### to facilitate and improve the proper functioning of the ceas and to assist member states in implementing their obligations within the framework of ceas , the european union agency for asylum should provide member states with operational and technical assistance , in particular when their asylum and receptions systems are subject to disproportionate pressure . the agency should provide the necessary operational and technical assistance through the deployment of asylum support teams consisting of experts from the agency ' s own staff , experts from member states or experts seconded by member states to the agency , and based on an operational plan . those teams should support member states with operational and technical measures , including by providing expertise relating to identification and registration of third countries nationals , interpreting services , information on countries of origin and knowledge of the handling and management of asylum cases , as well as by assisting national authorities competent for the examination of applications for international protection and by assisting with relocation . the arrangements for the asylum support teams should be governed by this regulation in order to ensure their effective deployment . ### to facilitate and improve the proper functioning of the ceas and to assist member states in implementing their obligations within the framework of ceas , the european union agency for asylum should provide member states with operational and technical assistance , in particular when their asylum and receptions systems are subject to disproportionate pressure . the agency should provide the necessary operational and technical assistance through the deployment of asylum support teams consisting of experts from the agency ' s own staff , experts from member states or experts seconded by member states to the agency , and based on an operational plan . members of the asylum support teams should have been trained by the agency and have a relevant experience . those teams should support member states with operational and technical measures , including by providing expertise relating to identification and registration of third countries nationals , interpreting services , information on countries of origin and knowledge of the handling and management of asylum cases , as well as by assisting national authorities competent for the examination of applications for international protection and by assisting with relocation . the arrangements for the asylum support teams should be governed by this regulation in order to ensure their effective deployment .


### the common eu list of safe countries of origin established by regulation no xxx / xxx 9 should be regularly reviewed by the commission . having regard to the agency ' s expertise , it should assist the commission in reviewing that list . the agency should also , at the request of the commission , provide it with information on specific third countries which could be included in the common eu list of safe countries of origin , and on third countries designated as safe countries of origin or safe third countries or to which the concepts of safe third country , first country of asylum or european safe third country by member states apply . __________________ 9 oj l [ … ] ### the common eu list of safe countries of origin established by regulation no xxx / xxx 9 should be regularly reviewed by the commission . having regard to the agency ' s expertise , it should assist the commission in reviewing that list . the agency should also provide the commission and the european parliament with information on specific third countries which could be included in the common eu list of safe countries of origin , and on third countries designated as safe countries of origin or safe third countries or to which the concepts of safe third country , first country of asylum or european safe third country by member states apply . __________________ 9 oj l [ &#8230 ; ]


### develop a common format and a common methodology including terms of reference , in line with the requirements of union law on asylum , for developing reports and other products with information on countries of origin at the level of the union . ### develop a common format and a common methodology including terms of reference and evaluation criteria , in line with the requirements of international and union law on asylum , for developing reports and other products with information on countries of origin at the level of the union .


### assist with the relocation or transfer of beneficiaries of international protection within the union ; ### provide assistance and ensure the relocation or transfer of applicants or beneficiaries of international protection within the union ;


### the european union agency for asylum should facilitate operational cooperation between member states in matters covered by this regulation . it should also cooperate with authorities of third - countries in the framework of working arrangements which should receive the commission ' s prior approval . the agency should act in accordance with the union ' s external relations policy and under no circumstances should it formulate any independent external policy . in their cooperation with third countries , the agency and the member states should comply with norms and standards at least equivalent to those set by union legislation also when the cooperation with third countries takes place on the territory of those countries . ### the european union agency for asylum should facilitate operational cooperation between member states in matters covered by this regulation . it should also cooperate with authorities of third - countries in the framework of working arrangements which should receive the commission ' s prior approval . the agency should act in accordance with the union ' s external relations policy and under no circumstances should it formulate any independent external policy . in their cooperation with third countries , the agency and the member states should comply with norms and standards at least equivalent to those set by union legislation also when the cooperation with third countries takes place on the territory of those countries . the european parliament should be timely informed and be able to ask the commission and the agency to report on the state of cooperation with any particular third - country .


### member states shall contribute to the asylum intervention pool through a national expert pool on the basis of the various defined profiles and by nominating experts corresponding to the required profiles . the duration of deployment shall be determined by the home member state but it shall not be less than 30 days . ### member states shall contribute to the asylum intervention pool through a national expert pool on the basis of the various defined profiles and by nominating experts corresponding to the required profiles . the duration of deployment shall be determined by the home member state but it shall not be less than 60 days .


### monitor the implementation and assess all aspects of the ceas in member states , in particular the dublin system , reception conditions , asylum procedures , the application of criteria determining protection needs and the nature and quality of protection afforded to persons in need of international protection by member states , including as regards the respect of fundamental rights , child protection safeguards and the needs of vulnerable persons ; ### monitor the implementation and assess all aspects of the ceas in member states , in particular the dublin system , reception conditions , asylum procedures , relocation procedures , the application of criteria determining protection needs and the nature and quality of protection afforded to persons in need of international protection by member states , including as regards the respect of fundamental rights , child protection safeguards , family reunification and the needs of vulnerable persons and resettlement ;


### make use of all relevant sources of information , including its information analysis on the situation of asylum and other information gathered from governmental , non - governmental and international organisations , including through the networks referred to in article 9 , as well as union institutions , agencies , bodies , offices and the european external action service ; ### make use of all relevant sources of information , including its information analysis on the situation of asylum and other information gathered from governmental , non - governmental and international organisations , in particular unhcr , including through the networks referred to in article 9 , fact finding missions , as well as union institutions , agencies , bodies , offices and the european external action service ;


### to ensure a high degree of uniformity as regards asylum procedures , reception conditions and the assessment of protection needs across the union , the agency should organise and coordinate activities promoting union law . for that purpose , the agency should assist member states by developing operational standards and indicators for monitoring compliance with those standards . the agency should also develop guidelines on asylum - related matters and should enable the exchange of best practices among member states . ### to ensure a high degree of uniformity as regards asylum procedures , reception conditions and the assessment of protection needs across the union , the agency should organise and coordinate activities promoting union law . for that purpose , the agency should assist member states by developing operational standards and indicators for monitoring compliance with those standards , as well as with established international rules . the agency should also develop guidelines on asylum - related matters and should coordinate the exchange of best practices among member states .


