### sustainable infrastructure policy window : comprises sustainable investment in the areas of transport , energy , digital connectivity , supply and processing of raw materials , space , oceans and water , waste , nature and other environment infrastructure , equipment , mobile assets and deployment of innovative technologies that contribute to the environmental or social sustainability objectives of the union , or to both , or meet the environmental or social sustainability standards of the union ; ### sustainable infrastructure policy window : comprises sustainable investment in the areas of transport and logistics , energy , digital and broadband connectivity , tourism , supply and processing of raw materials , space , oceans and water , waste , nature and other environment infrastructure , equipment , mobile assets and deployment of innovative technologies that contribute to the environmental or social sustainability objectives of the union , or to both , or meet the environmental or social sustainability standards of the union ;


### the delegation of power referred to in articles 15 and , articles 19 , 21 and 23 and shall be conferred on the commission for an indeterminate period of time from . ### the power to adopt delegated acts referred to in articles 15 and , articles 19 , 21 and 23 and shall be conferred on the commission for a period of five years from . the commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five - year period . the delegation of power shall be tacitly extended for periods of an identical duration , unless the european parliament or the council opposes such extension not later than three months before the end of each period .


### ‘ navigation time’ means the time that deck crew members spent aboard during a journey performed by a vessel on inland waterways and validated by the competent authority ; ### ‘ navigation time’ means the time that deck crew members spent aboard during a journey performed by a vessel on inland waterways , including time spent training on a simulator approved under article 19 , which period may not exceed one - quarter of the total time , and validated by the competent authority ;


### within one year of the entry into force of this directive , the commission shall gradually adopt delegated acts setting up : ### within one year of the entry into force of this directive , the commission shall gradually adopt delegated and implementing acts setting up :


### the delegation of power referred to in articles 15 and , articles 19 , 21 and 23 and shall be conferred on the commission for an indeterminate period of time from . ### the power to adopt delegated acts referred to in articles 8 , 15 and , articles 19 , 21 and 23 and shall be conferred on the commission for a period of five years from . the commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five - year period . the delegation of power shall be tacitly extended for periods of an identical duration , unless the european parliament or the council opposes such extensions not later than six months before the end of each period .


### the commission shall ensure the financial management of the fund . the commission shall manage and invest the resources of the guarantee fund in accordance with the principle of sound financial management and shall follow appropriate prudential rules . ’ ### the commission shall ensure the financial management of the fund in accordance with this regulation and with the internal rules and procedures of the fund . in addition , the commission shall manage and invest the resources of the guarantee fund in accordance with the principle of sound financial management and shall follow appropriate prudential rules , while taking into account the principles guiding the union ' s external action . the commission shall explain to the european parliament how the management of the fund is embedded in its broader development strategy . ’


### the financial management of the guarantee fund should be transferred from the eib to the commission , which has an established practice of managing similar investments . by taking over the asset management of the guarantee fund , the commission should be able to streamline and consolidate its asset management activities , building on existing structures and a good track record . ### the financial management of the guarantee fund should be transferred from the eib to the commission , which has an established practice of managing similar investments . by taking over the asset management of the guarantee fund , the commission should be able to further streamline and consolidate its asset management activities as well as to coordinate all external financing aspects of the european agenda on migration , building on existing structures and further strengthening its track record . the transfer of management should lead to cost savings for the union budget and better and more accurate information about the management and situation of the guarantee fund provided by the commission to the european parliament .


### the financial management of the guarantee fund should be transferred from the eib to the commission , which has an established practice of managing similar investments . by taking over the asset management of the guarantee fund , the commission should be able to streamline and consolidate its asset management activities , building on existing structures and a good track record . ### the possibility of transferring the financial management of the guarantee fund from the eib to the commission should be evaluated in terms of associated costs and benefits in order to ensure maximum efficiency of the use of union financial resources in view of the post - 2020 multiannual financial framework .


### the first subparagraph shall not apply to cases of non - compliance with the eligibility conditions for individual beneficiaries laid down in the national cap strategic plans and national rules . ### the first subparagraph shall not extend to cases of non - compliance with the eligibility conditions for individual beneficiaries laid down in the national cap strategic plans and national rules .


### for the purposes of article 127 of the financial regulation , the commission shall take assurance from the work of the certification bodies referred to in article 11 of this regulation , unless it has informed the member state that it cannot rely on the work of the certification body for a given financial year , and it shall take it into account in its risk assessment of the need for commission audits in the member state concerned . ### for the purposes of article 127 of the financial regulation , the commission may take assurance from the work of the certification bodies referred to in article 11 of this regulation , unless it has informed the member state that it cannot rely on the work of the certification body for a given financial year , and it shall take it into account in its risk assessment of the need for commission audits in the member state concerned .


### the expenditure for the measures laid down in regulation no 1308 / 2013 for which reimbursement has been requested from the commission is legal and regular . ; ### the expenditure for the measures laid down in regulation no 1308 / 2013 for which reimbursement has been requested from the commission for the measures laid down in regulation no 1308 / 2013 , regulation no 228 / 2013 , regulation no 229 / 2013 and regulation 1144 / 2014 is legal and regular ;


### member states shall record and keep any data and documentation on the annual outputs reported in the context of the annual performance clearance as referred to in article 52 , and the reported progress towards targets as set out in the cap strategic plan and monitored in accordance with article 115 of regulation … / … [ cap strategic plan regulation ] . ### member states shall record and keep any data and documentation on the annual outputs which are reported in the context of the annual performance clearance as referred to in article 52 , and the progress reported towards targets as set out in the cap strategic plan and monitored in accordance with article 115 of regulation … / … [ cap strategic plan regulation ] .


