### sustainable infrastructure policy window : comprises sustainable investment in the areas of transport , energy , digital connectivity , supply and processing of raw materials , space , oceans and water , waste , nature and other environment infrastructure , equipment , mobile assets and deployment of innovative technologies that contribute to the environmental or social sustainability objectives of the union , or to both , or meet the environmental or social sustainability standards of the union ; ### sustainable infrastructure policy window : comprises sustainable investment in the areas of transport , energy , digital infrastructure , digital connectivity , supply and processing of raw materials , space , oceans and water , waste , nature and other environment infrastructure , equipment , mobile assets and deployment of innovative technologies that contribute to the environmental or social sustainability objectives of the union , or to both , or meet the environmental or social sustainability standards of the union ;


### the sustainability of the union economy and its growth ; ### the growth of the union economy and its sustainability ;


### financing and investment operations under the sustainable infrastructure policy window referred to in point of paragraph shall be subject to climate , environmental and social sustainability proofing with a view to minimise detrimental impacts and maximise benefits on climate , environment and social dimension . for that purpose , promoters requesting financing shall provide adequate information based on guidance to be developed by the commission . projects below a certain size defined in the guidance shall be excluded from the proofing . ### financing and investment operations under the sustainable infrastructure policy window referred to in point of paragraph shall be subject to climate , environmental and social sustainability proofing with a view to minimise detrimental impacts and maximise benefits on climate , environment and social dimension . for that purpose , promoters requesting financing shall provide adequate information based on guidance to be developed by the commission before the entry into force of the regulation . projects below a certain size defined in the guidance shall be excluded from the proofing .


### the investeu fund should contribute to improving the competitiveness of the union , including in the field of innovation and digitisation , the sustainability of the union’s economic growth , the social resilience and inclusiveness and the integration of the union capital markets , including solutions addressing their fragmentation and diversifying sources of financing for the union enterprises . to that end , it should support projects that are technically and economically viable by providing a framework for the use of debt , risk sharing and equity instruments underpinned by a guarantee from the union’s budget and by contributions from implementing partners . it should be demand - driven while support under the investeu fund should at the same time focus on contributing to meeting policy objectives of the union . ### the investeu fund should contribute to improving the competitiveness of the union , including in the field of innovation and digitisation , the sustainability of the union’s economic growth , the social resilience and inclusiveness and the integration of the union capital markets , including solutions addressing their fragmentation and diversifying sources of financing for the union enterprises . to that end , it should support the dual value of cultural and creative sectors , projects that are technically and economically and socially viable by providing a framework for the use of debt , risk sharing and equity instruments underpinned by a guarantee from the union’s budget and by financial contributions from implementing partners . it should be demand - driven while support under the investeu fund should at the same time focus on contributing to meeting policy objectives of the union .


### in addition , it shall , by 31 may of each year , submit to the european parliament , to the council and to the court of auditors an annual report on the management of the guarantee fund in the previous calendar year . the annual report shall contain the presentation of the financial position of the guarantee fund at the end of the previous calendar year , the financial flows during the previous calendar year as well as the significant transactions and any relevant information on the financial accounts . the report shall also include information about the financial management and performance and the risk of the guarantee fund at the end of the previous calendar year . ### in addition , it shall , by 31 may of each year , submit to the european parliament , to the council and to the court of auditors an annual report on the management of the guarantee fund in the previous calendar year . the annual report shall contain the presentation of the financial position of the guarantee fund at the end of the previous calendar year , the financial flows during the previous calendar year as well as the significant transactions and any relevant information on the financial accounts . the report shall also include information about the financial management and performance and the risk of the guarantee fund at the end of the previous calendar year as well as an assessment of how the surplus exceeding 10% of the union ' s total outstanding capital liabilities that will be paid back to the general budget of the union minimises the potential additional risk of default of the eib operations related to the migration crisis .


### the financial management of the guarantee fund should be transferred from the eib to the commission , which has an established practice of managing similar investments . by taking over the asset management of the guarantee fund , the commission should be able to streamline and consolidate its asset management activities , building on existing structures and a good track record . ### the financial management of the guarantee fund should be transferred from the eib to the commission , which has an established practice of managing similar investments . by taking over the asset management of the guarantee fund , the commission should be able to further streamline and consolidate its asset management activities as well as to coordinate all external financing aspects of the european agenda on migration , building on existing structures and further strengthening its track record . the transfer of management should lead to cost savings for the union budget and better and more accurate information about the management and situation of the guarantee fund provided by the commission to the european parliament .


### member states shall take the necessary measures to ensure that procedural costs related to representative actions do not constitute financial obstacles for qualified entities to effectively exercise the right to seek the measures referred to in articles 5 and 6 , such as limiting applicable court or administrative fees , granting them access to legal aid where necessary , or by providing them with public funding for this purpose . ### member states shall take the necessary measures to ensure that procedural costs related to representative actions do not constitute financial obstacles for qualified entities to effectively exercise the right to seek the measures referred to in articles 5 and 6 , in particular limiting applicable court or administrative fees , granting them access to legal aid where necessary , or by providing them with public funding for this purpose .


### independent public bodies and consumer organisations in particular should play an active role in ensuring compliance with relevant provisions of union law and are all well placed to act as qualified entities . since these entities have access to different sources of information regarding traders ' practices towards consumers and hold different priorities for their activities , member states should be free to decide on the types of measures that may be sought by each of these qualified entities in representative actions . ### independent public bodies , consumer organisations , and citizens ' advice groups in particular should play an active role in ensuring compliance with relevant provisions of union law and are all well placed to act as qualified entities . since these entities have access to different sources of information regarding traders ' practices towards consumers and hold different priorities for their activities , member states should be free to decide on the types of measures that may be sought by each of these qualified entities in representative actions .