### in cases where a member state ' s asylum and reception systems are subject to disproportionate pressure that places exceptionally heavy and urgent demands on their asylum or reception systems , the european union agency for asylum should assist that member state upon request or on the agency ' s own initiative , by means of a comprehensive set of measures , including the deployment of experts from the asylum intervention pool . to ensure the availability of those experts and their immediate deployment , the asylum intervention pool should constitute a reserve of experts from member states amounting to a minimum of 500 persons . the agency should itself be able to intervene in support of a member state where despite the disproportionate pressure , the member state concerned does not request for sufficient assistance from the agency or the member state does not take sufficient action to address that pressure with the consequence that the asylum and reception systems would be ineffective to the extent of jeopardising the functioning of the ceas . a disproportionate number of applications for international protection for which a member states is responsible may be an indication of disproportionate pressure . ### in cases where a member state ' s asylum and reception systems are subject to disproportionate pressure that places exceptionally heavy and urgent demands on their asylum or reception systems , the european union agency for asylum should assist that member state upon request or on the agency ' s own initiative , by means of a comprehensive set of measures , including the deployment of experts from the asylum intervention pool . to ensure the availability of those experts and their immediate deployment , the asylum intervention pool should constitute a reserve of experts from member states amounting to a minimum of 500 persons . if necessary , the agency should be able to recruit personnel in order to be able to provide the required support to member states . the agency should itself be able to intervene in support of a member state where despite the disproportionate pressure , the member state concerned does not request for sufficient assistance from the agency or the member state does not take sufficient action to address that pressure with the consequence that the asylum and reception systems would be ineffective to the extent of jeopardising the functioning of the ceas . a disproportionate number of applications for international protection for which a member states is responsible may be an indication of disproportionate pressure .


### the commission may request the agency to carry out a review of the situation in any such third country with a view to assess whether the relevant conditions and criteria set out in that directive are respected . ### the commission or the european parliament may request the agency to carry out a review of the situation in any such third country with a view to assess whether the relevant conditions and criteria set out in that directive are respected .


### monitor compliance by member states with operational standards , indicators guidelines and best practices on asylum ; ### monitor compliance by member states with operational standards , indicators guidelines and best practices on asylum , as well as international law in close synergy with the unchr ;


### the recommendations should be followed up on the basis of an action plan prepared by the member state concerned . if , within the set period of time , the member state concerned does not take the necessary measures to address the recommendations , and the shortcomings in the asylum and reception systems are so serious that they jeopardize the functioning of the ceas , the commission should , based on its own assessment of the implementation of the action plan and the seriousness of the shortcomings , adopt recommendations addressed to that member state outlining the measures needed to remedy the serious shortcomings . the commission may need to organise on - site visits to the member state concerned to verify the implementation of the action plan . where necessary , the commission should also identify the measures that should be taken by the agency in support of that member state . if the member state should remain non - compliant for a certain period of time , the commission may take further action requiring the agency to intervene in support of that member state . ### the recommendations should be followed up on the basis of an action plan prepared by the member state concerned . the commission should also identify the measures that should be taken by the union and the agency in support of that member state . if , within the set period of time , the member state concerned does not take the necessary measures to address the recommendations , and the shortcomings in the asylum and reception systems are so serious that they jeopardize the functioning of the ceas , the commission should , based on its own assessment of the implementation of the action plan and the seriousness of the shortcomings , adopt recommendations addressed to that member state outlining the measures needed to remedy the serious shortcomings . the commission may need to organise on - site visits to the member state concerned to verify the implementation of the action plan . if the member state should remain non - compliant for a certain period of time , the commission may take further action requiring the union and the agency to intervene in support of that member state and continue insisting on the need of compliance .


### for member states that are faced with specific and disproportionate pressure on their asylum and reception systems due , in particular , to their geographical or demographic situation , the european union agency for asylum should support the development of solidarity within the union and assist in the better relocation of beneficiaries of international protection among member states , while ensuring that asylum and reception systems are not abused . ### for member states that are faced with specific and disproportionate pressure on their asylum and reception systems due , in particular , to their geographical , economic or demographic situation , the european union agency for asylum should support the development of solidarity within the union and fair share of responsibility , assisting in the better relocation of applicants or beneficiaries of international protection among member states , while ensuring that asylum and reception systems are not abused .


### the european union agency for asylum shall ensure the efficient and uniform application of union asylum law in member states . it shall facilitate the implementation and improve the functioning of the common european asylum system , and it shall be responsible for enabling convergence in the assessment of applications for international protection across the union . ### the european union agency for asylum shall ensure the efficient and uniform application of union asylum law in member states . it shall facilitate the implementation and improve the functioning of the common european asylum system in line with international law and standards , and it shall be responsible for enabling convergence in the assessment of applications for international protection across the union .


### the management board shall include one representative of unhcr , without the right to vote . ### the management board shall include one representative of unhcr and one representative of the european agency for fundamental rights without the right to vote .


### the agency shall work closely with the member states ' asylum authorities , with national immigration and asylum services and other national services and with the commission . the agency shall carry out its duties without prejudice to those assigned to other relevant bodies of the union and shall work closely with those bodies and with the united nations high commissioner for refugees . ### the agency shall work closely with the member states ' asylum authorities , with national immigration and asylum services and other national services and with the commission . the agency shall carry out its duties without prejudice to those assigned to other relevant bodies of the union and shall work closely with those bodies and with the united nations high commissioner for refugees , while benefiting from the expertise of other un - related bodies , such as the international organisation for migration .


### the agency shall be a centre for gathering relevant , reliable , accurate and up - to date information on countries of origin of persons applying for international protection , including child - specific information and targeted information on persons belonging to vulnerable groups . it shall draw up and regularly update reports and other products providing for information on countries of origin at the level of the union including on thematic issues specific to countries of origin . ### the agency shall be an independent centre for gathering relevant , reliable , accurate and up - to date information on countries of origin of persons applying for international protection , including child - specific , gender - specific and sexual orientation - specific information and targeted information on persons belonging to vulnerable groups . it shall draw up and regularly update reports and other products providing for information on countries of origin at the level of the union including on thematic issues specific to countries of origin .


### member states shall ensure that the experts that they contribute match the profiles and numbers decided upon by the management board . the duration of deployment shall be determined by the home member state but it shall not be less than 30 days . ### member states shall ensure that the experts that they contribute match the profiles and numbers requested by the member state in need . the duration of deployment shall be determined by the home member state but it shall not be less than 60 days .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colours to indicate the presence of individuals . this should be done in accordance with article 25 of regulation 2016 / 679 . to display the traffic movements in certain directions during a certain period of time , an identifier may be necessary to link the positions of individuals at certain time intervals . when processing electronic communications metadata , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 .


