Interim update
The regulation should actually have been in force for more than 3 years. The current draft title is "Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC Regulation on Privacy and Electronic Communications", or "E-Privacy Regulation" for short. Discussions and amendments have so far protracted the procedure.
Currently, the draft is in the so-called trilogue status (coordination between the three EU institutions Commission, Parliament and Council). Due to the large number of outstanding points, it is questionable when it can be expected to enter into force. However, it will probably come at some point. It is therefore important that companies deal with it in good time.
What will this regulation govern?
The future regulation is to become a special regulation to the GDPR. In short, it is intended to regulate the protection of fundamental rights and freedoms, in particular respect for private life, confidentiality and the protection of personal data in the field of electronic communications.
It is intended to cover all electronic communications, Internet access services, number-based interpersonal communications services, number-independent interpersonal communications services and services consisting wholly or mainly in the transmission of signals. This probably means Internet access services, e-mail, SMS, telephony (fixed and mobile), telephony via messenger providers (voice-over-IP services, VoIP services), messaging via messenger providers (over-the-top category I services, OTT I services), social media channels, newsletters, websites, and also machine-to-machine transmission services.
This concerns topics such as data protection-friendly default settings (scope of data collected, setting of cookies, etc.) or data security (e.g. encryption).
Both natural persons and legal entities (e.g., companies, public authorities, etc.) that use or provide one or more such communication channels are affected.
... and why are we already reporting on it?
As an EU regulation, it will apply directly in the member states without having to be transformed into national law, and will thus take precedence over national laws (in Austria, for example, the Data Protection Act and the Telecommunications Act).
Experience shows that regulations in this area are becoming stricter rather than looser. Companies that still have unresolved issues from the GDPR with regard to electronic communication are therefore well advised to address these in good time so that they do not have to start from scratch when the regulation comes into force.
Your KWR data protection team will keep you up to date and is available to answer any questions!
Practical tip: Already now: Check electronic internal and external corporate communications for legal compliance with the GDPR in order to be prepared when the EU E-Privacy Regulation comes into force.