EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

EUDPR· Article 37

Analysis in our dossiers
Cookies, device access and consent

Text

Article 37 EUDPR as printed in the Council text of 22 October 2026

Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment

Source Council, 22 October 2026. Article 37: ST 14756/26, page 154 · pp. 154–155 · exact text page

Article 37(2) Dropped

This Council draft drops the change the Commission proposed. It deletes nothing from the law in force.

Article 37(3) Dropped

Article 37(4) Dropped

Article 37(5) Dropped

Article 37(6) Dropped

Article 37(7) Dropped

Article 37(8) Dropped

Article 37(9) Dropped

Article 37(10) Dropped

How the provision changed

Show the statuses

Each text against the law in forceEach text against the text before it

What each text would do to the law in force
Element Commission19 Nov 2025Art 37 Council10 Jun 2026Art 37 Council18 Jun 2026Art 37 Council3 Sep 2026Art 37 Council2 Oct 2026Art 37 Council22 Oct 2026Art 37
Compared withlaw in forcethe proposal10 Jun text18 Jun text3 Sep text2 Oct text
Consent for storing or accessing personal data
37(2) Adds Added
37(2) Adds Unchanged
37(2) Adds Unchanged
37(2) Adds Unchanged
Not in the law in force or this text, dropped since 3 Sep Dropped
Not in the law in force or this text In neither text
Storage or access based on Union law
37(3) Adds Added
37(3) Adds Unchanged
37(3) Adds Unchanged
37(3) Adds Unchanged
Not in the law in force or this text, dropped since 3 Sep Dropped
Not in the law in force or this text In neither text
Purposes allowed without consent
37(4) Adds Added
37(4) Adds, changed since the proposal Changed
37(4) Adds, changed since 10 Jun Changed
37(4) Adds, changed since 18 Jun Changed
Not in the law in force or this text, dropped since 3 Sep Dropped
Not in the law in force or this text In neither text
Handling of consent requests
37(5) Adds Added
37(5) Adds Unchanged
37(5) Adds, changed since 10 Jun Changed
37(5) Adds Unchanged
Not in the law in force or this text, dropped since 3 Sep Dropped
Not in the law in force or this text In neither text
Date of application of the Article
37(6) Adds Added
37(6) Adds Unchanged
37(6) Adds Unchanged
37(6) Adds Unchanged
Not in the law in force or this text, dropped since 3 Sep Dropped
Not in the law in force or this text In neither text
Automated and machine-readable consent choices
37(7) Adds Added
Not in the law in force or this text, dropped since the proposal Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Respect for data subjects’ choices
37(8) Adds Added
Not in the law in force or this text, dropped since the proposal Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Presumption of conformity with harmonised standards
37(9) Adds Added
Not in the law in force or this text, dropped since the proposal Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Later application of paragraphs 7 to 9
37(10) Adds Added
Not in the law in force or this text, dropped since the proposal Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text

Each text against the law in force: +Adds adds a provision the law in force lacks— neither the law in force nor the text has it changed from the text before

Each text against the text before it: +Added in this text, not in the text before~Changed wording changed−Dropped drops a provision the text before added=Unchanged same as the text before— in neither text

Parliament amendments

27 amendments to this article

19 would delete the wording, 6 propose alternative wording and 2 would add wording.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DRenewECRPfEESNNI
− Deletion41143·9
~ Alternative4··12··
+ Addition·1···1·

By political group

  • − Deletion The Left 4 S&D 1 Renew 1 ECR 4 PfE 3 NI 9
  • ~ Alternative The Left 4 ECR 1 PfE 2
  • + Addition S&D 1 ESN 1

Show

Paragraph (2)Consent for storing or accessing personal data5 amendments

  1. 1677 Deletion Marina Kaljurand +8S&D · ITRE–LIBE Deletes the Commission’s wording

    Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.

    [...]

    Justification

    Replaced by an amended version of article 37.

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    EUDPR Article 37
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37
  2. 1678 Deletion Sebastian Tynkkynen +1ECR · ITRE–LIBE Deletes the Commission’s wording

    Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.

    [...]

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    EUDPR Article 37
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37
  3. 1679 Deletion Irena Joveva +5Renew · ITRE–LIBE Deletes the Commission’s wording

    Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.

    [...]