### end - users who have consented to the processing of electronic communications data as set out in point of article 6 and points and of article 6 shall be given the possibility to withdraw their consent at any time as set forth under article 7 of regulation 2016 / 679 and be reminded of this possibility at periodic intervals of 6 months , as long as the processing continues . ### end - users who have given their consent to the processing of electronic communications data as set out in point c of article 6 and points a and b of article 6 , point b of article 8 and point aa of article 8 shall be given the possibility to withdraw their consent at any time as set forth under article 7 of regulation 2016 / 679 and be reminded of this possibility at periodic intervals of 6 months , as long as the processing continues .


### without prejudice to paragraph 1 , where technically possible and feasible , for the purposes of point of article 8 , consent may be expressed by using the appropriate technical settings of a software application enabling access to the internet . ### without prejudice to paragraph 1 , where technically possible and feasible , for the purposes of point of article 8 , consent may be expressed by using technical specifications of electronic communications services . when such technical specifications are used by the end - user , they shall be binding on , and enforceable against , any other party .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or any processing of electronic communications data regardless of whether this data is in transit or stored , by persons other than the end - users , shall be prohibited , except when permitted by this regulation .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colours to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### terminal equipment of end - users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the end - users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes information that may reveal details of an individual ' s emotional , political , social complexities , including the content of communications , pictures , the location of individuals by accessing the device’s gps capabilities , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . furthermore , the so - called spyware , web bugs , hidden identifiers , tracking cookies and other similar unwanted tracking tools can enter end - user ' s terminal equipment without their knowledge in order to gain access to information , to store hidden information and to trace the activities . information related to the end - user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the end - user , and may seriously intrude upon the privacy of these end - users . techniques that surreptitiously monitor the actions of end - users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the end - users’ terminal equipment pose a serious threat to the privacy of end - users . therefore , any such interference with the end - user ' s terminal equipment should be allowed only with the end - user ' s consent and for specific and transparent purposes . ### terminal equipment of end - users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the end - users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes very sensitive data that may reveal details of the behaviour , psychological features , emotional condition and political and social preferences of an individual , including the content of communications , pictures , the location of individuals by accessing the gps capabilities of their device , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . information related to the end - user ' s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ' device fingerprinting ' , often without the knowledge of the end - user , and may seriously intrude upon the privacy of these end - users . furthermore , so - called spyware , web bugs , hidden identifiers and unwanted tracking tools can enter end - users ' terminal equipment without their knowledge in order to gain access to information or to store hidden information . techniques that surreptitiously monitor the actions of end - users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the end - users ' terminal equipment pose a serious threat to the privacy of end - users . therefore , any such interference with the end - user ' s terminal equipment should be allowed only with the end - user ' s consent and for specific and transparent purposes . end - users should receive all relevant information about the intended processing in clear and easily understandable language . such information should be provided separately from the terms and conditions of the service .


### the protection of information related to the terminal equipment of end - users located in the union . ### the protection of information related to the terminal equipment of end - users in the union .


### natural or legal persons may use electronic communications services for the purposes of sending direct marketing communications to end - users who are natural persons that have given their consent . ### the use by natural or legal persons of electronic communications services , including voice - to - voice calls , automated calling and communications systems , including semi - automated systems that connect the call person to an individual , faxes , e - mail or other use of electronic communications services for the purposes of presenting unsolicited or direct marketing communications to end - users , shall be allowed only in respect of end - users who have given their prior consent .


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ' accept all cookies ' . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent by default the cross - domain tracking and storing of information on the terminal equipment by other parties ; this is often presented as ' reject third party trackers and cookies ' . end - users should be offered , by default , a set of privacy setting options , ranging from higher to lower and intermediate . these options may also be more fine - grained . privacy settings should also include options to allow the user to decide for example , whether flash , javascript or similar software can be executed , if a website can collect geo - location data from the user , or if it can access specific hardware such as a webcam or microphone . such privacy settings should be presented in an easily visible , objective and intelligible manner .


### the provisions of this regulation particularise and complement regulation 2016 / 679 by laying down specific rules for the purposes mentioned in paragraphs 1 and 2 . ### the provisions of this regulation particularise and complement regulation 2016 / 679 by laying down necessary specific rules for the purposes mentioned in paragraphs 1 and 2 .


### it is done exclusively in order to , for the time necessary for , and for the purpose of establishing a connection ; or ### it is done exclusively in order to , for the time necessary for , and for the sole purpose of establishing a connection requested by the end - user ; or


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### after receiving all relevant information about the intended processing in clear and easily understandable language , provided separately from the terms and conditions of the provider , the user or users concerned have given their specific consent to the processing of their communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled without the processing of such metadata .


### this regulation applies to the processing of electronic communications data carried out in connection with the provision and the use of electronic communications services and to information related to the terminal equipment of end - users . ### this regulation applies to the processing of electronic communications data carried out in connection with the provision and the use of electronic communications services and to information related to or processed by the terminal equipment of end - users .


### the use of processing and storage capabilities of terminal equipment and the collection of information from end - users ' terminal equipment , including about its software and hardware , other than by the end - user concerned shall be prohibited , except on the following grounds : ### the use of processing and storage capabilities of terminal equipment and the collection of information from end - users ' terminal equipment , or making information available through the terminal equipment , including information about or generated by its software and hardware , other than by the end - user concerned shall be prohibited , except on the following grounds :


### the methods used for providing information and obtaining end - user ' s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , end - users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , end - users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should provide for the possibility to express consent by using the appropriate settings of a browser or other application . the choices made by end - users when establishing its general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . web browsers are a type of software application that permits the retrieval and presentation of information on the internet . other types of applications , such as the ones that permit calling and messaging or provide route guidance , have also the same capabilities . web browsers mediate much of what occurs between the end - user and the website . from this perspective , they are in a privileged position to play an active role to help the end - user to control the flow of information to and from the terminal equipment . more particularly web browsers may be used as gatekeepers , thus helping end - users to prevent information from their terminal equipment from being accessed or stored . ### the methods used for providing information and obtaining end - user ' s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , end - users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , end - users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should prevent the use of so - called ' cookie walls ' and ' cookie banners ' that do not help users to maintain control over their personal information and privacy or become informed about their rights . this regulation should provide for the possibility to express consent by technical specifications , for instance by using the appropriate settings of a browser or other application . those settings should include choices concerning the storage of information on the user ' s terminal equipment as well as a signal sent by the browser or other application indicating the user ' s preferences to other parties . the choices made by users when establishing the general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . web browsers are a type of software application that permits the retrieval and presentation of information on the internet . other types of applications , such as the ones that permit calling and messaging or provide route guidance , have also the same capabilities . web browsers mediate much of what occurs between the end - user and the website . from this perspective , they are in a privileged position to play an active role to help the user to control the flow of information to and from the terminal equipment . more particularly , web browsers , applications or mobile operating systems may be used as the executor of the choices of an end - user , thus helping end - users to prevent information from their terminal equipment from being accessed or stored .


