### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications metadata can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications networks and services to further process electronic communications metadata . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication , billing , interconnection payments or security . therefore , this regulation should , in principle , require providers of electronic communications networks and services to obtain end - users’ consent to further process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . as an exception from obtaining end - users’ consent , the processing of electronic communications metadata for purposes other than those for which the personal data were initially collected should be allowed in cases where the processing is compatible in accordance with point of article 6 of regulation 2016 / 679 . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications shall be confidential . any interference , with electronic communications at rest or in transit , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or any processing of electronic communications , by persons other than the users , shall be prohibited , except when permitted by this regulation .


### in the case of software which has already been installed on 25 may 2018 , the requirements under paragraphs 1 and 2 shall be complied with at the time of the first update of the software , but no later than 25 august 2018 . ### in the case of software which has already been installed on 25 may 2018 , the requirements under paragraphs 1 and 2 shall be complied with at the time of the first update of the software , but no later than one year after entry into force of this regulation .


### the providers of publicly available directories shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data . ### the operators of electronic information , communication and telecommunication services collect the data of end - users who are natural persons to include their personal data in publicly available directories . they grant end - users who are natural persons the right to object against the inclusion of their related data in directories . the operators shall give end - users who are natural persons the option to verify , correct and delete such data .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications shall be confidential . any processing of electronic communications data , including any interference with electronic communications data such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance of electronic communications data , by persons other than the users , shall be prohibited , except when permitted by this regulation . this includes electronic communications data that is stored after the transmission has been completed .


### any natural or legal person using electronic communications services to transmit direct marketing communications shall inform end - users of the marketing nature of the communication and the identity of the legal or natural person on behalf of whom the communication is transmitted and shall provide the necessary information for recipients to exercise their right to withdraw their consent , in an easy manner , to receiving further marketing communications . ### any natural or legal person using electronic communications services to transmit direct marketing communications shall inform end - users of the marketing nature of the communication and the identity of the legal or natural person on behalf of whom the communication is transmitted and shall provide the necessary information for recipients to exercise their right to withdraw their consent , in an easy manner and free of charge , to receiving further marketing communications .


### the definition of and conditions for consent provided for under articles 4 and 7 of regulation 2016 / 679 / eu shall apply . ### the definition of and conditions for consent provided for in regulation 2016 / 679 / eu , including , inter alia , in its articles 4 , 7 and 8 , shall apply .


### article 7 of the charter of fundamental rights of the european union protects the fundamental right of everyone to the respect for his or her private and family life , home and communications . respect for the privacy of one ' s communications is an essential dimension of this right . confidentiality of electronic communications ensures that information exchanged between parties and the external elements of such communication , including when the information has been sent , from where , to whom , is not to be revealed to anyone other than to the parties involved in a communication . the principle of confidentiality should apply to current and future means of communication , including calls , internet access , instant messaging applications , e - mail , internet phone calls and personal messaging provided through social media . ### article 7 of the charter of fundamental rights of the european union protects the fundamental right of everyone to the respect for his or her private and family life , home and communications . respect for the privacy of one ' s communications is an essential dimension of this right . confidentiality of electronic communications ensures that information exchanged between parties and the external elements of such communication , including information regarding when the information has been sent , from where , to whom , is not to be revealed to anyone other than to the communicating parties . the principle of confidentiality should apply to current and future means of communication , including calls , internet access , instant messaging applications , e - mail , internet phone calls and inter - personal messaging provided through social media . it should also apply when the confidentiality of electronic communications and the privacy of the physical environment converge , i . e . where terminal devices for electronic communication can also listen into their physical environment or use other input channels such as bluetooth signalling or movement sensors .


