European UnionePrivacy Directive
Officially ePrivacy Directive, Confidentiality of Communications
Directive 2002/58/EC, Art. 5(1) and (2)
In force since .
An interception and recording consent rule binding public and private bodies.
- Obligation class
- Consent, Prohibition
What it requires
- Under the national law that transposes Article 5(1), do not listen to, tap, store, or otherwise intercept or monitor, as a person other than its users, the content or related traffic data of a communication carried over a public electronic communications network without the consent of the users concerned, unless legislation adopted under Article 15(1) authorises it as a necessary, appropriate and proportionate measure to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system.
- A recording that national law legally authorises and that is made in the course of lawful business practice to provide evidence of a commercial transaction or other business communication is not caught by the consent rule above; check the Member State's own law for whether, and on what further conditions, it authorises such recording.
These lines are LexLint's reading of the law's text. Also read by: Court of Justice, Case C-623/17, Privacy International, EU:C:2020:790 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 15a(1) requires Member States to lay down penalties 'including criminal sanctions where appropriate' for an infringement of any provision adopted under this Directive, but the Directive itself does not make a breach a criminal offence; whether an Article 5 infringement is prosecuted as a crime is entirely a matter for each Member State's own transposing law.
Who enforces it
Enforcement body
Each Member State's own competent national authority and, where relevant, other national bodies designated under Article 15a(2) to (4). The Directive has no clause for Article 5 like Article 13(6)'s express right to bring proceedings, but Article 15(2) applies the judicial remedies, liability and sanctions chapter of Directive 95/46/EC to every national provision adopted under the Directive and to the individual rights derived from it.
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0623
- Case citation
- Court of Justice, Case C-623/17, Privacy International, EU:C:2020:790
- Open questions
- Which conditions must national law attach to a recording to make it 'legally authorised' under Article 5(2) of Directive 2002/58, so that a recording made in the course of lawful business practice to provide evidence of a commercial transaction falls outside the consent rule of Article 5(1)?
- Does the ban on 'other kinds of interception or surveillance' in Article 5(1) of Directive 2002/58 reach automated scanning of message content by the service provider for its own purposes, such as spam or abuse detection, where the users have not consented and no legislation under Article 15(1) applies?
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 80/2003
- Source link
- https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:22003D0080
- Decision date
What this law does
Article 5(1) requires Member States to prohibit listening to, tapping, storing, or otherwise intercepting or surveilling a communication and its related traffic data by anyone other than the users, without the users' consent, except where legally authorised under Article 15(1), which lets a Member State restrict that confidentiality by legislation when the restriction is a necessary, appropriate and proportionate measure to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system.
Article 5(2) leaves untouched any legally authorised recording made in the course of lawful business practice to provide evidence of a commercial transaction or of any other business communication; the Directive's own recitals expect the parties to be told before such a recording is made, though that expectation is not stated as an operative duty of the Article itself, and whether a given recording is legally authorised, and on what further conditions, is for each Member State's own law.
How courts have read itPremium data
Our analysis of this law draws on 2 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app records calls, records text chat or processes voice recordings.
Back to the example · Lint your app
Page updated .