### without prejudice to point of article 6 and points and of article 6 , the provider of the electronic communications service shall erase electronic communications content or make that data anonymous after receipt of electronic communication content by the intended recipient or recipients . such data may be recorded or stored by the end - users or by a third party entrusted by them to record , store or otherwise process such data , in accordance with regulation 2016 / 679 . ### without prejudice to points and of article 6 and points and of article 6 , the provider of the electronic communications service shall erase electronic communications content after receipt of electronic communication content by the intended recipient or recipients . such data may be recorded or stored by the end - users or by a party , which could be the provider of the electronic communication service , specifically entrusted by the end - user to record , store or otherwise process such data . the end - user may further process the content in accordance with regulation 2016 / 679 , if applicable .


### software placed on the market permitting electronic communications , including the retrieval and presentation of information on the internet , shall offer the option to prevent third parties from storing information on the terminal equipment of an end - user or processing information already stored on that equipment . ### software placed on the market permitting electronic communications , including the retrieval and presentation of information on the internet , shall :


### upon installation , the software shall inform the end - user about the privacy settings options and , to continue with the installation , require the end - user to consent to a setting . ### for the purpose of points a and b of paragraph 1 , the settings shall include a signal which is sent to the other parties to inform them about the user ' s privacy settings . these settings shall be binding on , and enforceable against , any other party .


### terminal equipment of end - users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the end - users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes information that may reveal details of an individual ' s emotional , political , social complexities , including the content of communications , pictures , the location of individuals by accessing the device’s gps capabilities , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . furthermore , the so - called spyware , web bugs , hidden identifiers , tracking cookies and other similar unwanted tracking tools can enter end - user ' s terminal equipment without their knowledge in order to gain access to information , to store hidden information and to trace the activities . information related to the end - user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the end - user , and may seriously intrude upon the privacy of these end - users . techniques that surreptitiously monitor the actions of end - users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the end - users’ terminal equipment pose a serious threat to the privacy of end - users . therefore , any such interference with the end - user ' s terminal equipment should be allowed only with the end - user ' s consent and for specific and transparent purposes . ### terminal equipment of end - users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the end - users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes information that may reveal details of an individual ' s emotional , political , social complexities , including the content of communications , pictures , the location of individuals by accessing the device ' s gps capabilities , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . furthermore , the so - called spyware , web bugs , hidden identifiers , tracking cookies and other similar unwanted tracking tools can enter end - user ' s terminal equipment without their knowledge in order to gain access to information , to store hidden information and to trace the activities or to instigate certain technical operations or tasks , often without the knowledge of the user . information related to the end - user ' s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ' device fingerprinting ' , often without the knowledge of the end - user , and may seriously intrude upon the privacy of these end - users . techniques that surreptitiously monitor the actions of end - users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the end - users ' terminal equipment pose a serious threat to the privacy of end - users . therefore , any such interference with the end - user ' s terminal equipment should be allowed only with the end - user ' s consent and for specific , limited , and transparent purposes


### it is necessary for billing , calculating interconnection payments , detecting or stopping fraudulent , or abusive use of , or subscription to , electronic communications services ; or ### it is strictly necessary for billing , calculating interconnection payments , detecting or stopping fraudulent , unlawful use of , or subscription to , electronic communications services ; or


### the end - user has given his or her consent ; or ### the user has given his or her specific consent , which shall not be mandatory to access the service ; or


### providers of electronic communications networks and services may process electronic communications data if : ### providers of electronic communications networks and services may process electronic communications data only if :


### service providers who offer electronic communications services should inform end - users of measures they can take to protect the security of their communications for instance by using specific types of software or encryption technologies . the requirement to inform end - users of particular security risks does not discharge a service provider from the obligation to take , at its own costs , appropriate and immediate measures to remedy any new , unforeseen security risks and restore the normal security level of the service . the provision of information about security risks to the subscriber should be free of charge . security is appraised in the light of article 32 of regulation 2016 / 679 . ### service providers who offer electronic communications services should process electronic communications data in such a way as to prevent unauthorised access , disclosure or alteration , ensure that such unauthorised access , disclosure or alteration is capable of being ascertained , and also ensure that such electronic communications data are protected by using specific types of software and encryption technologies . the requirement to inform end - users of particular security risks does not discharge a service provider from the obligation to take , at its own costs , appropriate and immediate measures to remedy any new , unforeseen security risks and restore the normal security level of the service . the provision of information about security risks to the subscriber should be free of charge . security is appraised in the light of article 32 of regulation 2016 / 679 . the obligations of article 40 of the [ european electronic communications code ] should apply to all services within the scope of this regulation as regards the security of networks and services and related security obligations thereto .


### the providers of publicly available directories shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data . ### the providers of publicly available directories or the electronic communication service providers shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data .


### if it is necessary for web audience measuring , provided that such measurement is carried out by the provider of the information society service requested by the end - user . ### if it is technically necessary for web audience measuring of the information society service requested by the end - user , provided that such measurement is carried out by the provider , or on behalf of the provider , or by an independent web analytics agency acting in the public interest or for scientific purpose ; and further provided that no personal data is made accessible to any other party and that such web audience measurement does not adversely affect the fundamental rights of the end - user .


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### the end - user concerned , after receiving all relevant information about the intended processing in clear and easily understandable language , provided separately from the terms and conditions of the provider , has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled without the processing of such metadata .


### present the identity of a line on which they can be contacted ; or ### present the identity of a line on which they can be contacted ; and


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ' accept all cookies ' . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent by default the cross - domain tracking and storing of information on the terminal equipment by other parties ; this is often presented as ' reject third party trackers and cookies ' . end - users should be offered , by default , a set of privacy setting options , ranging from higher to lower and intermediate . these options may also be more fine - grained . privacy settings should also include options to allow the user to decide for example , whether flash , javascript or similar software can be executed , if a website can collect geo - location data from the user , or if it can access specific hardware such as a webcam or microphone . such privacy settings should be presented in an easily visible , objective and intelligible manner .


