Amendment 1682· EUDPR Article 37(3)
~Alternative
Text of the amendment
As tabled
Wordingagainst the Commission’s
(3) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).This shall not prevent any technical storage or access and the corresponding processing of personal data if it is exclusively related to and strictly necessary for:
a) carrying out the transmission of an electronic communication over an electronic communications network;
b) providing a service explicitly requested by the subscriber or user;
c) measuring the general audience of an online service requested by a subscriber or user in an immediately anonymised and aggregated form;
d) maintaining or restoring the technical security of a service explicitly requested by the subscriber or user through strictly proportionate means;
If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least six months. Refusing to give consent should not be more difficult than giving consent. Consent shall by default not be considered to be given in an informed and specific manner when the request for consent involves the disclosure of data to more than 10 controllers in a single action.
Struck CommissionHighlighted amendment
EUDPR Article 37 with this amendment
Amendment 1682 applied to the Commission proposal, no other amendment
Unchanged: 2 paragraphs
Union institutions and bodies shall protect the information transmitted to, stored in, related to, processed by and collected from the terminal equipment of users accessing their publicly available websites and mobile applications, in accordance with Article 5(3) of Directive 2002/58/EC.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).This shall not prevent any technical storage or access and the corresponding processing of personal data if it is exclusively related to and strictly necessary for:
carrying out the transmission of an electronic communication over an electronic communications network;
+Newproviding a service explicitly requested by the subscriber or user;
+Newmeasuring the general audience of an online service requested by a subscriber or user in an immediately anonymised and aggregated form;
+Newmaintaining or restoring the technical security of a service explicitly requested by the subscriber or user through strictly proportionate means;
+NewIf the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least six months. Refusing to give consent should not be more difficult than giving consent. Consent shall by default not be considered to be given in an informed and specific manner when the request for consent involves the disclosure of data to more than 10 controllers in a single action.
Unchanged: 8 paragraphs
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
carrying out the transmission of an electronic communication over an electronic communications network;
providing a service explicitly requested by the data subject;
creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.
This paragraph also applies to the subsequent processing of personal data based on consent.
This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]
Controllers shall ensure that their online interfaces allow data subjects to:
give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;
decline a request for consent through automated and machine-readable means.
Controllers shall respect the choices made by data subjects in accordance with paragraph 7.
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof referred to in paragraph 4 of Article 88b of Regulation (EC) 2016/679 shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 7.
Paragraphs 7 to 9 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].
Struck removed Highlighted added Full text on the EUDPR Article 37 page
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
Commission proposalCOM(2025) 837
(3) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).
The Council text of 22 October 2026 drops the Commission’s wording.
Cite this amendment
Amendment 1682 (Pernando Barrena Arza), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1565–1740 to the draft report on COM(2025) 837 (CJ72-AM-791874, PE791.874v01-00, 27 July 2026), pp. 108–109
Link, short form and official text
Amendment 1682 (Pernando Barrena Arza), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1565–1740 to the draft report on COM(2025) 837 (CJ72-AM-791874, PE791.874v01-00, 27 July 2026), pp. 108–109
ITRE–LIBE Amendment 1682 (CJ72-AM-791874), p. 108