Article 37 – Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing for the same purpose, shall be lawful to the extent it is strictly necessary for any of the following purposes:

carrying out the transmission of an electronic communication over an electronic communications network;

providing a service, including its functionality, explicitly requested by the data subject;

creating aggregated information about the usage of an online service to measure the audience of that service, provided that it is carried out by the provider of the service requested by the subscriber or user, or by a third party on behalf of that provider, and the data collected for the purpose of aggregating the information is not shared with third parties nor combined with data from third parties;

performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083, provided that personal data are pseudonymised immediately after collection, and that any information shared with third parties other than those acting either on behalf of or jointly together with that provider does not contain personal data;

maintaining or restoring the technical security of the means strictly necessary for the provision of an information society service requested by the subscriber or user or the technical security of the terminal equipment used for the provision of such service;

measuring the display and performance of advertising that is based solely on the immediate content displayed during an individual visit to a single web page or on the basis of a single search query, provided that such measurement does not involve profiling, data retention or any link with the past or future activity of the subscriber or user, where such measurement is carried out by the provider of an online service, including jointly with others, or by a third party on behalf of that provider.

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

if the data subject refuses a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation].

This Council draft drops the change the Commission proposed. It deletes nothing from the law in force.