Regulation (EU) 2016/679 — Article 88a

Alternative wording Amendment 115 IMCO draft opinion · Alex Agius Saliba (rapporteur)

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject. In particular, gatekeepers under Regulation (EU) 2022/1925 should not be allowed to prompt data subjects more than once a year to give consent for the same processing purpose in respect of which they did not give consent or withdrew their consent;

Justification

This amendment is inspired on the wording of recital 37 of the DMA.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
This change cannot be reconstructed from the source: The empty-base row supplies a source sentence at paragraph 88a(4), but the official source does not identify its insertion point relative to the existing child list. The current tree would render it before points (a)-(c), so preserve the source wording as an unresolved partial result and do not apply it.
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject. In particular, gatekeepers under Regulation (EU) 2022/1925 should not be allowed to prompt data subjects more than once a year to give consent for the same processing purpose in respect of which they did not give consent or withdrew their consent;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject. In particular, gatekeepers under Regulation (EU) 2022/1925 should not be allowed to prompt data subjects more than once a year to give consent for the same processing purpose in respect of which they did not give consent or withdrew their consent;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 116 IMCO draft opinion · Alex Agius Saliba (rapporteur)

In order to prevent unfair commercial practices pursuant to Directive 2005/29/EC, new requests for consent within these periods preclude consent from being validly granted.

Justification

With this amendment the rapporteur tries to prevent consent fatigue by reducing the possibility to use dark patterns under consumer law, in particular Directive 2005/29/EC.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
This change cannot be reconstructed from the source: The empty-base row supplies a source sentence at paragraph 88a(4), but the official source does not identify its insertion point relative to the existing child list. The current tree would render it before points (a)-(c), so preserve the source wording as an unresolved partial result and do not apply it.
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject. In particular, gatekeepers under Regulation (EU) 2022/1925 should not be allowed to prompt data subjects more than once a year to give consent for the same processing purpose in respect of which they did not give consent or withdrew their consent;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
This change cannot be reconstructed from the source: The empty-base row supplies a source sentence at paragraph 88a(4), but the official source does not identify its insertion point relative to the existing child list. The current tree would render it before points (a)-(c), so preserve the source wording as an unresolved partial result and do not apply it.
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 258 JURI

(da)

ensuring security-related operations, including risk assessment for security purposes, fraud prevention, and user authentication;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (da)
  
  ensuring security-related operations, including risk assessment for security purposes, fraud prevention, and user authentication;
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 259 JURI

(db)

maintaining cross-session service continuity requested by the data subject;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (db)
  
  maintaining cross-session service continuity requested by the data subject;
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 260 JURI

(dc)

retaining user-selected configuration or preference data.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (dc)
  
  retaining user-selected configuration or preference data.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 405 IMCO

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where processing of such data is ~~only~~carried ~~allowed when that person has given his or her consent,~~out in accordance with this Regulation and is based on one of the legal bases set out in Article 6 of this Regulation.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where processing of such data is ~~only~~carried ~~allowed when that person has given his or her consent,~~out in accordance with this Regulation and is based on one of the legal bases set out in Article 6 of this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 407 IMCO

(2) ~~Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in~~Where the ~~terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives~~processing referred to in paragraph 1 is based on legitimate interests pursuant to Article 236(1), point (f), of this Regulation (EU), the GDPR requires a balancing test to ensure that the company’s interests do not override the user’s rights and reasonable expectations, this principle should we always respect and strive to achieve the right balance.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

~~Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in~~Where the ~~terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives~~processing referred to in paragraph 1 is based on legitimate interests pursuant to Article 236(1), point (f), of this Regulation (EU), the GDPR requires a balancing test to ensure that the company’s interests do not override the user’s rights and reasonable expectations, this principle should we always respect and strive to achieve the right balance.
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 408 IMCO

(3) ~~Storing~~The offollowing ~~personal data, or gaining of access to personal~~operational data ~~already~~processing ~~stored,~~activities inshall ~~the~~not ~~terminal equipment of a natural person without~~require consent under paragraph 1, and ~~subsequent~~may ~~processing~~rely on other applicable legal bases under Regulation (EU) 2016/679, ~~shall be lawful~~subject to the ~~extent~~conditions itand issafeguards ~~necessary~~set ~~for~~out ~~any~~in ofthat ~~the following~~Regulation:

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
~~Storing~~The offollowing ~~personal data, or gaining of access to personal~~operational data ~~already~~processing ~~stored,~~activities inshall ~~the~~not ~~terminal equipment of a natural person without~~require consent under paragraph 1, and ~~subsequent~~may ~~processing~~rely on other applicable legal bases under Regulation (EU) 2016/679, ~~shall be lawful~~subject to the ~~extent~~conditions itand issafeguards ~~necessary~~set ~~for~~out ~~any~~in ofthat ~~the following~~Regulation:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 409 IMCO

(a) carrying out the transmission of an electronic communication over an electronic communications network; such access shall be strictly limited to what is technically necessary for the sole purpose of transmitting the communication to ensure the highest level of consumer protection. Such access shall not be used for purposes unrelated to the transmission of the communication, including profiling, advertising, audience measurement, service optimisation, or the creation of behavioural or usage analytics.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network; such access shall be strictly limited to what is technically necessary for the sole purpose of transmitting the communication to ensure the highest level of consumer protection. Such access shall not be used for purposes unrelated to the transmission of the communication, including profiling, advertising, audience measurement, service optimisation, or the creation of behavioural or usage analytics. (b) providing a service explicitly requested by the data subject;
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 410 IMCO

