RomaniaLaw 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 4, Paragraphs 5 to 6, Consent for Storing or Accessing Information in Terminal Equipment
Art. 4 alin. (5)-(6), Legea nr. 506/2004
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://legislatie.just.ro/Public/DetaliiDocument/56973In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Obtain the subscriber's or user's consent before storing information in their terminal equipment or gaining access to information stored there, and give them, before they consent, clear and complete information that is easy to understand and easily accessible and that states the purpose of processing the stored information or the information they can access (article 4, paragraph 5).NIST Privacy FrameworkCT.PO-P1
- Where you let third parties store or access information in the terminal equipment, include in that information the third parties' general purpose of processing and how the subscriber or user can use browser settings or similar technologies to delete stored information or refuse third-party access (article 4, paragraph 5).NIST Privacy FrameworkCM.AW-P1
- You can obtain the consent through the settings of an internet browsing application or similar technologies through which the subscriber or user can be considered to have expressed it (article 4, paragraph 5^1).
- No consent is needed for technical storage or access exclusively to carry out the transmission of a communication through an electronic communications network, or where it is strictly necessary to provide an information society service the subscriber or user expressly requested (article 4, paragraph 6).
These lines are LexLint's reading of the law's text, as of . Also read by: Court of Justice, judgment of , Planet49, C-673/17 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
Article 13(2) sets a fine of RON 5,000 to RON 100,000 for these contraventions and, for a company with turnover above RON 5,000,000, a fine of up to 2 percent of turnover.
- Rule
- Higher of
- As of
- Minimum
- 5,000
- Currency
- RON
- Fixed cap
- 100,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The staff of the National Supervisory Authority for Personal Data Processing (ANSPDCP) record the contraventions and apply the sanctions (article 13(5)).
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673
- Case citation
- Court of Justice, judgment of , Planet49, C-673/17
- Open questions
- Does consent given 'prin utilizarea setărilor aplicației de navigare pe internet' under Article 4(5^1) of Legea nr. 506/2004 meet the active consent that the Court of Justice required for cookies in Planet49?
What this law does
Article 4(5) of Law 506/2004 allows storing information in, or gaining access to information stored in, the terminal equipment of a subscriber or user only if the conditions that follow are all met. Article 4(5)(a) requires the subscriber or user to have given consent. Article 4(5)(b) requires that, before consent is given, the subscriber or user has been given clear and complete information in accordance with the data protection law the provision cites.
That information must be expressed in language that is easy to understand and be easily accessible to the subscriber or user. It must also state the purpose of processing the information stored by the subscriber or user, or the information to which the subscriber or user has access.
Where the provider allows third parties to store or access information in the terminal equipment, the information must include the general purpose of the third parties' processing and how the subscriber or user can use browser settings or similar technologies to delete stored information or refuse third-party access.
Article 4(5^1) allows the consent to be given through the settings of an internet browsing application or similar technologies through which the subscriber or user can be considered to have expressed it. Article 4(6) leaves in place technical storage or access exclusively to carry out the transmission of a communication through an electronic communications network.
Article 4(6) also leaves in place storage or access that is strictly necessary to provide an information society service the subscriber or user expressly requested. Article 13(1)(i) makes failing to meet the conditions of article 4(5) a contravention. Article 13(2) sanctions the contraventions in article 13(1)(a) to (l), (n), (o) and (q) with a fine of RON 5,000 to RON 100,000 and, for a company with turnover above RON 5,000,000, with a fine of up to 2 percent of turnover.
Article 13(5) has the staff of the National Supervisory Authority for Personal Data Processing (ANSPDCP) record those contraventions and apply the sanctions. Emergency Ordinance 13/2012, published on , amended article 4(5) and added article 4(5^1).
When LexLint raises it
When your app profile says your app tracks devices.