On January 10, 2017, the European Commission sent to the EU Parliament the proposal for the EU Regulation concerning the protection of personal data in electronic communications. Such proposal, which is part of the “Strategy for a Unified Digital Market” recently promoted by the EU institutions in order to enhance the public confidence in digital services and in their safety, constitutes a lex specialis of the new EU Regulation no. 679/2016 on privacy and will complete the rules concerning the protection of the information included in electronic communications and having the character of “personal data”. If approved, the new regulation will repeal the EU Directive 2002/58/CE concerning the processing of personal data and the protection of privacy in the sector of electronic communications.


The aim of the Regulation is to adapt the current European legal framework to the latest developments in the field of electronic communications, especially after the spread in the market of new models of communication and messaging, so-called “Over the top”, such as Facebook, Skype and WhatsApp.

The main innovations contained in the regulation proposal are: i) the provision of stricter rules for the processing, by electronic communication providers, of the data contained in electronic communications: the provider will in fact be obliged to remove or otherwise anonymize such data once the recipient of the communication has received its content (art. 7); ii) the simplification of the rules on “cookies”: the user’s consent won’t in fact be necessary anymore for the saving, among others, of cookies necessary to measure the number of website visitors or of cookies that are required to guarantee the website’s functionality in favour of the user (eg. storage of items in a shopping cart of an e-commerce website) (art. 8); iii) the provision of stronger guarantees for the users of so-called interpersonal communication services based on a number (eg. mobile telephony services): the providers of such services will be required to make available to the user services that enable the generalized block of anonymous calls or of calls coming from specific numbers (art. 12 and 14).

According to the legislative procedure for the approval of EU regulations, this proposal of regulation, in order to acquire force of law and to become directly applicable in all Member States, must now be approved by both the European Parliament and the EU Council. The aim is to let the Regulation enter into force on 25 May 2018, together with EU Regulation on privacy.