### member states shall ensure that qualified entities are entitled to bring representative actions seeking measures eliminating the continuing effects of the infringement . these measures shall be sought on the basis of any final decision establishing that a practice constitutes an infringement of union law listed in annex i harming collective interests of consumers , including a final injunction order referred to in paragraph . ### member states shall ensure that only entities qualified for article 6 measures are entitled to bring representative actions seeking a declaratory decision regarding the liability of the trader towards the consumers harmed by an infringement of union law listed in annex i .


### ‘ collective interests of consumers’ means the interests of a number of consumers ; ### ‘ collective interests of consumers’ means the general interest of consumers independent of the number of consumers concerned by the case in question ;


### to increase the procedural effectiveness of representative actions , qualified entities should have the possibility to seek different measures within a single representative action or within separate representative actions . these measures should include interim measures for stopping an ongoing practice or prohibiting a practice in case the practice has not been carried out but there is a risk that it would cause serious or irreversible harm to consumers , measures establishing that a given practice constitutes an infringement of law and , if necessary , stopping or prohibiting the practice for the future , as well as measures eliminating the continuing effects of the infringement , including redress . if sought within a single action , qualified entities should be able to seek all relevant measures at the moment of bringing the action or first seek relevant injunctions order and subsequently and if appropriate redress order . ### to increase the procedural effectiveness of representative actions , qualified entities should have the possibility to seek different measures within a single representative action or within separate representative actions . these measures should include interim measures for stopping an ongoing practice or prohibiting a practice in case the practice has not been carried out but there is a risk that it would cause serious or irreversible harm to consumers , measures establishing that a given practice constitutes an infringement of law and , if necessary , stopping or prohibiting the practice for the future , as well as measures eliminating the continuing effects of the infringement . if sought within a single action , qualified entities should be able to seek all relevant measures at the moment of bringing the action or first seek relevant injunctions order and subsequently and if appropriate declaratory order .


### the qualified entity seeking a redress order as referred in article 6 shall declare at an early stage of the action the source of the funds used for its activity in general and the funds that it uses to support the action . it shall demonstrate that it has sufficient financial resources to represent the best interests of the consumers concerned and to meet any adverse costs should the action fail . ### the entity qualified for article 5 actions shall declare at the stage of admissibility of the action if it uses any funds to support the representative action . it shall demonstrate that it has sufficient financial resources to represent the best interests of the consumers concerned and to meet any adverse costs should the action fail .


### as only qualified entities can bring the representative actions , to ensure that the collective interests of consumers are adequately represented the qualified entities should comply with the criteria established by this directive . in particular , they would need to be properly constituted according to the law of a member state , which could include for example requirements regarding the number of members , the degree of permanence , or transparency requirements on relevant aspects of their structure such as their constitutive statutes , management structure , objectives and working methods . they should also be not for profit and have a legitimate interest in ensuring compliance with the relevant union law . these criteria should apply to both qualified entities designated in advance and to ad hoc qualified entities that are constituted for the purpose of a specific action . ### as only qualified entities can bring the representative actions , to ensure that the collective interests of consumers are adequately represented the qualified entities should comply with the criteria established by this directive .


### ensuring that consumers are informed about a representative action is crucial for its success . consumers should be informed of ongoing representative action , the fact that a trader ' s practice has been considered as a breach of law , their rights following the establishment of an infringement and any subsequent steps to be taken by consumers concerned , particularly for obtaining redress . the reputational risks associated with spreading information about the infringement are also important for deterring traders infringing consumer rights . ### ensuring that consumers are informed about a representative action is crucial for its success . consumers should be informed of ongoing representative action , the fact that a trader ' s practice has been considered as a breach of law , their rights following the establishment of an infringement and any subsequent steps to be taken by consumers concerned , particularly for obtaining redress .


### it has a legitimate interest in ensuring that provisions of union law covered by this directive are complied with ; ### its statutes , governance and track record demonstrate its legitimate interest in protecting consumers and ensuring that provisions of union law covered by this directive are complied with ;


### member states may provide that a qualified entity and a trader who have reached a settlement regarding redress for consumers affected by an allegedly illegal practice of that trader can jointly request a court or administrative authority to approve it . such request should be admitted by the court or administrative authority only if there is no other ongoing representative action regarding the same practice . a competent court or administrative authority approving such collective settlement must take into consideration the interests and rights of all parties concerned , including individual consumers . individual consumers concerned shall be given the possibility to accept or to refuse to be bound by such a settlement . ### member states may provide that a qualified entity and a trader who have reached a settlement regarding redress for consumers affected by an allegedly illegal practice of that trader can jointly request a court or administrative authority to approve it . such request should be admitted by the court or administrative authority only if there is no other ongoing representative action regarding the same practice . a competent court or administrative authority approving such collective settlement must take into consideration the interests and rights of all parties concerned , including individual consumers .


### for the purposes of article 5 , member states shall ensure that qualified entities are entitled to bring representative actions seeking a redress order , which obligates the trader to provide for , inter alia , compensation , repair , replacement , price reduction , contract termination or reimbursement of the price paid , as appropriate . a member state may require the mandate of the individual consumers concerned before a declaratory decision is made or a redress order is issued . ### member states may require the mandate of the individual consumers concerned before a declaratory decision is made or a redress order is issued , including , where applicable , on the type of remedies sought .


### by [ six months after the entry into force of this regulation ] and every six months thereafter during the development phase , eu - lisa shall submit a report to the european parliament and the council on the state of play of the development of the ecris - tcn system . once the development is finalised , a report shall be submitted to the european parliament and the council explaining how the objectives , in particular relating to planning and costs , were achieved , as well as justifying any divergences . ### by [ six months after the entry into force of this regulation ] and every six months thereafter during the development phase , eu - lisa shall submit a report to the european parliament and the council on the state of play of the development of the ecris - tcn system . that report shall include an overview of the current development of costs and progress of the project , a financial impact assessment , and information on any technical problems and risks which may impact the overall costs of the system to be borne by the general budget of the union in accordance with article 31 .


