How to treat communications content, traffic data, and location data as privacy-critical product surfaces.
Focus: Articles 5, 6, and 9, retention and access controls, GDPR interplay, and the current OTT coverage gap.
Structured answer sets in this page tree.
Cited legal and guidance references.
For communications products, confidentiality is a product-architecture constraint, not a checkbox. Under the current directive, the baseline rules sit in Article 5 for confidentiality, Article 6 for traffic data, and Article 9 for location data other than traffic data, all as implemented in national law. The safest operational approach is a strict use-case register: what you do with content, traffic data, or location data, why, who can access it, for how long, and how users are informed.
The current legal baseline is still Directive 2002/58/EC, not the proposed regulation. That means you should classify your communications data against the current directive text and national implementation first.
The most useful split in practice is content, traffic data, and location data other than traffic data, because the directive treats them differently.
A use-case register is your core control. It prevents scope creep and forces teams to justify why communications data is being used at all.
Make it audit-ready with owners, approval dates, retention windows, and testable access controls.
Most communications products hit the same pressure points. Treat these as risk hotspots and keep the controls product-specific.
The operational question is not only whether a use case is useful. It is whether the use case is permitted, necessary, minimized, and explainable.
The GDPR still matters because many communications datasets include personal data and because the ePrivacy Directive is implemented alongside GDPR-era consent and transparency standards.
The proposed regulation is still useful as reform context, especially because it was designed to address the uneven treatment of OTT services, but you should not present it as current law.
Your evidence should answer what data you use, for what purpose, under which controls, and how you prevent repurposing or excessive retention.
Make the pack exportable for internal audits, regulator questions, and product reviews.
Research Copilot can take EU ePrivacy Directive Confidentiality of Communications from getting cited answers and faster research on this topic to a reusable workflow inside Sorena. Teams working on EU ePrivacy Directive can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from EU ePrivacy Directive Confidentiality of Communications and answer scope, timing, and interpretation questions with cited outputs.
Review your current process, evidence gaps, and next steps for EU ePrivacy Directive Confidentiality of Communications.