Digital Omnibus proposal· Recital 45

7 propose alternative wording.

1. 23 ~Alternative Alex Agius Saliba (rapporteur)Rapporteur · IMCO “In addition, gatekeepers designated under Regulation (EU) 2022/1925 should not be allowed to prompt data subjects more than once a year to give…”

   (45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period. In addition, gatekeepers designated under Regulation (EU) 2022/1925 should not be allowed to prompt data subjects more than once a year to give consent for the same processing purpose in respect of which they did not give consent or withdrew their consent.

   Justification

   This amendment is inspired by recital 37 of the Digital Markets Act.

   Rapporteur

   Alex Agius Saliba

   Group

   Rapporteur

   Targets

   Digital Omnibus proposal Recital 45

   Document

   IMCO draft opinion

   Source

   Official text, page 25

   Printed header

   Recital 45

   Links

   Link to this amendment
   Cite this amendment

2. 182 ~Alternative David CormandGreens/EFA · IMCO “cookie or similar device stored on their terminal equipment. This is particularly important where a user other than the original user have access to…”

   (45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests.Consumers should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where a user other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user’s terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period.The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose. When a user has refused or withdrawn consent, electronic communications service providers and third parties may not seek the user’s consent again until one year has elapsed from the date of the user’s decision.

   Tabled by

   David Cormand on behalf of the Verts/ALE Group

   Group

   Greens/EFA

   Targets

   Digital Omnibus proposal Recital 45

   Document

   IMCO amendments 125–328 to the draft opinion

   Source

   Official text, pages 57–58

   Printed header

   Recital 45

   Links

   Link to this amendment
   Cite this amendment

3. 458 ~Alternative Irena Joveva +5Renew · ITRE–LIBE “Therefore, web browsers and operating systems should enable user-friendly, straightforward and prominently displayed single-click button to refuse or…”

   (45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period.To enable genuine freedom of choice, the controller should therefore be obliged to respect the data subject’s choices to refuse, withdraw, or receive relavent information to make informed decision regarding a request for consent for at least one year, prevening continuous requests, including via pop-up windows on online interface. Moreover, data subject’s freedom to express a refusal or withdrawal of consent must be as effortless and instantaneous as granting it. Therefore, web browsers and operating systems should enable user-friendly, straightforward and prominently displayed single-click button to refuse or withdraw consent directly alongside any option to accept. Furthermore, users should never be put in the situation of surrendering their data by providers of services denying them access to a service or any functionality of that service, unless it is strictly necessary for the functioning of that service. It is also necesarry to protect users from unsolicited invasive stealth tracking methods. Therefore, online choice architectures should be designed neutrally, and the processing of indentifiers beyond what is strictly to remember a privacy choice when consent is refused or withdrawn should not be permitted. Furthermore, in order to guarantee the validity of user intent, consent obtained through manipulative designs or dark patters that distors free choice should be considered legally invalid.

   Tabled by

   Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller

   Group

   Renew

   Targets

   Digital Omnibus proposal Recital 45

   Document

   ITRE–LIBE amendments 401–526 to the draft report

   Source

   Official text, pages 48–50

   Printed header

   Recital 45

   Links

   Link to this amendment
   Cite this amendment

4. 459 ~Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “The requirements for consent were also strengthened in the case of accessing information already stored or storing information on the terminal…”

   (45) Data subjectsUsers that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects or users which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period.The controller should therefore be obliged to respect the users’ choices to refuse a request for consent and not ask for consent again where the user has already expressed their choice for the given purpose. For consistency purposes, this Regulation further specifies that the refusal of a request for consent should be as easy as consenting or withdrawing consent, as required under Article 7 of Regulation (EU) 2016/679. The requirements for consent were also strengthened in the case of accessing information already stored or storing information on the terminal equipment of a natural person. Both should be read in conjunction, as the intent is that an option to refuse consent in an easy and intelligible manner is to be provided with a prominently displayed single-click button, especially when there is a possibility to consent to all purposes with a single-click button in the case of Regulation (EU) 2016/679.

   Tabled by

   Markéta Gregorová on behalf of the Verts/ALE Group

   Group

   Greens/EFA

   Targets

   Digital Omnibus proposal Recital 45

   Document

   ITRE–LIBE amendments 401–526 to the draft report

   Source

   Official text, page 50

   Printed header

   Recital 45

   Links

   Link to this amendment
   Cite this amendment

5. 460 ~Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “The single-click modality and the period referred to constitute an ergonomic ideal rather than a mandatory technological standard, their practical…”

   (45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period. The single-click modality and the period referred to constitute an ergonomic ideal rather than a mandatory technological standard, their practical implementation being more complex and capable of varying according to context. Data subjects should be able to express and modulate their consent at several levels — terminal equipment, operating system, web browser, application or on a site-by-site basis — and to outsource its management to a consent and agency-enhancing service provider, a data intermediation service provided to data subjects or a personal data space. An automated indication should not preclude the expression of service-specific choices.

   Justification

   Privacy choices are contextual. A blanket signal imposed without granularity would conflict with the specificity requirement of consent under the Regulation itself. The amendment preserves the anti-fatigue objective while restoring the data subject’s ability to modulate.

   Tabled by

   Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay

   Group

   ECR, PfE

   Targets

   Digital Omnibus proposal Recital 45

   Document

   ITRE–LIBE amendments 401–526 to the draft report

   Source

   Official text, page 51

   Printed header

   Recital 45

   Links

   Link to this amendment
   Cite this amendment

6. 461 ~Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “from requesting consent at a later stage, for example if the data subject requests to access the service, through a different device, browser…”

   (45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period.The controller should therefore be obliged to respect the data subject’s refusal of consent for a reasonable period of time, taking into account the context of the processing, the means by which the data subject accessed the service, and technical feasibility. This obligation should not prevent a provider from requesting consent at a later stage, for example if the data subject requests to access the service, through a different device, browser, account or access method, nor should it lead to a disproportionate deterioration of the service or prevent the data subject from accessing the service under different conditions. The provider should also make available effective and easily accessible means for the data subject to withdraw or modify their choice at any time.

   Tabled by

   Sebastian Tynkkynen, Diego Solier

   Group

   ECR

   Targets

   Digital Omnibus proposal Recital 45

   Document

   ITRE–LIBE amendments 401–526 to the draft report

   Source

   Official text, page 52

   Printed header

   Recital 45

   Links

   Link to this amendment
   Cite this amendment

7. 462 ~Alternative Diana Iovanovici ŞoşoacăNI · ITRE–LIBE “In such cases, a validation or consent request could clarify situations that might add legal uncertainty.”

   (45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period. In such cases, a validation or consent request could clarify situations that might add legal uncertainty.

   Tabled by

   Diana Iovanovici Şoşoacă

   Group

   NI

   Targets

   Digital Omnibus proposal Recital 45

   Document

   ITRE–LIBE amendments 401–526 to the draft report

   Source

   Official text, pages 52–53

   Printed header

   Recital 45

   Links

   Link to this amendment
   Cite this amendment