### member states shall ensure that the safety analysis , the safety report , the eu declaration of conformity and the other documents relating to the conformity of subsystems and safety components as well as the documentation concerning the characteristics of the cableway installation are submitted to the authority responsible for approving the cableway installation . the documentation concerning the cableway installation shall also include the necessary conditions , including the restrictions on operation , and full details for servicing supervision , adjustment and maintenance of the cableway installation . a copy of those documents shall be kept at the cableway installation . ### member states shall ensure that the safety analysis , the safety report , the eu declaration of conformity and the other documents relating to the conformity of subsystems and safety components as well as the documentation concerning the characteristics of the cableway installation are submitted to the authority or body responsible for approving the cableway installation . the documentation concerning the cableway installation shall also include the necessary conditions , including the restrictions on operation , and full details for servicing supervision , adjustment and maintenance of the cableway installation . a copy of those documents shall be kept at the cableway installation .


### manufacturers who consider or have reason to believe that the a subsystem or a safety component which they have placed on the market is not in conformity with this regulation shall immediately take the necessary corrective measures necessary to bring that subsystem or safety component into conformity , to withdraw it or recall it , if appropriate . furthermore , where the subsystem or the safety component presents a risk , manufacturers shall immediately inform the competent national authorities of the member states in which they made the subsystem or the safety component available on the market to that effect , giving details , in particular , of the non - compliance and of any corrective measures taken . ### manufacturers who consider or have reason to believe that a subsystem or a safety component which they have placed on the market is not in conformity with this regulation shall immediately take the corrective measures necessary to bring that subsystem or safety component into conformity , to withdraw it or recall it , if appropriate . furthermore , where the subsystem or the safety component presents a risk , manufacturers shall immediately inform the competent national authorities of the member states in which they made the subsystem or the safety component available on the market to that effect , giving details , in particular , of the non - compliance and of any corrective measures taken .


### manufacturers shall , further to a reasoned request from a competent national authority , provide it with all the information and documentation necessary to demonstrate the conformity of the subsystem or the safety component with this regulation , in a language which can be easily understood by that authority . that information and documentation may be provided in paper or electronic form . they shall cooperate with that authority , at its request , on any action taken to eliminate the risks posed by the subsystems or safety components which they have placed on the market . ### manufacturers shall , further to a request from a competent national authority , where there is a justified assumption of a danger for human beings or for public or private assets , provide it with all the information and documentation necessary to demonstrate the conformity of the subsystem or the safety component with this regulation , in a language which can be easily understood by that authority . that information and documentation may be provided in paper or electronic form . they shall cooperate with that authority , at its request , on any action taken to eliminate the risks posed by the subsystems or safety components which they have placed on the market .


### all planned installations shall be subject to a safety analysis as defined in annex iii which shall cover all safety aspects of the cableway installation and its environment in the context of the design , construction and entry into service and shall make it possible to identify from past experience risks liable to occur during the operation of the cableway installation . ### the person responsible for the cableway installation , determined by a member state in accordance with national law , shall carry out a safety analysis of the planned cableway installation or have such safety analysis carried out .


### manufacturers shall , further to a reasoned request from a competent national authority , provide it with all the information and documentation necessary to demonstrate the conformity of the subsystem or the safety component with this regulation , in a language which can be easily understood by that authority . that information and documentation may be provided in paper or electronic form . they shall cooperate with that authority , at its request , on any action taken to eliminate the risks posed by the subsystems or safety components which they have placed on the market . ### in the case of components not available on the market on the basis of the provisions of the harmonised standards , manufacturers shall supply all the information and documentation necessary to demonstrate the conformity of the subsystem or the safety component with this regulation , in a language which can be easily understood by the competent national authority . that information and documentation may be provided in paper or electronic form . they shall cooperate with that authority , at its request , on any action taken to eliminate the risks posed by the subsystems or safety components which they have placed on the market .


### 2 . 3 . 3 . in all cableway installations there shall be two or more braking systems , each capable of bringing the cableway installation to a halt , and coordinated in such a way that they automatically replace the active system when its efficiency becomes inadequate . the traction cable ' s last braking system shall act directly on the driving pulley . these provisions do not apply to drag lifts . ### 2 . 3 . 3 . in all cableway installations there shall be two or more braking systems , each capable of bringing the cableway installation to a halt , and coordinated in such a way that they automatically replace the active system when its efficiency becomes inadequate . the installation ' s last braking system shall act as close as possible to the traction cable , or on one or several pulleys including the driving pulley . these provisions do not apply to drag lifts .


### importers shall indicate their name , registered trade name or registered trade mark and the postal address at which they can be contacted on the subsystem or the safety component or where that is not possible , on its packaging and in the instructions accompanying the safety component . the contact details shall be in a language easily understood by users and market surveillance authorities as determined by the member state concerned . ### importers shall indicate on the subsystem or the safety component their name , registered trade name or registered trade mark and the postal address at which they can be contacted or where that is not possible , on its packaging and in a document accompanying the subsystem or the safety component . the contact details shall be in a language easily understood by users and market surveillance authorities as determined by the member state concerned .


### for the purpose of applying the first subparagraph , the office shall verify in accordance with article 12g via the eppo ' s case management system whether the eppo is conducting an investigation . the office may request further information from the eppo . the eppo shall reply to such a request within 10 working days . ### for the purpose of applying the first subparagraph , the office shall verify in accordance with article 12g whether the eppo is conducting an investigation .


### in consideration of the office ' s expertise , the institutions , bodies , offices and agencies of the union should have the choice to make use of the office to conduct such preliminary evaluation of allegations reported to them . ### in consideration of the office ' s expertise , the institutions , bodies , offices and agencies of the union should have the choice to make use of the office to conduct such preliminary evaluation of allegations reported to them , in cases where they are not able to perform this assessment . this should not delay timely reporting to the eppo .


### in the event that the eppo does not object within the time period of the previous subparagraph , the office may open an investigation , and it shall conduct it in close consultation with the eppo . ### if the eppo agrees with the request , the office shall take such action in close consultation with the eppo .