### the end - user has given his or her consent ; or ### the end - user has given his or her consent or there is another legitimate ground within the meaning of article 6 of regulation 2016 / 679 ; or


### if it is necessary for web audience measuring , provided that such measurement is carried out by the provider of the information society service requested by the end - user . ### it is necessary for measuring the scope of the information society service requested by the end - user , including the taking of meaurements in order to calculate royalties for the collective management of rights or other remuneration or payment schemes ; or


### if all end - users concerned have given their consent to the processing of their electronic communications content for one or more specified purposes that cannot be fulfilled by processing information that is made anonymous , and the provider has consulted the supervisory authority . points and of article 36 of regulation 2016 / 679 shall apply to the consultation of the supervisory authority . ### if the service provider ' s end - user has consented to the processing of their electronic communications content pursuant to regulation 2016 / 679 .


### it shall apply from 25 may 2018 . ### it shall apply from [ one year from the date of entry into force of this regulation ] .


### the providers of publicly available directories shall provide end - users that are legal persons with the possibility to object to data related to them being included in the directory . providers shall give such end - users that are legal persons the means to verify , correct and delete such data . ### the operators of electronic information , communication and telecommunication services shall provide end - users that are legal persons with the possibility to object to data related to them being included in directories . the operators shall give such end - users that are legal persons the option to verify , correct and delete such data . natural persons who act with commercial intent , such as freelancers , small traders or self - emlyed persons , are equated to legal persons .


### without prejudice to paragraph 1 , where technically possible and feasible , for the purposes of point of article 8 , consent may be expressed by using the appropriate technical settings of a software application enabling access to the internet . ### end - users who have consented to the processing of electronic communications data as set out in point of article 6 points and of article 6 , point of article 8 and point of article 8 shall be given the possibility to withdraw their consent at any time as set forth under article 7 of regulation 2016 / 679 and be reminded of this possibility at periodic intervals of 6 months , as long as the processing continues .


### the end - user has given his or her consent ; or ### the user has given his or her specific consent , which shall not be mandatory to access the service ; or


### the provisions of this regulation particularise and complement the general rules on the protection of personal data laid down in regulation 2016 / 679 as regards electronic communications data that qualify as personal data . this regulation therefore does not lower the level of protection enjoyed by natural persons under regulation 2016 / 679 . processing of electronic communications data by providers of electronic communications services should only be permitted in accordance with this regulation . ### the provisions of this regulation particularise and complement the general rules on the protection of personal data laid down in regulation 2016 / 679 as regards electronic communications data that qualify as personal data . this regulation therefore can not lower the level of protection enjoyed by natural persons under regulation 2016 / 679 . processing of electronic communications data should only be permitted in accordance with and on legal ground specifically provided under this regulation .


### the providers of a publicly available directory shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory and obtain end - users’ consent before enabling such search functions related to their own data . ### in publicly available directories the providers of these directories shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory . the operators shall inform end - users if new search functions are enabled .


### the independent supervisory authority or authorities responsible for monitoring the application of regulation 2016 / 679 shall also be responsible for monitoring the application of this regulation . chapter vi and vii of regulation 2016 / 679 shall apply mutatis mutandis . the tasks and powers of the supervisory authorities shall be exercised with regard to end - users . ### each member state shall provide for one or more independent public authorities to be responsible for monitoring the application of this regulation .


### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural and legal persons who use electronic communications services to send direct marketing commercial communications or collect information related to or stored in end - users’ terminal equipment . ### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural and legal persons who use electronic communications services to send direct marketing communications or collect information related to or stored in end - users’ terminal equipment .


### natural or legal persons may use electronic communications services for the purposes of sending direct marketing communications to end - users who are natural persons that have given their consent . ### the use by natural or legal persons of electronic communications services , including voice - to - voice calls , automated calling and communications systems , including semi - automated systems that connect the call person to an individual , faxes , e - mail or other use of electronic communications services for the purposes of presenting unsolicited or direct marketing communications to end - users , shall be allowed only in respect of end - users who have given their prior consent .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . as an exemption from obtaining end - user´s consent , the processing of metadata for purposes other than those for which they were initially collected should be allowed in cases where the processing is compatible and is subject to specific safeguards , especially pseudonymisation as set forth in point of article 6 of regulation 2016 / 679 , as well as if it is necessary in accordance with article 6 of regulation 2016 / 679 for the purpose of legitimate interest , provided that the data protection impact assessment was carried out , as prescribed in article 35 of regulation 2016 / 679 .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications data shall be confidential . any interference with electronic communications data , such as by unauthorised listening , tapping , storing , monitoring , scanning or other kinds of interception , or surveillance , by persons other than the end - users , shall be prohibited , except when permitted by this regulation .


