PortugalLei n.º 41/2004, Article 5, Storage of and Access to Information on Terminal Equipment
Artigo 5.º da Lei n.º 41/2004, de 18 de agosto, na redação da Lei n.º 46/2012
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Obtain the subscriber's or user's prior consent, based on clear and complete information that covers, in particular, the purposes of the processing, before you store information in, or access information stored in, their terminal equipment, unless the storage or access is solely to transmit a communication through an electronic communications network or is strictly necessary to supply an information society service that the subscriber or user has expressly requested.
These lines are LexLint's reading of the law's text, as of . Also read by: Comissão Nacional de Proteção de Dados (guidance, recorded ); Court of Justice, judgment of , Planet49, C-673/17 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673
- Guidance link
- https://www.cnpd.pt/media/x2zdus50/nota-informativa-cnpd_cookies_20210625.pdf
- Case citation
- Court of Justice, judgment of , Planet49, C-673/17
- Guidance body
- Comissão Nacional de Proteção de Dados
- Open questions
- When is storage or access 'estritamente necessário' to provide a service 'solicitado expressamente' under Article 5(2)(b) of Lei n.º 41/2004, so that no consent is needed?
What this law does
Article 5, paragraph 1 of Lei 41/2004 allows the storage of information, and the possibility of access to information stored, in the terminal equipment of a subscriber or user only if they have given their prior consent, on the basis of clear and complete information, in particular about the purposes of the processing.
Paragraph 2 provides that Article 5 and the preceding article do not prevent technical storage or access whose sole purpose is to transmit a communication through an electronic communications network, or that is strictly necessary for the provider to supply an information society service expressly requested by the subscriber or user. Article 2 of Lei 46/2012 gave Article 5 of Lei 41/2004 its present wording. Lei 46/2012 entered into force on the day after its publication.
When LexLint raises it
When your app profile says your app tracks devices.