### the office shall report to the eppo without undue delay any criminal conduct in respect of which the eppo could exercise its competence in accordance with article 22 and article 25 and of regulation 2017 / 1939 . the report shall be sent at any stage before or during an investigation of the office . ### the office shall immediately notify the eppo on any indication of a criminal conduct in respect of which the eppo exercises its competence in accordance with articles 22 and 25 of regulation 2017 / 1939 . the eppo may request the office to send a report and shall establish the time frame of the report . both the notification and the report shall be sent at any stage before or during an investigation of the office .


### within 30 days after receipt of this information the eppo may object to the opening of an investigation or to the performance of certain acts pertaining to the investigation , where necessary to avoid jeopardising its own investigation or prosecution , and for as long as these grounds persist . the eppo shall notify to the office without undue delay when the grounds for the objection cease to apply . ### within 10 working days after receipt of this information the eppo may object to the opening of an investigation or to the performance of certain acts pertaining to the investigation , where necessary to avoid jeopardising its own investigation or prosecution , and for as long as these grounds persist . the eppo shall notify to the office without undue delay when the grounds for the objection cease to apply .


### the institutions , bodies , offices and agencies may request the office to conduct a preliminary evaluation of allegations reported to them . for the purposes of those requests , paragraph 3 shall apply . ### the institutions , bodies , offices and agencies may request the office to conduct a preliminary evaluation of allegations reported to them . for the purposes of those requests , paragraph 3 shall apply . this shall not delay timely reporting to the eppo .


### the office shall have indirect access to information in the eppo ' s case management system on the basis of a hit / no hit system . whenever a match is found between data entered into the case management system by the office and data held by the eppo , the fact that there is a match shall be communicated to both the eppo and the office . the office shall take appropriate measures to enable the eppo to have access to information in its case management system on the basis of a hit / no - hit system . ; ### the eppo shall designate a person to verify the eppo case management system , on the basis of a hit / no hit system , for the purpose of identifying and avoiding any case duplication situations with the office or any other law enforcement authorities . the office shall have indirect access to information in the eppo ' s case management system on the basis of a hit / no hit system , via the eppo designated person . before opening an investigation , the office shall consult the eppo ' s case management system in order to identify whether the eppo is already conducting an investigation into the same facts . whenever a match is found between data entered into the case management system by the office and data held by the eppo , the fact that there is a match shall be automatically communicated to both the eppo and the office . the office shall take appropriate measures to enable the eppo to have access to information in its case management system on the basis of a hit / no - hit system . access to the eppo ' s case management system shall be limited to the purpose of applying articles 12c to 12g . the office shall keep a log of all instances of access to the eppo ' s case management system and shall provide concrete justifications for requiring access to the eppo ' s case management system . the results obtained from such access shall be subject to the rules on confidentiality and data protection in article 10 .


### the report shall contain , as a minimum , a description of the facts , including an assessment of the damage caused or likely to be caused the possible legal qualification and any available information about potential victims , suspects and any other involved persons . ### the report shall contain : a description of all the facts in the knowledge of the office ; any information on the damage caused or likely to be caused , where the office has such information ; any information about potential victims , suspects and any other involved persons , where the office has such information , and ; any other information on the case , that the office has knowledge of .


### elements pointing to possible criminal conduct falling within the competence of the eppo may , in practice , be present in initial allegations received by the office or may emerge only in the course of an administrative investigation opened by the office on the grounds of suspicion of administrative irregularity . in order to comply with its duty to report to the eppo , the office should therefore , as the case may be , report criminal conduct at any stage before or during an investigation . ### elements pointing to possible criminal conduct falling within the competence of the eppo may , in practice , be present in initial allegations received by the office or may emerge only in the course of an administrative investigation opened by the office on the grounds of suspicion of administrative irregularity . in order to comply with its duty to report to the eppo , the office should therefore , as the case may be , immediately notify any criminal conduct . this notification may be followed by a report , where the eppo considers necessary . both the notification and the report should be sent at any stage before or during an investigation .


### for the purpose of applying the first subparagraph , the office shall verify in accordance with article 12g via the eppo ' s case management system whether the eppo is conducting an investigation . the office may request further information from the eppo . the eppo shall reply to such a request within 10 working days . ### for the purpose of applying the first subparagraph , the office shall verify in accordance with article 12g whether the eppo is conducting an investigation . the office may request further information from the eppo . the eppo shall reply to such a request without undue delay .


### the office shall have indirect access to information in the eppo ' s case management system on the basis of a hit / no hit system . whenever a match is found between data entered into the case management system by the office and data held by the eppo , the fact that there is a match shall be communicated to both the eppo and the office . the office shall take appropriate measures to enable the eppo to have access to information in its case management system on the basis of a hit / no - hit system . ; ### the eppo shall designate a person to verify the eppo case management system , on the basis of a hit / no hit system , for the purpose of identifying and avoiding any case duplication situations with the office or any other law enforcement authorities . before opening any investigation , the office shall inform the eppo designated person who shall consult the eppo case management system , on the basis of a hit / no hit system , in order to identify whether the eppo is already conducting an investigation into the same facts . whenever a match is found between data entered into the case management system by the eppo and data held by the office , the fact that there is a match shall be communicated by the eppo to the office . the office shall take appropriate measures to enable the eppo to have access to information in its case management system on the basis of a hit / no hit system .


### the report shall contain , as a minimum , a description of the facts , including an assessment of the damage caused or likely to be caused the possible legal qualification and any available information about potential victims , suspects and any other involved persons . ### the report shall contain , as a minimum , a description of the facts , including an assessment of the damage caused or likely to be caused the possible legal qualification and any available information about potential victims , suspects and any other involved persons . together with the report , the office shall transmit to the eppo any other available information , on the case , in its possession .