### publicly available directories of end - users of electronic communications services are widely distributed . publicly available directories means any directory or service containing end - users information such as phone numbers , email address contact details and includes inquiry services . the right to privacy and to protection of the personal data of a natural person requires that end - users that are natural persons are asked for consent before their personal data are included in a directory . the legitimate interest of legal entities requires that end - users that are legal entities have the right to object to the data related to them being included in a directory . ### publicly available directories of end - users of electronic communications services are widely distributed . publicly available directories means any directory or service containing end - users information such as phone numbers , email address contact details and includes inquiry services . the right to privacy and to protection of the personal data of a natural person acting out of his / her business capacity requires that end - users that are natural persons are asked for consent before their personal data are included in a directory . the legitimate interest of legal entities and natural persons acting in their business capacity requires that end - users that are legal entities and natural persons acting in their business capacity have the right to object to the data related to them being included in a directory . in cases where the information was not originally collected for the purposes of a publicly available directory , the first party to collect the data should be the one to request the consent of the end - user concerned . consent should be collected by the electronic communications service provider at the moment of signing the contract for such service .


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### a legitimate ground in accordance with article 6 of regulation 2016 / 679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data , and repealing directive 95 / 46 / ec is applicable .


### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to end - users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should display prominent notices located on the edge of the area of coverage informing end - users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the end - user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 . ### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to end - users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should ask for the end - user´s consent or should carry out data protection impact assessment and in this case the data collected is or is rendered pseudonymous or anonymous . where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk , prior consultation with the supervisory authority , as prescribed in article 36 of regulation 2016 / 679 , shall be carried out . providers should display prominent notices located on the edge of the area of coverage informing end - users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the end - user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 .


### the use of processing and storage capabilities of terminal equipment and the collection of information from end - users ' terminal equipment , including about its software and hardware , other than by the end - user concerned shall be prohibited , except on the following grounds : ### the use of processing and storage capabilities of terminal equipment and the collection of information from users ' terminal equipment , or making information available through the terminal equipment , including information about or generated by its software and hardware , other than by the user concerned shall be prohibited , except on the following grounds :


### where a natural or legal person obtains electronic contact details for electronic mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own similar products or services only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the right to object shall be given at the time of collection and each time a message is sent . ### where a natural or legal person obtains electronic contact details for e - mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own products or services only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the customer shall be informed about the right to object and shall be given an easy way to exercise it at the time of collection and each time a message is sent .


### safeguards should be provided to protect end - users against unsolicited communications for direct marketing purposes , which intrude into the private life of end - users . the degree of privacy intrusion and nuisance is considered relatively similar independently of the wide range of technologies and channels used to conduct these electronic communications , whether using automated calling and communication systems , instant messaging applications , emails , sms , mms , bluetooth , etc . it is therefore justified to require that consent of the end - user is obtained before commercial electronic communications for direct marketing purposes are sent to end - users in order to effectively protect individuals against the intrusion into their private life as well as the legitimate interest of legal persons . legal certainty and the need to ensure that the rules protecting against unsolicited electronic communications remain future - proof justify the need to define a single set of rules that do not vary according to the technology used to convey these unsolicited communications , while at the same time guaranteeing an equivalent level of protection for all citizens throughout the union . however , it is reasonable to allow the use of e - mail contact details within the context of an existing customer relationship for the offering of similar products or services . such possibility should only apply to the same company that has obtained the electronic contact details in accordance with regulation 2016 / 679 . ### safeguards should be provided to protect end - users against unsolicited communications , including for direct marketing purposes , which intrude into the private life of end - users . the degree of privacy intrusion and nuisance is considered relatively similar independently of the wide range of technologies and channels used to conduct these electronic communications , whether using automated calling and communication systems , instant messaging applications , emails , sms , mms , bluetooth , etc . it is therefore justified to require that consent of the end - user is obtained before commercial electronic communications for direct marketing purposes are sent to end - users in order to effectively protect individuals against the intrusion into their private life as well as the legitimate interest of legal persons . legal certainty and the need to ensure that the rules protecting against unsolicited electronic communications remain future - proof justify the need to define a single set of rules that do not vary according to the technology used to convey these unsolicited communications , while at the same time guaranteeing an equivalent level of protection for all citizens throughout the union . however , it is reasonable to allow the use of e - mail contact details within the context of an existing customer relationship for the offering of products or services . such possibility should only apply to the same company that has obtained the electronic contact details in accordance with regulation 2016 / 679 .