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    EUDPR Article 37
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37
  4. 1680 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (2) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

    Justification

    See Article 5(3) of Directive 2002/58/EC

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    EUDPR Article 37(2)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 2
  5. 1702 Addition Marina Kaljurand +8S&D · ITRE–LIBE “Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment 1. Storing of information…”

    Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.

    8a. Article 37 is replaced by the following

    Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment 1. Storing of information, or gaining of access to information already stored, in the terminal equipment including about its software and hardware, other than by the user concerned, shall be prohibited, except on the following grounds:

    (a)it is strictly necessary for the sole purpose of carrying out the transmission of an electronic communication over an electronic communications network;

    (b)the user has given their specific consent in accordance with this Regulation, or;

    (c)it is strictly technically necessary for providing an information society service specifically requested by the user;

    (d)it is technically necessary for maintaining or restoring the technical security of a service provided by the controller and requested by the user;

    (e)for the purpose of creating instant anonymous aggregated information about the usage of an online service requested by the user to measure the audience of such a service, where it is carried out by the provider of that online service requested by the user solely for its own use, or by a processor acting on behalf of this controller, solely for the controller’ own use and not further processed for any other purpose, not combined with data from other services from the provider of the online service, or from a third party, nor shared with any third party, or;

    (f)for the purpose of verifying the user’s past refusal to a request to consent without involving the use of a unique identifier or additional processing of personal data.

    2.Where storing of information, or gaining of access to information already stored, in the terminal equipment of a user is based on consent, the following shall apply:

    (a)the user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

    (b)if the user gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the user;

    (c)if the user declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of information based on consent.

    3.This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    EUDPR Article 37
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 a (new) / Regulation (EU) 2018/1725 / Article 37

Paragraph (3)Storage or access based on Union law2 amendments

  1. 1681 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (3) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

    Justification

    See Article 5(3) of Directive 2002/58/EC

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    EUDPR Article 37(3)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 3
  2. 1682 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “if it is exclusively related to and strictly necessary for: a) carrying out the transmission of an electronic communication over an electronic…”

    (3) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).This shall not prevent any technical storage or access and the corresponding processing of personal data if it is exclusively related to and strictly necessary for: a) carrying out the transmission of an electronic communication over an electronic communications network; b) providing a service explicitly requested by the subscriber or user; c) measuring the general audience of an online service requested by a subscriber or user in an immediately anonymised and aggregated form; d) maintaining or restoring the technical security of a service explicitly requested by the subscriber or user through strictly proportionate means; If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least six months. Refusing to give consent should not be more difficult than giving consent. Consent shall by default not be considered to be given in an informed and specific manner when the request for consent involves the disclosure of data to more than 10 controllers in a single action.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    EUDPR Article 37(3)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 3

Paragraph (4)Purposes allowed without consent2 amendments

  1. 1684 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (4) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

    Justification

    See Article 5(3) of Directive 2002/58/EC

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    EUDPR Article 37(4)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 4
  2. 1685 Deletion Pernando Barrena Arza +1The Left · ITRE–LIBE Deletes the Commission’s wording

    (4) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

    Tabled by
    Pernando Barrena Arza, João Oliveira
    Group
    The Left
    Targets
    EUDPR Article 37(4)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 4

Paragraph (5)Handling of consent requests7 amendments

  1. 494 Alternative Virginie JoronPfE · IMCO “only be valid if it is freely given, specific, informed and unambiguous, and takes the form of a statement or a clear affirmative action, in…”

    Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the consent shall only be valid if it is freely given, specific, informed and unambiguous, and takes the form of a statement or a clear affirmative action, in accordance with Article 4, point (11), and Article 7 of this Regulation, in accordance with Guidelines 05/2020 of the European Data Protection Board on consent. It must be as easy for the data subject to refuse or withdraw consent as it was to give consent, and any such refusal or withdrawal must be without detriment. The interface used to request, give, refuse or withdraw consent shall be designed, organised and used in accordance with Article 25 of Regulation (EU) 2022/2065 and must not deceive or manipulate the data subject or materially distort or impair his or her ability to make free and informed decisions.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    EUDPR Article 37(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5
  2. 1686 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (5) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

    Justification

    See Article 5(3) of Directive 2002/58/EC

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    EUDPR Article 37(5)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5
  3. 1687 Deletion Pernando Barrena Arza +1The Left · ITRE–LIBE Deletes the Commission’s wording