### in conformity with regulation 2017 / 1939 , the office should in principle not open an administrative investigation parallel to an investigation conducted by the eppo into the same facts . however , in certain cases , the protection of the union’s financial interests may require that the office carry out a complementary administrative investigation before the conclusion of criminal proceedings initiated by the eppo with the purpose of ascertaining whether precautionary measures are necessary , or financial , disciplinary or administrative action should be taken . these complementary investigations may be appropriate , inter alia , when necessary to recover amounts due to the union budget subject to specific time - barring rules , when the amounts at risk are very high , or where there is the need to avoid further expenditure in risk situations through administrative measures . ### in conformity with regulation 2017 / 1939 , the office should in principle not open an administrative investigation parallel to an investigation conducted by the eppo into the same facts . however , in certain cases , the protection of the union’s financial interests may require that the office carry out a complementary administrative investigation before the conclusion of criminal proceedings initiated by the eppo with the purpose of ascertaining whether precautionary measures are necessary , or financial , disciplinary or administrative action should be taken . these complementary investigations may be appropriate , inter alia , when necessary to recover amounts due to the union budget subject to specific time - barring rules , when the amounts at risk are very high , or where there is the need to avoid further expenditure in risk situations through administrative measures . such complementary investigations should only be carried out upon agreement of the eppo .


### regulation 2017 / 1939 provides that the eppo may request such complementary investigations to the office . in cases where the eppo does not request it , such a complementary investigation should also be possible on the initiative of the office , under certain conditions . in particular , the eppo should be able to object to the opening or continuation of an investigation by the office , or to the performance of specific acts of investigation by it . the reasons for this objection should be based on the need to protect the effectiveness of the eppo ' s investigation and should be proportionate to this aim . the office should refrain from performing the action on which the eppo raised an objection . if the eppo does not object , the office investigation should be conducted in close consultation with the eppo . ### regulation 2017 / 1939 provides that the eppo may request such complementary investigations to the office . in cases where the eppo does not request it , such a complementary investigation should also be possible on the initiative of the office , under certain conditions only upon agreement of and in close consultation with the eppo . in cases where the eppo objects to the opening or continuation of an investigation by the office , or to the performance of specific acts of investigation by it the office should refrain from performing them .


### regulation 2017 / 1939 specifies the minimum elements that , as a rule , reports should contain . the office may need to conduct a preliminary evaluation of allegations to ascertain these elements and collect the necessary information . the office should conduct this evaluation expeditiously and through means which do not risk jeopardising a possible future criminal investigation . upon completion of its evaluation , it should report to the eppo where a suspicion of an offence within its competence is identified . ### regulation 2017 / 1939 specifies the minimum elements that , as a rule , reports should contain . in addition to these elements , the office should transmit to the eppo all information available to it . the office may need to conduct a preliminary evaluation of allegations to ascertain these elements and collect the necessary information . the office should conduct this evaluation as expeditiously as possible and through means which do not risk jeopardising a possible future criminal investigation . upon completion of its evaluation , it should report to the eppo where a suspicion of an offence within its competence is identified .


### a clear and prominent notice is displayed informing of , at least , the modalities of the collection , its purpose , the person responsible for it and the other information required under article 13 of regulation 2016 / 679 where personal data are collected , as well as any measure the end - user of the terminal equipment can take to stop or minimise the collection . ### clear and prominent information is displayed or available taking account of the normal means a consumer interacts with such a terminal equipment , informing of , at least , the modalities of the collection , its purpose , the person responsible for it and the other information required under article 13 of regulation 2016 / 679 where personal data are collected , as well as any measure the consumer of the terminal equipment can take to stop or minimise the collection . the collection of such information shall be conditional on the application of appropriate technical and organisational measures to ensure a level of security appropriate to the risks , as set out in article 32 of regulation 2016 / 679 , has been applied .


### this regulation applies to the processing of electronic communications data carried out in connection with the provision and the use of electronic communications services and to information related to the terminal equipment of end - users . ### this regulation applies to the processing of electronic communications data carried out in connection with the provision and the use of electronic communications services .


### upon installation , the software shall inform the end - user about the privacy settings options and , to continue with the installation , require the end - user to consent to a setting . ### upon installation , the software shall inform the end - user about the privacy settings options .


### the providers of a publicly available directory shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory and obtain end - users’ consent before enabling such search functions related to their own data . ### the providers of a publicly available directory shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory , which they shall do there . the providers of electronic information , communications and telecommunications services shall inform end - users when new search functions are made available .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications metadata can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to further process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to further process electronic communications metadata , which should include data on the location of the device . as an exception from obtaining end - users’ consent , the processing of electronic communications metadata for purposes other than those for which the personal data were initially collected should be allowed in cases where the further processing is compatible in accordance with article 6 of regulation 2016 / 679 . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . therefore , whenever the purpose of further processing of data cannot be achieved by processing data that is made anonymous , pseudonymisation of data should be allowed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 .


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ' hotspots ' situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ' hotspots ' situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . therefore , this regulation should apply to electronic communications data using electronic communications services which are targeting the general public , and public communications networks . this regulation should not apply to closed groups of end - users such as corporate networks . such networks are offered to a defined group of end - users . however , even if undefined end - users use the network in question in the context of the activities of the defined group of end - users it should not preclude them from being considered outside the material scope of the regulation . for example , an enterprise’s collaboration platform primarily used by its employees that allows third parties to call - in or otherwise engage in the workspace should not be covered .


### the providers of publicly available directories shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data . ### the providers of electronic information , communications and telecommunications services shall collect the data of end - users who are natural persons in order to include their personal data in publicly accessible directories . they shall give end - users that are natural persons the right to object to data related to them being included in directories . &#160 ; providers shall give end - users who are natural persons the means to verify , correct , update , supplement and delete such data .