### the information to be provided pursuant to point of paragraph 2 may be provided in combination with standardized icons in order to give a meaningful overview of the collection in an easily visible , intelligible and clearly legible manner . ### the information to be provided pursuant to points and of paragraph 2 may be provided in combination with standardized icons in order to give a meaningful overview of the collection in an easily visible , intelligible and clearly legible manner .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . examples of such usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colours to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals , provided that the data are immediately anonymised or anonymisation techniques are used where the user is mixed with others . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### in response to the growing public demand for tax transparency and to promote investment firms ' corporate responsibility , it is appropriate to require that investment firms disclose certain information , including information on profits made , taxes paid and any public subsidies received . ### in response to the growing public demand for tax transparency and to promote investment firms ' corporate responsibility , it is appropriate to require that investment firms disclose on a yearly basis certain information , including information on profits made , taxes paid and any public subsidies received .


### many of the requirements that stem from regulation no 575 / 2013 and directive 2013 / 36 / eu framework are designed to address common risks faced by credit institutions . accordingly , the existing requirements are largely calibrated to preserve the lending capacity of credit institutions through economic cycles and to protect depositors and taxpayers from possible failure , and are not designed to address the different risk - profiles of investment firms . investment firms do not have large portfolios of retail and corporate loans and do not take deposits . the likelihood that their failure can have detrimental impacts for overall financial stability is lower than in the case of credit institutions . the risks faced and posed by investment firms are thus substantially different to the risks faced and posed by credit institutions and such difference should be clearly reflected in the prudential framework of the union . ### many of the requirements that stem from regulation no 575 / 2013 and directive 2013 / 36 / eu framework are designed to address common risks faced by credit institutions . accordingly , the existing requirements are largely calibrated to preserve the lending capacity of credit institutions through economic cycles and to protect depositors and taxpayers from possible failure , and are not designed to address the different risk - profiles of investment firms . investment firms do not have large portfolios of retail and corporate loans and do not take deposits . the likelihood that their failure can have detrimental impacts for overall financial stability is lower than in the case of credit institutions , but they still pose a risk which has to be addressed through a robust framework . the risks faced and posed by investment firms are thus substantially different to the risks faced and posed by credit institutions and such difference should be clearly reflected in the prudential framework of the union .


### competent authorities shall inform eba of administrative penalties and measures imposed pursuant to article 16 , of any appeal against those penalties and measures and of the outcome thereof . eba shall maintain a central database of administrative penalties and measures communicated to it solely for the purpose of exchanging information between competent authorities . that database shall be accessible to competent authorities only and it shall be updated regularly . ### competent authorities shall inform eba of administrative penalties and measures imposed pursuant to article 16 , of any appeal against those penalties and measures and of the outcome thereof . eba shall maintain a central database of administrative penalties and measures communicated to it solely for the purpose of exchanging information between competent authorities . that database shall be accessible to competent authorities and esma , and it shall be updated regularly , at least on a quarterly basis .


### in case of a legal person , administrative pecuniary penalties of up to 10% of the total annual net turnover , including the gross income consisting of interest receivable and similar income , income from shares and other variable or fixed - yield securities , and commissions or fees of the undertaking in the preceding business year ; ### in case of a legal person , administrative pecuniary penalties of up to 15% of the total annual net turnover , including the gross income consisting of interest receivable and similar income , income from shares and other variable or fixed - yield securities , and commissions or fees of the undertaking in the preceding business year ;


### member states shall ensure that competent authorities have the necessary powers to guarantee that investment firms which are determined as significant in accordance with article 26 establish a remuneration committee . that remuneration committee shall exercise competent and independent judgment on remuneration policies and practices and the incentives created for managing risk , capital and liquidity . ### member states shall ensure that competent authorities have the necessary powers to guarantee that investment firms which do not comply with the criteria in point of the first subparagraph of article 30 establish a remuneration committee . that remuneration committee shall exercise competent and independent judgment on remuneration policies and practices and the incentives created for managing risk , capital and liquidity . within a group , the remuneration committee can also be a group - wide remuneration committee .


### at least 40% of the variable remuneration shall be deferred over a three to five year period as appropriate , depending on the business cycle of the investment firm , the nature of its business , its risks and the activities of the individual in question , except in the case of a variable remuneration of a particularly high amount where the proportion of the variable remuneration deferred is at least 60% ; ### at least 50% of the variable remuneration shall be deferred over a three to five year period as appropriate , depending on the business cycle of the investment firm , the nature of its business , its risks and the activities of the individual in question , except in the case of a variable remuneration of a particularly high amount where the proportion of the variable remuneration deferred is at least 70% ;


### the investment firm is exposed to risks or elements of risks that are not covered or not sufficiently covered by the capital requirement set out in part three of [ regulation - - - / - - - - [ ifr ] ; ### the investment firm is exposed to risks or elements of risks that are not covered or not sufficiently covered by the capital requirement set out in part three of [ regulation - - - / - - - - [ ifr ] , especially taking into account risks in relation to environmental , social and governance factors ;


### to interview any other person who consents to be interviewed for the purposes of collecting information on the subject matter of an investigation ; ### to interview any other relevant person for the purposes of collecting information on the subject matter of an investigation ;


### member states shall ensure that competent authorities collect the information disclosed in accordance with points , and of article 51 of [ regulation - - - / - - - - [ ifr ] and use that information to benchmark remuneration trends and practices . competent authorities shall provide that information to eba . ### member states shall ensure that competent authorities collect the information disclosed in accordance with points , , , , and of article 51 of [ regulation - - - / - - - - [ ifr ] and use that information to benchmark remuneration trends and practices . competent authorities shall provide that information to eba and esma . eba shall publish an annual report on those trends and practices .


### member states shall designate one or more competent authorities that carry out the functions and duties provided for in this directive . the member states shall inform the commission and eba of that designation , and where there is more than one competent authority , of the functions and duties of each competent authority . ### member states shall designate one or more competent authorities that carry out the functions and duties provided for in this directive . the member states shall inform the commission , eba and esma&#160 ; of that designation , and where there is more than one competent authority , of the functions and duties of each competent authority .


### eba , in consultation with esma , shall issue guidelines on the application of sound remuneration policies . those guidelines shall take into account at least the requirements referred to in articles 28 to 31 and principles on sound remuneration policies set out in commission recommendation 2009 / 384 / ec43 . _________________ 43 commission recommendation 2009 / 384 / ec of 30 april 2009 on remuneration policies in the financial services sector . ### eba , in consultation with esma , shall issue guidelines on the application of sound and gender neutral remuneration policies . those guidelines shall take into account at least the requirements referred to in articles 28 to 31 and principles on sound remuneration policies set out in commission recommendation 2009 / 384 / ec43 . _________________ 43 commission recommendation 2009 / 384 / ec of 30 april 2009 on remuneration policies in the financial services sector .


