Research

Digital Omnibus tracker

EU institutions data protection regulation · Regulation (EU) 2018/1725

Article 37

Compare the available Commission, Council and Parliament texts and amendments affecting this article.

Article total: 10 parts · 3 Council drafts · 27 Parliament amendments

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to EU institutions data protection regulation

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 23 October 2018, with all 9 Commission proposal changes affecting this article applied.

Article 37

Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment

  1. Union institutions and bodies shall protect the information transmitted to, stored in, related to, processed by and collected from the terminal equipment of users accessing their publicly available websites and mobile applications, in accordance with Article 5(3) of Directive 2002/58/EC.

  2. 2.

    Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

  3. 3.

    Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

  4. 4.

    Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

    1. (a)

      carrying out the transmission of an electronic communication over an electronic communications network;

    2. (b)

      providing a service explicitly requested by the data subject;

    3. (c)

      creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

    4. (d)

      maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

  5. 5.

    Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

    1. (a)

      the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

    2. (b)

      if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

    3. (c)

      if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

  6. 6.

    This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

  7. 7.

    Controllers shall ensure that their online interfaces allow data subjects to:

    1. (a)

      give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;

    2. (b)

      decline a request for consent through automated and machine-readable means.

  8. 8.

    Controllers shall respect the choices made by data subjects in accordance with paragraph 7.

  9. 9.

    Online interfaces of controllers which are in conformity with harmonised standards or parts thereof referred to in paragraph 4 of Article 88b of Regulation (EC) 2016/679 shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 7.

  10. 10.

    Paragraphs 7 to 9 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

Commission source wording and instructions

Article 37(2)

Commission proposal

(2) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

Article 37(3)

Commission proposal

(3) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

Article 37(4)

Commission proposal

(4) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

Article 37(5)

Commission proposal

(5) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Article 37(6)

Commission proposal

(6) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

Article 37(7)

Commission proposal

(7) Controllers shall ensure that their online interfaces allow data subjects to: (a) give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent through automated and machine-readable means.

Article 37(8)

Commission proposal

(8) Controllers shall respect the choices made by data subjects in accordance with paragraph 7.

Article 37(9)

Commission proposal

(9) Online interfaces of controllers which are in conformity with harmonised standards or parts thereof referred to in paragraph 4 of Article 88b of Regulation (EC) 2016/679 shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 7.

Article 37(10)

Commission proposal

(10) Paragraphs 7 to 9 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

View full Council comparison →

Article 37(2)

June Presidency compromise · 10 June

(2) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

Article 37(3)

June Presidency compromise · 10 June

(3) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

Article 37(4)

June Presidency compromise · 10 June

Council wording reconstructed for this provision from the official operation

(4)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

(a)

carrying out the transmission of an electronic communication over an electronic communications network;

(b)

providing a service explicitly requested by the data subject and ensuring functionality of the requested service; (c) Measuring the audience of an online service in order to create anonymous aggregated information about the usage of that online service, where it is carried out by the controller of that online service, or by a third party acting together with or on behalf of this provider, including where the third party is an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083; (d) maintaining or restoring the security of the interface strictly necessary for the provision of an information society service requested by the user or the security of the terminal equipment used for the provision of such service;

(e)

preventing or detecting fraud provided that such measures do not override the fundamental rights and interests of the data subject.

Article 37(5)

June Presidency compromise · 10 June

(5) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Article 37(6)

June Presidency compromise · 10 June

(6) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

Article 37(7)

June Presidency compromise · 10 June

Exact provision wording unavailable within a wider Council operation

This provision forms part of a wider Council operation. Its wording is not available separately here; open the official source for the full passage.

Official source passage and amending instruction
8.

In Article 37 the following paragraphs are added:

‘(2)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

(3)

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

(4)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

(a)

carrying out the transmission of an electronic communication over an electronic communications network;

(b)

providing a service explicitly requested by the data subject and ensuring functionality of the requested service; (c) Measuring the audience of an online service in order to create anonymous aggregated information about the usage of that online service, where it is carried out by the controller of that online service, or by a third party acting together with or on behalf of this provider, including where the third party is an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083; (d) maintaining or restoring the security of the interface strictly necessary for the provision of an information society service requested by the user or the security of the terminal equipment used for the provision of such service;

(e)

preventing or detecting fraud provided that such measures do not override the fundamental rights and interests of the data subject.

(5)

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

(a)

the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(b)

if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

(c)

if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(6)

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

Article 37(8)

June Presidency compromise · 10 June

Exact provision wording unavailable within a wider Council operation

This provision forms part of a wider Council operation. Its wording is not available separately here; open the official source for the full passage.

Official source passage and amending instruction
8.

In Article 37 the following paragraphs are added:

‘(2)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

(3)

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

(4)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

(a)

carrying out the transmission of an electronic communication over an electronic communications network;

(b)

providing a service explicitly requested by the data subject and ensuring functionality of the requested service; (c) Measuring the audience of an online service in order to create anonymous aggregated information about the usage of that online service, where it is carried out by the controller of that online service, or by a third party acting together with or on behalf of this provider, including where the third party is an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083; (d) maintaining or restoring the security of the interface strictly necessary for the provision of an information society service requested by the user or the security of the terminal equipment used for the provision of such service;

(e)

preventing or detecting fraud provided that such measures do not override the fundamental rights and interests of the data subject.