### while the principles and main provisions of directive 2002 / 58 / ec of the european parliament and of the council5 remain generally sound , that directive has not fully kept pace with the evolution of technological and market reality , resulting in an inconsistent or insufficient effective protection of privacy and confidentiality in relation to electronic communications . those developments include the entrance on the market of electronic communications services that from a consumer perspective are substitutable to traditional services , but do not have to comply with the same set of rules . another development concerns new techniques that allow for tracking of online behaviour of end - users , which are not covered by directive 2002 / 58 / ec . directive 2002 / 58 / ec should therefore be repealed and replaced by this regulation . __________________ 5 directive 2002 / 58 / ec of the european parliament and of the council of 12 july 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector . ### while the principles and main provisions of directive 2002 / 58 / ec of the european parliament and of the council5 remain generally sound , that directive has not fully kept pace with the evolution of technological and market reality , resulting in an insufficient clarity and inconsistent enforcement of the protection of privacy and confidentiality in relation to electronic communications . those developments include the entrance on the market of electronic communications services that from a consumer perspective are substitutable to traditional services , but do not have to comply with the same set of rules . another development concerns new techniques that allow for tracking of online behaviour of end - users , which are not covered by directive 2002 / 58 / ec . directive 2002 / 58 / ec should therefore be repealed and replaced by this regulation . __________________ 5 directive 2002 / 58 / ec of the european parliament and of the council of 12 july 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector .


### this regulation ensures free movement of electronic communications data and electronic communications services within the union , which shall be neither restricted nor prohibited for reasons related to the respect for the private life and communications of natural and legal persons and the protection of natural persons with regard to the processing of personal data . ### this regulation ensures , in accordance with regulation no 2016 / 679 , free movement of electronic communications data and electronic communications services within the union , which shall be neither restricted nor prohibited for reasons related to the respect for the private life and communications of natural persons and the protection of natural persons with regard to the processing of personal data .


### it is necessary for providing an information society service requested by the end - user ; or ### it is necessary for providing an information society service requested by the end - user , particularly in order to preserve the integrity or security of the information society service or access to it , to improve what is offered or for measures to protect against unauthorised use of the service in accordance with the terms and conditions of use relating to the provision of services to the end - user ; or


### the providers of publicly available directories shall provide end - users that are legal persons with the possibility to object to data related to them being included in the directory . providers shall give such end - users that are legal persons the means to verify , correct and delete such data . ### the providers of electronic information , communications and telecommunications services shall provide end - users that are legal persons with the possibility to object to data related to them being included in the directory . providers shall give such end - users that are legal persons the means to verify , correct , update , supplement and delete such data . natural persons acting for an economic purpose , such as independent professionals , operators of small businesses or freelancers , shall be equated with legal persons .


### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to end - users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should display prominent notices located on the edge of the area of coverage informing end - users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the end - user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 . ### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to end - users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should ask for the end - user´s consent or should carry out data protection impact assessment and in this case the data collected is or is rendered pseudonymous or anonymous . where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk , prior consultation with the supervisory authority , as prescribed in article 36 of regulation 2016 / 679 , should be carried out . providers should display prominent notices located on the edge of the area of coverage informing end - users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the end - user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 .


### present the identity of a line on which they can be contacted ; or ### present the identity of a line on which they can be contacted ; and


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in a an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . providers of software enabling electronic communication , including the retrieval and presentation of information on the internet , should have an obligation to pre - set the software in such a way as to offer end - users the highest level of protection of their privacy and , in particular , prevent third parties from storing information on the terminal equipment ; end - users may be offered a set of privacy setting options , ranging from intermediate to lower protection . such privacy settings should come with a warning about the risks associated with lowering the level of protection and be presented in a an easily visible and intelligible manner .


### exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the end - user . this may include the storing of cookies for the duration of a single established session on a website to keep track of the end - user’s input when filling in online forms over several pages . cookies can also be a legitimate and useful tool , for example , in measuring web traffic to a website . information society providers that engage in configuration checking to provide the service in compliance with the end - user ' s settings and the mere logging of the fact that the end - user’s device is unable to receive content requested by the end - user should not constitute access to such a device or use of the device processing capabilities . ### exceptions to the obligation to obtain consent to store information in terminal equipment or to access information stored in terminal equipment should be limited to situations that comply with all obligations pursuant to regulation 2016 / 679 . for instance , the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a service requested by the consumer . this may include the storing of cookies for the duration of a single established session on a website to keep track of the consumer ' s input when filling in online forms over several pages . cookies can also be a legitimate and useful tool , for example , in measuring web traffic to a website . similarly , providers of terminal equipment and the software needed to operate such equipment regularly need access to configuration and other device information and the processing and storage capabilities to maintain the equipment , prevent security vulnerabilities or their exploitation and correct problems related to the equipment ' s operation . information society providers and electronic communications service providers that engage in configuration checking to provide the service in compliance with the consumer ' s settings and the mere logging of the fact that the consumer ' s device is unable to receive content requested by the consumer should not constitute access to such a device or use of the device processing capabilities .


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous or pseudonymised .


### upon installation , the software shall inform the end - user about the privacy settings options and , to continue with the installation , require the end - user to consent to a setting . ### the software may provide the end - user with various settings options to reduce privacy . it shall identify attendant risks , however , and require the end - user to consent to a setting .


### connected devices and machines increasingly communicate with each other by using electronic communications networks . the transmission of machine - to - machine communications involves the conveyance of signals over a network and , hence , usually constitutes an electronic communications service . in order to ensure full protection of the rights to privacy and confidentiality of communications , and to promote a trusted and secure internet of things in the digital single market , it is necessary to clarify that this regulation should apply to the transmission of machine - to - machine communications . therefore , the principle of confidentiality enshrined in this regulation should also apply to the transmission of machine - to - machine communications . specific safeguards could also be adopted under sectorial legislation , as for instance directive 2014 / 53 / eu . ### connected devices and machines increasingly communicate with each other by using electronic communications networks . the transmission of machine - to - machine communications involves the conveyance of signals over a network and , hence , it may constitute a publicly available electronic communications service . in such cases , in order to ensure full protection of the rights to privacy and confidentiality of communications , and to promote a trusted and secure internet of things in the digital single market , it is necessary to clarify that this regulation and the principle of confidentiality hereby enshrined should apply to the transmission of machine - to - machine communications . this regulation should not apply to machine - to - machine communications not provided as a service which targets the general population .