### to align remuneration with the risk profile of investment firms and to guarantee a level - playing field , investment firms should be subject to clear principles on corporate governance arrangements and rules on remuneration that take into account the differences between credit institutions and investment firms . small and non - interconnected investment firms should however be exempted from those rules because the provisions on remuneration and corporate governance under directive 2014 / 65 / eu are sufficiently comprehensive for those types of firms . ### to align remuneration with the risk profile of investment firms and to guarantee a level - playing field , investment firms should be subject to clear principles on corporate governance arrangements and rules on remuneration that are gender neutral and that take into account the differences between credit institutions and investment firms . small and non - interconnected investment firms should however be exempted from those rules because the provisions on remuneration and corporate governance under directive 2014 / 65 / eu of the european parliament and of the council1a are sufficiently comprehensive for those types of firms . ______________ 1a directive 2014 / 65 / eu of the european parliament and of the council of 15 may 2014 on markets in financial instruments and amending directive 2002 / 92 / ec and directive 2011 / 61 / eu .


### article 18 publication of administrative penalties and measures member states shall ensure that competent authorities publish on their official website any administrative penalties and measures imposed in accordance with article 16 and which has not been appealed or can no longer be appealed , without undue delay . that publication shall include information on the type and nature of the breach and the identity of the natural or legal person on whom the penalty is imposed or against whom the measure is taken . the information shall only be published after that person has been informed of those penalties or measures and to the extent the publication is necessary and proportionate . 2 . where member states permit the publication of administrative penalties or measures imposed in accordance with article 16 against which there has been an appeal , competent authorities shall also publish on their official website information on the appeal status and on the outcome of the appeal . 3 . competent authorities shall publish the administrative penalties or measures imposed in accordance with article 16 on an anonymous basis in any of the following cases : the penalty has been imposed on a natural person and publication of that person ' s personal data is found to be disproportionate ; the publication would jeopardise an ongoing criminal investigation or the stability of financial markets ; the publication would cause disproportionate damage to the investment firms or natural persons involved . 4 . competent authorities shall ensure that information published pursuant to this article remains on their official website for at least five years . personal data may only be retained on the official website of the competent authority where permitted by the applicable data protection rules . ### article 18 publication of administrative penalties and measures member states shall ensure that competent authorities publish on their official website any administrative penalties and measures imposed in accordance with article 16 and which has not been appealed or can no longer be appealed , without undue delay . that publication shall include information on the type and nature of the breach and the identity of the natural or legal person on whom the penalty is imposed or against whom the measure is taken . the information shall only be published after that person has been informed of those penalties or measures and to the extent the publication is necessary and proportionate . competent authorities shall ensure that the same information is published on the official website of the investment firm concerned . 2 . where member states permit the publication of administrative penalties or measures imposed in accordance with article 16 against which there has been an appeal , competent authorities shall also publish on their official website information on the appeal status and on the outcome of the appeal . competent authorities shall ensure that the same information is published on the official website of the investment firm concerned . 3 . competent authorities shall publish the administrative penalties or measures imposed in accordance with article 16 on an anonymous basis in any of the following cases : the penalty has been imposed on a natural person and publication of that person ' s personal data is found to be disproportionate ; the publication would jeopardise an ongoing criminal investigation or the stability of financial markets ; the publication would cause disproportionate damage to the investment firms or natural persons involved . 4 . competent authorities shall ensure that information published pursuant to this article remains on their official website for at least five years . personal data may only be retained on the official website of the competent authority where permitted by the applicable data protection rules .


### member states shall ensure that competent authorities have the necessary powers to guarantee that the remuneration committee is responsible for the preparation of decisions regarding remuneration , including decisions which have implications for the risk and risk management of the investment firm concerned and which are to be taken by the management body . the chair and the members of the remuneration committee shall be members of the management body who do not perform any executive function in the investment firm concerned . where employee representation in the management body is provided for by national law , the remuneration committee shall include one or more employee representatives . ### member states shall ensure that competent authorities have the necessary powers to guarantee that the remuneration committee is responsible for the preparation of decisions regarding remuneration , including decisions which have implications for the risk and risk management of the investment firm concerned and which are to be taken by the management body . the chair and the members of the remuneration committee shall be members of the management body who do not perform any executive function in the investment firm concerned . where employee representation in the management body is provided for by national law , the remuneration committee shall include one or more employee representatives . investment firms shall aim at a gender balance in their remuneration committee .


### terrorist financing should be punishable in the member states and cover the financing of terrorist acts , the financing of a terrorist group , as well as other offences related to terrorist activities such as the recruitment and training , or travel for terrorist purposes , with a view to disrupting the support structures facilitating the commission of terrorist offences . aiding and abetting or attempting terrorist financing should also be punishable . ### terrorist financing should be punishable in the member states and cover the financing of terrorist acts , the financing of a terrorist group , as well as the provision of funding for all preparatory activities for a terrorist attack , such as the recruitment and training , or travel for terrorist purposes , in the european union or elsewhere , with a view to disrupting the support structures facilitating the commission of terrorist offences . aiding and abetting or attempting terrorist financing should also be punishable .


### member states shall take the necessary measures to ensure that the distribution , or otherwise making available , of a message to the public , with the intent to incite the commission of one of the offences listed in points to of article 3 , where such conduct , whether or not directly advocating terrorist offences , causes a danger that one or more such offences may be committed , is punishable as a criminal offence when committed intentionally . ### member states shall take the necessary measures to ensure that the distribution of a message to the public , with the clear intent to incite the commission of one of the offences listed in points to of article 3 , where such conduct , advocating terrorist offences , causes a substantial and imminent danger that one or more such offences may be committed , is punishable as a criminal offence when committed intentionally and unlawfully .


### emotional and psychological support , such as trauma support and counselling ; ### medical , emotional and psychological support , such as trauma support and counselling ;


### the offenses related to public provocation to commit a terrorist offence act comprise , inter alia , the glorification and justification of terrorism or the dissemination of messages or images including those related to the victims of terrorism as a way to gain publicity for the terrorists cause or seriously intimidating the population , provided that such behaviour causes a danger that terrorist acts may be committed . ### the offenses related to public provocation to commit a terrorist offence act may comprise , inter alia , the glorification and justification of terrorism or the dissemination of messages or images including those related to the victims of terrorism as a way to gain publicity for the terrorists cause or seriously intimidating the population , provided that such behaviour causes a danger that terrorist acts may be committed . to strengthen action against public provocation to commit a terrorist offence , member states may take measures to remove webpages publicly inciting to commit terrorist offences . such measures should be taken after adequate control by the judicial authority , in order to guarantee their proportionality and the full respect of fundamental rights and procedural safeguards .


