Telecommunications

Legal Framework

Telecommunications providers operate at the intersection of multiple EU regulatory regimes. The ePrivacy Directive (2002/58/EC) governs the processing of personal data and the protection of privacy in the electronic communications sector, sitting alongside the GDPR as a lex specialis instrument. Article 5(3) of the ePrivacy Directive requires user consent for storing or accessing information on terminal equipment, a provision the CJEU interpreted strictly in Planet49 (C-673/17). The Court confirmed that pre-ticked checkboxes do not constitute valid consent and that the protection extends broadly to any device accessing user terminal equipment:

"Terminal equipment of users of electronic communications networks and any information stored on such equipment are part of the private sphere of the users requiring protection under the European Convention for the Protection of Human Rights and Fundamental Freedoms"
— Planet49 ¶7

Beyond ePrivacy, telecom providers fall within the scope of NIS2 Art. 2, which applies regardless of entity size where the provider is essential for critical societal or economic activities. The AI Act also reaches telecom-adjacent AI systems through its broad scope under AI Act Art. 2, and the European Telecommunications Standards Institute (ETSI) holds a permanent seat on the AI Act's advisory forum under AI Act Art. 67(5).

Key Developments

The CJEU's Planet49 ruling remains the cornerstone precedent for consent requirements in electronic communications. The case clarified that consent under the ePrivacy Directive must meet the same standard as GDPR consent — freely given, specific, informed, and unambiguous. Pre-ticked boxes fail this test.

Belgian DPA enforcement illustrates the practical interplay between ePrivacy and GDPR supervisory powers. The authority confirmed that data protection authorities apply the GDPR even where other regulators (such as telecom regulators) are competent to monitor specific ePrivacy obligations:

"are to apply the AVG to data processing, including in the context where other public authorities would be competent to monitor certain parts of the processing of personal data under national implementation of the ePrivacy Directive"
— Belgian DPA §29

Breach notification obligations for telecom providers predate the GDPR. The EDPB has noted the continuity:

"Obligations to notify in cases of breaches existed for certain organisations, such as providers of publicly-available electronic communications services (as specified in Directive 2009/136/EC and Regulation (EU) No 611/2013)"
— EDPB Guidelines 9/2022 §4

Dutch courts have addressed the lawfulness of intercepted communications data from encrypted platforms (EncroChat, SkyECC), focusing on whether cross-border evidence gathering complied with Directive 2014/41/EU notification requirements — though these rulings concern criminal procedure rather than telecom data protection per se.

Status of the Debate

This topic is actively contested. The ePrivacy Regulation — intended to replace the 2002 Directive — has been stalled in the legislative process for years, creating regulatory uncertainty about how cookie consent, metadata processing, and machine-to-machine communications should be handled going forward. The EDPB has repeatedly called for swift adoption. Meanwhile, courts and DPAs apply the existing Directive alongside the GDPR, producing a patchwork of interpretations on jurisdictional boundaries between telecom regulators and data protection authorities. A finalized ePrivacy Regulation would resolve the most pressing open questions, particularly around consent thresholds for non-cookie tracking technologies and the scope of "electronic communications services" in an OTT-dominated market.

Practical Guidance

• Consent mechanisms: Implement opt-in consent for all storage or access to terminal equipment. Pre-ticked boxes, implied consent, or continue-browsing banners do not satisfy the standard set by Planet49.
• Regulatory mapping: Identify which national authority supervises ePrivacy compliance (often the telecom regulator) versus GDPR compliance (the DPA), and coordinate reporting obligations across both. The Belgian DPA decision confirms DPAs retain competence over GDPR aspects even where ePrivacy is separately supervised.
• Breach notification: Telecom providers must notify breaches under both the ePrivacy framework (Article 4 of Regulation 611/2013) and GDPR Article 33. Align internal incident response to satisfy the stricter of the two timelines.
• Security obligations under NIS2: Assess whether your telecom entity qualifies as essential or important under NIS2 Art. 2, triggering enhanced risk-management and incident-reporting duties.
• AI systems in telecom infrastructure: Where AI is deployed in network management, customer service, or fraud detection, evaluate applicability of the AI Act and whether the system qualifies as high-risk under Article 6.