I saw this discussed in my Twitter feed today, so second-third-hand account is that the update has been in the works for almost a decade, being fought tooth and nail by the same companies that fight any other privacy initiative.
Ah yeah, this is what I came across earlier when looking for the full 2002 text: "Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)"