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 411 IMCO

(c) instantly creating aggregated and anonymous measurement information about the usage of an online service to measure the audience of such a service, where such measurement it is carried out by the controller of that online service solely for its own use,; is restricted to aggregated statistical counting does not enable the identification, tracking or profiling of consumers beyond what is strictly necessary for aggregated statistics and does not involve the creation of persistent identifiers, provided that the data is not combined with data from other services from the same provider or from a third party or made accessible to third parties, subject to provisions laid down in Regulation (EU) 2022/1925 or otherwise processed for purposes such as profiling, advertising, the optimisation of services beyond audience measurement, or the training of artificial intelligence systems, and provided that data subjects are given effective means to object without affecting the usability of the service.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  instantly creating aggregated and anonymous measurement information about the usage of an online service to measure the audience of such a service, where such measurement it is carried out by the controller of that online service solely for its own use,; is restricted to aggregated statistical counting does not enable the identification, tracking or profiling of consumers beyond what is strictly necessary for aggregated statistics and does not involve the creation of persistent identifiers, provided that the data is not combined with data from other services from the same provider or from a third party or made accessible to third parties, subject to provisions laid down in Regulation (EU) 2022/1925 or otherwise processed for purposes such as profiling, advertising, the optimisation of services beyond audience measurement, or the training of artificial intelligence systems, and provided that data subjects are given effective means to object without affecting the usability of the service. (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 412 IMCO

(c) ~~creating~~measuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  ~~creating~~measuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, ~~where~~as ~~it is carried out~~defined by ~~the~~article ~~controller of that online service solely for its own use;~~2
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
16.
of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);
1. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 413 IMCO

(c) ~~creating~~measuring the audience of an online service as defined in Article 2(16) of Regulation 2024/1083 to create aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by ~~the controller of~~ that online service or by entitled third parties jointly authorised by adverstisers or publishers, solely for ~~its~~the ~~own~~measurement ~~use~~of the overall market performance and subject to the safeguards laid down in Article 89(1);

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 414 IMCO

(c) ~~creating~~measuring ~~aggregated~~or ~~information about~~improving the ~~usage~~performance, security or functionality of an online service, toincluding ~~measure~~through testing and the ~~audience~~creation of ~~such~~aggregated ausage ~~service~~information, where itsuch processing is carried out ~~by the controller of that online service~~ solely for ~~its~~the controller’s own use;, the prevention of fraud or other risky behaviour or technical incidents

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  ~~creating~~measuring ~~aggregated~~or ~~information about~~improving the ~~usage~~performance, security or functionality of an online service, toincluding ~~measure~~through testing and the ~~audience~~creation of ~~such~~aggregated ausage ~~service~~information, where itsuch processing is carried out solely for the controller’s own use, the prevention of fraud or other risky behaviour or technical incidents (d) maintaining or restoring the security of a service provided by the controller ofand ~~that~~requested ~~online~~by ~~service~~the ~~solely~~data subject or the terminal equipment used for ~~its~~the ~~own~~provision ~~use;~~of such service.
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 415 IMCO

(d) ~~maintaining~~maintenance or ~~restoring~~restoration of the security of a service provided by the controller and requested explicitly by the data subject provided that it is limited to what is strictly necessary for ensuring a specific security purpose or addressing concrete security vulnerabilities or incidents affecting the requested service or device. Measures under this point shall not alter the functionality of the hardware or software, or the ~~terminal~~privacy ~~equipment~~settings chosen by the consumer, unrelated to that purpose. Access shall not be used ~~for~~to ~~the~~generate ~~provision~~persistent ofidentifiers, ~~such~~behavioural ~~service~~profiles, or long-term activity logs, nor shall it introduce device fingerprinting, device graphing, or similar techniques enabling tracking across services or applications.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  ~~maintaining~~maintenance or ~~restoring~~restoration of the security of a service provided by the controller and requested explicitly by the data subject provided that it is limited to what is strictly necessary for ensuring a specific security purpose or addressing concrete security vulnerabilities or incidents affecting the requested service or device. Measures under this point shall not alter the functionality of the hardware or software, or the ~~terminal~~privacy ~~equipment~~settings chosen by the consumer, unrelated to that purpose. Access shall not be used ~~for~~to ~~the~~generate ~~provision~~persistent ofidentifiers, ~~such~~behavioural ~~service~~profiles, or long-term activity logs, nor shall it introduce device fingerprinting, device graphing, or similar techniques enabling tracking across services or applications.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 416 IMCO

(d) maintaining or restoring the integrity or security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the integrity or security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 417 IMCO

(d) maintaining, restoring or ~~restoring~~ensuring the security of a service ~~provided~~or ~~by the controller and requested by the data subject or~~of the terminal equipment used for the provision of such service.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining, restoring or ~~restoring~~ensuring the security of a service ~~provided~~or ~~by the controller and requested by the data subject or~~of the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

New operation deleting existing wording Amendment 418 IMCO

new Parliament proposal instruction expressly deletes existing law

(da)

measuring the display and performance of contextual advertising provided that the processing of personal data is strictly limited to the activities falling under the definition in Article 4 (b) (xx), provided that consumers data including possibly identifying data and metadata is deleted immediately after the browsing session is closed and provided any data collection and processing for this purpose is kept within what is strictly necessary and in respect of the data minimisation principle and purpose limitation as set out in Articles 5(1)(b) and 5 (1)(c);

This provision can be invoked only where the controller is able to demonstrate, upon request by a Data Protection Authority, that it uses exclusively temporary, transient, non-persistent tracking technologies immediately deleted after the browsing session and technically designed to expire automatically at the moment the advertisement has been displayed and any strictly necessary measurement of its display or performance has occurred..

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  ~~carrying out the transmission of an electronic communication over an electronic communications network;~~
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

~~This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~

Additional proposed wording Amendment 419 IMCO

(da)

analytics and audience measurement for the purpose of understanding aggregate service usage or advertising campaign performance, provided the results are not used to profi le individual users;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (da)
  
  analytics and audience measurement for the purpose of understanding aggregate service usage or advertising campaign performance, provided the results are not used to profi le individual users;
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 420 IMCO

(db)

direct marketing communications addressed to existing customers in respect of the controller’s own products and services, in accordance with applicable rules;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (db)
  
  direct marketing communications addressed to existing customers in respect of the controller’s own products and services, in accordance with applicable rules;
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 421 IMCO

(dc)

processing strictly necessary for the detection and prevention of cyberattacks, fraud, and unauthorised access, and for the maintenance of technical service performance;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (dc)
  
  processing strictly necessary for the detection and prevention of cyberattacks, fraud, and unauthorised access, and for the maintenance of technical service performance;
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 422 IMCO

(dd)

frequency capping of advertising within a single service environment, where no cross-service tracking or persistent profiling is involved;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (dd)
  
  frequency capping of advertising within a single service environment, where no cross-service tracking or persistent profiling is involved;
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 423 IMCO