### terminal equipment of end - users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the end - users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes information that may reveal details of an individual’s emotional , political , social complexities , including the content of communications , pictures , the location of individuals by accessing the device’s gps capabilities , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . furthermore , the so - called spyware , web bugs , hidden identifiers , tracking cookies and other similar unwanted tracking tools can enter end - user’s terminal equipment without their knowledge in order to gain access to information , to store hidden information and to trace the activities . information related to the end - user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the end - user , and may seriously intrude upon the privacy of these end - users . techniques that surreptitiously monitor the actions of end - users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the end - users’ terminal equipment pose a serious threat to the privacy of end - users . therefore , any such interference with the end - user’s terminal equipment should be allowed only with the end - user’s consent and for specific and transparent purposes . ### terminal equipment of end - users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the end - users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes information that may reveal details of an individual’s emotional , political , social complexities , including the content of communications , pictures , the location of individuals by accessing the device’s gps capabilities , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . furthermore , the so - called spyware , web bugs , hidden identifiers , tracking cookies and other similar unwanted tracking tools can enter end - user’s terminal equipment without their knowledge in order to gain access to information , to store hidden information and to trace the activities . information related to the end - user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the end - user , and may seriously intrude upon the privacy of these end - users . techniques that surreptitiously monitor the actions of end - users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the end - users’ terminal equipment pose a serious threat to the privacy of end - users . therefore , any such interference with the end - user’s terminal equipment should be allowed only with the end - user’s consent or for clearly defined exceptions and for specific and transparent purposes .


### ‘ direct marketing communications’ means any form of advertising , whether written or oral , sent to one or more identified or identifiable end - users of electronic communications services , including the use of automated calling and communication systems with or without human interaction , electronic mail , sms , etc . ; ### ' direct marketing communications ' means any form of advertising , whether in written , audio , video , oral or any other format , sent , broadcast , served or presented to one or more identified or identifiable end - users of electronic communications services , including the use of automated calling and communication systems with or without human interaction , electronic mail , sms , etc . ;


### without prejudice to point of article 6 and points and of article 6 , the provider of the electronic communications service shall erase electronic communications metadata or make that data anonymous when it is no longer needed for the purpose of the transmission of a communication . ### without prejudice to article 6 and points , , and of article 6 , the provider of the electronic communications service shall erase electronic communications metadata or make that data anonymous when it is no longer needed for the purpose of the transmission of a communication .


### the possibility for end - users not to be included in a publicly available directory , or to verify , correct and delete any data related to them shall be provided free of charge . ### the possibility for end - users not to be included in a publicly available directory , or to verify , correct , update , supplement and delete any data related to them shall be provided free of charge and in an easily accessible manner .


### the provisions of this regulation particularise and complement the general rules on the protection of personal data laid down in regulation 2016 / 679 as regards electronic communications data that qualify as personal data . this regulation therefore does not lower the level of protection enjoyed by natural persons under regulation 2016 / 679 . processing of electronic communications data by providers of electronic communications services should only be permitted in accordance with this regulation . ### the provisions of this regulation particularise and complement the general rules on the protection of personal data laid down in regulation 2016 / 679 as regards electronic communications data that qualify as personal data . this regulation therefore does not lower the level of protection enjoyed by natural persons under regulation 2016 / 679 . on the contrary , it aims to provide additional , and complementary , safeguards taking into account the need for additional protection as regards the confidentiality of communications . processing of electronic communications data should only be permitted in accordance with , and on a legal ground specifically provided under , this regulation .


