European UnionRadio Equipment Directive, Network, Privacy and Fraud Protection Requirements for Internet-Connected Radio Equipment
Commission Delegated Regulation (EU) 2022/30, Arts. 1 to 3
In force since .
A product security requirements rule binding public and private bodies.
- Obligation class
- Security
As of .
What it requires
- Directive 2014/53/EU is addressed to the Member States, which adopted its measures by and apply them from (Article 49(1)), so you meet its rules through each Member State's transposing law; Delegated Regulation (EU) 2022/30, directly applicable and applying from , decides which radio equipment each of the three essential requirements below reaches.
- It reaches you if you are a manufacturer that places on the EU market radio equipment that can communicate itself over the internet, directly or via any other equipment: design and manufacture it so that it does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service (Article 3(3), point (d) of the Directive; Article 1(1) of the Regulation).
- If that equipment, radio equipment designed or intended exclusively for childcare, radio equipment covered by Directive 2009/48/EC on the safety of toys, or radio equipment designed or intended to be worn on, strapped to, or hung from the human body or clothing is capable of processing personal data, or traffic data or location data, design and manufacture it to incorporate safeguards that protect the personal data and privacy of the user and of the subscriber (point (e); Article 1(2)).
- If internet-connected radio equipment enables the holder or user to transfer money, monetary value or virtual currency, design and manufacture it to support features that protect against fraud (point (f); Article 1(3)).
- Radio equipment to which Regulation (EU) 2017/745 or Regulation (EU) 2017/746 also applies is outside all three requirements, and radio equipment to which Regulation (EU) 2018/1139, Regulation (EU) 2019/2144 or Directive (EU) 2019/520 also applies is outside points (e) and (f) (Article 2).
Who enforces it
Enforcement body
The market surveillance authorities of each Member State, which evaluate radio equipment under Article 40 of Directive 2014/53/EU and the national law that transposes it.
What this law does
Delegated Regulation (EU) 2022/30 supplements the Radio Equipment Directive, Directive 2014/53/EU, by specifying which radio equipment must meet the essential requirements of Article 3(3), points (d), (e) and (f), of that Directive.
The Directive defines radio equipment as an electrical or electronic product that intentionally emits and/or receives radio waves for the purpose of radio communication and/or radiodetermination, or one that must be completed with an accessory, such as an antenna, to do so.
Article 2(1), point (12), of the Directive defines a manufacturer as any natural or legal person who manufactures radio equipment or has radio equipment designed or manufactured, and markets that equipment under its name or trade mark. Article 1(1) applies point (d) to any radio equipment that can communicate itself over the internet, whether directly or via any other equipment, which the Regulation calls internet-connected radio equipment.
Point (d) requires that radio equipment does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service. Article 1(2) applies point (e) to internet-connected radio equipment, to radio equipment designed or intended exclusively for childcare, to radio equipment covered by Directive 2009/48/EC on the safety of toys, and to radio equipment designed or intended to be worn on, strapped to, or hung from the human body or clothing.
Article 1(2) applies point (e) to that equipment only if it is capable of processing personal data, or traffic data or location data, within the meaning of Regulation (EU) 2016/679 and Article 2, points (b) and (c), of Directive 2002/58/EC, a wording that Article 2 of Delegated Regulation (EU) 2023/2444 corrected. Point (e) requires that radio equipment incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected.
Article 1(3) applies point (f) to any internet-connected radio equipment that enables the holder or user to transfer money, monetary value or virtual currency as defined in Article 2, point (d), of Directive (EU) 2019/713. Point (f) requires that radio equipment supports certain features ensuring protection from fraud.
Article 2(1) provides that points (d), (e) and (f) do not apply to radio equipment to which Regulation (EU) 2017/745 on medical devices or Regulation (EU) 2017/746 on in vitro diagnostic medical devices also applies. Article 2(2) provides that points (e) and (f) do not apply to radio equipment to which Regulation (EU) 2018/1139 on civil aviation, Regulation (EU) 2019/2144 on motor vehicle type-approval or Directive (EU) 2019/520 on electronic road toll systems also applies.
Article 3, as replaced by Article 1 of Delegated Regulation (EU) 2023/2444, provides that Delegated Regulation (EU) 2022/30 applies from . Under Article 10(1) of the Directive, a manufacturer placing radio equipment on the market must ensure that it has been designed and manufactured in accordance with the essential requirements of Article 3.
Article 49(1) of the Directive required Member States to adopt and publish the measures necessary to comply with it by and to apply them from . Article 46 of the Directive leaves the rules on penalties to the Member States and provides that they may include criminal penalties for serious infringements.
When LexLint raises it
When your app profile says your app distributes a software product.