePrivacy Regulation.
It aims to demonstrate that EU law and in particular the Charter does not preclude a risk based approach, nor the processing of content data and metadata on the basis of legitimate interest, provided that the necessary safeguards protecting the individuals’ communications are put in place.
Neither Article 7 nor Article 52.1 of the Charter enumerate the grounds for limitation of fundamental rights. They do not prescribe that the right to privacy can be limited only on the basis of particular justificatory grounds, such as consent of the user.
The note also addresses a few connecting issues, such as the sensitive nature of content data and metadata, as well as the robust protection of individuals provided by the GDPR if an organisation relies on legitimate interests as a legal basis for processing electronic communications data, due to the increased accountability measures organisations need to take.
The note also deals with the confidentiality of communications of legal persons and explains that this confidentiality is not a matter of privacy and is protected under other EU law provisions.