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ‘ hotspots’ situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ‘ hotspots’ situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . therefore , this regulation should apply to electronic communications data using electronic communications services which are targeting the general public and public communications networks . this regulation should not apply to closed groups of end - users such as corporate networks access to which is limited to members of the corporation . however , even if undefined end - users use the network in question in the context of the activities of the defined group of end - users , it should not preclude them from being considered outside the material scope of the regulation .


### electronic communications data should be treated as confidential . this means that any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . the prohibition of interception of communications data should apply during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , including browsing habits without the end - users’ consent . ### electronic communications data should be treated as confidential . this means that any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . the prohibition of interception of communications data should apply during their conveyance . for non - real - time electronic communication such as email or messaging , the transmission starts with the submission of the content for delivery and finishes with the receipt of the content of the electronic communication by the service provider of the intended recipient . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , including browsing habits without the end - users’ consent .


### electronic communications data should be treated as confidential . this means that any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . the prohibition of interception of communications data should apply during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , including browsing habits without the end - users’ consent . ### any processing of electronic communications data or any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , by persons other than the end - users , should be prohibited . when the processing is allowed under any exception to the prohibitions under the this regulation , any other processing of the electronic communications data on the basis of article 6 of the regulation 2016 / 679 shall be considered as prohibited , including processing for another purpose on the basis of article 6 of that regulation . this would not prevent controllers from asking for additional consent for new processing operations . the prohibition of interception of communications data should apply also during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee and any temporary files in the network after receipt . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , and analysis of end users’ electronic communications metadata , including browsing habits without the end - users’ consent .


### protection of information stored in and related to end - users’ terminal equipment ### protection of information transmitted to , stored in and collected from terminal equipment


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications shall be confidential . any processing of electronic communications data , including any interference with electronic communications data such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance of electronic communications data , by persons other than the users , shall be prohibited , except when permitted by this regulation . this includes electronic communications data that is stored after the transmission has been completed .


### in the case of a particular risk that may compromise the security of networks and electronic communications services , the provider of an electronic communications service shall inform end - users concerning such risk and , where the risk lies outside the scope of the measures to be taken by the service provider , inform end - users of any possible remedies , including an indication of the likely costs involved . ### provider of electronic communication services shall comply with the security obligations as prescribed regulation 2016 / 679 and [ european electronic communications code ] .


### exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the end - user . this may include the storing of cookies for the duration of a single established session on a website to keep track of the end - user’s input when filling in online forms over several pages . cookies can also be a legitimate and useful tool , for example , in measuring web traffic to a website . information society providers that engage in configuration checking to provide the service in compliance with the end - user’s settings and the mere logging of the fact that the end - user’s device is unable to receive content requested by the end - user should not constitute access to such a device or use of the device processing capabilities . ### exceptions to the obligation to obtain consent store information in terminal equipment or to access information stored in terminal equipment should be limited to situations that comply with all obligations pursuant to regulation 2016 / 679 . for instance , the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the consumer . this may include the storing of cookies on a website to keep track of the consumer’s input when filling in online forms over several pages or enabling other adaptation to individual preferences . cookies can also be a legitimate and useful tool to improve the performance of a website , for example , in measuring web traffic to a website or identify if consumers get error messages from certain pages on a website . similarly , providers of terminal equipment and the software needed to operate such equipment regularly need access to configuration and other device information and the processing and storage capabilities to maintain the equipment , prevent security vulnerabilities or their exploitation and correct problems related to the equipment’s operation . information society providers and electronic communications service providers that engage in configuration checking to provide the service in compliance with the consumer’s settings and the mere logging of the fact that the consumer’s device is unable to receive content requested by the consumer should not constitute access to such a device or use of the device processing capabilities .


