Thus, Directive 2002/58/CE (PDF) regarding the processing of personal data and the protection of confidentiality in the electronic communications sector, amended by Directive 2009/136/CE (PDF), provides that:
“Art.5 – (3) The member states ensure that the storage of information or gaining access to the information already stored in the terminal equipment of a subscriber or user is allowed only on the condition that the subscriber or user in question has given his consent, after has received clear and complete information, in accordance with Directive 95/46/EC, inter alia, regarding the purposes of the processing. This does not prevent storage or technical access for the sole purpose of carrying out the transmission of the communication through an electronic communications network or in if this is strictly necessary in order to provide the provider with an information society service expressly requested by the subscriber or user.”
These provisions were transposed into the national legislation in Law no. 506/2004 on the processing of personal data and the protection of private life in the electronic communications sector, with subsequent amendments and additions:
“Art. 4 –
(5) Storing information or obtaining access to the information stored in the terminal equipment of a subscriber or user is allowed only with the cumulative fulfillment of the following conditions:
– the subscriber or user in question has expressed his consent;
– the subscriber or user in question were provided, prior to expressing the agreement, in accordance with the provisions of art. 12 of Law no. 677/2001, with subsequent amendments and additions, clear and complete information that:
– to be presented in an easy-to-understand language and to be easily accessible to the subscriber or user;
– to include mentions regarding the purpose of processing the information stored by the subscriber or user or the information to which he has access.
If the provider allows third parties to store or access information stored in the terminal equipment of the subscriber or user, the information in accordance with points (i) and (ii) will include the general purpose of the processing of this information by third parties and the way in which the subscriber or user can use the settings of the Internet browsing application or other similar technologies to delete the stored information or to deny third parties access to this information.
– (51) The agreement provided for in para. (5) lit. a) it can also be given by using the settings of the Internet browsing application or other similar technologies through which it can be considered that the subscriber or user has expressed his consent.
– (6) The provisions of para. (5) do not affect the possibility of storing or technical access to the stored information in the following cases:
– when these operations are carried out exclusively for the purpose of transmitting a communication through an electronic communication network;
– when these operations are strictly necessary in order to provide a service of the information society, expressly requested by the subscriber or user.”