(de)

processing where the controller deploys recognised privacy-enhancing technologies (PETs) that effectively mitigate risks to the rights and freedoms of data subjects, in accordance with the technical specifications adopted pursuant to paragraph 4, 5 and 6.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (de)
  
  processing where the controller deploys recognised privacy-enhancing technologies (PETs) that effectively mitigate risks to the rights and freedoms of data subjects, in accordance with the technical specifications adopted pursuant to paragraph 4, 5 and 6.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 424 IMCO

(3a)

Personal data of consumers accessed pursuant to paragraph 3 shall be processed only insofar as strictly necessary for the purpose of justifying the access and shall not be further processed for incompatible purposes to ensure the highest level of consumer protection. Article 6(4) shall not apply to such processing. Personal data of consumers accessed pursuant to paragraph 3 shall be deleted or rendered anonymous immediately after the purpose justifying the access has been fulfilled.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
3a.

Personal data of consumers accessed pursuant to paragraph 3 shall be processed only insofar as strictly necessary for the purpose of justifying the access and shall not be further processed for incompatible purposes to ensure the highest level of consumer protection. Article 6(4) shall not apply to such processing. Personal data of consumers accessed pursuant to paragraph 3 shall be deleted or rendered anonymous immediately after the purpose justifying the access has been fulfilled.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 425 IMCO

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 426 IMCO

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 427 IMCO

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the ~~following~~consent shall ~~apply:~~only be valid if it is freely given, specific, informed and unambiguous, and takes the form of a statement or a clear affirmative action, in accordance with Article 4, point (11), and Article 7 of this Regulation, in accordance with Guidelines 05/2020 of the European Data Protection Board on consent. It must be as easy for the data subject to refuse or withdraw consent as it was to give consent, and any such refusal or withdrawal must be without detriment. The interface used to request, give, refuse or withdraw consent shall be designed, organised and used in accordance with Article 25 of Regulation (EU) 2022/2065 and must not deceive or manipulate the data subject or materially distort or impair his or her ability to make free and informed decisions.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the ~~following~~consent shall ~~apply:~~only be valid if it is freely given, specific, informed and unambiguous, and takes the form of a statement or a clear affirmative action, in accordance with Article 4, point (11), and Article 7 of this Regulation, in accordance with Guidelines 05/2020 of the European Data Protection Board on consent. It must be as easy for the data subject to refuse or withdraw consent as it was to give consent, and any such refusal or withdrawal must be without detriment. The interface used to request, give, refuse or withdraw consent shall be designed, organised and used in accordance with Article 25 of Regulation (EU) 2022/2065 and must not deceive or manipulate the data subject or materially distort or impair his or her ability to make free and informed decisions. (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 428 IMCO

(a) the ~~data subject~~consumer shall be able to exercise their choice to refuse requests for consent or withdraw consent in ana ~~easy~~consumer-friendly, accessible,n and ~~intelligible~~easy manner with a single-click button or equivalent means; it shall be as easy to refuse or withdraw consent as to give it;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the ~~data subject~~consumer shall be able to exercise their choice to refuse requests for consent or withdraw consent in ana ~~easy~~consumer-friendly, accessible,n and ~~intelligible~~easy manner with a single-click button or equivalent means; it shall be as easy to refuse or withdraw consent as to give it;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 429 IMCO

(aa)

consent that uses unfair commercial practices that influence or manipulate the free and genuine consumer choice to consent shall make consent void;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 430 IMCO

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; When a user has refused or withdrawn consent, electronic communications service providers and third parties may not seek the user’s consent again until one year has elapsed from the date of the user’s decision for the same processing purpose.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; When a user has refused or withdrawn consent, electronic communications service providers and third parties may not seek the user’s consent again until one year has elapsed from the date of the user’s decision for the same processing purpose. (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 431 IMCO

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. Cross-service tracking techniques or data reuse for incompatible purposes shall also be excluded in line with provision under Regulation (EU) 2022/1925.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. Cross-service tracking techniques or data reuse for incompatible purposes shall also be excluded in line with provision under Regulation (EU) 2022/1925. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 432 IMCO

New requests for consent within these periods, precludes consent from being validly granted. This paragraph also applies to the subsequent processing of personal data based on consent.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. New requests for consent within these periods, precludes consent from being validly granted. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 433 IMCO

(4a)

The Commission may adopt implementing acts to specify the technical standards and criteria to determine whether a technology qualifies as a recognised Privacy Enhancing Technology (PET) and effectively mitigates risks as referred to in paragraph 3.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
4a.

The Commission may adopt implementing acts to specify the technical standards and criteria to determine whether a technology qualifies as a recognised Privacy Enhancing Technology (PET) and effectively mitigates risks as referred to in paragraph 3.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 434 IMCO

(4b)

For the purpose of paragraph 4 the Commission shall: (a) assess the state of the art of available technologies; (b)develop criteria to assess the effectiveness of risk mitigation in relation to the specific categories of data and processing operations.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
4b.

For the purpose of paragraph 4 the Commission shall: (a) assess the state of the art of available technologies; (b)develop criteria to assess the effectiveness of risk mitigation in relation to the specific categories of data and processing operations.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 435 IMCO

(4c)

The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EDPB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
4c.

The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EDPB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1360 ITRE · LIBE

~~Article 88a~~

Justification

Deletion applies to all of Article 88a (paragraphs 1-5).

