BRUSSELS—Revised ePrivacy laws should guarantee confidentiality of communications and encourage encryption, the European Union’s data watchdog has said.

European Data Protection Supervisor (EDPS) Giovanni Buttarelli published his official opinion on the review of the ePrivacy Directive on Monday.

An overhaul to the so-called Cookie Law is currently be worked on by officials at the European Commission, with the completion date expected before the end of the year to bring it into line with the new General Data Protection Regulation (GDPR).

“The EU rules designed to protect privacy in electronic communications need to reflect the world that exists today," said Buttarelli.

By preserving and not reducing the high level of protection offered by the current ePrivacy Directive, and harmonising some specific provisions to complement the GDPR, the EU can reinforce the confidentiality and integrity of our electronic communications.” He added:

The new rules should also clearly allow users to use end-to-end encryption (without 'backdoors') to protect their electronic communications. Decryption, reverse engineering or monitoring of communications protected by encryption should be prohibited. In addition, the use of end-to-end encryption should also be encouraged and when necessary, mandated, in accordance with the principle of data protection by design.

Buttarelli urged the commission to ensure that privacy safeguards cover all forms of electronic communications, whether by telephone, voice-over-IP services, or messaging apps, and should include all publicly accessible networks, such as Wi-Fi services in hotels, coffee shops, and airports, as well as hospitals, universities, and hotspots created by public administrations.

The current ePrivacy Directive rules only apply to publicly available electronic communication services, but not to over-the-top service providers (OTTs).

In a public consultation held from April to early July, the commission specifically asked for feedback on whether widening the scope of the law is a good idea, noting that failure to do so “may result in both a void of protection for citizens and in an uneven playing field in this market.”

He added that the revised ePrivacy Directive should continue to ban interception/surveillance of communications, clearly and specifically covering both content and "metadata" (including traffic data).

“No communications should be subject to unlawful tracking and monitoring without freely given consent, whether by cookies, device-fingerprinting, or other technological means," Buttarelli said.

"Users must also have user-friendly and effective mechanisms to give, or not give, their consent. In order to better protect the confidentiality and security of electronic communications, the current consent requirement for traffic and location data must be strengthened.”

Existing rules on spam should also be updated, the EDPS added.

He also wants to know more about law enforcement information requests and suggested that a new requirement for organisations “to periodically disclose aggregate numbers indicating EU and non-EU law enforcement or government requests for information” would provide “some welcome transparency in the sensitive, complex and often contentious area of government access to communications.”

Earlier this month, a vast coalition of tech and telco firms called for the law to be scrapped.