### the providers of publicly available directories shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data . ### without prejudice to member states national law the providers of electronic information , communication and telecommunication services&#160 ; shall give end - users who are natural persons the right to object to data related to them being included in directories and shall provide a transparent information about the data being included in the directory and the means to verify , correct , update and delete such data .


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in a an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to inform the end - user about the possibility to express or withdraw his or her consent using appropriate technical settings . the end - user should be offered multiple options to choose from , including to prevent the storage of information on the terminal equipment . end - users should be offered a set of privacy setting options , ranging from , for example , rejecting cookies or trackers that are not necessary for the functionality of the website or other software to , for example , accepting tracking necessary for the functionality of the website or other software as well as for other purposes or , for example , accepting tracking necessary for the functionality of the website or other software and tracking for other purposes by parties that demonstrate the compliance with article 40 and 42 of regulation 2016 / 679 , and the possibility to opt out from cross - device tracking . these options may also be more fine - grained and , among other aspects , reflect the possibility that another party might act as a data processor in the meaning of regulation 2016 / 679 for the provider of the service . in cases where a business model is based on targeted advertising , consent should not be considered as freely given if the access to the service is made conditional on data processing . the end - user should therefore be able to choose between accepting cookies or being provided fair and reasonable options to access the service , such as subscription , payment or limited access to parts of the service or other options . where the end - user accepts cookies for purpose of targeted advertising , the end - user should also be able to correct the information gathered about him or her to prevent the possible harm caused by inaccurate information . such privacy settings should be presented in an easily visible and intelligible manner . information provided may include examples of benefits and risks associated with allowing cookies to be stored in the computer . such obligations do not arise where the software already seeks to prevent the storage of information on the terminal equipment of an end - user or the processing of information already stored on that equipment .


### the providers of publicly available directories shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data . ### the providers of electronic information , communication and telecommunication services shall collect the data of end - users who are natural persons in order to include their personal data in publicly accessible directories . upon the request of an end - user who is natural person the directory providers shall provide the end - user with transparent information about the data being included in the directory and the means to verify , correct , update , supplement and delete such data .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications metadata can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , in accordance with article 6 and 6 of regulation no 2016 / 679 . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to comply with regulation no 2016 / 679 when processing electronic communications metadata , which should include data on the location of the device . as an exception from obtaining end - users’ consent , the processing of electronic communications metadata for purposes other than those for which the personal data were initially collected should be allowed in cases where further processing is compatible in accordance with article 6 and article 6 of regulation 2016 / 679 generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . therefore , whenever the purpose of further processing cannot be achieved by processing data that is made anonymous , pseudonymisation of data should be allowed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 of regulation 2016 / 679 .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications metadata can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications networks and services to further process electronic communications metadata . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication , billing , interconnection payments or security . therefore , this regulation should , in principle , require providers of electronic communications networks and services to obtain end - users’ consent to further process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . as an exception from obtaining end - users’ consent , the processing of electronic communications metadata for purposes other than those for which the personal data were initially collected should be allowed in cases where the processing is compatible in accordance with point of article 6 of regulation 2016 / 679 . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### the member states should be allowed , within the limits of this regulation , to maintain or introduce national provisions to further specify and clarify the application of the rules of this regulation in order to ensure an effective application and interpretation of those rules . therefore , the margin of discretion , which member states have in this regard , should maintain a balance between the protection of private life and personal data and the free movement of electronic communications data . ### the european data protection board should , where necessary , issue guidance and opinions within the limits of this regulation , to further clarify the application of the rules of this regulation in order to ensure an effective application and interpretation of those rules . such guidance and opinions should take into account the dual objective of this regulation and should therefore maintain a balance between the protection of private life and personal data and the free movement of electronic communications data .


