Article 37 – Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment
Text as printed
Article 37(2) In every text (Article 37(2))
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.
Article 37(3) In every text (Article 37(3))
Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).
Article 37(4) In every text (Article 37(4))
Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.
Article 37(5) In every text (Article 37(5))
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.
Article 37(6) In every text (Article 37(6))
This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]
Article 37(7) In every text (Article 37(7))
Controllers shall ensure that their online interfaces allow data subjects to: (a) give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent through automated and machine-readable means.
Article 37(8) In every text (Article 37(8))
Controllers shall respect the choices made by data subjects in accordance with paragraph 7.
Article 37(9) In every text (Article 37(9))
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof referred to in paragraph 4 of Article 88b of Regulation (EC) 2016/679 shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 7.
Article 37(10) In every text (Article 37(10))
Paragraphs 7 to 9 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].
Cross-referenceSource cites “Regulation (EC) 2016/679”; the GDPR is Regulation (EU) 2016/679.