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  ~~carrying out the transmission of an electronic communication over an electronic communications network;~~
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

~~This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~

Remove proposed wording Amendment 1361 ITRE · LIBE

~~Article 88a~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  ~~carrying out the transmission of an electronic communication over an electronic communications network;~~
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

~~This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~

Remove proposed wording Amendment 1362 ITRE · LIBE

~~Article 88a~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  ~~carrying out the transmission of an electronic communication over an electronic communications network;~~
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

~~This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~

Remove proposed wording Amendment 1363 ITRE · LIBE

~~Article 88a~~

Justification

Deletion of new article 88a

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  ~~carrying out the transmission of an electronic communication over an electronic communications network;~~
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

~~This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~

Remove proposed wording Amendment 1364 ITRE · LIBE

~~Article 88a~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  ~~carrying out the transmission of an electronic communication over an electronic communications network;~~
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

~~This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~

Remove proposed wording Amendment 1365 ITRE · LIBE

~~Article 88a~~

Justification

Article 88a moved back to the ePrivacy Directive

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  ~~carrying out the transmission of an electronic communication over an electronic communications network;~~
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

~~This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~

Remove proposed wording Amendment 1366 ITRE · LIBE

~~Article 88a~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  ~~carrying out the transmission of an electronic communication over an electronic communications network;~~
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

~~This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~

Remove proposed wording Amendment 1367 ITRE · LIBE

~~Processing of personal data in the terminal equipment of natural persons~~

Alternative wording Amendment 1368 ITRE · LIBE

Processing of personal data in ~~the~~ terminal equipment ~~of natural persons~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1369 ITRE · LIBE

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1370 ITRE · LIBE

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a ~~natural~~data ~~person~~subject, and any subsequent processing necessary to achieve the purpose for which the data subject has given consent is only allowed when that person has given his or her consent, in accordance with this Regulation.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a ~~natural~~data ~~person~~subject, and any subsequent processing necessary to achieve the purpose for which the data subject has given consent is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1371 ITRE · LIBE

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where such processing is ~~only~~carried ~~allowed when that person has given his or her consent,~~out in accordance with this Regulation and on the basis of Article 6 of this Regulation.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where such processing is ~~only~~carried ~~allowed when that person has given his or her consent,~~out in accordance with this Regulation and on the basis of Article 6 of this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1372 ITRE · LIBE

(1) Storing of personal data, or gaining of access to personal data already stored, in ~~the~~a terminal equipment, ofand asubsequent ~~natural person~~processing is only allowed when that person has given ~~his or her~~ consent, in accordance with this Regulation.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in ~~the~~a terminal equipment, ofand asubsequent ~~natural person~~processing is only allowed when that person has given ~~his or her~~ consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1373 ITRE · LIBE

(1a) In Article 88a, the following paragraph 1a is inserted:

A data subject shall not be denied access to a service or to a functionality of a service on the grounds that the data subject has not given consent under paragraph 1 to the storing of, or gaining of access to, personal data in a terminal equipment that is not strictly necessary for the provision of that service or functionality.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
1a.

A data subject shall not be denied access to a service or to a functionality of a service on the grounds that the data subject has not given consent under paragraph 1 to the storing of, or gaining of access to, personal data in a terminal equipment that is not strictly necessary for the provision of that service or functionality.'
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1374 ITRE · LIBE

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1375 ITRE · LIBE

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1376 ITRE · LIBE

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1), provided that any such measure is necessary and proportionate and does not require the general identification of users, nor the weakening of anonymity, encryption or other protective tools on which users, including journalists, activists and other persons at risk, rely.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1), provided that any such measure is necessary and proportionate and does not require the general identification of users, nor the weakening of anonymity, encryption or other protective tools on which users, including journalists, activists and other persons at risk, rely.
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1377 ITRE · LIBE

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6 and, where applicable, Article 9, including applicable obligations of professional secrecy to safeguard the objectives referred to in Article 23(1).

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6 and, where applicable, Article 9, including applicable obligations of professional secrecy to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1378 ITRE · LIBE

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in ~~the~~a terminal equipment, ofand asubsequent ~~natural person~~processing, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6(3), to safeguard the objectives referred to in Article 23(1).

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in ~~the~~a terminal equipment, ofand asubsequent ~~natural person~~processing, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6(3), to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1379 ITRE · LIBE

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a ~~natural~~data ~~person~~subject, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a ~~natural~~data ~~person~~subject, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1380 ITRE · LIBE

In Article 88a, the following paragraph 2a is inserted:

(2a)

This Article shall not be interpreted as a legal basis for accessing the content of electronic communications, for weakening, circumventing or preventing end-to-end encryption, for client-side scanning, for covert access to terminal equipment, for device fingerprinting or for cross-service tracking of natural persons. The confidentiality of communications and the protection of terminal equipment under Directive 2002/58/EC shall remain unaffected. Measures taken pursuant to Article 23 of this Regulation shall be determined by law, necessary and proportionate and, where there is significant infringement of fundamental rights, subject to prior independent judicial review.’

Justification

Secure communication is a civil right. The rules governing terminal devices and cookies must never create a back door for content control or for making encryption technically weaker.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
2a.

This Article shall not be interpreted as a legal basis for accessing the content of electronic communications, for weakening, circumventing or preventing end-to-end encryption, for client-side scanning, for covert access to terminal equipment, for device fingerprinting or for cross-service tracking of natural persons. The confidentiality of communications and the protection of terminal equipment under Directive 2002/58/EC shall remain unaffected. Measures taken pursuant to Article 23 of this Regulation shall be determined by law, necessary and proportionate and, where there is significant infringement of fundamental rights, subject to prior independent judicial review.’
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1381 ITRE · LIBE

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  ~~carrying out the transmission of an electronic communication over an electronic communications network;~~
2. (b)
  
  ~~providing a service explicitly requested by the data subject;~~
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1382 ITRE · LIBE

(3) Storing of personal data, or gaining of access to personal data already stored, in ~~the~~a terminal equipment ~~of a natural person~~ without consent, and subsequent processing, shall solely be lawful to the extent it is strictly necessary for any of the following purposes:

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in ~~the~~a terminal equipment ~~of a natural person~~ without consent, and subsequent processing, shall solely be lawful to the extent it is strictly necessary for any of the following purposes:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1383 ITRE · LIBE

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a ~~natural~~data ~~person~~subject without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a ~~natural~~data ~~person~~subject without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1384 ITRE · LIBE

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful ~~to the extent it is necessary~~ for any of the following:

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful ~~to the extent it is necessary~~ for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1385 ITRE · LIBE

(aa) In Article 88a, paragraph 3, the following point aa is inserted

(aa)

enabling contextual advertising to the user, and related purposes which support contextual advertising, which is not based on any type of profiling.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (aa)
  
  enabling contextual advertising to the user, and related purposes which support contextual advertising, which is not based on any type of profiling.'
3. (b)
  
  providing a service explicitly requested by the data subject;
4. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
5. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1386 ITRE · LIBE