### the services used for communications purposes , and the technical means of their delivery , have evolved considerably . end - users increasingly replace traditional voice telephony , text messages and electronic mail conveyance services in favour of functionally equivalent online services such as voice over ip , messaging services and web - based e - mail services . in order to ensure an effective and equal protection of end - users when using functionally equivalent services , this regulation uses the definition of electronic communications services set forth in the [ directive of the european parliament and of the council establishing the european electronic communications code24 ] . that definition encompasses not only internet access services and services consisting wholly or partly in the conveyance of signals but also interpersonal communications services , which may or may not be number - based , such as for example , voice over ip , messaging services and web - based e - mail services . the protection of confidentiality of communications is crucial also as regards interpersonal communications services that are ancillary to another service ; therefore , such type of services also having a communication functionality should be covered by this regulation . _________________ 24 commission proposal for a directive of the european parliament and of the council establishing the european electronic communications code ) . ### the services used for communications purposes , and the technical means of their delivery , have evolved considerably . users and subscribers increasingly replace traditional voice telephony , text messages and electronic mail conveyance services in favour of functionally equivalent online services such as voice over ip , messaging services and web - based e - mail services , also known as “over - the - top services” . this regulation aims at ensuring an effective and equal protection of users and subscribers when using functionally equivalent services , so as to ensure the confidentiality of their communication , irrespective of the technological medium chosen . . that definition encompasses not only internet access services and services consisting wholly or partly in the conveyance of signals but also interpersonal communications services , which may or may not be number - based , such as for example , voice over ip , messaging services and web - based e - mail services . the protection of confidentiality of communications is crucial also as regards interpersonal communications services that are ancillary to another service , such as internal messaging , newsfeeds , timelines and similar functions in online services where messages are exchanged with other users within or outside that service ; therefore , such type of services also having a communication functionality should be covered by this regulation .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications metadata can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to further process electronic communications metadata . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to comply with regulation 2016 / 679 when processing electronic communications metadata , which should include data on the location of the device . the processing of electronic communications metadata for purposes other than those for which the personal data were initially collected should be allowed in cases where consent was obtained for the initial collection and the further processing is compatible in accordance with article 6 of regulation 2016 / 679 . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### where a natural or legal person obtains electronic contact details for e - mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own similar products or services only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the right to object shall be given at the time of collection and each time a message is sent . ### where a natural or legal person obtains electronic contact details for electronic mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own similar products or services for a period of no more than 12 months only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the customer shall be informed about the right to object and shall be given an easy way to exercise it at the time of collection and each time a message is sent .


### directive 2002 / 58 / ec is repealed with effect from 25 may 2018 . ### directive 2002 / 58 / ec and regulation 611 / 2013 are repealed with effect from [ xxx ] .


### the possibility for end - users not to be included in a publicly available directory , or to verify , correct and delete any data related to them shall be provided free of charge . ### the possibility for end - users not to be included in a publicly available directory , or to verify , correct and delete any data related to them shall be provided free of charge and in an easily accessible manner by the party that collected the consent or directly from the provider of publicly available directory .


### the services used for communications purposes , and the technical means of their delivery , have evolved considerably . end - users increasingly replace traditional voice telephony , text messages and electronic mail conveyance services in favour of functionally equivalent online services such as voice over ip , messaging services and web - based e - mail services . in order to ensure an effective and equal protection of end - users when using functionally equivalent services , this regulation uses the definition of electronic communications services set forth in the [ directive of the european parliament and of the council establishing the european electronic communications code24 ] . that definition encompasses not only internet access services and services consisting wholly or partly in the conveyance of signals but also interpersonal communications services , which may or may not be number - based , such as for example , voice over ip , messaging services and web - based e - mail services . the protection of confidentiality of communications is crucial also as regards interpersonal communications services that are ancillary to another service ; therefore , such type of services also having a communication functionality should be covered by this regulation . __________________ 24 commission proposal for a directive of the european parliament and of the council establishing the european electronic communications code ) . ### the services used for communications purposes , and the technical means of their delivery , have evolved considerably . end - users increasingly replace traditional voice telephony , text messages and electronic mail conveyance services in favour of functionally equivalent online services such as voice over ip , messaging services and web - based e - mail services . in order to ensure an effective and equal protection of end - users when using functionally equivalent services , this regulation uses the definition of electronic communications services set forth in the [ directive of the european parliament and of the council establishing the european electronic communications code24 ] . that definition encompasses not only internet access services and services consisting wholly or partly in the conveyance of signals but also interpersonal communications services , which may or may not be number - based , such as for example , voice over ip , messaging services and web - based e - mail services . the protection of confidentiality of communications is crucial also as regards interpersonal communications services that are ancillary to another service , such as internal messaging , newsfeeds , timelines and similar functions in online services where messages are exchanged with other users within or outside that service ; therefore , such type of services also having a communication functionality should be covered by this regulation . __________________ 24 commission proposal for a directive of the european parliament and of the council establishing the european electronic communications code ) .