(5)

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

(a)

the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(b)

if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

(c)

if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(6)

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

Article 37(9)

June Presidency compromise · 10 June

Exact provision wording unavailable within a wider Council operation

This provision forms part of a wider Council operation. Its wording is not available separately here; open the official source for the full passage.

Official source passage and amending instruction
8.

In Article 37 the following paragraphs are added:

‘(2)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

(3)

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

(4)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

(a)

carrying out the transmission of an electronic communication over an electronic communications network;

(b)

providing a service explicitly requested by the data subject and ensuring functionality of the requested service; (c) Measuring the audience of an online service in order to create anonymous aggregated information about the usage of that online service, where it is carried out by the controller of that online service, or by a third party acting together with or on behalf of this provider, including where the third party is an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083; (d) maintaining or restoring the security of the interface strictly necessary for the provision of an information society service requested by the user or the security of the terminal equipment used for the provision of such service;

(e)

preventing or detecting fraud provided that such measures do not override the fundamental rights and interests of the data subject.

(5)

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

(a)

the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(b)

if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

(c)

if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(6)

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

Article 37(10)

June Presidency compromise · 10 June

Exact provision wording unavailable within a wider Council operation

This provision forms part of a wider Council operation. Its wording is not available separately here; open the official source for the full passage.

Official source passage and amending instruction
8.

In Article 37 the following paragraphs are added:

‘(2)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

(3)

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

(4)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

(a)

carrying out the transmission of an electronic communication over an electronic communications network;

(b)

providing a service explicitly requested by the data subject and ensuring functionality of the requested service; (c) Measuring the audience of an online service in order to create anonymous aggregated information about the usage of that online service, where it is carried out by the controller of that online service, or by a third party acting together with or on behalf of this provider, including where the third party is an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083; (d) maintaining or restoring the security of the interface strictly necessary for the provision of an information society service requested by the user or the security of the terminal equipment used for the provision of such service;

(e)

preventing or detecting fraud provided that such measures do not override the fundamental rights and interests of the data subject.

(5)

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

(a)

the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(b)

if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

(c)

if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(6)

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

More filters

Alternative wording Amendment 494 · Virginie Joron IMCO
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the followingconsent shall apply:only be valid if it is freely given, specific, informed and unambiguous, and takes the form of a statement or a clear affirmative action, in accordance with Article 4, point (11), and Article 7 of this Regulation, in accordance with Guidelines 05/2020 of the European Data Protection Board on consent. It must be as easy for the data subject to refuse or withdraw consent as it was to give consent, and any such refusal or withdrawal must be without detriment. The interface used to request, give, refuse or withdraw consent shall be designed, organised and used in accordance with Article 25 of Regulation (EU) 2022/2065 and must not deceive or manipulate the data subject or materially distort or impair his or her ability to make free and informed decisions.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5

Remove proposed wording Amendment 1677 · Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec ITRE · LIBE

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 37

[...]
Justification

Replaced by an amended version of article 37.

Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1678 · Sebastian Tynkkynen, Diego Solier ITRE · LIBE

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 37

[...]
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1679 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 37

[...]
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1680 · Sibylle Berg, Martin Sonneborn ITRE · LIBE
(2) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
Justification

See Article 5(3) of Directive 2002/58/EC

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 2

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1681 · Sibylle Berg, Martin Sonneborn ITRE · LIBE
(3) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).
Justification

See Article 5(3) of Directive 2002/58/EC

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 3

Deletion marker printed in the source: deleted

Alternative wording Amendment 1682 · Pernando Barrena Arza ITRE · LIBE
(3) ParagraphThis 1 doesshall not precludeprevent storingany technical storage or access and the corresponding processing of personal data, if it is exclusively related to and strictly necessary for: a) carrying out the transmission of an electronic communication over an electronic communications network; b) providing a service explicitly requested by the subscriber or gaininguser; c) measuring the general audience of accessan toonline personalservice datarequested alreadyby stored,a subscriber or user in an immediately anonymised and aggregated form; d) maintaining or restoring the terminaltechnical equipmentsecurity of a naturalservice person,explicitly basedrequested on Union law withinby the meaningsubscriber or user through strictly proportionate means; If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of, at least six months. Refusing to give consent should not be more difficult than giving consent. Consent shall by default not be considered to be given in an informed and subjectspecific manner when the request for consent involves the disclosure of data to themore conditionsthan of10 Article 5, to safeguard the objectives referred tocontrollers in Articlea 25(1)single action.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 3

Additional proposed wording Amendment 1683 · Mary Khan ITRE · LIBE

(3a) In Article 37 the following paragraph 3a is inserted:

This article may not be interpreted as a legal basis for accessing the content of electronic communication, for weakening, circumventing or preventing end-to-end encryption, for performing client-side scanning, for gaining covert access to terminal equipment, or for performing device fingerprinting or cross-service tracking. Interference with the terminal equipment of natural persons by Union bodies or institutions shall require a specific legal basis and shall be subject to prior, independent judicial control.’

