ePrivacy Regulation, Article 6c, Compatible processing of electronic communications metadata.
1. Where the processing for a purpose other than that for which the electronic communications metadata have been collected under paragraph 1 of Articles 6 and 6b is not based on the end-user's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 11, the provider of electronic communications networks and services shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the electronic communications metadata are initially collected, take into account, inter alia:
(a) any link between the purposes for which the electronic communications metadata have been collected and the purposes of the intended further processing;
(b) the context in which the electronic communications metadata have been collected, in particular regarding the relationship between end-users concerned and the provider;
(c) the nature of the electronic communications metadata as well as the modalities of the intended further processing, in particular where such data or the intended further processing could reveal categories of data, pursuant to Articles 9 or 10 of Regulation (EU) 2016/679;
(d) the possible consequences of the intended further processing for end-users;
(e) the existence of appropriate safeguards, such as encryption and pseudonymisation.
2. Such processing, if considered compatible, may only take place, provided that:
(a) the processing could not be carried out by processing information that is made anonymous, and electronic communications metadata is erased or made anonymous as soon as it is no longer needed to fulfil the purpose, and
(b) the processing is limited to electronic communications metadata that is pseudonymised, and
(c) the electronic communications metadata is not used to determine the nature or characteristics of an end-user or to build a profile of an end-user, which produces legal effects concerning him or her or similarly significantly affects him or her.
3. For the purposes of paragraph 1 of this Article, the providers of electronic communications networks and services shall not, without prejudice to Article 6 (3), share such data with any third parties, unless it is made anonymous.
Note: This is not the final text of the ePrivacy Regulation. This is the text of the ePrivacy Regulation Proposal of the Council of the European Union from 10.2.2021.