Article 88a

Article 88a

Justification

Deletion applies to all of Article 88a (paragraphs 1-5).

Article 88a

Article 88a

Article 88a

Justification

Deletion of new article 88a

Article 88a

Article 88a

Justification

Article 88a moved back to the ePrivacy Directive

Article 88a

Processing of personal data in the terminal equipment of natural persons

Processing of personal data in the terminal equipment of natural persons

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a naturaldata personsubject, and any subsequent processing necessary to achieve the purpose for which the data subject has given consent is only allowed when that person has given his or her consent, in accordance with this Regulation.

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where such processing is onlycarried allowed when that person has given his or her consent,out in accordance with this Regulation and on the basis of Article 6 of this Regulation.

(1) Storing of personal data, or gaining of access to personal data already stored, in thea terminal equipment, ofand asubsequent natural personprocessing is only allowed when that person has given his or her consent, in accordance with this Regulation.

(1a) In Article 88a, the following paragraph 1a is inserted:

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1), provided that any such measure is necessary and proportionate and does not require the general identification of users, nor the weakening of anonymity, encryption or other protective tools on which users, including journalists, activists and other persons at risk, rely.

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6 and, where applicable, Article 9, including applicable obligations of professional secrecy to safeguard the objectives referred to in Article 23(1).

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in thea terminal equipment, ofand asubsequent natural personprocessing, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6(3), to safeguard the objectives referred to in Article 23(1).

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a naturaldata personsubject, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

In Article 88a, the following paragraph 2a is inserted:

Justification

Secure communication is a civil right. The rules governing terminal devices and cookies must never create a back door for content control or for making encryption technically weaker.

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

(3) Storing of personal data, or gaining of access to personal data already stored, in thea terminal equipment of a natural person without consent, and subsequent processing, shall solely be lawful to the extent it is strictly necessary for any of the following purposes:

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a naturaldata personsubject without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

(aa) In Article 88a, paragraph 3, the following point aa is inserted

(b) providing a service explicitly requested by the data subject, where the personal data processed remains strictly limited to what is necessary for the provision of a specific an identifiable service;

(b) providing a service or the maintenance of a user session explicitly requested by the data subject;

(ba) In Article 88a, paragraph 3, the following point ba is inserted

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

(c) creatingmeasuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);

(c) Immediately creating anonymous aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use and does not enable the identification, tracking or profiling of data subjects;

(c) creating aggregated, anonymised information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use, provided that such information is not further processed for another purpose;

(c) creating aggregated information about the usage of an online service tosolely measurefor the audienceuse of such a service, where it is carried out by the controllerprovider of that online service solely for its own use;

(c) (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out byat the direction of the controller of that online service, serviceor solelyby fora itsthird ownparty useacting on behalf of the controller;

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;measure the audience as defined in article 2(16) of Regulation 2024/1083, where it is carried out by the provider of that online service, or by a joint controller or processor mandated by the provider of that online service;

Justification

This amendment ensures legal clarity by aligning the text with the EMFA definition of audience measurement and allowing mandated joint controllers or processors to carry it out. This safeguards independent, comparable and verifiable measurement, while enabling the use of aggregated market statistics for transparency and fair competition.

(c) creating aggregated information about the usage of an online service to measuremeasuring the audience of suchan aonline service, where it is carried out by the controller of that online service solely for its own use, or by a third party acting on behalf of the controller;

(ca) In Article 83, paragraph 3, the following point ca is inserted:

(d) maintaining or restoring the security, integrity and functioning of a service provided by the controller and requested by the data subject or the security of the terminal equipment used for the provision of such service., including detecting, preventing or mitigating fraud, automated or non-human traffic, unauthorised access, misuse of the service, circumvention of technical access conditions, or other uses that are contrary to the provider’s terms and conditions

(d) maintaining, restoring or restoringensuring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service., including in particular cybersecurity, the protection of personal data and privacy of the user and prevention of fraud and unauthorised access provided that such measures do not override the fundamental rights and interests of the subscriber or user;

(d) demonstrably and proportionally maintaining or restoring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

(d) maintaining or restoring the security and integrity of a service provided by the controller, andincluding requestedfraud by the data subjectprevention or technical incidents, of the terminal equipment used for the provision of such service.