(b) providing a service explicitly requested by the data subject, where the personal data processed remains strictly limited to what is necessary for the provision of a specific an identifiable service;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject, where the personal data processed remains strictly limited to what is necessary for the provision of a specific an identifiable service;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1387 ITRE · LIBE

(b) providing a service or the maintenance of a user session explicitly requested by the data subject;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service or the maintenance of a user session explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1388 ITRE · LIBE

(ba) In Article 88a, paragraph 3, the following point ba is inserted

(ba)

the prevention and detection of fraud, provided that the controller can demonstrate that the data are processed exclusively for that purpose, are not used for any other commercial purpose, and are not made available to third parties for purposes other than the prevention and detection of fraud.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (ba)
  
  the prevention and detection of fraud, provided that the controller can demonstrate that the data are processed exclusively for that purpose, are not used for any other commercial purpose, and are not made available to third parties for purposes other than the prevention and detection of fraud.'
4. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
5. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1389 ITRE · LIBE

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1390 ITRE · LIBE

(c) ~~creating~~measuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  ~~creating~~measuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, ~~where~~as ~~it is carried out~~defined by ~~the~~article ~~controller of that online service solely for its own use;~~2
4. (d)
  
  ~~maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.~~
16.
of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);
1. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1391 ITRE · LIBE

(c) Immediately creating anonymous aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use and does not enable the identification, tracking or profiling of data subjects;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  Immediately creating anonymous aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use and does not enable the identification, tracking or profiling of data subjects;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1392 ITRE · LIBE

(c) creating aggregated, anonymised information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use, provided that such information is not further processed for another purpose;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated, anonymised information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use, provided that such information is not further processed for another purpose;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1393 ITRE · LIBE

(c) creating ~~aggregated~~ information about the usage of an online service tosolely ~~measure~~for the ~~audience~~use of ~~such a service, where it is carried out by~~ the ~~controller~~provider of that ~~online~~ service ~~solely for its own use~~;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating ~~aggregated~~ information about the usage of an online service tosolely ~~measure~~for the ~~audience~~use of ~~such a service, where it is carried out by~~ the ~~controller~~provider of that ~~online~~ service ~~solely for its own use~~;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1394 ITRE · LIBE

(c) (c) creating ~~aggregated~~  information about the usage of an online service to measure  the audience of  such a  service, where it is carried out byat the direction of the controller of that online service, ~~service~~or ~~solely~~by ~~for~~a ~~its~~third ~~own~~party ~~use~~acting on behalf of the controller;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject; (c) (c) creating information about the usage of an online service to measure the audience of such a service, where it is carried out at the direction of the controller of that online service, or by a third party acting on behalf of the controller;
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;~~
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1395 ITRE · LIBE

(c) ~~creating aggregated information about the usage of an online service to~~ measure the audience as defined in article 2(16) of ~~such~~Regulation ~~a service~~2024/1083, where it is carried out by the ~~controller~~provider of that online service, ~~solely~~or ~~for~~by ~~its~~a ~~own~~joint ~~use~~controller or processor mandated by the provider of that online service;

Justification

This amendment ensures legal clarity by aligning the text with the EMFA definition of audience measurement and allowing mandated joint controllers or processors to carry it out. This safeguards independent, comparable and verifiable measurement, while enabling the use of aggregated market statistics for transparency and fair competition.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  ~~creating aggregated information about the usage of an online service to~~ measure the audience as defined in article 2(16) of ~~such~~Regulation ~~a service~~2024/1083, where it is carried out by the ~~controller~~provider of that online service, ~~solely~~or ~~for~~by ~~its~~a ~~own~~joint ~~use~~controller or processor mandated by the provider of that online service;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1396 ITRE · LIBE

(c) ~~creating aggregated information about the usage of an online service to measure~~measuring the audience of ~~such~~an aonline service, where it is carried out by the controller of that online service solely for its own use, or by a third party acting on behalf of the controller;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  ~~creating aggregated information about the usage of an online service to measure~~measuring the audience of ~~such~~an aonline service, where it is carried out by the controller of that online service solely for its own use, or by a third party acting on behalf of the controller;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1397 ITRE · LIBE

(ca)

In Article 83, paragraph 3, the following point ca is inserted:

performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (ca)
  
  performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.
5. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1398 ITRE · LIBE

(d) maintaining or restoring the security, integrity and functioning of a service provided by the controller and requested by the data subject or the security of the terminal equipment used for the provision of such service., including detecting, preventing or mitigating fraud, automated or non-human traffic, unauthorised access, misuse of the service, circumvention of technical access conditions, or other uses that are contrary to the provider’s terms and conditions

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security, integrity and functioning of a service provided by the controller and requested by the data subject or the security of the terminal equipment used for the provision of such service., including detecting, preventing or mitigating fraud, automated or non-human traffic, unauthorised access, misuse of the service, circumvention of technical access conditions, or other uses that are contrary to the provider’s terms and conditions
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1399 ITRE · LIBE

(d) maintaining, restoring or ~~restoring~~ensuring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service., including in particular cybersecurity, the protection of personal data and privacy of the user and prevention of fraud and unauthorised access provided that such measures do not override the fundamental rights and interests of the subscriber or user;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining, restoring or ~~restoring~~ensuring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service., including in particular cybersecurity, the protection of personal data and privacy of the user and prevention of fraud and unauthorised access provided that such measures do not override the fundamental rights and interests of the subscriber or user;
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1400 ITRE · LIBE

(d) demonstrably and proportionally maintaining or restoring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  demonstrably and proportionally maintaining or restoring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1401 ITRE · LIBE

(d) maintaining or restoring the security and integrity of a service provided by the controller, ~~and~~including ~~requested~~fraud ~~by the data subject~~prevention or technical incidents, of the terminal equipment used for the provision of such service.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security and integrity of a service provided by the controller, ~~and~~including ~~requested~~fraud ~~by the data subject~~prevention or technical incidents, of the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1402 ITRE · LIBE

(d) maintaining or restoring the integrity and security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the integrity and security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1403 ITRE · LIBE

(da) In Article 88a, paragraph 3, the following point da is added

(da)

contextual advertising and related limitation of advertisement display, audience measurement and preventing fraudulent misrepresentation of audience, unless at least one of the following applies:

