Article 88d

'Article 88d

Processing in the context of the provision of audiovisual media services of general interest

Where the processing of personal data, including the storage of or access to personal data already stored in the terminal equipment of a natural person, is necessary for the delivery and audience measurement of both programmes and advertising provided by audiovisual media services of general interest, as referred to in Article 7a of Directive 2010/13/EU, such processing shall be carried out on the basis of legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679. This shall apply except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, in particular where the data subject is a child.

Any such processing shall be subject to appropriate organisational and technical measures, as well as safeguards to protect the rights and freedoms of the data subject. These measures and safeguards shall be set out in a sectoral code of conduct established in accordance with Article 40(2)(b) of Regulation (EU) 2016/679 and approved pursuant to Article 40(5) thereof.

'Article 88d

1.The Commission and the European Data Protection Board shall develop voluntary, standardised and machine-readable templates tailored to SMEs for the fulfilment of information, documentation and notification obligations under this Regulation.

2.Supervisory authorities shall provide accessible and proportionate guidance channels for SMEs, taking due account of their administrative and financial capacity when determining practical compliance measures.

3.The measures referred to in paragraphs 1 and 2 shall be without prejudice to the responsibility of controllers and processors to comply with this Regulation.

Article 88d Processing of personal data in industrial operational environments

1.Where personal data are generated or collected by industrial machinery, industrial equipment, production systems or industrial internet-of-things devices in the course of their operation in an industrial operational environment, and are processed by a controller or processor solely for the purposes of operating, maintaining, monitoring, improving or securing such machinery, equipment, systems or devices, Articles 15 to 22, Article 30 and Article 35 shall not apply, provided that the conditions laid down in paragraph 2 are met.

2.Paragraph 1 shall apply only where the controller or processor, as applicable, implements appropriate technical and organisational measures to ensure that the personal data are pseudonymised, or that any identifiers that are not strictly needed for the purposes described in paragraph 1 are removed, and are not processed for the purpose of evaluating the performance, behaviour or conduct of an identified or identifiable natural person, and are not used to take a decision producing legal effects concerning a data subject or similarly significantly affecting him or her within the meaning of Article 22(1).

3.This Article shall not apply to the processing of special categories of personal data referred to in Article 9(1), nor to personal data relating to criminal convictions and offences referred to in Article 10.