Only persons processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union. An organisation that merely uses such services, rather than providing them, does not fall within the wording, although some obligations of Directive 2002/58/EC, such as those on terminal equipment, address a wider circle.

No. It operates matter by matter, so the Regulation is displaced only where the Directive contains a specific obligation with the same objective. For everything the Directive does not specifically regulate, including most controller obligations and data subject rights, the Regulation applies in full, as Recital 173 confirms.

Breach notification by providers of publicly available electronic communications services is a matter for which Directive 2002/58/EC lays down a specific obligation with the same objective, so Article 95 prevents the Regulation from adding a parallel obligation for the same processing. Outside that specific field, the notification duties of Articles 33 and 34 apply as normal.

Yes. The Directive defines consent by reference to Directive 95/46/EC, and Article 94(2) construes such references as references to the Regulation, so consent under the Directive must meet the conditions of Article 4(11) and Article 7.