(i)

the processing is likely to result in a risk to the rights and freedoms of natural persons;

(ii)

the processing involves profiling;

(iii)

personal data are stored at the time when the electronic communication service is not actively used;

(iv)

personal data are connected with past or future activity of the data subject.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (da)
  contextual advertising and related limitation of advertisement display, audience measurement and preventing fraudulent misrepresentation of audience, unless at least one of the following applies:
  1. (i)
    
    the processing is likely to result in a risk to the rights and freedoms of natural persons;
  2. (ii)
    
    the processing involves profiling;
  3. (iii)
    
    personal data are stored at the time when the electronic communication service is not actively used;
  4. (iv)
    
    personal data are connected with past or future activity of the data subject.'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1404 ITRE · LIBE

(da) In Article 88a, paragraph 3, the following point da is added

(da)

contextual advertising and related limitation of advertisement display, audience measurement and preventing fraudulent misrepresentation of audience, unless at least one of the following applies:

(i)

the processing is likely to result in a risk to the rights and freedoms of natural persons;

(ii)

the processing involves profiling;

(iii)

personal data are stored at the time when the electronic communication service is not actively used;

(iv)

personal data are connected with past or future activity of the data subject. ‘

Justification

New exemptions are suggested concerning activities that are not based on profiling, i.e. covering low‑risk to the rights and freedoms, non‑profiling activities that do not involve any retention of personal data beyond the user’s active session nor any link to past or future behaviour. This suggestion is inspired by the EDPB/EDPS joint opinion aimed to to create incentives to use less‑intrusive forms of online advertising and to make the rules more proportionate, i.e. allowing some forms of targeted advertising, which is crucial for European publishers and service providers.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (da)
  contextual advertising and related limitation of advertisement display, audience measurement and preventing fraudulent misrepresentation of audience, unless at least one of the following applies:
  1. (i)
    
    the processing is likely to result in a risk to the rights and freedoms of natural persons;
  2. (ii)
    
    the processing involves profiling;
  3. (iii)
    
    personal data are stored at the time when the electronic communication service is not actively used;
  4. (iv)
    
    personal data are connected with past or future activity of the data subject. ‘
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1405 ITRE · LIBE

(da) In Article 88a, paragraph 3, the following point da is added

(da)

‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, where the advertising itself is directly generating revenue for the controller, or where there is no direct relationship with the data subject.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (da)
  
  ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, where the advertising itself is directly generating revenue for the controller, or where there is no direct relationship with the data subject.'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1406 ITRE · LIBE

(da) In Article 88a, paragraph 3, the following point da is added

(da)

legitimate purposes in relation to contextual advertising, including measuring the performance and reach of such advertisement or capping the frequency with which such advertisement is being displayed.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (da)
  
  legitimate purposes in relation to contextual advertising, including measuring the performance and reach of such advertisement or capping the frequency with which such advertisement is being displayed.'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1407 ITRE · LIBE

(da) In Article 88a, paragraph 3, the following sentence is added

The purposes listed in this paragraph shall be interpreted narrowly and shall not serve as a basis for tracking, profiling or the large-scale monitoring of the online activity of data subjects.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. The purposes listed in this paragraph shall be interpreted narrowly and shall not serve as a basis for tracking, profiling or the large-scale monitoring of the online activity of data subjects.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1408 ITRE · LIBE

(da) In Article 88a, paragraph 3, the following point da is added

(da)

processing where the controller deploys recognised Privacy Enhancing Technologies (PETs) that effectively mitigate risks associated to the processing of personal data.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (da)
  
  processing where the controller deploys recognised Privacy Enhancing Technologies (PETs) that effectively mitigate risks associated to the processing of personal data.'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1409 ITRE · LIBE

(da) In Article 88a, paragraph 3, the following point da is added

(da)

carrying out operations to detect, prevent or mitigate fraud and money laundering, as well as to combat the financing of terrorism;'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (da)
  
  carrying out operations to detect, prevent or mitigate fraud and money laundering, as well as to combat the financing of terrorism;'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1410 ITRE · LIBE

(db) In Article 88a, paragraph 3, the following point db is added

(db)

‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, regardless of whether there is a direct relationship with the data subject. This does not preclude the processing of data for internal product optimisation, provided such processing is not used to track the user.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (db)
  
  ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, regardless of whether there is a direct relationship with the data subject. This does not preclude the processing of data for internal product optimisation, provided such processing is not used to track the user.'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1411 ITRE · LIBE

(db) In Article 88a, paragraph 3, the following point db is inserted

(db)

processing where the controller deploys recognised privacy-enhancing technologies (PETs) that effectively mitigate risks to the rights and freedoms of data subjects, in accordance with the technical specifications adopted pursuant to paragraph 4, 5 and 6;'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (db)
  
  processing where the controller deploys recognised privacy-enhancing technologies (PETs) that effectively mitigate risks to the rights and freedoms of data subjects, in accordance with the technical specifications adopted pursuant to paragraph 4, 5 and 6;'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1412 ITRE · LIBE

(db) In Article 88a, paragraph 3, the following point db is added

(db)

performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (db)
  
  performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1413 ITRE · LIBE

(dc) In Article 88a, paragraph 3, the following point dc is added

(dc)

For the purpose of Article 88a paragraph (3)(e), the Commission shall:

(i)

assess the state of the art of available technologies;

(ii)

develop criteria to assess the effectiveness of risk mitigation in relation to the specific categories of data and processing operations.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
5. (dc)
  For the purpose of Article 88a paragraph (3)(e), the Commission shall:
  1. (i)
    
    assess the state of the art of available technologies;
  2. (ii)
    
    develop criteria to assess the effectiveness of risk mitigation in relation to the specific categories of data and processing operations.'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1414 ITRE · LIBE

(3a) In Article 88a, the following paragraph 3a is added:

Paragraph 3 shall not apply to behavioural or personalised advertising, profiling, customer segmentation, or the inference of health status or other special categories of personal data. Processing for those purposes shall require the data subject’s consent.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
3a.

