ePrivacy Regulation, Article 6b, Permitted processing of electronic communications metadata.
1. Without prejudice to Article (6) 1, providers of electronic communications networks and services shall be permitted to process electronic communications metadata only if:
(a) it is necessary for the purposes of network management or network optimisation, or to meet technical quality of service requirements pursuant to Directive (EU) 2018/1972 or Regulation (EU) 2015/2120; or
(b) it is necessary for the performance of an electronic communications service contract to which the end-user is party, or if necessary for billing, calculating interconnection payments, detecting or stopping fraudulent, or abusive use of, or subscription to, electronic communications services; or
(c) the end-user concerned has given consent to the processing of communications metadata for one or more specified purposes; or
(d) it is necessary in order to protect the vital interest of a natural person; or
(e) in relation to metadata that constitute location data, it is necessary for scientific or historical research purposes or statistical purposes, provided that:
i. such data is pseudonymised;
ii. the processing could not be carried out by processing information that is made anonymous, and the location data is erased or made anonymous when it is no longer needed to fulfil the purpose; and
iii. the location data is not used to determine the nature or characteristics of an end-user or to build a profile of an end-user.
(f) in relation to metadata other than location data, it is necessary for scientific or historical research purposes or statistical purposes, provided that such processing is in accordance with Union or Member State law and subject to appropriate safeguards, including encryption and pseudonymisation, to protect fundamental rights and the interest of the end-users and is in accordance with paragraph 6 of Article 21 and paragraphs 1, 2 and 4 of Article 89 of Regulation (EU) 2016/679.
2a. Data processed under point e and f of paragraph 1 of this article may also be used for the development, production and dissemination of official national and European statistics to the extent necessary for this purpose and in accordance, respectively, with national or Union law.
2. Without prejudice to Article 6 (3), electronic communications metadata processed pursuant to paragraph 1 (e) shall not be shared by the provider with any third party unless it has been made anonymous.
Note: This is not the final text of the ePrivacy Regulation. This is the text of the ePrivacy Regulation Proposal of the Council of the European Union from 10.2.2021.