The current law

Since 1997, European law has required our consent in order to analyse or sell our electronic communications (calls, texts, email, Internet use) for commercial purposes (articles 5 and 6 of Directive 97/66/CE, later included in Directive 2002/58/CE).

This requirement protects our fundamental right to private communications. It guarantees that no one can put together a list of people we communicate with, or a list of information we look up on the net, and that the content of our messages remain confidential.

What will change

Under pressure from big corporations (as Orange, Deutsche Telekom, Google, Whatsapp ou Snapchat), Member States position is likely to favor the ongoing exploitation of our communications for commercial purposes without our consent.

Fortunately, their ambitions were hindered by the European Parliament in October. But Member States are capable of overthrowing the whole situation in order to open the Pandora’s box of commercial surveillance.

These corporations try to establish two exceptions in order to bypass our consent.

Legitimate interest

If a company claims it has a ‘legitimate interest’ (such as an economic interest) in analysing or monetizing our communications, it will be authorised to do so without our consent. It will only have to claim that its activity does not cause ‘excessive harm’ to the person whose communications have been processed.

However, this notion of excessive harm is particularly permissive. It is the company itself which gets to decide what is ‘excessive’ or not. Afterwards, a complaint shall need to be lodged before a Data Protection Authority for it to ensure that a proper balance is struck.

In any case, whether harm is excessive or not, commercial interests will now allow the violation of our communications’ privacy. Until now, this was only possible with our explicit consent.

Further processing

When using a phone or the Internet, we rely on many providers to relay our communications over the network. Our recourse to their service naturally authorizes them to process these communications in order to be able to convey our communications.

However, these providers would now be allowed to engage in any ‘further processing’ of our communications to re-use and monetize them – without our permission. They will only have to ensure that this new processing pursues a ‘compatible’ purpose with our initial request.

It is difficult to anticipate what a ‘compatible’ processing might mean or imply. Nevertheless, companies that support this exception make it clear that they want it for commercial reasons.

As a consequence, once again, each company will get to decide on its own what is ‘compatible’ or not.