Amendment 488· Digital Omnibus proposal Recital 48
~Alternative
Text of the amendment
As tabled
Wordingagainst the Commission’s
(48) Article 4 of Directive 2002/58/EC should be repealedmaintained. That Article 4sets of Directive 2002/58/EC setsspecific requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and the notification requirementsof security breaches. Subsequently, Directive (EU) 2022/2555 has set new requirements as regards cybersecurity risk-management measures and incident reporting for those providers. In order to reduce overlapping obligations for entities in the electronic communications sector, Article 4 of Directive 2002/58/EC should be repealed. As regards the security of processing of personal data pursuant to Article 4(1) and (1a) of this directive and the notification of personal data breaches pursuant to Article 4(3) to (5) of Directive 2002/58/EC this directive, the Regulation (EU) 2016/679 already provide for comprehensive and up-to-date rules.That Article sets specific requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and the notification of security breaches. Those requirements are specific to the electronic communications sector and are not fully substituted by the general regimes of Directive (EU) 2022/2555 and Regulation (EU) 2016/679. These rules should therefore apply to providers of publicly available electronic communication services and providers of public communications networks, thereby ensuring that one regime applies to the controllers and processors.Its repeal would leave sector-specific obligations without an equivalent, to the detriment of the confidentiality and integrity of communications. Those requirements are specific to the electronic communications sector and are not fully substituted by the general regimes of Directive (EU) 2022/2555 and Regulation (EU) 2016/679. Its repeal would leave sector-specific obligations without an equivalent, to the detriment of the confidentiality and integrity of communications.
Struck CommissionHighlighted amendment
Justification
The repeal of Article 4 of the ePrivacy Directive would empty of substance the sector-specific security regime applicable to electronic communications, on the assumption that NIS2 and the GDPR fully substitute for it. That assumption is not established. The Union should not dismantle a functioning protection in the name of an alignment whose equivalence is not demonstrated.
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
Commission proposalCOM(2025) 837
Article 4 of Directive 2002/58/EC should be repealed. Article 4 of Directive 2002/58/EC sets requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and notification requirements. Subsequently, Directive (EU) 2022/2555 has set new requirements as regards cybersecurity risk-management measures and incident reporting for those providers. In order to reduce overlapping obligations for entities in the electronic communications sector, Article 4 of Directive 2002/58/EC should be repealed. As regards the security of processing of personal data pursuant to Article 4(1) and (1a) of this directive and the notification of personal data breaches pursuant to Article 4(3) to (5) of Directive 2002/58/EC this directive, the Regulation (EU) 2016/679 already provide for comprehensive and up-to-date rules. These rules should therefore apply to providers of publicly available electronic communication services and providers of public communications networks, thereby ensuring that one regime applies to the controllers and processors.
Council text of 22 October 2026ST 14756/26
Article 4 of Directive 2002/58/EC should be repealed. Article 4 of Directive 2002/58/EC sets requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and notification requirements. Subsequently, Directive (EU) 2022/2555 has set new requirements as regards cybersecurity risk-management measures and incident reporting for those providers. In order to reduce overlapping obligations for entities in the electronic communications sector, Article 4 of Directive 2002/58/EC should be repealed. As regards the security of processing of personal data pursuant to Article 4(1) and (1a) of this directive and the notification of personal data breaches pursuant to Article 4(3) to (5) of Directive 2002/58/EC this directive, the Regulation (EU) 2016/679 already provide for comprehensive and up-to-date rules. These rules should therefore apply to providers of publicly available electronic communication services and providers of public communications networks, thereby ensuring that one regime applies to the controllers and processors.
Cite this amendment
Amendment 488 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 401–526 to the draft report on COM(2025) 837 (CJ72-AM-790968, PE790.968v01-00, 27 July 2026), pp. 75–76
Link, short form and official text
Amendment 488 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 401–526 to the draft report on COM(2025) 837 (CJ72-AM-790968, PE790.968v01-00, 27 July 2026), pp. 75–76
ITRE–LIBE Amendment 488 (CJ72-AM-790968), p. 75