### this directive shall not prevent member states from adopting or maintaining in force provisions designed to grant qualified entities or any other persons concerned other procedural means to bring actions aimed at the protection of the collective interests of consumers at national level . ### this directive aims at minimum harmonisation and shall therefore not prevent member states from adopting or maintaining in force provisions designed to grant qualified entities or any other persons concerned other procedural means to bring actions aimed at the protection of the collective interests of consumers at national level .


### individual consumers concerned shall be given the possibility to accept or to refuse to be bound by settlements referred to in paragraphs 1 , 2 and 3 . the redress obtained through an approved settlement in accordance with paragraph 4 shall be without prejudice to any additional rights to redress that the consumers concerned may have under union or national law . ### individual consumers concerned shall be given the possibility to accept or to refuse to be bound by settlements referred to in paragraphs 1 , 2 and 3 and file or pursuit their corresponding individual action . the redress obtained through an approved settlement in accordance with paragraph 4 shall be without prejudice to any additional rights to redress that the consumers concerned may have under union or national law .


### member states shall ensure that representative actions can be brought before national courts or administrative authorities by qualified entities provided that there is a direct relationship between the main objectives of the entity and the rights granted under union law that are claimed to have been violated in respect of which the action is brought . ### member states shall ensure that representative actions according to article 1 can be brought before national courts or administrative authorities by qualified entities .


### member states shall ensure that qualified entities are entitled to bring representative actions seeking measures eliminating the continuing effects of the infringement . these measures shall be sought on the basis of any final decision establishing that a practice constitutes an infringement of union law listed in annex i harming collective interests of consumers , including a final injunction order referred to in paragraph . ### member states shall ensure that qualified entities are entitled to bring representative actions seeking measures eliminating the continuing effects of the infringement . these measures shall be sought on the basis of any infringement of union law listed in annex i harming collective interests of consumers , including an incident , previous or parallel injunction order reffered to in paragraph . any measures eliminating the continuing effects of the infringement shall be executed only on the basis of a final decision on the preceded infringement .


### a representative action should offer an effective and efficient way of protecting the collective interests of consumers . it should allow qualified entities to act with the aim of ensuring compliance with relevant provisions of union law and to overcome the obstacles faced by consumers within individual actions , such as the uncertainty about their rights and available procedural mechanisms , psychological reluctance to take action and the negative balance of the expected costs and benefits of the individual action . ### a representative action should offer an effective and efficient way of protecting the collective interests of all consumers , without discrimination . it should allow qualified entities to act with the aim of ensuring compliance with relevant provisions of union law and to overcome the obstacles faced by consumers within individual actions , such as the uncertainty about their rights and available procedural mechanisms , psychological reluctance to take action and the negative balance of the expected costs and benefits of the individual action .


### the qualified entity seeking a redress order as referred in article 6 shall declare at an early stage of the action the source of the funds used for its activity in general and the funds that it uses to support the action . it shall demonstrate that it has sufficient financial resources to represent the best interests of the consumers concerned and to meet any adverse costs should the action fail . ### the qualified entity seeking a redress order as referred in article 6 shall declare at an early stage of the action the source of the funds used for its activity in general and the funds that it uses to support the action . it shall demonstrate that it has access to sufficient financial resources to represent the best interests of the consumers concerned and to meet any adverse costs should the action fail . this may include a guarantee or indemnity from a third party subject also to the provisions of paragraphs 2 and 3 of this article .


### for the purposes of article 5 , member states shall ensure that qualified entities are entitled to bring representative actions seeking a redress order , which obligates the trader to provide for , inter alia , compensation , repair , replacement , price reduction , contract termination or reimbursement of the price paid , as appropriate . a member state may require the mandate of the individual consumers concerned before a declaratory decision is made or a redress order is issued . ### for the purposes of article 5 , member states shall ensure that qualified entities are entitled to bring representative actions seeking a redress order for the economic and non - economic damages , which obligates the trader to provide for , inter alia , compensation , repair , replacement , price reduction , contract termination or reimbursement of the price paid , as appropriate . a member state may require the mandate of the individual consumers concerned before a redress order is issued . . if a member state does not require a mandate of the individual consumer to join the representative action , this member state shall nevertheless allow those individuals who are not habitually resident in the member state where the action occurs , to participate in the representative action , in case they expressed their willingness to be part of the representative action within the applicable time limit .


### as only qualified entities can bring the representative actions , to ensure that the collective interests of consumers are adequately represented the qualified entities should comply with the criteria established by this directive . in particular , they would need to be properly constituted according to the law of a member state , which could include for example requirements regarding the number of members , the degree of permanence , or transparency requirements on relevant aspects of their structure such as their constitutive statutes , management structure , objectives and working methods . they should also be not for profit and have a legitimate interest in ensuring compliance with the relevant union law . these criteria should apply to both qualified entities designated in advance and to ad hoc qualified entities that are constituted for the purpose of a specific action . ### as only qualified entities can bring the representative actions , to ensure that the collective interests of consumers are adequately represented the qualified entities should comply with the criteria established by this directive . in particular , they would need to be properly constituted according to the law of a member state , which could include for example requirements regarding the number of members , the degree of permanence , or transparency requirements on relevant aspects of their structure such as their constitutive statutes , management structure , objectives and working methods . qualified entities should be registered in a member state of the european union . they should also be not for profit and have a legitimate interest in ensuring compliance with the relevant union law . these criteria should apply to both qualified entities designated in advance and to ad hoc qualified entities that are constituted for the purpose of a specific action .


### member states shall ensure that courts and administrative authorities are empowered to assess the circumstances referred to in paragraph 2 and accordingly require the qualified entity to refuse the relevant funding and , if necessary , reject the standing of the qualified entity in a specific case . ### member states shall ensure that courts and administrative authorities assess the circumstances referred to in paragraph 2 and accordingly require the qualified entity to refuse the relevant funding and , if necessary , reject the standing of the qualified entity in a specific case .


### it has a legitimate interest in ensuring that provisions of union law covered by this directive are complied with ; ### its main objectives as laid down in its internal rules state to ensure that provisions of union law covered by this directive are complied with ;


### to increase the procedural effectiveness of representative actions , qualified entities should have the possibility to seek different measures within a single representative action or within separate representative actions . these measures should include interim measures for stopping an ongoing practice or prohibiting a practice in case the practice has not been carried out but there is a risk that it would cause serious or irreversible harm to consumers , measures establishing that a given practice constitutes an infringement of law and , if necessary , stopping or prohibiting the practice for the future , as well as measures eliminating the continuing effects of the infringement , including redress . if sought within a single action , qualified entities should be able to seek all relevant measures at the moment of bringing the action or first seek relevant injunctions order and subsequently and if appropriate redress order . ### to increase the procedural effectiveness of representative actions , qualified entities should have the possibility to seek different measures within a single representative action or within separate representative actions . these measures should include interim measures for stopping an ongoing practice or prohibiting a practice in case the practice has not been carried out but there is a risk that it would cause serious or irreversible harm to consumers , measures establishing that a given practice constitutes an infringement of law and , if necessary , stopping or prohibiting the practice for the future . if sought within a single action , qualified entities should be able to seek all relevant measures at the moment of bringing the action .


### member states may provide that a qualified entity and a trader who have reached a settlement regarding redress for consumers affected by an allegedly illegal practice of that trader can jointly request a court or administrative authority to approve it . such request should be admitted by the court or administrative authority only if there is no other ongoing representative action regarding the same practice . a competent court or administrative authority approving such collective settlement must take into consideration the interests and rights of all parties concerned , including individual consumers . individual consumers concerned shall be given the possibility to accept or to refuse to be bound by such a settlement . ### member states may provide that a qualified entity and a trader who have reached a settlement regarding redress for consumers affected by an allegedly illegal practice of that trader can jointly request a court or administrative authority to approve it . such request should be admitted by the court or administrative authority only if there is no other ongoing representative action regarding the same practice . a competent court or administrative authority approving such collective settlement must take into consideration the interests and rights of all parties concerned , including individual consumers . individual consumers concerned shall be given the possibility to accept or to refuse to be bound by such a settlement and file or pursuit their corresponding individual action .


### the qualified entity seeking a redress order as referred in article 6 shall declare at an early stage of the action the source of the funds used for its activity in general and the funds that it uses to support the action . it shall demonstrate that it has sufficient financial resources to represent the best interests of the consumers concerned and to meet any adverse costs should the action fail . ### the qualified entity seeking a redress order as referred in article 6 shall declare at an early stage of the action the source of the funds used for its activity in general and the funds that it uses to support the action .


### member states shall take the necessary measures to prohibit any form of retaliation , whether direct or indirect , against reporting persons meeting the conditions set out in article 13 , including in particular in the form of : ### member states shall take the necessary measures to prohibit any form of retaliation , whether direct or indirect , against reporting persons , or those preparing an imminent report or disclosure , as well as those assisting them , under the scope of this directive , including in particular in the form or threat of :


### three years after the start of operations of the ecris - tcn system and every four years thereafter , the commission shall produce an overall evaluation of the ecris - tcn system and the ecris reference implementation . that overall evaluation shall include an assessment of the application of the regulation , an examination of results achieved against objectives and the impact on fundamental rights , and an assessment of the continuing validity of the underlying rationale , the application of the regulation , the security of the system and any implications on future operations , and shall make any necessary recommendations . the commission shall transmit the evaluation report to the european parliament and the council . ### one year after the start of operations of the ecris - tcn system and every two years thereafter , the commission shall produce an overall evaluation of the ecris - tcn system and the ecris reference implementation . that overall evaluation shall include an assessment of the application of the regulation , an examination of results achieved against objectives and the impact on fundamental rights , as well as the costs , and an assessment of the continuing validity of the underlying rationale , the application of the regulation , the security of the system and any implications on future operations , and shall make any necessary recommendations , including a detailed assessment of their budgetary implications . the commission shall transmit the evaluation report to the european parliament and the council .


### three years after the start of operations of the ecris - tcn system and every four years thereafter , the commission shall produce an overall evaluation of the ecris - tcn system and the ecris reference implementation . that overall evaluation shall include an assessment of the application of the regulation , an examination of results achieved against objectives and the impact on fundamental rights , and an assessment of the continuing validity of the underlying rationale , the application of the regulation , the security of the system and any implications on future operations , and shall make any necessary recommendations . the commission shall transmit the evaluation report to the european parliament and the council . ### two years after the start of operations of the ecris - tcn system and every two years thereafter , the commission shall produce an overall evaluation of the ecris - tcn system and the ecris reference implementation . that overall evaluation shall include an assessment of the application of the regulation , an examination of results achieved against objectives and the impact on fundamental rights and their costs , an assessment of the continuing validity of the underlying rationale , the application of the regulation , the security of the system and any implications on future operations , and shall make any necessary recommendations . the commission shall transmit the evaluation report to the european parliament and the council .


### two years after the start of operations of the ecris - tcn system and every year thereafter , eu - lisa shall submit to the commission a report on the technical functioning of the ecris - tcn system and the ecris reference implementation , including the security thereof , based in particular on the statistics on the functioning and use of ecris - tcn system and on the exchange , through the ecris reference implementation , of information extracted from the criminal records . ### two years after the start of operations of the ecris - tcn system and every year thereafter , eu - lisa shall submit to the commission a report on the technical functioning of the ecris - tcn system and the ecris reference implementation , including their security and costs , based in particular on the statistics on the functioning and use of ecris - tcn system and on the exchange , through the ecris reference implementation , of information extracted from the criminal records .


### reflecting the importance of tackling climate change in line with the union ' s commitments to implement the paris agreement and the united nations sustainable development goals , this programme will contribute to mainstream climate actions and to the achievement of an overall target of 25 % of the eu budget expenditures supporting climate objectives . ### reflecting the importance of tackling climate change in line with the union ' s commitments to implement the paris agreement and the united nations sustainable development goals , this programme will contribute to mainstream climate actions and to the swift achievement of an overall target of 30 % of the eu budget expenditures supporting climate objectives .


### when deemed appropriate with regard to the risks presented by a subsystem or a safety component , manufacturers shall , to protect the health and safety of users , carry out sample testing of the subsystem or the safety component made available on the market , investigate , and , if necessary , keep a register of complaints of non - conforming subsystems or safety components and recalls of such subsystems or safety components , and shall keep distributors informed of any such monitoring . ### proportionate to the possible risks presented by a subsystem or a safety component , manufacturers shall , to protect the health and safety of users , carry out sample testing of the subsystem or the safety component made available on the market , investigate , and , if necessary , keep a register of complaints of non - conforming subsystems or safety components and recalls of such subsystems or safety components , and shall keep distributors informed of any such monitoring .


### manufacturers who consider or have reason to believe that the a subsystem or a safety component which they have placed on the market is not in conformity with this regulation shall immediately take the necessary corrective measures necessary to bring that subsystem or safety component into conformity , to withdraw it or recall it , if appropriate . furthermore , where the subsystem or the safety component presents a risk , manufacturers shall immediately inform the competent national authorities of the member states in which they made the subsystem or the safety component available on the market to that effect , giving details , in particular , of the non - compliance and of any corrective measures taken . ### manufacturers who consider or have reason to believe that a subsystem or a safety component which they have placed on the market is not in conformity with this regulation shall immediately take the corrective measures necessary to bring that subsystem or safety component into conformity , to withdraw it or recall it , if appropriate . furthermore , where the subsystem or the safety component presents a risk , manufacturers shall immediately inform the competent national authorities of the member states in which they made the subsystem or the safety component available on the market to that effect , giving details , in particular , of the non - compliance and of any corrective measures taken .


### when deemed appropriate with regard to the risks presented by a subsystem or a safety component , importers shall , to protect the health and safety of the users , upon a duly justified request of the competent authorities , carry out sample testing of subsystems or safety components made available on the market , investigate , and , if necessary , keep a register of complaints of nonconforming subsystems or safety components and recalls of such subsystems or safety components , and shall keep distributors informed of any such monitoring . ### when deemed appropriate with regard to the risks presented by a subsystem or a safety component , importers shall , to protect the health and safety of the passengers , operating personnel and third parties , carry out sample testing of subsystems or safety components made available on the market , investigate , and , if necessary , keep a register of complaints of nonconforming subsystems or safety components and recalls of such subsystems or safety components , and shall keep distributors informed of any such monitoring .


### it is necessary to maintain or restore the security of electronic communications networks and services , or detect technical faults and / or errors in the transmission of electronic communications , for the duration necessary for that purpose . ### it is technically strictly necessary to maintain or restore the availability , integrity and confidentiality of the respective electronic communications networks or services , or to detect technical faults and / or errors in the transmission of electronic communications , for the duration necessary for that purpose ; or


### upon installation , the software shall inform the end - user about the privacy settings options and , to continue with the installation , require the end - user to consent to a setting . ### upon installation , first use or whenever any significant modifications are introduced , the user shall be informed about the default privacy settings and other available options , if any . information shall be presented in an easily visible and intelligible manner . it shall not incentivise users to select lower privacy settings and shall include relevant information about the risks associated with each setting . settings must be easily accessible and modifiable at any time during the use of the device or software .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . examples of such usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colours to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals , provided that the data are immediately anonymised or anonymisation techniques are used where the user is mixed with others . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### providers of electronic communications networks and services may process electronic communications data if : ### providers of electronic communications networks and services may process electronic communications data only if :


### the methods used for providing information and obtaining end - user ' s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , end - users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , end - users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should provide for the possibility to express consent by using the appropriate settings of a browser or other application . the choices made by end - users when establishing its general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . web browsers are a type of software application that permits the retrieval and presentation of information on the internet . other types of applications , such as the ones that permit calling and messaging or provide route guidance , have also the same capabilities . web browsers mediate much of what occurs between the end - user and the website . from this perspective , they are in a privileged position to play an active role to help the end - user to control the flow of information to and from the terminal equipment . more particularly web browsers may be used as gatekeepers , thus helping end - users to prevent information from their terminal equipment from being accessed or stored . ### the methods used for providing information and obtaining end - user ' s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should prevent the use of so - called ' cookie walls ' and ' cookie banners ' that do not help users to maintain control over their personal information and privacy or become informed about their rights . this regulation should provide for the possibility to express consent by technical specifications , for instance by using the appropriate settings of a browser or other application . those settings should include choices concerning the storage of information on the user ' s terminal equipment as well as a signal sent by the browser or other application indicating the user ' s preferences to other parties . the choices made by users when establishing the general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . in this sense , settings must be granular enough to control all data processing that the user consents to and to cover all relevant functionalities . devices and software applications enabling electronic communications should implement technical mechanisms such as the do not track standard to ensure that users ' privacy is protected by default and that users are given genuine choice and control .


### exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the end - user . this may include the storing of cookies for the duration of a single established session on a website to keep track of the end - user’s input when filling in online forms over several pages . cookies can also be a legitimate and useful tool , for example , in measuring web traffic to a website . information society providers that engage in configuration checking to provide the service in compliance with the end - user ' s settings and the mere logging of the fact that the end - user’s device is unable to receive content requested by the end - user should not constitute access to such a device or use of the device processing capabilities . ### exceptions to the obligation to obtain consent to make use of the input , output , processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the user . this may include the storing of information for the duration of a single established session on a website to keep track of the end - user ' s input when filling in online forms over several pages . information society service providers that engage in configuration checking to provide the service in compliance with the user ' s settings and the mere logging of the fact that the user ' s device is unable to receive content requested by the user should not constitute illegitimate access .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications shall be confidential . any interference , with electronic communications at rest or in transit , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or any processing of electronic communications , by persons other than the users , shall be prohibited , except when permitted by this regulation .


### present the identity of a line on which they can be contacted ; or ### present the identity of a line on which they can be contacted ; and


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ' hotspots ' situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as wi - fi access points situated at different places within a city , for example department stores , shopping centres and hospitals , as well as airports , public transport , hotels and restaurants . those wi - fi access points might require a login or a password and might be provided also by public administrations . to the extent that those communications networks are provided to users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in addition , this regulation should apply to closed social media profiles and groups that the user has restricted or defined as private . in contrast , this regulation should not apply to closed groups of end - users such as corporate intranet networks , access to which is limited to members of an organisation .


### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural and legal persons who use electronic communications services to send direct marketing commercial communications or collect information related to or stored in end - users’ terminal equipment . ### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural and legal persons who use electronic communications services to send direct marketing communications or collect information related to or stored in end - users’ terminal equipment .


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ' hotspots ' situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as wireless internet access points situated at different places within a city , department stores , shopping malls , hospitals , airports , hotels and restaurants . those access points might require a login or provide a password and might be provided also by public administrations , including union bodies and agencies . to the extent that those communications networks are provided to users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . this regulation should also apply to closed social media profiles and groups that the users have defined as private . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , to which access is limited to members of the organisation .


### it is necessary for billing , calculating interconnection payments , detecting or stopping fraudulent , or abusive use of , or subscription to , electronic communications services ; or ### it is strictly necessary for billing , calculating interconnection payments , detecting or stopping fraudulent use , or abusive use of , or subscription to , electronic communications services ; or


### it is necessary to achieve the transmission of the communication , for the duration necessary for that purpose ; or ### it is technically strictly necessary to achieve the transmission of the communication , for the duration necessary for that purpose ; or


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in a an easily visible and intelligible manner . ### the principles of data protection by design and by default are codified under article 25 of regulation 2016 / 679 . hardware manufacturers and providers of software permitting electronic communications should have an obligation to configure devices and software so that their default settings provide the highest level of privacy protection possible , protecting users ' against cross - domain tracking and unauthorised interferences with their communications and terminal equipment . users should be informed about the default privacy settings and any available options to change those settings during installation or first use of the device or software and when they make significant changes to it . privacy settings should be presented in an objective , easily visible and intelligible manner . they should be easily accessible and modifiable during the use of the device or software . information provided should not incentivise users to select lower privacy settings and should include relevant information about the risks associated with each setting .


### it is done exclusively in order to , for the time necessary for , and for the purpose of establishing a connection ; or ### it is done exclusively in order to , for the time necessary for , and for the sole purpose of establishing a connection requested by the user ; or


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### after receiving all relevant information about the intended processing in clear and easily understandable language , provided separately from the terms and conditions of the provider , the user or users concerned have given their specific consent to the processing of their communications metadata for one or more specified purposes , including for the provision of specific services to such users , provided that the purpose or purposes concerned could not be fulfilled without the processing of such metadata . if the processing is likely to result in a high risk to the rights and freedoms of natural persons , articles 35 and 36 of regulation 2016 / 679 shall apply


### if it is necessary for web audience measuring , provided that such measurement is carried out by the provider of the information society service requested by the end - user . ### if it is necessary for information society service audience measuring requested by the end - user for purposes including the calculation of royalties for the management of collective rights or of other remuneration or payments systems .


### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to end - users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should display prominent notices located on the edge of the area of coverage informing end - users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the end - user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 . ### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to users , for example when they enter stores , with personalized offers . while some of these functionalities may not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . users ' privacy should be adequately protected in these situations . information emitted by terminal equipment of users when connecting to a network or other device should only be processed should only be allowed for specific and transparent purposes if the users have consented or if the processing is necessary for statistical counting , as long as such counting is carried out for public utility purposes , there are no other means to achieve the envisaged purpose and that the measures established in article 35 and article 36 of regulation 2016 / 679 have been fulfilled .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications shall be confidential . any processing of electronic communications data , including any interference with electronic communications data such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance of electronic communications data , by persons other than the users , shall be prohibited , except when permitted by this regulation . this includes electronic communications data that is stored after the transmission has been completed .


### the end - user has given his or her consent ; or ### the user has given his or her consent for a specific purpose , and the consent has not been a condition to access or use a service , for the duration necessary for that purpose ; or


### for the sole purpose of the provision of a specific service to an end - user , if the end - user or end - users concerned have given their consent to the processing of his or her electronic communications content and the provision of that service cannot be fulfilled without the processing of such content ; or ### for the sole purpose of the provision of a specific service requested by the user , if the users concerned have given their specific consent to the processing of their electronic communications content and the provision of that specific service cannot be fulfilled without the processing of such content ; or


### end - users who have consented to the processing of electronic communications data as set out in point of article 6 and points and of article 6 shall be given the possibility to withdraw their consent at any time as set forth under article 7 of regulation 2016 / 679 and be reminded of this possibility at periodic intervals of 6 months , as long as the processing continues . ### users who have consented to the processing of electronic communications data as set out in point of article 6 , point of article 6 , point of article 6 , point of article 8 and point of article 8 shall be given the possibility to withdraw their consent at any time as set forth under article 7 of regulation 2016 / 679 and be reminded of this possibility at periodic intervals of 6 months , as long as the processing continues .


### upon installation , the software shall inform the end - user about the privacy settings options and , to continue with the installation , require the end - user to consent to a setting . ### upon installation , first use or whenever any significant modifications are introduced , the user shall be informed about the default privacy settings and other available options , if any . information shall be presented in an easily visible and intelligible manner . it shall not incentivise users to select lower privacy settings and shall include relevant information about the risks associated with each setting . settings must be easily accessible and modifiable at any time during the use of the device or software .


### the use of processing and storage capabilities of terminal equipment and the collection of information from end - users ' terminal equipment , including about its software and hardware , other than by the end - user concerned shall be prohibited , except on the following grounds : ### the use of processing and storage capabilities of terminal equipment and the processing of information from users ' terminal equipment , or making information available through the terminal equipment , including information about or generated by its software and hardware , other than by the user concerned shall be prohibited , except on the following grounds :


### if it is necessary for web audience measuring , provided that such measurement is carried out by the provider of the information society service requested by the end - user . ### if it is technically necessary for web audience measuring of the information society service requested by the user , provided that such measurement is carried out by the provider , or on behalf of the provider , or by an independent web analytics agency acting in the public interest or for scientific purpose ; and further provided that no personal data is made accessible to any other party and that such web audience measurement does not adversely affect the fundamental rights of the user ;


### the use of processing and storage capabilities of terminal equipment and the collection of information from end - users ' terminal equipment , including about its software and hardware , other than by the end - user concerned shall be prohibited , except on the following grounds : ### the use of input , output , processing and storage capabilities of terminal equipment and the processing of information from users ' terminal equipment , or making information available through the terminal equipment , including information about and processed by its software and hardware , other than by the user concerned shall be prohibited , except on the following grounds :


### notwithstanding paragraph 1 , member states may provide by law that the placing of direct marketing voice - to - voice calls to end - users who are natural persons shall only be allowed in respect of end - users who are natural persons who have not expressed their objection to receiving those communications . ### notwithstanding paragraph 1 , member states may provide by law that the placing of direct marketing voice - to - voice calls to users shall only be allowed in respect of users who have not expressed their objection to receiving those communications . member states shall provide that users can object to receiving the unsolicited communications via a national do not call register , thereby also ensuring that the user is only required to opt out once .


### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to end - users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should display prominent notices located on the edge of the area of coverage informing end - users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the end - user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 . ### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such electronic communications metadata may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should only be permitted to process such electronic communications metadata based on the consent of the users concerned .


### where a natural or legal person obtains electronic contact details for electronic mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own similar products or services only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the right to object shall be given at the time of collection and each time a message is sent . ### where a natural or legal person obtains electronic contact details for e - mail from its customer , in the context of the sale of a product or a service , in accordance with regulation 2016 / 679 , that natural or legal person may use these electronic contact details for direct marketing of its own similar products or services only if customers are clearly and distinctly given the opportunity to object , free of charge and in an easy manner , to such use . the customer shall be informed about the right to object and shall be given an easy way to exercise it at the time of collection and each time a message is sent .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata in accordance with regulation 2016 / 679 . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to comply with regulation 2016 / 679 when processing electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colours to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### the methods used for providing information and obtaining end - user ' s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , end - users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , end - users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should provide for the possibility to express consent by using the appropriate settings of a browser or other application . the choices made by end - users when establishing its general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . web browsers are a type of software application that permits the retrieval and presentation of information on the internet . other types of applications , such as the ones that permit calling and messaging or provide route guidance , have also the same capabilities . web browsers mediate much of what occurs between the end - user and the website . from this perspective , they are in a privileged position to play an active role to help the end - user to control the flow of information to and from the terminal equipment . more particularly web browsers may be used as gatekeepers , thus helping end - users to prevent information from their terminal equipment from being accessed or stored . ### the methods used for providing information and obtaining end - user ' s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should prevent the use of so - called ' cookie walls ' and ' cookie banners ' that do not help users to maintain control over their personal information and privacy or become informed about their rights . this regulation should provide for the possibility to express consent by technical specifications , for instance by using the appropriate settings of a browser or other application . those settings should include choices concerning the storage of information on the user ' s terminal equipment as well as a signal sent by the browser or other application indicating the user ' s preferences to other parties . the choices made by users when establishing the general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . in this sense , settings must be granular enough to control all data processing that the user consents to and to cover all relevant functionalities . devices and software applications enabling electronic communications should implement technical mechanisms such as the do not track standard to ensure that users ' privacy is protected by default and that users are given genuine choice and control .


### it is necessary to maintain or restore the security of electronic communications networks and services , or detect technical faults and / or errors in the transmission of electronic communications , for the duration necessary for that purpose . ### it is technically strictly necessary to maintain or restore the availability , integrity , confidentiality and security of electronic communications networks and services , or detect technical faults and / or errors in the transmission of electronic communications , for the duration necessary for that purpose .


### end - users who have consented to the processing of electronic communications data as set out in point of article 6 and points and of article 6 shall be given the possibility to withdraw their consent at any time as set forth under article 7 of regulation 2016 / 679 and be reminded of this possibility at periodic intervals of 6 months , as long as the processing continues . ### users who have given their consent pursuant to article 6 or article 8 shall be given the possibility to withdraw their consent at any time as set forth under article 7 of regulation 2016 / 679 and be reminded of this possibility at periodic intervals of 6 months , as long as the processing continues .


### exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the end - user . this may include the storing of cookies for the duration of a single established session on a website to keep track of the end - user’s input when filling in online forms over several pages . cookies can also be a legitimate and useful tool , for example , in measuring web traffic to a website . information society providers that engage in configuration checking to provide the service in compliance with the end - user ' s settings and the mere logging of the fact that the end - user’s device is unable to receive content requested by the end - user should not constitute access to such a device or use of the device processing capabilities . ### exceptions to the obligation to obtain consent to make use of the input , output , processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the user . this may include the storing of information for the duration of a single established session on a website to keep track of the end - user ' s input when filling in online forms over several pages . information society service providers that engage in configuration checking to provide the service in compliance with the user ' s settings and the mere logging of the fact that the user ' s device is unable to receive content requested by the user should not constitute illegitimate access .


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### after receiving all relevant information about the intended processing in clear and easily understandable language , provided separately from the terms and conditions of the provider , the user or users concerned have given their specific consent to the processing of their communications metadata for one or more specified purposes , including for the provision of specific services to such users , provided that the purpose or purposes concerned could not be fulfilled without the processing of such metadata . if the processing is likely to result in a high risk to the rights and freedoms of natural persons , articles 35 and 36 of regulation 2016 / 679 shall apply


### for the sole purpose of the provision of a specific service to an end - user , if the end - user or end - users concerned have given their consent to the processing of his or her electronic communications content and the provision of that service cannot be fulfilled without the processing of such content ; or ### the user concerned has given his or her consent to the processing of his or her electronic communications content for the sole purpose of the provision of a specific service explicitly requested by the end - user , for the duration necessary for that purpose , provided that the provision of that specific service cannot be fulfilled without the processing of such content by the provider , and the consent has not been a condition to access or use a service ; or


### if it is necessary for web audience measuring , provided that such measurement is carried out by the provider of the information society service requested by the end - user . ### if it is necessary for information society service audience measuring requested by the end - user for purposes including the calculation of royalties for the management of collective rights or of other remuneration or payments systems .


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in a an easily visible and intelligible manner . ### the principles of data protection by design and by default are codified under article 25 of regulation 2016 / 679 . hardware manufacturers and providers of software permitting electronic communications should have an obligation to configure devices and software so that their default settings provide the highest level of privacy protection possible , protecting users ' against cross - domain tracking and unauthorised interferences with their communications and terminal equipment . users should be informed about the default privacy settings and any available options to change those settings during installation or first use of the device or software and when they make significant changes to it . privacy settings should be presented in an objective , easily visible and intelligible manner . they should be easily accessible and modifiable during the use of the device or software . information provided should not incentivise users to select lower privacy settings and should include relevant information about the risks associated with each setting .


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ' hotspots ' situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as wi - fi access points situated at different places within a city , for example department stores , shopping centres and hospitals , as well as airports , public transport , hotels and restaurants . those wi - fi access points might require a login or a password and might be provided also by public administrations . to the extent that those communications networks are provided to users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in addition , this regulation should apply to closed social media profiles and groups that the user has restricted or defined as private . in contrast , this regulation should not apply to closed groups of end - users such as corporate intranet networks , access to which is limited to members of an organisation .


### it is necessary for providing an information society service requested by the end - user ; or ### it is strictly technically necessary for providing an information society service requested by the user ; or


### for the sole purpose of the provision of a specific service to an end - user , if the end - user or end - users concerned have given their consent to the processing of his or her electronic communications content and the provision of that service cannot be fulfilled without the processing of such content ; or ### for the sole purpose of the provision of a specific service requested by the user , if the users concerned have given their specific consent to the processing of their electronic communications content and the provision of that specific service cannot be fulfilled without the processing of such content ; or


### it is necessary for the sole purpose of carrying out the transmission of an electronic communication over an electronic communications network ; or ### it is strictly technically necessary for the sole purpose of carrying out the transmission of an electronic communication over an electronic communications network ; or


### a national or regional strategy in the form of a development plan or a similar document accepted by the commission as a basis for the corresponding multiannual indicative programme , at the time of adoption of the latter document ; ### a national or regional strategy in the form of a development plan or a similar document accepted by the commission as a basis for the corresponding multiannual indicative programme , at the time of adoption of the latter document and based on a meaningful consultation with the local population , civil society and with participation of marginalised groups including children , older persons with disabilities , lgbti persons and indigenous people ;


### in accordance with article 41 of the treaty on european union , union funding under this regulation shall not be used to finance the procurement of arms or ammunition , or operations having military or defence implications . ### in accordance with article 41 of the treaty on european union , union funding under this regulation shall not be used to finance the procurement of arms or ammunition , or operations having military or defence implications . any equipment supplied under this regulation shall be subject to strict transfer controls as set out in the eu common position on arms exports .


### reflecting the importance of tackling climate change in line with the union commitments to implement the paris agreement and the united nations sustainable development goals , this regulation should contribute to mainstream climate action in the union policies and to the achievement of an overall target of 25 % of the union budget expenditures supporting climate objectives . actions under this regulation are expected to contribute 25% of its overall financial envelope to climate objectives . relevant actions will be identified during the implementation of this regulation , and the overall contribution from this regulation should be part of relevant evaluations and review processes . ### reflecting the importance of tackling climate change , protecting the environment and fight nature loss , in line with the union commitments to implement the paris agreement , the convention on biological diversity and the united nations sustainable development goals , this regulation should contribute to mainstream climate and environmental action in the union policies and to the achievement of an overall target of 50 % of the union budget expenditures supporting climate and environment objectives . actions under this regulation are expected to contribute 50% of its overall financial envelope to climate and environment related objectives and support actions with clear and identifiable co - benefits across sectors . relevant actions will be identified during the implementation of this regulation , and the overall contribution from this regulation should be part of relevant evaluations and review processes . as a general principle , all union action and expenditure should be consistent with the objectives of the paris agreement and not contribute to environmental degradation . special emphasis should be put on support for adaptation to climate change in poor , highly vulnerable countries . financing of climate action through this regulation will contribute to the honouring of the developed countries’ commitment to mobilise usd 100 billion per year from 2020 to address the needs of developing countries .


### this regulation should reflect the need to focus on strategic priorities , both geographically – the european neighbourhood and africa , as well as countries that are fragile and most in need , but also thematically – security , migration , climate change and human rights . ### this regulation should reflect the need to focus on strategic priorities , both geographically – the european neighbourhood and africa , as well as countries that are fragile and most in need , particularly least developed countries , but also thematically – democracy and human rights , gender equality , sustainable development , poverty eradication and fighting inequalities , security , migration , climate change , biodiversity , environment and global public health threats .


### reaffirming at global level the central role of sustainable agriculture and fisheries and aquaculture for increased food security , poverty eradication , job creation , mitigating and adapting to climate change , resilience and healthy ecosystems ; ### reaffirming at global level the central role of sustainable agriculture and fisheries and aquaculture , including smallholder agriculture and livestock - keeping for increased food security , poverty eradication , job creation , equitable and sustainable access to and management of resources , including land and land rights , water , credit and other agricultural inputs , mitigating and adapting to climate change , resilience and healthy ecosystems ;


### the european neighbourhood policy , as reviewed in 201562 , aims at the stabilisation of neighbouring countries and strengthening resilience , particularly by boosting economic development , as the union ' s main political priorities . in order to attain its objective , the reviewed european neighbourhood policy has been focusing on four priority areas : good governance , democracy , the rule of law and human rights , with a particular focus in engaging further with civil society ; economic development ; security ; migration and mobility , including tackling the root causes of irregular migration and forced displacement . differentiation and enhanced mutual ownership are the hallmark of the european neighbourhood policy , recognising different levels of engagement , and reflecting the interests of each country concerning the nature and focus of its partnership with the union . _________________ 62 joint communication to the european parliament , the council , the european economic and social committee and the committee of the regions , ' review of the european neighbourhood policy ' , 18 november 2015 . ### the european neighbourhood policy , as reviewed in 201562 , aims at the stabilisation of neighbouring countries and strengthening resilience , particularly by boosting economic development , as the union ' s main political priorities . in order to attain its objective , the reviewed european neighbourhood policy has been focusing on four priority areas : good governance , democracy , the rule of law and human rights , with a particular focus in engaging further with civil society ; economic development ; security ; migration and mobility , including tackling the root causes of forced displacement and supporting populations , countries and regions confronted with enhanced migratory pressure . differentiation and enhanced mutual ownership are the hallmark of the european neighbourhood policy , recognising different levels of engagement , and reflecting the interests of each country concerning the nature and focus of its partnership with the union . actions under this regulation should also aim to achieve the agenda 2030 in the context of the european neighbourhood policy and ensure policy coherence for development throughout its objectives . _________________ 62 joint communication to the european parliament , the council , the european economic and social committee and the committee of the regions , ' review of the european neighbourhood policy ' , 18 november 2015 .


### programmes and actions under this regulation shall mainstream climate change , environmental protection and gender equality and shall address interlinkages between sustainable development goals , to promote integrated actions that can create co - benefits and meet multiple objectives in a coherent way . these programmes and actions shall be based on an analysis of risks and vulnerabilities , integrate a resilience approach and be conflict sensitive . they shall be guided by the principle of leaving no one behind . ### programmes and actions under this regulation shall mainstream climate change , environmental protection , education and culture , and gender equality and shall address interlinkages between sustainable development goals , to promote integrated actions that can create co - benefits and meet multiple objectives in a coherent way . these programmes and actions shall be based on an analysis of risks and vulnerabilities , including the understanding of different forms of discrimination , multiple discrimination , and their impacts on specific groups including women and youth , integrate a resilient preventive approach and be conflict sensitive . they shall be guided by the principle of leaving no one behind .


### the purpose of the efsd + as an integrated financial package supplying financial capacity drawing on the methods of implementation set up in article 23 , , and , shall be to support investments and increase access to financing , in order to foster sustainable and inclusive economic and social development and promote the socio - economic resilience in partner countries with a particular focus on the , eradication of poverty , sustainable and inclusive growth , the creation of decent jobs , economic opportunities , skills and entrepreneurship , socioeconomic sectors , micro , small and medium - sized enterprises as well as addressing specific socioeconomic root causes of irregular migration , in accordance with the relevant indicative programming documents . special attention shall be given to countries identified as experiencing fragility or conflict , least developed countries and heavily indebted poor countries . ### the purpose of the efsd + as an integrated financial package supplying financial capacity in the form of grants , guarantees and other financial instruments as set out in article 23 shall be to support investments and increase access to financing , in order to foster sustainable and inclusive economic and social development and promote the socio - economic resilience of partner countries with a particular focus on the eradication of poverty , sustainable and inclusive growth , the creation of decent jobs , economic opportunities , skills and entrepreneurship , socioeconomic sectors , micro , small and medium - sized enterprises as well as addressing specific root causes of migration , as well as climate action and environmental protection and management , while maximising additionality , delivering innovative products and crowding in private sector funds . 30% of the financing shall be progressively allocated to investments that contribute to climate action , renewable energy and resource efficiency . a geographical balance shall be ensured , in line with eu external action and development priorities . special attention shall be given to countries identified as experiencing fragility or conflict , least developed countries and heavily indebted poor countries .


### strengthening the involvement of local communities in climate change responses , conservation of ecosystems and the governance of natural resources . promoting sustainable urban development and resilience in urban areas ; ### strengthening the involvement of local communities and indigenous people in climate change responses , the fight against biodiversity loss and wildlife crime , conservation of ecosystems and the governance of natural resources , including through the improvement of land use and water resources management . promoting sustainable urban development and resilience in urban areas


### appropriate environmental screening , including for climate change and biodiversity impacts , shall be undertaken at the level of actions , in accordance with the applicable legislative acts of the union , including directive 2011 / 92 / eu82 of the european parliament and of the council and council directive 85 / 337 / eec83 , comprising , where applicable , an environmental impact assessment for environmentally sensitive actions , in particular for major new infrastructure . _________________ 82 directive 2011 / 92 / eu of the european parliament and of the council of 13 december 2011 on the assessment of the effects of certain public and private projects on the environment . 83 council directive of 27 june 1985 on the assessment of the effects of certain public and private projects on the environment . ### appropriate environmental screening , including for climate change and biodiversity impacts , shall be undertaken at the level of actions , in accordance with the applicable legislative acts of the union , including directive 2011 / 92 / eu82 of the european parliament and of the council and council directive 85 / 337 / eec83 , comprising , where applicable , an environmental impact assessment for environmentally sensitive actions , in particular for major new infrastructure as well as human rights due diligence and an assessment of externalities . _________________ 82 directive 2011 / 92 / eu of the european parliament and of the council of 13 december 2011 on the assessment of the effects of certain public and private projects on the environment . 83 council directive of 27 june 1985 on the assessment of the effects of certain public and private projects on the environment .