On Friday, 19 May 2017, the Council of the EU has released a Progress Report regarding the ePrivacy Regulation as proposed by the European Commission in January. The Progress Report reveals the current timeline for this ordinary legislative procedure and allows to presume that the final text of the ePrivacy Regulation may not be available in all languages of the EU before April 2019. Hence, the ePrivacy Regulation will become applicable about a year later than the GDPR. During the Interim, the privacy rules will be determined by the interplay between the GDPR and the ePrivacy Directive addressed only partially in Art. 95 GDPR (for more details see Bender/Jones/Young/Wulfert-Markert, "Recent Developments and Future Changes to Internet Privacy Rules in the EU, the UK and the U.S.", CRi 2017, pp. 68-74).

Status Quo

Based on this Progress Report the status quo of the legislative process appears to be the following:

• EU-Parliament:  According to para. 5 of the Progress Report the vote in the LIBE committee is tentatively scheduled for October 2017.
• EDPS:  According to para. 6 of the Progress Report the European Data Protection Supervisor (EDPS) presented his opinion to the Council's Working Party on Telecommunications and Information Society (WP TELE) on 3 May 2017 (see "Proposed ePrivacy Regulation: In-Depth Study for Parliament and EDPS Opinion", CRonline News).
• EU-Council:  According to para. 8 of the Progress Report the WP TELE has proceeded with the article-by-article examination of the proposal covering, to date, Articles 1 to 8 (of 29 Articles in total). Member States are still in the process of analysing the proposal and formulating their respective national positions. The Progress Report aims to inform the Ministers at the TTE Council of 9 June 2017.

Estimated Timeline

The Status quo leads to the following realistic estimates:

• The position of the EU Parliament may earliest be expected by the end of 2017.
• The general approach of the EU Council could then be expected within the first half of 2018; however, according to Art. 294(5) Treaty on the Funktioning of the EU (TFEU) there is no deadline for the EU Council within which to deliver its general approach to the proposed ePrivacy Regulation.
• 2nd Reading in EU Parliament: Only once the EU Council has issued its general approach to the EU-Parliament, then the EU Parliament has to have its second reading of the proposed ePrivacy Regulation within 3 months which might open trilogue. This deadline may be extended by one month to 4 months in total, see Art. 294(14) TFEU.
• The trilogue may last up to 6 weeks and may be extended by another 2 weeks to 4 weeks or about 2 months in total, see Art. 294(10) and (14) TFEU.

Conclusion

Should the Commission's proposal for an ePrivacy Regulation move through the legislative process with speed identical to the GDPR, then the final text of the ePrivacy Regulation would be available in all languages of the EU in April 2019.

After the GDPR will become applicable on 25 May 2018, the privacy rules are determined by the interplay of the GDPR and the ePrivacy Directive. The GDPR addresses its relationship to the ePrivacy Directive in Art. 95 GDPR only partially so that many upcoming questions remain open.

(ga)

Council of the EU, Regulation on Privacy and Electronic Communications - Progress Report, 9324/17, 19 May 2017

Bender/Jones/Young/Wulfert-Markert, "Recent Developments and Future Changes to Internet Privacy Rules in the EU, the UK and the U.S.", CRi 2017, pp. 68-74