The Single Digital Gateway (SDG) Regulation (EU) 2018/1724 aims to simplify cross-border administrative access in the EU through a unified Digital Gateway, centered around the Once-Only Principle (OOP), in which users provide data only once [1]. In accordance with Article 14(3)(a) and (4) of the SDG Regulation, the implementation of the Once-Only Technical System (OOTS) enabling automated cross-border exchange of evidence under the OOP is subject to an explicit user request, except where specific legal provisions provide otherwise [1]. In Germany, the former § 5(2) of the E-Government Act (EGovG) allowed such exchange with user consent [2]. It was questionable whether the expression of request in Article 14(3)(a) and (4) of the SDG Regulation could be understood as consent under the General Data Protection Regulation (GDPR) for the processing of personal evidence. Section 5(2) of the old EGovG was seen as a violation of the prohibition of repetition, since Article 6(1)(a) of the GDPR already requires consent as the legal basis and does not provide any opening clauses [2]. On the other hand, this could lead to a contradiction with regulated exceptions under Article 14(4) of the SDG Regulation [1], which allows data transfer without explicit user request if mandated by national law - introducing consent would undermine this mechanism. The EGovG amendment adopted in 2024 resolves the aforementioned conflicts by defining evidence exchange in the new §§ 5 and 5a on the basis of Article 6(1)(e) GDPR - public interest [3]. The "Explicit Request" under Article 14(3)(a) and (4) SDG Regulation remains a legal requirement for technical implementation, but not as a consent [1]. How does the "Explicit Request" under the SDG Regulation differ legally and technically from prior consent under the OOP? Figure 1 shows the requirements for the "Explicit Request".
This approach identifies and compares the requirements for the "Explicit Request" according to
Article 14(7) of the SDG Regulation and the "Consent" as defined by Article 4(11) of the GDPR for
the processing of personal data in accordance with Article 6(
The GDPR's consent rules are conceptually fragmented, spread across Articles 4(11), 6(
The following two examples demonstrate how addressing the aforementioned limitations would
affect the identified legal requirements and technical implementation evaluation. First, in light of
the requirement for "Explicitness", the "Explicit Request" under the SDG Regulation cannot be
fulfilled by a simple click [5]. It must involve a clear and unambiguous action, similar to consent
under Article 9(
The "Explicit Request" and "Consent" have similar requirements, but they can differ technically. The meaning of each technical implementation requirement only becomes apparent through legal interpretation within the relevant legal framework, as demonstrated in the above cases.
During the preparation of this work, the author used GPT-4o-mini in order to: Text translation, improve writing style, grammar and spelling check. After using this tool/service, the author reviewed and edited the content as needed and take full responsibility for the publication’s content.