The Directive has replaced a number of EU directives, which previously represented the regulatory framework for electronic communications, namely:

• the Telecoms Package (Directive 2009/140/EC of the European Parliament and of the Council of 25 November 2009 amending Directives 2002/21/EC on a common regulatory framework for electronic communications networks and services, 2002/19/EC on access to, and interconnection of, electronic communications networks and associated facilities, and 2002/20/EC on the authorisation of electronic communications networks and services);
• Directive 2002/22/EC of the European Parliament and of the Council of 7 March 2002 on universal service and users' rights relating to electronic communications networks and services (Universal Service Directive) ;
• Directive 2009/140/EC of the European Parliament and of the Council of 25 November 2009 amending Directives 2002/21/EC on a common regulatory framework for electronic communications networks and services, 2002/19/EC on access to, and interconnection of, electronic communications networks and associated facilities, and 2002/20/EC on the authorisation of electronic communications networks and services; and
• Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users' rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws.

Reasons for adoption of ZEKom-2

The main reason for the adoption of the ZEKom-2 was the transposition of the solutions and rules brought by the Directive. Nonetheless, the ZEKom-2 also had the specific objective of reinforcing the security of public communications networks and services, especially in light of the increased risks arising from 5G technology, particularly by ensuring such security to entities which, from the State and the society's point of view, provide so-called crucial services, thus also having implications for national security¹. In order to achieve the above, the Government (as the proponent of the ZEKom-2) also aimed to implement (in particular strategic) measures of the EU Toolbox for 5G security, which is the result of a joint effort and approach by the Member States, representatives of the European Union Agency for Cybersecurity ('ENISA'), and the European Commission².

In addition, the ZEKom-2 aims to accelerate the development of electronic communications networks and services of the country, including the development of its information society, access to, and use of, very high performance networks for all citizens and businesses in the EU, whilst strengthening the security requirements for the provision of networks and services. According to the Government, the latter will additionally lead to increased trust and confidence among users, accelerate the use of the services concerned, as well as the development of the EU internal market, and promote the legitimate interests of all its citizens.

Major novelties brought by the ZEKom-2

Applicability of the ZEKom-2 for OTT service providers

One of the most important changes brought by the ZEKom-2 (and the Directive) is a change in the legal regime of over-the-top ('OTT') services. OTT services cover online services, which the service provider does not normally provide through their own communication networks or by leasing network capacity from public communications network operators. Instead, the service provider uses internet infrastructure in such a way that their services are accessible to anyone who has access to the internet. OTT services are offered by providers of internet telephony and messaging, providers of online video platforms, and many other online services.

The provision of OTT services has until now not yet fallen under sector-specific rules, but instead has only been subject to horizontal regulation. Such horizontal regulation applied to all services, regardless of their nature. As a result, providers of traditional services were subject to stricter regulations than providers of OTT services, even though they offered essentially similar services (Article 131 of the ZEKom-2).

According to the ZEKom-2 (as well as the Directive), the definition of number-independent interpersonal communications services is relevant for OTT communications services. Those are services that enable interpersonal and interactive exchange of information through an internet access service (i.e. traditional voice calls between two individuals, e-mail, messaging services, or group chats) (Articles 3(40) and 3(42) of the ZEKom-2).

Thus, OTT services are now subject to the legal regime applicable to number-based interpersonal communications services. Pursuant to the ZEKom-2, providers of number-independent interpersonal communications will not be obliged to notify the Agency for Communication Networks and Services ('AKOS') of the commencement of the provision of services and will not be liable to pay the same based on a notification (Article 5 of the ZEKom-2). Thus, only a certain set of obligations will apply to OTT service providers, and only when it is in the public interest (Article 131 of the ZEKom-2).

The most important areas of OTT regulations include security of service, cooperation with public security authorities, customer protection, data protection, and observance of the secrecy of telecommunications actions.

Changes in direct marketing

Although changes in direct marketing are mainly influenced by the Personal Data Protection Act 2022 ('ZVOP-2'), which entered into effect on 26 January 2023, as personal data has become permanently accessible information to a wider circle of subjects via electronic communications. Nonetheless, in order to protect personal data, the ZEKom-2 also stipulates certain provisions in regard to this topic.

In relation to the protection under Article 115 of the ZEKom-2, providers of public communications services must take appropriate technical and organisational measures to ensure the security of their services. These measures must ensure a level of security and insurance, commensurate with the foreseeable risk, and must include the adoption, implementation, and monitoring of a security information management system.

Furthermore, Article 214 of the ZEKom-2 ensures the confidentiality of communications in order to protect and secure the expected privacy in the use of electronic communications, ensuring freedom of communication and expression. The aforementioned confidentiality provision covers the content of communications, traffic, and location data, as well as the facts and circumstances surrounding the disconnection. The operator is obliged to always secure the confidentiality of communications, even after the cessation of their activities. Recording of content and retrieval of related data is only allowed under specified conditions, e.g. for the purpose of providing evidence of a commercial transaction in the course of a legitimate business practice or other commercial communication provided that the parties to the communication are informed in advance of the recording, its purpose, and the duration of the retention of the recording.

In this context, it is important to note that the recorded communication must be deleted without delay, at the latest by the expiry of the period during which the transaction may be lawfully challenged (Article 214(7) of the ZEKom-2). On the other hand, no notice of recording is required for calls made to an operational telephone number which is not intended for the public and which is operated by an essential service provider, such as electricity transmission companies and grid operators (Article 214(9) of the ZEKom-2).

The ZEKom-2 did not, however, introduce any novelties in relation to unwanted communication. Therefore, automated dialling and communication systems to carry out calls to the telephone number of subscribers or users, who are natural persons, e.g. automatic telephone dialling machines, texts, faxes, or e-mails, for the purpose of direct marketing are only allowed if consent of the subscriber or user is obtained. The ZEKom-2 does, nonetheless, provide for certain exceptions: for example, a seller may use their customer's email address obtained when selling their products or services for the direct marketing of related products, provided that the customer was given a clear and explicit opportunity to refuse, free of charge and easily, such use of their e-mail address (Article 226 of the ZEKom-2).

Other novelties

A couple of further novelties in regard to user relationship and subscriptions were introduced. Subscribers, for example, can now terminate the subscription agreement without having to face any costs connected therewith, such as termination costs or other administrative costs, contractual penalties, amounts of benefits received, or other agreed compensation (Article 192 of the ZEKom-2). Additionally, subscribers do not have to bear any cost in relation to the transfer of their telephone number to another operator (Article 195 of the ZEKom-2).

The ZEKom-2 has also taken consideration to low-income subscribers and users. On the basis of the data collected on retail prices, AKOS will be entitled to require service providers to offer to low-income consumers or consumers with special needs price options or packages which differ in price from those otherwise provided on normal commercial terms (Article 173 of the ZEKom-2). Thus, disadvantaged groups of people will also be able to access and use appropriate telecommunications services and broadband internet access.

Kevin Rihtar Partner
[email protected]
Karanović & Partners, Belgrade

1. See at: https://e-uprava.gov.si/drzava-in-druzba/e-demokracija/predlogi-predpisov/predlog-predpisa.html?id=10097 (only available in Slovenian)
2. See at: https://op.europa.eu/en/publication-detail/-/publication/7def1c03-da16-11eb-895a-01aa75ed71a1/language-en