Article 8 Proposal for the ePrivacy Regulation 2019 Protection of information stored in and related to end-user’s terminal equipment

1. The use of processing and storage capabilities of terminal equipment and the collection of information from end-users’ terminal equipment, including about its software and hardware, other than by the end-user concerned shall be prohibited, except on the following grounds:
   1. it is necessary for the sole purpose of carrying out the transmission of electronic communication over an electronic communications network; or
   2. the end-user has given his or her consent; or
   3. it is necessary for providing an information society service requested by the end-user; or
   4. if it is necessary for web audience measuring, provided that such measurement is carried out by the provider of the information society service requested by the end-user.
2. The collection of information emitted by terminal equipment to enable it to connect to another device and, or to network equipment shall be prohibited, except if:
   1. it is done exclusively in order to, for the time necessary for, and for the purpose of establishing a connection; or
   2. a clear and prominent notice is displayed informing of, at least, the modalities of the collection, its purpose, the person responsible for it and the other information required under Article 13 of Regulation (EU) 2016/679 where personal data are collected, as well as any measure the end-user of the terminal equipment can take to stop or minimise the collection.

The collection of such information shall be conditional on the application of appropriate technical and organisational measures to ensure a level of security appropriate to the risks, as set out in Article 32 of Regulation (EU) 2016/679, have been applied.

3. The information to be provided pursuant to point (b) of paragraph 2 may be provided in combination with standardized icons in order to give a meaningful overview of the collection in an easily visible, intelligible and clearly legible manner.
4. The Commission shall be empowered to adopt delegated acts in accordance with Article 27 determining the information to be presented by the standardized icon and the procedures for providing standardized icons.