### where the provider of an electronic communications service is not established in the union it shall designate in writing a representative in the union . ### where the provider of an electronic communications service is not established in the union the party identified pursuant to article 27 of regulation 2016 / 679 shall act as its representative in the union .


### the providers of a publicly available directory shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory and obtain end - users’ consent before enabling such search functions related to their own data . ### the providers of a publicly available directory shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory , and shall give end - users who are natural persons the means to verify , correct and delete such data .


### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural and legal persons who use electronic communications services to send direct marketing commercial communications or collect information related to or stored in end - users’ terminal equipment . ### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural and legal persons who use electronic communications services to send direct marketing communications or collect information related to or stored in end - users’ terminal equipment .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . the processing of electronic communications data after transmission to the intended recipient or to the provider shall be governed by regulation no 2016 / 679 .


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in a an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ' accept all cookies ' . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to inform the end - user about the possibility to express his or her consent using appropriate technical settings . the end - user should be offered multiple options to choose from , including to prevent third parties from storing information on the terminal equipment . end - users should be offered a set of privacy setting options , ranging from , for example , rejecting tracking that is not necessary for the functionality of the website or other software to , for example , accepting tracking necessary for the functionality of the website or other software as well as for other purposes or , for example , accepting tracking necessary for the functionality of the website or other software and tracking for other purposes by parties that demonstrate the compliance with the eu data protection and privacy legislation , for instance in line with article 40 and 42 of regulation 2016 / 679 . such privacy settings should be presented in an easily visible and intelligible manner .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . examples of such usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colours to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals , provided that the data are immediately anonymised or anonymisation techniques are used where the user is mixed with others . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### the providers of publicly available directories shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data . ### providers of number - based interpersonal communication services and electronic communication providers shall obtain the consent of end - users who are natural persons to include their personal data in a directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . directory&#160 ; providers shall give end - users who are natural persons the means to verify , correct and delete such data .


### without prejudice to point of article 6 and points and of article 6 , the provider of the electronic communications service shall erase electronic communications metadata or make that data anonymous when it is no longer needed for the purpose of the transmission of a communication . ### without prejudice to point of article 6 , the provider of the electronic communications service shall erase electronic communications metadata or make that data anonymous when it is no longer needed for the purpose of the transmission of a communication .


### the content of electronic communications may reveal highly sensitive information about the natural persons involved in the communication , from personal experiences and emotions to medical conditions , sexual preferences and political views , the disclosure of which could result in personal and social harm , economic loss or embarrassment . similarly , metadata derived from electronic communications may also reveal very sensitive and personal information . these metadata includes the numbers called , the websites visited , geographical location , the time , date and duration when an individual made a call etc . , allowing precise conclusions to be drawn regarding the private lives of the persons involved in the electronic communication , such as their social relationships , their habits and activities of everyday life , their interests , tastes etc . ### the content of electronic communications may reveal highly sensitive information about the natural persons involved in the communication . similarly , metadata derived from electronic communications may also reveal very sensitive and personal information . these metadata includes the numbers called , the websites visited , geographical location , the time , date and duration when an individual made a call etc . , allowing precise conclusions to be drawn regarding the private lives of the persons involved in the electronic communication , such as their social relationships , their habits and activities of everyday life , their interests , tastes etc .


### the providers of publicly available directories shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data . ### the providers of electronic communication services shall obtain the consent of end - users who are natural persons to share their personal data to a public directory and shall provide a transparent information about the data being included in the directory in order to allow the end - user to make an informed decision .


### in the case of software which has already been installed on 25 may 2018 , the requirements under paragraphs 1 and 2 shall be complied with at the time of the first update of the software , but no later than 25 august 2018 . ### in the case of software which has already been installed on 25 may 2018 , the requirements under paragraph 1 shall have been complied with .


### if all end - users concerned have given their consent to the processing of their electronic communications content for one or more specified purposes that cannot be fulfilled by processing information that is made anonymous , and the provider has consulted the supervisory authority . points and of article 36 of regulation 2016 / 679 shall apply to the consultation of the supervisory authority . ### if service providers ' end - users have consented to the processing of their electronic communications content pursuant to regulation 2016 / 679 .


### the providers of publicly available directories shall provide end - users that are legal persons with the possibility to object to data related to them being included in the directory . providers shall give such end - users that are legal persons the means to verify , correct and delete such data . ### the providers of electronic information , communications and telecommunications services shall provide end - users that are legal persons with the possibility to object to data related to them being included in the directory . providers shall give such end - users that are legal persons the means to verify , correct , update , supplement and delete such data . natural persons acting for an economic purpose , such as independent professionals , operators of small businesses or freelancers , shall be equated with legal persons .


### it is necessary to maintain or restore the security of electronic communications networks and services , or detect technical faults and / or errors in the transmission of electronic communications , for the duration necessary for that purpose . ### it is necessary to maintain or restore the security of electronic communications networks and services , or detect technical faults and / or errors in the transmission of electronic communications .