### where a natural or legal person obtains electronic contact details for electronic mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own similar products or services only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the right to object shall be given at the time of collection and each time a message is sent . ### where a natural or legal person obtains electronic contact details for e - mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own products or services only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the customer shall be informed about the right to object and shall be given an easy way to exercise it at the time of collection and each time a message is sent .


### it is necessary for billing , calculating interconnection payments , detecting or stopping fraudulent , or abusive use of , or subscription to , electronic communications services ; or ### it is strictly necessary for billing , calculating interconnection payments , detecting or stopping fraudulent use of , or subscription to , electronic communications services ; or


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . end - users should be offered to choose appropriate technical settings expressing their privacy preferences . such privacy settings should be presented in an easily visible and intelligible manner .


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### after receiving all relevant information about the intended processing in a clear and easily understandable language , provided separately from the terms and conditions of the provider , the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to all end - users , or which are provided in order to deliver a specific functionality to the end - user concerned , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . consent may be provided to the provider of the communication service or to the provider of the specific service , but if it is provided to the latter , the latter must be able to prove to the provider of the communication service that such consent has been given .


### exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the end - user . this may include the storing of cookies for the duration of a single established session on a website to keep track of the end - user’s input when filling in online forms over several pages . cookies can also be a legitimate and useful tool , for example , in measuring web traffic to a website . information society providers that engage in configuration checking to provide the service in compliance with the end - user’s settings and the mere logging of the fact that the end - user’s device is unable to receive content requested by the end - user should not constitute access to such a device or use of the device processing capabilities . ### exceptions to the obligation to obtain consent store information in terminal equipment or to access information stored in terminal equipment should be limited to situations that comply with all obligations pursuant to regulation 2016 / 679 . for instance , the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the consumer . this may include the storing of cookies on a website to keep track of the consumer’s input when filling in online forms over several pages or enabling other adaptation to individual preferences . cookies can also be a legitimate and useful tool to improve the performance of a website , for example , in measuring web traffic to a website or identify if consumers get error messages from certain pages on a website . similarly , providers of terminal equipment and the software needed to operate such equipment regularly need access to configuration and other device information and the processing and storage capabilities to maintain the equipment , prevent security vulnerabilities or their exploitation and correct problems related to the equipment’s operation . information society providers and electronic communications service providers that engage in configuration checking to provide the service in compliance with the consumer’s settings and the mere logging of the fact that the consumer’s device is unable to receive content requested by the consumer should not constitute access to such a device or use of the device processing capabilities .


### the definition of and conditions for consent provided for under articles 4 and 7 of regulation 2016 / 679 / eu shall apply . ### the definitions of and conditions for consent provided for under articles 4 and 7 , and of regulation 2016 / 679 shall apply .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . as an exemption from obtaining end - user´s consent , the processing of metadata for purposes other than those for which they were initially collected should be allowed in cases where the processing is compatible and is subject to specific safeguards , especially pseudonymisation as set forth in point of article 6 of regulation 2016 / 679 , as well as if it is necessary in accordance with article 6 of regulation 2016 / 679 for the purpose of legitimate interest , provided that the data protection impact assessment was carried out , as prescribed in article 35 of regulation 2016 / 679 .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . examples of such usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colours to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals , provided that the data are immediately anonymised or anonymisation techniques are used where the user is mixed with others . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .