GreeceLaw 3471/2006, Article 4(5), Consent for Storing or Reading Information on Terminal Equipment
In force.
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Obtain the subscriber's or user's consent, given after clear and comprehensive information, before you store information in, or gain access to information already stored in, their terminal equipment, unless the storage or access is solely for the transmission of a communication over an electronic communications network or is necessary for an information society service that the user or subscriber has expressly requested.
These lines are LexLint's reading of the law's text, as of . Also read by: Hellenic Data Protection Authority (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.dpa.gr/el/enimerwtiko/thematikes_enotites/electronikesepikoinwnies/cookies/cookies_diadiktuo_cookies
- Guidance body
- Hellenic Data Protection Authority
What this law does
Article 4, paragraph 5 of Law 3471/2006 allows storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user only if that subscriber or user has given consent after clear and comprehensive information. The consent may be given through appropriate settings in the web browser or through another application.
The rule does not prevent technical storage or access whose sole purpose is to carry out the transmission of a communication over an electronic communications network, or that is necessary to provide an information society service that the user or subscriber has expressly requested. An act of the Data Protection Authority sets out the ways in which the information is given and the consent declared.
When LexLint raises it
When your app profile says your app tracks devices.