Directive on privacy and electronic communications (Directive 2002/58/EC)
European Union · Regulation · European Parliament and Council of the European Union
Our summary
This directive establishes rules for protecting personal data and privacy in the electronic communications sector, covering subscribers and users of publicly available electronic communications services. It applies to processing of personal data, traffic data, location data, and communications in networks such as telecommunications and the Internet. The directive requires service providers to implement security measures, respect confidentiality of communications, and handle user consent and data in accordance with specified protections.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
21 sections
Jump to a chapter
Article 1 Scope and aim
This directive seeks to harmonise Member States' rules on protecting fundamental rights and privacy when handling personal data in electronic communications, and ensuring free movement of such data and services across the Community. It adds to Directive 95/46/EC and extends protection to legal persons' legitimate interests. The directive does not apply to activities outside the European Community treaty framework, or to public security, defence, state security, economic well-being linked to state security, or state activities in criminal law.
Article 2 Definitions
The directive adopts definitions from two other directives and defines eight additional terms specific to electronic communications: user, traffic data, location data, communication, call, consent, value added service, and electronic mail. These terms establish what types of people, data, services and information the directive covers.
Article 3 Services concerned
The directive applies to processing personal data when providing publicly available electronic communications services over public networks in the Community. Articles 8, 10 and 11 must apply to digital exchange subscriber lines, and to analogue lines where technically feasible and economically reasonable. Member States must notify the Commission when technical or economic barriers prevent compliance.
Article 4 Security
Electronic communications service providers must implement appropriate technical and organisational security measures proportionate to the risk, considering available technology and implementation costs. Providers must inform subscribers of any particular breach risk and available remedies, including likely costs where the risk is beyond the provider's control.
Article 5 Confidentiality of the communications
Member States must prohibit listening, tapping, storing or intercepting communications and traffic data without consent, except when legally authorised, while permitting technical storage needed for transmission. They may allow lawful business recording for evidence of transactions or communications. They must require clear information and an opt-out right before storing information on or accessing user terminal equipment, except for transmission or explicitly requested services.
Article 6 Traffic data
Providers must erase or anonymise traffic data after transmission completes, unless needed for billing until the challenge period expires, for value added services with consent, or for other specified purposes. Providers must inform users of traffic data types and processing duration, and restrict processing to authorised staff handling billing, traffic management, fraud detection, customer enquiries, marketing, or value added services. Competent bodies may be informed of traffic data to resolve disputes.
Article 7 Itemised billing
Subscribers may request bills that do not itemize their calls. Member States must establish national rules balancing the entitlements of subscribers who want itemised bills against the privacy interests of callers and called parties, such as by providing alternative methods for confidential communication or payment.
Article 8 Presentation and restriction of calling and connected line identification
Service providers must offer calling users and subscribers simple, free tools to block sending their calling line identification, and called subscribers simple, free tools to block receiving it. When identification is shown before call setup, called parties may reject calls where the caller has blocked identification. Called subscribers may also block showing their connected line identification to callers.
Article 9 Location data other than traffic data
Providers may process location data only when anonymised or with consent for value added services. They must inform users before obtaining consent of the data type, purposes, duration, and third-party sharing. Users may withdraw consent and may temporarily refuse processing at no cost per connection.
Article 10 Exceptions
Member States must establish transparent procedures allowing providers to override calling line identification suppression temporarily when a subscriber requests tracing of malicious or nuisance calls, with subscriber identification data stored and made available. Providers may also override calling line identification suppression and location data consent denial for emergency services recognised by Member States, including law enforcement, ambulance and fire services responding to emergency calls.
Article 11 Automatic call forwarding
Member States must guarantee that subscribers can easily and at no cost prevent others from redirecting calls to their phone through a straightforward method.
Article 12 Directories of subscribers
Member States must ensure subscribers receive free advance notification about public or directory-inquiry directories containing their personal data, including any search functions, and are given the option to decide on inclusion, verify, correct or remove their data at no charge. For purposes beyond basic contact search, member States may require additional subscriber approval. These protections apply to natural person subscribers; member States must also adequately safeguard the legitimate interests of non-natural person subscribers in directory listings.
Article 13 Unsolicited communications
Automated calling systems, fax, or email for direct marketing require prior consent; however, entities may email existing customers about similar products using their collected electronic contact details if customers can easily object for free at collection and with each message. Member States must prevent other unsolicited marketing communications without subscriber consent or in accordance with their choice of consent model, and must prohibit disguised sender identity or missing response addresses in direct marketing emails. These rules apply to natural person subscribers, with member States also protecting non-natural persons' legitimate interests.
Article 14 Technical features and standardisation
Member States must not impose mandatory technical requirements that would obstruct equipment market access or free movement between member States. Where directive implementation requires specific technical features, member States must notify the Commission under the applicable procedure. Standards for terminal equipment may be adopted to ensure compatibility with users' rights to manage personal data protection.
Article 15 Application of certain provisions of Directive 95/46/EC
Member States may limit privacy rights and obligations through legislation if justified for national security, defence, public security, or preventing criminal offences, including temporary data retention. The remedies, liability and sanctions chapter of Directive 95/46/EC applies to measures taken under this Directive. The Article 29 Working Party shall oversee matters under this Directive regarding fundamental rights and legitimate interests in electronic communications.
Article 16 Transitional arrangements
Article 12 does not apply to directories in printed or offline electronic form already released before national implementation. Subscriber personal data previously included in directories under prior law may remain unless subscribers object, after receiving the information required by Article 12.
Article 17 Transposition
Member States must adopt implementing provisions by 31 October 2003 and inform the Commission, incorporating a reference to the Directive in their legislation. Member States shall communicate their national implementing provisions and any amendments to the Commission.
Article 18 Review
The Commission must report to Parliament and Council no later than three years after implementation on the Directive's application and impact, particularly regarding unsolicited communications, requesting necessary information from member States. The Commission may then propose amendments to strengthen the Directive's effectiveness.
Article 19 Repeal
Directive 97/66/EC is repealed effective from the transposition deadline, and all references to the former Directive now refer to this one.
Article 20 Entry into force
Article 21 Addressees
The Directive is addressed to Member States.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
- Official text wordingSource for this change (opens in a new tab)
- Official text wordingSource for this change (opens in a new tab)