### the directive should replace framework decision 2002 / 475 / jha29 for the member states bound by this directive . ________________ 29 as amended by council framework decision 2008 / 919 / jha of 28 november 2008 amending framework decision 2002 / 475 / jha . ### this directive replaces framework decision 2002 / 475 / jha for the member states bound by this directive .


### taking account of the evolution of terrorist threats and legal obligations to the union and member states under international law , the definition of terrorist offences , including offences related to a terrorist group and offences related to terrorist activities , should be further approximated in all member states , so that it covers more comprehensively conduct related to in particular foreign terrorist fighters and terrorist financing . these forms of behaviour should be punishable also if committed through the internet , including social media . ### taking account of the evolution of terrorist threats and legal obligations to the union and member states under international law , the definition of terrorist offences , offences related to a terrorist group and offences related to terrorist activities , should be further approximated in all member states , while respecting the principle of proportionality , with regard to the legitimate aims pursued and to the necessity of criminalisation and fighting impunity in a democratic society .


### considering the seriousness of the threat and the need to in particular stem the flow of foreign terrorist fighters , it is necessary to criminalise the travelling abroad for terrorist purposes , being not only the commission of terrorist offences and providing or receiving training but also to participate in the activities of a terrorist group . any act of facilitation of such travel should also be criminalised . ### considering the seriousness of the threat and the need to in particular stem the flow of foreign terrorist fighters , it is necessary to criminalise the travelling abroad for the commission of terrorist offences and providing or receiving training . the act of travelling should be criminalised only when the terrorist purpose of the travel is proven by objective circumstances and facilitation of such travel should also be criminalised .


### the terrorist threat has grown and rapidly evolved in recent years . individuals referred to as ' foreign terrorist fighters ' travel abroad for terrorism purposes . returning foreign terrorist fighters pose a heightened security threat to all eu member states . foreign terrorist fighters have been linked to several recent attacks or plots , including the attacks in paris on 13 november 2015 . in addition , the european union and its member states face increased threats from individuals inspired or instructed by terrorist groups abroad but who remain within europe . ### the terrorist threat has grown and rapidly evolved in recent years . individuals referred to as ' foreign terrorist fighters ' travel abroad for terrorism purposes . returning foreign terrorist fighters pose a heightened security threat to all eu member states . in addition , the european union and its member states face increased threats from individuals inspired or instructed by terrorist groups abroad and within europe .


### threatening to commit any of the acts listed in points to . ### seriously threatening to commit any of the acts listed in points to , where the threat has been accompanied by physical manifestations of the threat .


### member states shall take the necessary measures to ensure that the distribution , or otherwise making available , of a message to the public , with the intent to incite the commission of one of the offences listed in points to of article 3 , where such conduct , whether or not directly advocating terrorist offences , causes a danger that one or more such offences may be committed , is punishable as a criminal offence when committed intentionally . ### member states shall take the necessary measures to ensure that the distribution , online display or otherwise making available , of a message to the public , with the intent to incite the commission of one of the offences listed in points to of article 3 , where such conduct , whether or not directly advocating terrorist offences , causes a danger that one or more such offences may be committed , is punishable as a criminal offence when committed intentionally .


### given that the objectives of this directive cannot be sufficiently achieved by the member states unilaterally and can therefore , because of the need for european - wide harmonised rules , be better achieved at the level of the union , the union may adopt measures , in accordance with the principle of subsidiarity , as set out in article 5 of the treaty on the european union . in accordance with the principle of proportionality , as set out in that article 5 , this directive does not go beyond what is necessary in order to achieve those objectives . ### given that the objectives of this directive cannot be sufficiently achieved by the member states unilaterally and can therefore , be better achieved at the level of the union , the union may adopt measures , in accordance with the principle of subsidiarity , as set out in article 5 of the treaty on the european union . in accordance with the principle of proportionality , as set out in that article 5 , this directive does not go beyond what is necessary in order to achieve those objectives .


### the directive should replace framework decision 2002 / 475 / jha29 for the member states bound by this directive . __________________ 29 as amended by council framework decision 2008 / 919 / jha of 28 november 2008 amending framework decision 2002 / 475 / jha . ### this directive replaces framework decision 2002 / 475 / jha29 . __________________ 29 as amended by council framework decision 2008 / 919 / jha of 28 november 2008 amending framework decision 2002 / 475 / jha .


### each member state shall take the necessary measures to ensure that aiding or abetting an offence referred to in articles 3 to 8 and 11 to 14 is made punishable . ### each member state shall take the necessary measures to ensure that aiding or abetting an offence referred to in articles 3 , 6 , 7 and 12 to 14 is made punishable .


### for an offence referred to in article 4 and title iii to be punishable , it shall not be necessary that a terrorist offence be actually committed , nor shall it be necessary to establish a link to a specific terrorist offence or , insofar as the offences in articles 9 to 11 are concerned , to specific offences related to terrorist activities . ### for an offence referred to in article 4 to be punishable , it shall not be necessary that a terrorist offence be actually committed .


### each member state shall take the necessary measures to ensure that inciting an offence referred to in articles 3to 14 is made punishable . ### each member state shall take the necessary measures to ensure that inciting an offence referred to in articles 3 to 14 is made punishable when it provokes the commission of , or the attempt to commit , one of those offences .


### this directive respects the principles recognised by article 2 of the treaty on the european union , respects fundamental rights and freedoms and observes the principles recognised in particular by the charter of fundamental rights of the european union , including those set out in chapters ii , iii , v and vi thereof which encompass inter alia the right to liberty and security , freedom of expression and information , freedom of association and freedom of thought conscience and religion , the general prohibition of discrimination in particular on grounds of race , colour , ethnic or social origin , genetic features , language , religion or belief , political or any other opinion , the right to respect for private and family life and the right to protection of personal data , the principle of legality and proportionality of criminal offences and penalties , covering also the requirement of precision , clarity and foreseeability in criminal law , the presumption of innocence as well as freedom of movement as set forth in article 21 of the treaty on the functioning of the european union and directive 2004 / 38 / ec . this directive has to be implemented in accordance with these rights and principles . ### this directive , in accordance with article 2 and 6 of the treaty on the european union , the european convention for the protection of human rights and fundamental freedoms , and other relevant obligations under international law , should not have the effect of requiring member states to take measures arbitrarily or unnecessarily limiting fundamental rights and freedoms and the principles recognised by the charter of fundamental rights of the european union , including those set out in chapters ii , iii , v and vi thereof which encompass inter alia the right to liberty and security , freedom of expression and information , freedom of association and freedom of thought conscience and religion , the general prohibition of discrimination in particular on grounds of race , colour , ethnic or social origin , genetic features , language , religion or belief , political or any other opinion , the right to respect for private and family life and the right to protection of personal data , the principle of legality and proportionality of criminal offences and penalties , covering also the requirement of precision , clarity and foreseeability in criminal law , the presumption of innocence as well as freedom of movement as set forth in article 21 of the treaty on the functioning of the european union and directive 2004 / 38 / ec . this directive has to be interpreted and implemented in accordance with these rights and principles .


### participating in the activities of a terrorist group , including by supplying information or material resources , or by funding its activities in any way , with knowledge of the fact that such participation will contribute to the criminal activities of the terrorist group . ### participating in the activities of a terrorist group , with knowledge of the fact that such participation will significantly contribute to the terrorist activities of the group .


### member states shall take the necessary measures to ensure that to receive instruction , from another person in the making or use of explosives , firearms or other weapons or noxious or hazardous substances , or in other specific methods or techniques , for the purpose of committing of or contributing to the commission of one of the offences listed in points to of article 3 is punishable as a criminal offence when committed intentionally . ### member states shall take the necessary measures to ensure that to receive instruction , from another person or to obtain documentation giving instruction in the making or use of explosives , firearms or other weapons or noxious or hazardous substances , or in other specific methods or techniques , for the purpose of committing of or contributing to the commission of one of the offences listed in points to of article 3 is punishable as a criminal offence when committed intentionally .


### the implementation of the criminalisation under this directive should be proportional to the nature and circumstances of the offence , with respect to the legitimate aims pursued and to their necessity in a democratic society , and should exclude any form of arbitrariness or discrimination . ### the implementation of this directive should be proportional to the nature and circumstances of each case , with respect to the legitimate aims pursued and to their necessity in a democratic society , and should exclude any form of arbitrariness or discrimination .


### furthermore , the provision of material support for terrorism through persons engaging in or acting as intermediaries in the supply or movement of services , assets and goods , including trade transactions involving the entry into or exit from the union should be punishable in the member states , as aiding and abetting terrorism or as terrorism financing if performed with the knowledge that these operations or the proceeds thereof are intended to be used , in full or in part , for terrorist purposes or will benefit terrorist groups . ### the provision of material support for terrorism through persons engaging in or acting as intermediaries in the supply or movement of services , assets and goods , including trade transactions involving the entry into or exit from the union , including smuggling of cultural heritage items , should be punishable in the member states , if performed with the intent of benefiting terrorist groups .


### terrorist financing should be punishable in the member states and cover the financing of terrorist acts , the financing of a terrorist group , as well as other offences related to terrorist activities such as the recruitment and training , or travel for terrorist purposes , with a view to disrupting the support structures facilitating the commission of terrorist offences . aiding and abetting or attempting terrorist financing should also be punishable . ### terrorist financing should be punishable in the member states and cover the financing of terrorist acts , the financing of a terrorist group , as well as the provision of funding for all preparatory activities for a terrorist attack , such as the recruitment and training , or travel for terrorist purposes , in the european union or elsewhere , with a view to disrupting the support structures facilitating the commission of terrorist offences . aiding and abetting or attempting terrorist financing should also be punishable .


### terrorist financing should be punishable in the member states and cover the financing of terrorist acts , the financing of a terrorist group , as well as other offences related to terrorist activities , such as the recruitment and training , or travel for terrorist purposes , with a view to disrupting the support structures facilitating the commission of terrorist offences . aiding and abetting or attempting terrorist financing should also be punishable . ### in a coherent manner with directive 2015 / 849 / eu on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing , terrorism funding should be punishable in the member states and cover the financing of terrorist acts , the financing of a terrorist group , as well as the financing of any action enabling terrorist offences . any physical or legal person sanctioned for terrorism financing shall be allowed to challenge the relevant decision rapidly and effectively before an independent authority .


### member states shall take the necessary measures to ensure that soliciting another person to commit one of the offences listed in points to of article 3 , or in article 4 is punishable as a criminal offence when committed intentionally . ### member states shall take the necessary measures to ensure that soliciting another person to commit one of the offences listed in points to of article 3 , or in article 4 , including the recruitment or enticement to the above mentioned terrorist offences via social media or other online environments , is punishable as a criminal offence when committed intentionally .


### terrorist financing should be punishable in the member states and cover the financing of terrorist acts , the financing of a terrorist group , as well as other offences related to terrorist activities , such as the recruitment and training , or travel for terrorist purposes , with a view to disrupting the support structures facilitating the commission of terrorist offences . aiding and abetting or attempting terrorist financing should also be punishable . ### in a coherent manner with directive 2015 / 849 / eu on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing , terrorism funding should be punishable in the member states and cover the financing of terrorist acts , the financing of a terrorist group , as well as travels for terrorist purposes . any physical or legal person sanctioned for terrorism financing shall be allowed to challenge the relevant decision rapidly and effectively before an independent authority .


### mitigating circumstances ### particular circumstances


### travelling abroad for terrorism ### travelling abroad for the purpose of terrorism


### considering the seriousness of the threat and the need to in particular stem the flow of foreign terrorist fighters , it is necessary to criminalise the travelling abroad for terrorist purposes , being not only the commission of terrorist offences and providing or receiving training but also to participate in the activities of a terrorist group . any act of facilitation of such travel should also be criminalised . ### considering the seriousness of the threat and the need to in particular stem the flow of foreign terrorist fighters , it is necessary to criminalise the travelling abroad for the commission of terrorist offences and providing or receiving training . the act of travelling should be criminalised only when the terrorist purpose of the travel is proven by objective circumstances and facilitation of such travel should also be criminalised .


### observation , study , disassembly or test of a product or object that has been made available to the public or that it is lawfully in the possession of the acquirer of the information ; ### observation , study , disassembly or test of a product or object that has been made available to the public or that is lawfully in the possession of a natural person or market operator with access to independent technological discoveries and designs and goods manufactured on the basis thereof ;


### for the purpose of protecting a legitimate interest . ### where a claimed infringement of a trade secret concerns , by chance , part or all of a set of information obtained independently or where that information is the subject of a patent , copyright , industrial design or trade mark of a company .


### the use or disclosure of a trade secret shall be considered unlawful whenever carried out , without the consent of the trade secret holder , intentionally or with gross negligence , by a person who is found to meet any of the following conditions : ### unauthorised disclosure of a trade secret take place where , without the consent of its holder , a legal or natural person who has had access to trade documentation belonging to the firm or to other proprietary sources intentionally or as a result of gross negligence :