BelgiumAct of 30 July 2018, Article 10/2, Consent for Storing or Reading Information on Terminal Equipment
Loi du 30 juillet 2018, art. 10/2
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Before you store information on a user's device, or read information already stored there, give the user clear and precise information about the purposes of the processing and their rights under the General Data Protection Regulation (GDPR) and the Act of .
- Obtain the user's consent, given after that information, before you store or access information on the device.
- You need no consent for the technical recording of information, or access to information on the device, whose sole purpose is to carry out the sending of a communication over an electronic communications network, or to provide a service the user expressly requested, where it is strictly necessary for that purpose.
- The same rule reaches other tracking techniques on the device, such as local storage, and not only cookies.
Who enforces it
Enforcement body
The Data Protection Authority (Autorité de protection des données, Gegevensbeschermingsautoriteit), whose supervisory competence covers Articles 10/1 and 10/2 of the Act of .
What this law does
Article 10/2 of the Act of allows the storage of information in the terminal equipment of a subscriber or user, or access to information already stored there, only on two conditions. The first is that the subscriber or user concerned receives clear and precise information about the purposes of the processing and their rights under the Regulation and the Act. The second is that the subscriber or end user has given consent after being informed in that way.
The first paragraph does not apply to the technical recording of information, or access to information stored in terminal equipment, whose sole purpose is to carry out the sending of a communication over an electronic communications network or to provide a service the subscriber or end user expressly requested, where that is strictly necessary for that purpose.
The article is made in application of Article 125, paragraph 1, point 1° of the Act of on electronic communications and without prejudice to the Regulation and the Act. The Data Protection Authority's guidance states that the consent must meet all the conditions for the validity of a consent. The same guidance treats other tracking techniques, such as local storage, as covered by the rules on storing and reading information on the device.
The Data Protection Authority's opinion on the bill that inserted Articles 10/1 and 10/2 records that their content is almost identical to that of Articles 128 and 129 of the Act of .
When LexLint raises it
When your app profile says your app tracks devices.