LuxembourgAct of 30 May 2005, Article 4(3)(e), Consent for Storing or Reading Information on Terminal Equipment
Art. 4, paragraphe (3), lettre (e), loi modifiée du 30 mai 2005
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Obtain the subscriber's or user's consent, given after clear and complete information that covers, among other things, the purposes of the processing, before you store information in, or obtain access to information already stored in, their terminal equipment, unless the storage or access is solely to carry out the transmission of a communication over an electronic communications network or is strictly necessary for an information society service that the subscriber or user has expressly requested.
These lines are LexLint's reading of the law's text, as of . Also read by: Commission nationale pour la protection des données (CNPD) (guidance, recorded ); Case C-673/17 Planet49, judgment of the Court of Justice of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Imprisonment of eight days to one year and a fine of EUR 251 to EUR 125,000, or one of those penalties only; the court may also order the processing to stop under a penalty payment (Article 4(4)).
Who enforces it
Enforcement body
The National Commission for Data Protection (Commission nationale pour la protection des données), which Article 12 charges with ensuring the application of the Act.
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673
- Guidance link
- https://cnpd.public.lu/content/dam/cnpd/fr/dossiers-thematiques/cookies/CNPD-LD-Cookies.pdf
- Case citation
- Case C-673/17 Planet49, judgment of the Court of Justice of
- Guidance body
- Commission nationale pour la protection des données (CNPD)
What this law does
Article 4, paragraph 3, point (e) of the Act of provides that the prohibition on interception in paragraph 2 does not apply to storing information in, or obtaining access to information already stored in, the terminal equipment of a subscriber or user, on condition that the subscriber or user has given consent after receiving clear and complete information, among other things on the purposes of the processing.
Where technically possible and effective, the consent may be expressed through the appropriate settings of a browser or another application. The provision does not prevent technical storage or access whose sole purpose is to carry out the transmission of a communication over an electronic communications network, or that is strictly necessary for the provider to supply an information society service expressly requested by the subscriber or user. The Act of replaced point (e) with the consent wording. That Act entered into force on .
When LexLint raises it
When your app profile says your app tracks devices.