Justification

EU bodies must respect secure communication and may not reinterpret the provisions on cookies and terminal equipment for monitoring purposes.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 3 a (new)

Remove proposed wording Amendment 1684 · Sibylle Berg, Martin Sonneborn ITRE · LIBE
(4) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
Justification

See Article 5(3) of Directive 2002/58/EC

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 4

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1685 · Pernando Barrena Arza, João Oliveira ITRE · LIBE
(4) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 4

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1686 · Sibylle Berg, Martin Sonneborn ITRE · LIBE
(5) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
Justification

See Article 5(3) of Directive 2002/58/EC

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1687 · Pernando Barrena Arza, João Oliveira ITRE · LIBE
(5) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5

Deletion marker printed in the source: deleted

Alternative wording Amendment 1688 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
Where the storing of personal data, or the gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, thethat followingconsent shall apply:comply with the principles of freedom, specificity, information, unambiguity, fair design, withdrawal and demonstrability, as defined in Regulation (EU) 2016/679.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5

Remove proposed wording Amendment 1689 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1690 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1691 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 5

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1692 · Sibylle Berg, Martin Sonneborn ITRE · LIBE
(6) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]
Justification

See Article 5(3) of Directive 2002/58/EC

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 6

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1693 · Pernando Barrena Arza, João Oliveira ITRE · LIBE
(6) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 6

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1694 · Sibylle Berg, Martin Sonneborn ITRE · LIBE
(7) Controllers shall ensure that their online interfaces allow data subjects to: (a) give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent through automated and machine-readable means.
Justification

Content already provided for by Article 23(3) of this Regulation.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 7

Deletion marker printed in the source: deleted

Alternative wording Amendment 1695 · Pernando Barrena Arza ITRE · LIBE
(a) giveGive, refuse and withdraw consent through automated and machine-readable means, provided that thesuch conditionsmeans forallow consentspecific laidand downinformed in this Regulation are fulfilledchoices;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 6 – point a

Alternative wording Amendment 1696 · Pernando Barrena Arza ITRE · LIBE
(b) declineexercise athe requestright forto consentobject pursuant to Article 23(2) through automated and machine-readable means.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 6 – point b

Remove proposed wording Amendment 1697 · Sibylle Berg, Martin Sonneborn ITRE · LIBE
(8) Controllers shall respect the choices made by data subjects in accordance with paragraph 7.
Justification

Content already provided for by Article 23(3) of this Regulation.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 8

Deletion marker printed in the source: deleted

Alternative wording Amendment 1698 · Pernando Barrena Arza ITRE · LIBE
(8) Controllers shall disclose the purposes for which they request consent or where a data subject can object through automated and machine-readable means and be respect the choices made by data subjects in accordance with paragraph 7.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 8

Remove proposed wording Amendment 1699 · Sibylle Berg, Martin Sonneborn ITRE · LIBE
(9) Online interfaces of controllers which are in conformity with harmonised standards or parts thereof referred to in paragraph 4 of Article 88b of Regulation (EC) 2016/679 shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 7.
Justification

Content already provided for by Article 23(3) of this Regulation.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 9

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1700 · Sibylle Berg, Martin Sonneborn ITRE · LIBE
(10) Paragraphs 7 to 9 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 10

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1701 · Pernando Barrena Arza, João Oliveira ITRE · LIBE
(10) Paragraphs 7 to 9 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 / Regulation (EU) 2018/1725 / Article 37 – paragraph 10

Deletion marker printed in the source: deleted

Additional proposed wording Amendment 1702 · Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec ITRE · LIBE

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 37

8a. Article 37 is replaced by the following

Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment 1. Storing of information, or gaining of access to information already stored, in the terminal equipment including about its software and hardware, other than by the user concerned, shall be prohibited, except on the following grounds:

(a)

it is strictly necessary for the sole purpose of carrying out the transmission of an electronic communication over an electronic communications network;

(b)

the user has given their specific consent in accordance with this Regulation, or;

(c)

it is strictly technically necessary for providing an information society service specifically requested by the user;

(d)

it is technically necessary for maintaining or restoring the technical security of a service provided by the controller and requested by the user;

(e)

for the purpose of creating instant anonymous aggregated information about the usage of an online service requested by the user to measure the audience of such a service, where it is carried out by the provider of that online service requested by the user solely for its own use, or by a processor acting on behalf of this controller, solely for the controller’ own use and not further processed for any other purpose, not combined with data from other services from the provider of the online service, or from a third party, nor shared with any third party, or;

(f)

for the purpose of verifying the user’s past refusal to a request to consent without involving the use of a unique identifier or additional processing of personal data.

2.

Where storing of information, or gaining of access to information already stored, in the terminal equipment of a user is based on consent, the following shall apply:

(a)

the user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(b)

if the user gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the user;

(c)

if the user declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of information based on consent.

3.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 8 a (new) / Regulation (EU) 2018/1725 / Article 37