A marketplace startup assumes the e-Commerce Directive alone answers all personal-data compliance questions. How should counsel respond?
Select an answer to reveal the explanation.
Short Explanation
The e-Commerce Directive helps with intermediary and information-society service themes — it is not a GDPR substitute. Think of it as traffic rules for online shops, not the full privacy constitution. Personal data still needs the GDPR toolkit.
Full Explanation
Directive 2000/31/EC on electronic commerce forms part of the wider European framework for information-society services, including themes such as intermediary liability and online commercial communications, but it is not a substitute for GDPR personal-data rules. Marketplace counsel should locate the e-Commerce Directive as an adjacent digital-market instrument while insisting that personal-data processing still needs GDPR analysis for roles, lawful bases, rights, and transfers. Claiming the Directive repealed personal-data law for online marketplaces invents a repeal that did not occur. Treating it as identical to the GDPR and interchangeable in DPIAs collapses distinct statutes. Limiting it to brick-and-mortar kiosks without websites contradicts its information-society focus. Exam caveat: related-legislation questions reward stacking instruments correctly—e-Commerce beside GDPR/ePrivacy, not instead of them. Operational check: in a startup compliance matrix, keep separate rows for e-Commerce Directive obligations and GDPR obligations so product counsel cannot close a personal-data risk by citing hosting-provider liability language alone. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion.