The GDPR

Article 95 clarifies the link with Directive 2002/58/EC of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector.

The Regulation does not impose any additional obligations in the provision of electronic communications services available to the public on public networks of communications in the Union, for the areas in which they are submitted to specific obligations having the same purpose as those set out in Directive 2002/58/EC.

According to recital 173, the future Regulation is intended to apply to all aspects of the protection of rights and freedoms with respect to the personal data processing, unless specific obligations with the same purpose are set out in the Directive 2002/58/EC. The Regulation calls for a revision of Directive 2002/58/EC to ensure consistency with the new European text.

The Directive

-

Potential issues

We do not see a priori any specific implementation difficulties. 

European Union

CJEU caselaw

C-129/21 (27 October 2022) - Proximus (Annuaires électroniques publics)

1.      Article 12(2) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in conjunction with point (f) of the second paragraph of Article 2 of that directive and with Article 95 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that ‘consent’ within the meaning of Article 4(11) of that regulation is required from the subscriber of a telephone service operator in order for the personal data of that subscriber to be included in publicly available telephone directories and directory enquiry services published by providers other than that operator, and that that consent may be provided to that operator or to one of those providers.

2.      Article 17 of Regulation 2016/679

must be interpreted as meaning that the request by a subscriber to have his or her personal data withdrawn from publicly available telephone directories and directory enquiry services constitutes making use of the ‘right to erasure’ within the meaning of that article.

3.      Article 5(2) and Article 24 of Regulation 2016/679

must be interpreted as meaning that a national supervisory authority may require that the provider of publicly available telephone directories and directory enquiry services, as controller, take appropriate technical and organisational measures to inform third-party controllers, namely the telephone service operator that has communicated its subscriber’s personal data to that provider and the other providers of publicly available telephone directories and directory enquiry services to which that provider has itself supplied such data, of the withdrawal of the subscriber’s consent.

4.      Article 17(2) of Regulation 2016/679

must be interpreted as not precluding a national supervisory authority from ordering a provider of publicly available telephone directories and directory enquiry services – which has been requested by the subscriber of a telephone service operator to cease disclosing personal data relating to him or her – to take ‘reasonable steps’, within the meaning of that provision, to inform search engine providers of that request for erasure of the data.
 

Judgment of the Court 

Opinion of Advocate General 

Retour au sommaire Retour au sommaire