Paragraph 3 shall not apply to behavioural or personalised advertising, profiling, customer segmentation, or the inference of health status or other special categories of personal data. Processing for those purposes shall require the data subject’s consent.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1415 ITRE · LIBE

(3a) In Article 88a, the following paragraph 3a is added:

For any other purpose than those referred to in the second subparagraph, the processing shall comply with Article 6 and, where applicable, with Article 9.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
3a.

For any other purpose than those referred to in the second subparagraph, the processing shall comply with Article 6 and, where applicable, with Article 9.'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1416 ITRE · LIBE

(3b) In Article 88a, the following paragraph 3b is added:

The storing of information, or the gaining of access to information already stored, in the terminal equipment of a user or subscriber pursuant to this Article shall be without prejudice to Directive 2002/58/EC, which shall continue to apply in full. In particular, this Article shall not affect the confidentiality of communications and of the related traffic data, the protection of traffic and location data, the safeguards against unsolicited communications, and the possibility for Member States to adopt restrictive measures, as provided for in Articles 5, 6, 9, 13 and 15(1) of that Directive.'

Justification

The storing of, or access to, information in terminal equipment pursuant to Article 88a is without prejudice to Directive 2002/58/EC, which continues to apply in full, and in particular to the confidentiality of communications and of the related traffic data, the protection of traffic and location data, the safeguards against unsolicited communications, and the powers of Member States under Article 15(1). Without this clause, the transfer of the terminal regime to the GDPR could be read as an implicit repeal of the ePrivacy protections which survive it.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1417 ITRE · LIBE

(3c) In Article 88a, the following paragraph 3c is added:

In particular, information relating to other natural persons stored in the terminal equipment of a user or subscriber, such as contact details, constitutes personal data of those persons. Consent given by the user or subscriber to the storing of, or access to, such information shall not constitute consent by the natural persons to whom that information relates, nor a legal basis for any further processing of their personal data. Such information shall not be transmitted to third parties, nor used for purposes other than those strictly necessary for the service explicitly requested by the user or subscriber.'

Justification

Information relating to other natural persons stored in the terminal equipment of a user, such as contact details, constitutes personal data of those persons. Consent given by the user does not constitute consent by the persons to whom that information relates, nor a legal basis for any further processing of their data. Such information may not be transmitted to third parties nor used for purposes other than those strictly necessary for the service explicitly requested.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1418 ITRE · LIBE

(3d) In Article 88a, the following paragraph 3d is added:

This Article shall be without prejudice to the right of data subjects to receive compensation for material or non-material damage resulting from the storing of information, or the gaining of access to information already stored, in their terminal equipment pursuant to this Article, and to the liability of controllers and processors for such processing.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
3d.

This Article shall be without prejudice to the right of data subjects to receive compensation for material or non-material damage resulting from the storing of information, or the gaining of access to information already stored, in their terminal equipment pursuant to this Article, and to the liability of controllers and processors for such processing.'
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1419 ITRE · LIBE

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Remove proposed wording Amendment 1420 ITRE · LIBE

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
~~Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:~~
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1421 ITRE · LIBE

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
~~Where~~This ~~storing~~paragraph also applies to the subsequent processing of personal data~~, or gaining of access to personal data already stored, in the terminal equipment of a natural person is~~ based on consent~~, the following shall apply:~~.
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1422 ITRE · LIBE

Where storing of personal data, or gaining of access to personal data already stored, in ~~the~~a terminal equipment ~~of a natural person~~ is based on consent, the following shall apply without processing more personal data in line with Article 11:

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in ~~the~~a terminal equipment ~~of a natural person~~ is based on consent, the following shall apply without processing more personal data in line with Article 11:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1423 ITRE · LIBE

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following principles shall apply:

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following principles shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1424 ITRE · LIBE

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a ~~natural~~data ~~person~~subject is based on consent, the following shall apply:

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a ~~natural~~data ~~person~~subject is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1425 ITRE · LIBE

~~(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  ~~the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;~~
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1426 ITRE · LIBE

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;, except where the controller is a media service provider as defined in Article 2
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
2.
of Regulation (EU) 2024/108 (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
1. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1427 ITRE · LIBE

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a ~~single-click~~paid ~~button or equivalent means~~alternative;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a ~~single-click~~paid ~~button or equivalent means~~alternative;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1428 ITRE · LIBE

(a) the data subject shall be able to refuse or withdraw requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse or withdraw requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1429 ITRE · LIBE

(a) the data subject shall be able to refuse or accept requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse or accept requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1430 ITRE · LIBE

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1431 ITRE · LIBE

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully or technically rely on the consent of the data subject;

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully or technically rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1432 ITRE · LIBE

~~(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; This paragraph also applies to the subsequent processing of personal data based on consent.
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1433 ITRE · LIBE

~~(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; This paragraph also applies to the subsequent processing of personal data based on consent.
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1434 ITRE · LIBE

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. Information about declined requests may be stored and accessed lawfully in the terminal equipment provided that such information does not contain personal data nor unique identifiers and is used only for determining when consent was refused.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. Information about declined requests may be stored and accessed lawfully in the terminal equipment provided that such information does not contain personal data nor unique identifiers and is used only for determining when consent was refused. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1435 ITRE · LIBE

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months unless a substantial change in circumstances, in the purposes of the processing or in the safeguards afforded to the data subject justifies a new request.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months unless a substantial change in circumstances, in the purposes of the processing or in the safeguards afforded to the data subject justifies a new request. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1436 ITRE · LIBE

(c) ~~if the~~Where data subject ~~declines a request for consent, the controller shall not make a new~~refuse request for consent ~~for~~presented by media service providers, Media service providers shall be able to offer data subjects an equivalent alternative that is not accompanied by the ~~same~~processing ~~purpose~~of personal data for audience-based advertising purposes, where appropriate for a ~~period~~reasonable ~~of at least six months~~fee.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  ~~if the~~Where data subject ~~declines a request for consent, the controller shall not make a new~~refuse request for consent ~~for~~presented by media service providers, Media service providers shall be able to offer data subjects an equivalent alternative that is not accompanied by the ~~same~~processing ~~purpose~~of personal data for audience-based advertising purposes, where appropriate for a ~~period~~reasonable ~~of at least six months~~fee. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Alternative wording Amendment 1437 ITRE · LIBE

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108.

