GDPR· Article 88a

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where processing of such data is onlycarried allowed when that person has given his or her consent,out in accordance with this Regulation and is based on one of the legal bases set out in Article 6 of this Regulation.

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a naturaldata personsubject, and any subsequent processing necessary to achieve the purpose for which the data subject has given consent is only allowed when that person has given his or her consent, in accordance with this Regulation.

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where such processing is onlycarried allowed when that person has given his or her consent,out in accordance with this Regulation and on the basis of Article 6 of this Regulation.

(1) Storing of personal data, or gaining of access to personal data already stored, in thea terminal equipment, ofand asubsequent natural personprocessing is only allowed when that person has given his or her consent, in accordance with this Regulation.

(1a) In Article 88a, the following paragraph 1a is inserted:

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).Where the processing referred to in paragraph 1 is based on legitimate interests pursuant to Article 6(1), point (f), of this Regulation (EU), the GDPR requires a balancing test to ensure that the company’s interests do not override the user’s rights and reasonable expectations, this principle should we always respect and strive to achieve the right balance.

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1), provided that any such measure is necessary and proportionate and does not require the general identification of users, nor the weakening of anonymity, encryption or other protective tools on which users, including journalists, activists and other persons at risk, rely.

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6 and, where applicable, Article 9, including applicable obligations of professional secrecy to safeguard the objectives referred to in Article 23(1).

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in thea terminal equipment, ofand asubsequent natural personprocessing, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6(3), to safeguard the objectives referred to in Article 23(1).

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a naturaldata personsubject, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

In Article 88a, the following paragraph 2a is inserted:

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

(da) In Article 88a, paragraph 3, the following sentence is added

(a) carrying out the transmission of an electronic communication over an electronic communications network; such access shall be strictly limited to what is technically necessary for the sole purpose of transmitting the communication to ensure the highest level of consumer protection. Such access shall not be used for purposes unrelated to the transmission of the communication, including profiling, advertising, audience measurement, service optimisation, or the creation of behavioural or usage analytics.

(3a) In Article 88a, the following paragraph 3a is added:

(3a) In Article 88a, the following paragraph 3a is added:

(b) providing a service explicitly requested by the data subject, where the personal data processed remains strictly limited to what is necessary for the provision of a specific an identifiable service;

(b) providing a service or the maintenance of a user session explicitly requested by the data subject;

(3b) In Article 88a, the following paragraph 3b is added:

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

(c) instantly creating aggregated and anonymous measurement information about the usage of an online service to measure the audience of such a service, where such measurement it is carried out by the controller of that online service solely for its own use,; is restricted to aggregated statistical counting does not enable the identification, tracking or profiling of consumers beyond what is strictly necessary for aggregated statistics and does not involve the creation of persistent identifiers, provided that the data is not combined with data from other services from the same provider or from a third party or made accessible to third parties, subject to provisions laid down in Regulation (EU) 2022/1925 or otherwise processed for purposes such as profiling, advertising, the optimisation of services beyond audience measurement, or the training of artificial intelligence systems, and provided that data subjects are given effective means to object without affecting the usability of the service.

(c) creatingmeasuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);

(c) creatingmeasuring the audience of an online service as defined in Article 2(16) of Regulation 2024/1083 to create aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service or by entitled third parties jointly authorised by adverstisers or publishers, solely for itsthe ownmeasurement useof the overall market performance and subject to the safeguards laid down in Article 89(1);

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;measuring or improving the performance, security or functionality of an online service, including through testing and the creation of aggregated usage information, where such processing is carried out solely for the controller’s own use, the prevention of fraud or other risky behaviour or technical incidents

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

(c) creatingmeasuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);

(c) Immediately creating anonymous aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use and does not enable the identification, tracking or profiling of data subjects;

(c) creating aggregated, anonymised information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use, provided that such information is not further processed for another purpose;

(c) creating aggregated information about the usage of an online service tosolely measurefor the audienceuse of such a service, where it is carried out by the controllerprovider of that online service solely for its own use;

