The GDPR

Article 95 clarifies the link with Directive 2002/58/EC of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector.

The Regulation does not impose any additional obligations in the provision of electronic communications services available to the public on public networks of communications in the Union, for the areas in which they are submitted to specific obligations having the same purpose as those set out in Directive 2002/58/EC.

According to recital 173, the future Regulation is intended to apply to all aspects of the protection of rights and freedoms with respect to the personal data processing, unless specific obligations with the same purpose are set out in the Directive 2002/58/EC. The Regulation calls for a revision of Directive 2002/58/EC to ensure consistency with the new European text.

The Directive

-

Potential issues

We do not see a priori any specific implementation difficulties. 

European Union

CJEU caselaw

C-129/21 (27 October 2022) - Proximus (Annuaires électroniques publics)

1.      Article 12(2) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in conjunction with point (f) of the second paragraph of Article 2 of that directive and with Article 95 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that ‘consent’ within the meaning of Article 4(11) of that regulation is required from the subscriber of a telephone service operator in order for the personal data of that subscriber to be included in publicly available telephone directories and directory enquiry services published by providers other than that operator, and that that consent may be provided to that operator or to one of those providers.

2.      Article 17 of Regulation 2016/679

must be interpreted as meaning that the request by a subscriber to have his or her personal data withdrawn from publicly available telephone directories and directory enquiry services constitutes making use of the ‘right to erasure’ within the meaning of that article.

3.      Article 5(2) and Article 24 of Regulation 2016/679

must be interpreted as meaning that a national supervisory authority may require that the provider of publicly available telephone directories and directory enquiry services, as controller, take appropriate technical and organisational measures to inform third-party controllers, namely the telephone service operator that has communicated its subscriber’s personal data to that provider and the other providers of publicly available telephone directories and directory enquiry services to which that provider has itself supplied such data, of the withdrawal of the subscriber’s consent.

4.      Article 17(2) of Regulation 2016/679

must be interpreted as not precluding a national supervisory authority from ordering a provider of publicly available telephone directories and directory enquiry services – which has been requested by the subscriber of a telephone service operator to cease disclosing personal data relating to him or her – to take ‘reasonable steps’, within the meaning of that provision, to inform search engine providers of that request for erasure of the data.
 

Judgment of the Court 

Opinion of Advocate General 

C-654/23 (13 November 2025) - Inteligo Media

1. Article 13(1) and (2) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, must be interpreted as meaning that the email address of a user is obtained by the publisher of an online publication ‘in the context of the sale of a product or a service’, within the meaning of Article 13(2) of that directive, where that user creates a free account on that publisher’s online platform giving him or her the right to access, free of charge, a certain number of articles of that publication, to receive, free of charge, via email, a daily newsletter containing a summary of the new legislation discussed in articles within that publication, including hyperlinks to those articles, and the right to access, for a fee, additional articles and analyses of that publication. The transmission of such a newsletter constitutes a use of electronic mail ‘for the purposes of direct marketing’ for ‘similar products or services’ within the meaning of that provision.

2. Article 13(2) of Directive 2002/58, as amended by Directive 2009/136, read in conjunction with Article 95 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that, where the controller uses the email address of a user in order to send him or her an unsolicited communication, in accordance with Article 13(2) of that directive, the conditions for lawful processing laid down in Article 6(1) of that regulation are not applicable.

Judgment of the Court 

Opinion of Advocate General 

Retour au sommaire Retour au sommaire