(d) maintaining or restoring the integrity and security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

(da) In Article 88a, paragraph 3, the following point da is added

(da) In Article 88a, paragraph 3, the following point da is added

Justification

New exemptions are suggested concerning activities that are not based on profiling, i.e. covering low‑risk to the rights and freedoms, non‑profiling activities that do not involve any retention of personal data beyond the user’s active session nor any link to past or future behaviour. This suggestion is inspired by the EDPB/EDPS joint opinion aimed to to create incentives to use less‑intrusive forms of online advertising and to make the rules more proportionate, i.e. allowing some forms of targeted advertising, which is crucial for European publishers and service providers.

(da) In Article 88a, paragraph 3, the following point da is added

(da) In Article 88a, paragraph 3, the following point da is added

(da) In Article 88a, paragraph 3, the following sentence is added

(da) In Article 88a, paragraph 3, the following point da is added

(da) In Article 88a, paragraph 3, the following point da is added

(db) In Article 88a, paragraph 3, the following point db is added

(db) In Article 88a, paragraph 3, the following point db is inserted

(db) In Article 88a, paragraph 3, the following point db is added

(dc) In Article 88a, paragraph 3, the following point dc is added

(3a) In Article 88a, the following paragraph 3a is added:

(3a) In Article 88a, the following paragraph 3a is added:

(3b) In Article 88a, the following paragraph 3b is added:

Justification

The storing of, or access to, information in terminal equipment pursuant to Article 88a is without prejudice to Directive 2002/58/EC, which continues to apply in full, and in particular to the confidentiality of communications and of the related traffic data, the protection of traffic and location data, the safeguards against unsolicited communications, and the powers of Member States under Article 15(1). Without this clause, the transfer of the terminal regime to the GDPR could be read as an implicit repeal of the ePrivacy protections which survive it.

(3c) In Article 88a, the following paragraph 3c is added:

Justification

Information relating to other natural persons stored in the terminal equipment of a user, such as contact details, constitutes personal data of those persons. Consent given by the user does not constitute consent by the persons to whom that information relates, nor a legal basis for any further processing of their data. Such information may not be transmitted to third parties nor used for purposes other than those strictly necessary for the service explicitly requested.

(3d) In Article 88a, the following paragraph 3d is added:

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

Where storing of personal data, or gaining of access to personal data already stored, in thea terminal equipment of a natural person is based on consent, the following shall apply without processing more personal data in line with Article 11:

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following principles shall apply:

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a naturaldata personsubject is based on consent, the following shall apply:

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a single-clickpaid button or equivalent meansalternative;

(a) the data subject shall be able to refuse or withdraw requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(a) the data subject shall be able to refuse or accept requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully or technically rely on the consent of the data subject;

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. Information about declined requests may be stored and accessed lawfully in the terminal equipment provided that such information does not contain personal data nor unique identifiers and is used only for determining when consent was refused.

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months unless a substantial change in circumstances, in the purposes of the processing or in the safeguards afforded to the data subject justifies a new request.

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.Where data subject refuse request for consent presented by media service providers, Media service providers shall be able to offer data subjects an equivalent alternative that is not accompanied by the processing of personal data for audience-based advertising purposes, where appropriate for a reasonable fee.

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108.

In Article 88a, paragraph 4, points a, b, c, d are replaced by the following:

Justification

avoid hard-coded consent UX mandates sources guidelines EDPB 05/2020

This paragraph also applies to the subsequent processing of personal data based on consent.

(4a) In Article 88a, the following paragraph 4a is inserted:

(4a) In Article 88a, the following paragraph 4a is inserted:

(5) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]