§ ePrivacy Directive · Article 9
ePrivacy Directive Article 9: Obligations, Deadlines & Penalties
At a glance
Article 9 of the ePrivacy Directive imposes 5 obligations on provider of the public communications network or publicly available communications service, service provider. At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 9
Obligation 1
Location data other than traffic data may only be processed when made anonymous or with the consent of users or subscribers to the extent and for the duration necessary for the provision of a value added service.
Directive 2002/58/EC, Article 9, Article 9
- Obligated entity
-
service provider
- Sector scope
- public communications networks or publicly available electronic communications services
- Action required
-
process
- Deadline
-
—
- Penalty
-
—
- Exemptions
- data made anonymous
Obligation 2
The service provider must inform users or subscribers prior to obtaining consent of the type of location data processed, the purposes and duration of processing, and whether data will be transmitted to a third party.
Directive 2002/58/EC, Article 9, Article 9
- Obligated entity
-
service provider
- Sector scope
- public communications networks or publicly available electronic communications services
- Action required
-
inform
- Deadline
-
prior to obtaining consent
- Penalty
-
—
Obligation 3
Users or subscribers must be given the possibility to withdraw their consent for the processing of location data other than traffic data at any time.
Directive 2002/58/EC, Article 9, Article 9
- Obligated entity
-
service provider
- Sector scope
- public communications networks or publicly available electronic communications services
- Action required
-
enable withdrawal
- Deadline
-
at any time
- Penalty
-
—
Obligation 4
Where consent has been obtained, the user or subscriber must continue to have the possibility, using a simple means and free of charge, of temporarily refusing the processing of such data for each connection or transmission.
Directive 2002/58/EC, Article 9, Article 9
- Obligated entity
-
service provider
- Sector scope
- public communications networks or publicly available electronic communications services
- Action required
-
enable refusal
- Deadline
-
—
- Penalty
-
—
Obligation 5
Processing of location data must be restricted to persons acting under the authority of the provider or third party and restricted to what is necessary for providing the value added service.
Directive 2002/58/EC, Article 9, Article 9
- Obligated entity
-
provider of the public communications network or publicly available communications service
- Sector scope
- public communications networks or publicly available electronic communications services
- Action required
-
restrict
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 9
Who must comply with Article 9 of the ePrivacy Directive?
+
provider of the public communications network or publicly available communications service, service provider.
What does Article 9 of the ePrivacy Directive require?
+
process inform enable withdrawal
What is the compliance deadline for ePrivacy Directive Article 9?
+
at any time; prior to obtaining consent