    (5) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

    Tabled by
    Pernando Barrena Arza, João Oliveira
    Group
    The Left
    Targets
    EUDPR Article 37(5)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5
  4. 1688 Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “comply with the principles of freedom, specificity, information, unambiguity, fair design, withdrawal and demonstrability, as defined in Regulation…”

    Where the storing of personal data, or the gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, thethat followingconsent shall apply:comply with the principles of freedom, specificity, information, unambiguity, fair design, withdrawal and demonstrability, as defined in Regulation (EU) 2016/679.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    EUDPR Article 37(5)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5
  5. 1689 Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    EUDPR Article 37(5)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5
  6. 1690 Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    EUDPR Article 37(5)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5
  7. 1691 Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    EUDPR Article 37(5)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5

Paragraph (6)Date of application of the Article4 amendments

  1. 1692 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (6) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

    Justification

    See Article 5(3) of Directive 2002/58/EC

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    EUDPR Article 37(6)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 6
  2. 1693 Deletion Pernando Barrena Arza +1The Left · ITRE–LIBE Deletes the Commission’s wording

    (6) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

    Tabled by
    Pernando Barrena Arza, João Oliveira
    Group
    The Left
    Targets
    EUDPR Article 37(6)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 6
  3. 1695 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “Give, refuse and withdraw”

    (a) give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;Give, refuse and withdraw consent through automated and machine-readable means, provided that such means allow specific and informed choices;

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    EUDPR Article 37
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 6 – point a
  4. 1696 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “object pursuant to Article 23(2)”

    (b) decline a request for consent through automated and machine-readable means.exercise the right to object pursuant to Article 23(2) through automated and machine-readable means.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    EUDPR Article 37
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 6 – point b

Paragraph (7)Automated and machine-readable consent choices1 amendment

  1. 1694 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (7) Controllers shall ensure that their online interfaces allow data subjects to: (a) give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent through automated and machine-readable means.

    Justification

    Content already provided for by Article 23(3) of this Regulation.

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    EUDPR Article 37(7)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 7

Paragraph (8)Respect for data subjects’ choices2 amendments

  1. 1697 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (8) Controllers shall respect the choices made by data subjects in accordance with paragraph 7.

    Justification

    Content already provided for by Article 23(3) of this Regulation.

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    EUDPR Article 37(8)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 8
  2. 1698 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “disclose the purposes for which they request consent or where a data subject can object through automated and machine-readable means and be”

    (8) Controllers shall disclose the purposes for which they request consent or where a data subject can object through automated and machine-readable means and be respect the choices made by data subjects in accordance with paragraph 7.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    EUDPR Article 37(8)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 8

Paragraph (9)Presumption of conformity with harmonised standards1 amendment

  1. 1699 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (9) Online interfaces of controllers which are in conformity with harmonised standards or parts thereof referred to in paragraph 4 of Article 88b of Regulation (EC) 2016/679 shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 7.

    Justification

    Content already provided for by Article 23(3) of this Regulation.

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    EUDPR Article 37(9)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 9

Paragraph (10)Later application of paragraphs 7 to 92 amendments

  1. 1700 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (10) Paragraphs 7 to 9 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    EUDPR Article 37(10)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 10
  2. 1701 Deletion Pernando Barrena Arza +1The Left · ITRE–LIBE Deletes the Commission’s wording

    (10) Paragraphs 7 to 9 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

    Tabled by
    Pernando Barrena Arza, João Oliveira
    Group
    The Left
    Targets
    EUDPR Article 37(10)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 10

New paragraphs1 amendment

  1. 1683 Addition Mary KhanESN · ITRE–LIBE “This article may not be interpreted as a legal basis for accessing the content of electronic communication, for weakening, circumventing or…” numbered 3a

    (3a) In Article 37 the following paragraph 3a is inserted:

    This article may not be interpreted as a legal basis for accessing the content of electronic communication, for weakening, circumventing or preventing end-to-end encryption, for performing client-side scanning, for gaining covert access to terminal equipment, or for performing device fingerprinting or cross-service tracking. Interference with the terminal equipment of natural persons by Union bodies or institutions shall require a specific legal basis and shall be subject to prior, independent judicial control.’

    Justification

    EU bodies must respect secure communication and may not reinterpret the provisions on cookies and terminal equipment for monitoring purposes.

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    EUDPR Article 37 – paragraph 3 a (new)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 3 a (new)