Amendment 1702· EUDPR Article 37

Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment 1. Storing of information, or gaining of access to information already stored, in the terminal equipment including about its software and hardware, other than by the user concerned, shall be prohibited, except on the following grounds:

(a)it is strictly necessary for the sole purpose of carrying out the transmission of an electronic communication over an electronic communications network;

(b)the user has given their specific consent in accordance with this Regulation, or;

(c)it is strictly technically necessary for providing an information society service specifically requested by the user;

(d)it is technically necessary for maintaining or restoring the technical security of a service provided by the controller and requested by the user;

(e)for the purpose of creating instant anonymous aggregated information about the usage of an online service requested by the user to measure the audience of such a service, where it is carried out by the provider of that online service requested by the user solely for its own use, or by a processor acting on behalf of this controller, solely for the controller’ own use and not further processed for any other purpose, not combined with data from other services from the provider of the online service, or from a third party, nor shared with any third party, or;

(f)for the purpose of verifying the user’s past refusal to a request to consent without involving the use of a unique identifier or additional processing of personal data.

2.Where storing of information, or gaining of access to information already stored, in the terminal equipment of a user is based on consent, the following shall apply:

(a)the user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(b)if the user gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the user;

(c)if the user declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of information based on consent.

3.This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]