(c) (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out byat the direction of the controller of that online service, serviceor solelyby fora itsthird ownparty useacting on behalf of the controller;

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;measure the audience as defined in article 2(16) of Regulation 2024/1083, where it is carried out by the provider of that online service, or by a joint controller or processor mandated by the provider of that online service;

(c) creating aggregated information about the usage of an online service to measuremeasuring the audience of suchan aonline service, where it is carried out by the controller of that online service solely for its own use, or by a third party acting on behalf of the controller;

(3c) In Article 88a, the following paragraph 3c is added:

(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.maintenance or restoration of the security of a service provided by the controller and requested explicitly by the data subject provided that it is limited to what is strictly necessary for ensuring a specific security purpose or addressing concrete security vulnerabilities or incidents affecting the requested service or device. Measures under this point shall not alter the functionality of the hardware or software, or the privacy settings chosen by the consumer, unrelated to that purpose. Access shall not be used to generate persistent identifiers, behavioural profiles, or long-term activity logs, nor shall it introduce device fingerprinting, device graphing, or similar techniques enabling tracking across services or applications.

(d) maintaining or restoring the integrity or security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

(d) maintaining, restoring or restoringensuring the security of a service providedor by the controller and requested by the data subject orof the terminal equipment used for the provision of such service.

(d) maintaining or restoring the security, integrity and functioning of a service provided by the controller and requested by the data subject or the security of the terminal equipment used for the provision of such service., including detecting, preventing or mitigating fraud, automated or non-human traffic, unauthorised access, misuse of the service, circumvention of technical access conditions, or other uses that are contrary to the provider’s terms and conditions

(d) maintaining, restoring or restoringensuring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service., including in particular cybersecurity, the protection of personal data and privacy of the user and prevention of fraud and unauthorised access provided that such measures do not override the fundamental rights and interests of the subscriber or user;

(d) demonstrably and proportionally maintaining or restoring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

(d) maintaining or restoring the security and integrity of a service provided by the controller, andincluding requestedfraud by the data subjectprevention or technical incidents, of the terminal equipment used for the provision of such service.

(d) maintaining or restoring the integrity and security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

(3d) In Article 88a, the following paragraph 3d is added:

(aa) In Article 88a, paragraph 3, the following point aa is inserted

(ca)In Article 83, paragraph 3, the following point ca is inserted:

(da) In Article 88a, paragraph 3, the following point da is added

(da) In Article 88a, paragraph 3, the following point da is added

(da) In Article 88a, paragraph 3, the following point da is added

(da) In Article 88a, paragraph 3, the following point da is added

(da) In Article 88a, paragraph 3, the following point da is added

(da) In Article 88a, paragraph 3, the following point da is added

(db) In Article 88a, paragraph 3, the following point db is inserted

(db) In Article 88a, paragraph 3, the following point db is added

(dc) In Article 88a, paragraph 3, the following point dc is added

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(a) the data subjectconsumer shall be able to exercise their choice to refuse requests for consent or withdraw consent in ana easyconsumer-friendly, accessible,n and intelligibleeasy manner with a single-click button or equivalent means; it shall be as easy to refuse or withdraw consent as to give it;

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a single-clickpaid button or equivalent meansalternative;

(a) the data subject shall be able to refuse or withdraw requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(a) the data subject shall be able to refuse or accept requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(4a) In Article 88a, the following paragraph 4a is inserted:

(4a) In Article 88a, the following paragraph 4a is inserted:

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject. In particular, gatekeepers under Regulation (EU) 2022/1925 should not be allowed to prompt data subjects more than once a year to give consent for the same processing purpose in respect of which they did not give consent or withdrew their consent;

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; When a user has refused or withdrawn consent, electronic communications service providers and third parties may not seek the user’s consent again until one year has elapsed from the date of the user’s decision for the same processing purpose.

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully or technically rely on the consent of the data subject;

In Article 88a, paragraph 4, points a, b, c, d are replaced by the following:

(5) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Processing of personal data in the terminal equipment of natural persons