### connected devices and machines increasingly communicate with each other by using electronic communications networks . the transmission of machine - to - machine communications involves the conveyance of signals over a network and , hence , usually constitutes an electronic communications service . in order to ensure full protection of the rights to privacy and confidentiality of communications , and to promote a trusted and secure internet of things in the digital single market , it is necessary to clarify that this regulation should apply to the transmission of machine - to - machine communications . therefore , the principle of confidentiality enshrined in this regulation should also apply to the transmission of machine - to - machine communications . specific safeguards could also be adopted under sectorial legislation , as for instance directive 2014 / 53 / eu . ### connected devices and machines increasingly communicate with each other by using electronic communications networks . the transmission of machine - to - machine communications involves the conveyance of signals over a network and , hence , usually constitutes an electronic communications service . in order to ensure full protection of the rights to privacy and confidentiality of communications , and to promote a trusted and secure internet of things in the digital single market , it is necessary to clarify that this regulation should apply to the transmission of machine - to - machine communications . therefore , the principle of confidentiality enshrined in this regulation should also apply to the transmission of machine - to - machine communications . specific safeguards could also be adopted under sectorial legislation , as for instance directive 2014 / 53 / eu . regulation shall not apply to machine - to - machine communications which are not provided as a service targeting the general public . moreover , the provision of machine - to - machine platforms shall not be considered to be an electronic communications service solely by the inclusion of service other than the mere conveyance of communication data the platform , offering functions to analyse the machine - to - machine data via the platform or transfer signals to operate and control the machines via the platform ) .


### if it is necessary for web audience measuring , provided that such measurement is carried out by the provider of the information society service requested by the end - user . ### it is necessary in order to obtain information about the technical quality or effectiveness of an information society service that has been delivered , and has no or little impact on the privacy of the end - user concerned .


### the providers of a publicly available directory shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory and obtain end - users’ consent before enabling such search functions related to their own data . ### the providers of a publicly available directory shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory , which they shall do there . the providers of electronic information , communications and telecommunications services shall inform end - users when new search functions are made available .


### this regulation ensures free movement of electronic communications data and electronic communications services within the union , which shall be neither restricted nor prohibited for reasons related to the respect for the private life and communications of natural and legal persons and the protection of natural persons with regard to the processing of personal data . ### this regulation ensures free movement of electronic communications data and electronic communications services within the union .


### where a natural or legal person obtains electronic contact details for electronic mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own similar products or services only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the right to object shall be given at the time of collection and each time a message is sent . ### where a natural or legal person obtains electronic contact details for electronic mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own products or services only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the right to object shall be given at the time of collection and each time a message is sent .


### software placed on the market permitting electronic communications , including the retrieval and presentation of information on the internet , shall offer the option to prevent third parties from storing information on the terminal equipment of an end - user or processing information already stored on that equipment . ### software placed on the market permitting electronic communications , including the retrieval and presentation of information on the internet , shall have been preset for privacy , for first - time use by the end - user , and shall afford maximum privacy protection .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications metadata can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to further process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to further process electronic communications metadata , which should include data on the location of the device . as an exception from obtaining end - users’ consent , the processing of electronic communications metadata for purposes other than those for which the personal data were initially collected should be allowed in cases where the further processing is compatible in accordance with article 6 of regulation 2016 / 679 . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . therefore , whenever the purpose of further processing of data cannot be achieved by processing data that is made anonymous , pseudonymisation of data should be allowed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications data shall be confidential . any interference with electronic communications data during conveyance , such as by unauthorised listening , tapping , storing , or other kinds of interception , or surveillance of electronic communications data , by persons other than the sender or intended recipients , shall be prohibited , except when permitted by union or national legislation . the processing of electronic communications data following conveyance to the intended recipients or their service provider shall be subject to regulation 2016 / 679 .


### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . any interference with the content of electronic communications should be allowed only under very clear defined conditions , for specific purposes and be subject to adequate safeguards against abuse . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit , with the informed consent of all the end - users concerned . for example , providers may offer services that entail the scanning of emails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the presumption does not encompass the processing of content data to provide a service requested by the end - user where the end - user has consented to such processing and it is carried out for the purposes and duration strictly necessary and proportionate for such service . after electronic communications content has been sent by the end - user and received by the intended end - user or end - users , it may be recorded or stored by the end - user , end - users or by a third party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 . ### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . any interference with the content of electronic communications should be allowed only under very clear defined conditions , for specific purposes and be subject to safeguards against abuse pursuant to regulation 2016 / 679 . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit , with the informed consent of all the end - users concerned . for example , providers may offer services that entail the scanning of emails to remove certain pre - defined material . where an electronic communication service that is based on new technologies is likely to result in a high risk to the rights and freedoms of natural persons after taking into account the nature , scope , context and purposes of the service the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the obligation does not encompass the processing of content data to provide a service requested by the end - user where the end - user has consented to such processing and it is carried out pursuant to regulation 2016 / 679 . after electronic communications content has been sent by the sender and received by the intended recipient , it may be recorded or stored by the sender , the recipient or by a third party entrusted by them to record or store such data . for communications , which do not happen in real time , such as email and messaging , the transmission is completed as soon as the communication is delivered to the trusted service provider or collected by the addressee . any processing of such data must comply with regulation 2016 / 679 .


### the possibility for end - users not to be included in a publicly available directory , or to verify , correct and delete any data related to them shall be provided free of charge . ### the possibility for end - users not to be included in a publicly available directory , or to verify , correct , update , supplement and delete any data related to them shall be provided free of charge .


### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural and legal persons who use electronic communications services to send direct marketing commercial communications or collect information related to or stored in end - users’ terminal equipment . ### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural persons who use electronic communications services to send direct marketing commercial communications or collect information related to or stored in consumers ' terminal equipment .


### if it is necessary for web audience measuring , provided that such measurement is carried out by the provider of the information society service requested by the end - user . ### if it is necessary for web audience measuring , provided that the end - user has given his or her consent .


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in a an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . therefore providers of software enabling publicly available electronic communications services and permitting the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment . consumers should be offered a set of privacy setting options . such privacy settings should be presented in an easily visible and intelligible manner .


### providers of the electronic communications services may process electronic communications content only : ### providers of the electronic communications services may process electronic communications content in accordance with article 6 of regulation 2016 / 679 and to the extent the processing of all end - users electronic communications content for one or more specified purposes cannot be fulfilled by processing information that is made anonymous