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months., ~~This~~except ~~paragraph also applies to~~where the ~~subsequent~~controller ~~processing~~is ofa ~~personal~~media ~~data~~service ~~based~~provider onas ~~consent.~~defined in Article 2
2.

of Regulation (EU) 2024/108. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1438 ITRE · LIBE

In Article 88a, paragraph 4, points a, b, c, d are replaced by the following:

(a)

Freedom: consent shall be given freely, the data subject having a genuine choice to refuse or withdraw it without detriment, and neither a contract, a service, nor access to its functionalities shall be made conditional on consent to storage or access that is not necessary for that service;

(b)

Specificity: consent shall be given separately for each specified, explicit and legitimate purpose, a distinct opt-in being provided for each;

(c)

Information: prior to giving consent, the data subject shall be informed, in clear and plain language, of at least the controller's identity, the purpose of each processing operation, the data used, and the right to withdraw consent at any time;

(d)

Unambiguity: consent shall be given by a statement or clear affirmative action, silence, inactivity, pre-ticked boxes or mere continued use of a service not constituting consent;

(da)

Fair design: the interface used to give, refuse or withdraw consent shall be fair and neutral, and shall not give prominence to acceptance over refusal or otherwise impair the data subject's ability to decide freely;

(db)

Withdrawal: the data subject shall be able to withdraw consent at any time, as easily and through the same interface as it was given, free of charge and without degradation of the service;

(dc)

Demonstrability: the controller shall be able to demonstrate that valid consent was given, retaining no more information than necessary for that purpose.

Justification

avoid hard-coded consent UX mandates sources guidelines EDPB 05/2020

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  Freedom: consent shall be given freely, the data subject ~~shall~~having bea ~~able~~genuine choice to refuse ~~requests~~or withdraw it without detriment, and neither a contract, a service, nor access to its functionalities shall be made conditional on consent to storage or access that is not necessary for ~~consent~~that ~~in an easy and intelligible manner with a single-click button or equivalent means~~service;
2. (b)
  
  ~~if the data subject gives~~Specificity: consent~~, the controller~~ shall ~~not~~be ~~make~~given separately for each specified, explicit and legitimate purpose, a ~~new~~distinct ~~request~~opt-in being provided for ~~consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject~~each;
3. (c)
  
  ifInformation: prior to giving consent, the data subject ~~declines~~shall abe ~~request for consent~~informed, ~~the~~in ~~controller~~clear ~~shall~~and ~~not~~plain ~~make a new request for consent for the same purpose for a period~~language, of at least ~~six~~the ~~months.~~controller's ~~This~~identity, ~~paragraph~~the ~~also~~purpose ~~applies~~of each processing operation, the data used, and the right to ~~the subsequent processing of personal data based on~~withdraw consent. at any time;
4. (d)
  
  Unambiguity: consent shall be given by a statement or clear affirmative action, silence, inactivity, pre-ticked boxes or mere continued use of a service not constituting consent;
5. (da)
  
  Fair design: the interface used to give, refuse or withdraw consent shall be fair and neutral, and shall not give prominence to acceptance over refusal or otherwise impair the data subject's ability to decide freely;
6. (db)
  
  Withdrawal: the data subject shall be able to withdraw consent at any time, as easily and through the same interface as it was given, free of charge and without degradation of the service;
7. (dc)
  
  Demonstrability: the controller shall be able to demonstrate that valid consent was given, retaining no more information than necessary for that purpose.
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1439 ITRE · LIBE

~~This paragraph also applies to the subsequent processing of personal data based on consent.~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. ~~This paragraph also applies to the subsequent processing of personal data based on consent.~~
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1440 ITRE · LIBE

(4a) In Article 88a, the following paragraph 4a is inserted:

The Board shall encourage stakeholders to develop cross-device,, interoperable and ergonomic interfaces that address consent fatigue, while taking into account the economic balance of all the stakeholders concerned, by exploring possibilities such as:

(a)

enabling the data subject to refuse requests for consent in an easy and intelligible manner, through a single-click button or equivalent means;

(b)

ensuring that, where the data subject gives consent, the controller does not make a new request for consent for the same purpose during the period in which it can lawfully rely on that consent;

(c)

ensuring that, where the data subject declines a request for consent, the controller does not make a new request for consent for the same purpose for a reasonable period.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
4a.
The Board shall encourage stakeholders to develop cross-device,, interoperable and ergonomic interfaces that address consent fatigue, while taking into account the economic balance of all the stakeholders concerned, by exploring possibilities such as:
1. (a)
  
  enabling the data subject to refuse requests for consent in an easy and intelligible manner, through a single-click button or equivalent means;
2. (b)
  
  ensuring that, where the data subject gives consent, the controller does not make a new request for consent for the same purpose during the period in which it can lawfully rely on that consent;
3. (c)
  
  ensuring that, where the data subject declines a request for consent, the controller does not make a new request for consent for the same purpose for a reasonable period.'
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Additional proposed wording Amendment 1441 ITRE · LIBE

(4a) In Article 88a, the following paragraph 4a is inserted:

Nothing in this Article shall prevent a media service provider from making access to its service conditional on either the data subject's consent to the processing of personal data for one or more specified purposes, or the payment of a reasonable fee for access to an equivalent version that does not involve such processing. Where such is offered, both options shall be presented to the data subject with equal prominence, in plain language and without the use of dark patterns.'

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
4a.

Nothing in this Article shall prevent a media service provider from making access to its service conditional on either the data subject's consent to the processing of personal data for one or more specified purposes, or the payment of a reasonable fee for access to an equivalent version that does not involve such processing. Where such is offered, both options shall be presented to the data subject with equal prominence, in plain language and without the use of dark patterns.'
5.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Remove proposed wording Amendment 1442 ITRE · LIBE

~~(5) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~

Preview
against:

Article 88a

Processing of personal data in the terminal equipment of natural persons

1.

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
2.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
3.
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
1. (a)
  
  carrying out the transmission of an electronic communication over an electronic communications network;
2. (b)
  
  providing a service explicitly requested by the data subject;
3. (c)
  
  creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;
4. (d)
  
  maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
4.
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
1. (a)
  
  the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
2. (b)
  
  if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
3. (c)
  
  if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
5.

~~This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]~~