Activities of Dimitrios DROUTSAS related to 2012/0011(COD)
Plenary speeches (3)
Protection of individuals with regard to the processing of personal data - Processing of personal data for the purposes of crime prevention (debate)
Protection of individuals with regard to the processing of personal data - Processing of personal data for the purposes of crime prevention (debate)
Protection of individuals with regard to the processing of personal data - Processing of personal data for the purposes of crime prevention (debate)
Shadow reports (1)
REPORT on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) PDF (3 MB) DOC (3 MB)
Amendments (183)
Amendment 355 #
Proposal for a regulation
Recital 5
Recital 5
(5) Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of data sharing and collectiong has increased spectacularly. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities. Individuals increasingly make personal information available publicly and globally. Technology has transformed both the economy and social life, and requires to furtherimproved legal safeguards to facilitate the free flow of data within the Union, into the Union and the transfer to third countries and international organisations, while ensuring an high level of the protection of personal data.
Amendment 363 #
Proposal for a regulation
Recital 14
Recital 14
(14) This Regulation does not address issues of protection of fundamental rights and freedoms or the free flow of data related to activities which fall outside the scope of Union law, nor does it cover the processing of personal data by the Union institutions, bodies, offices and agencies, which are subject to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, or the processing of personal data by the Member States when carrying out activities in relation to the common foreign and security policy of the Union. To ensure a coherent data protection framework throughout the Union, Regulation (EC) No 45/2001 should be brought into line with this Regulation.
Amendment 371 #
Proposal for a regulation
Recital 16
Recital 16
(16) The protection of individuals with regard to the processing of personal data by competent public authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data, is subject of a specific legal instrument at Union level. Therefore, this Regulation should not apply to the processing activities for those purposes. However, data processed by public authorities under this Regulation when used for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties should be governed by the more specific legal instrument at Union level (Directive XX/YYY).
Amendment 453 #
Proposal for a regulation
Recital 38
Recital 38
(38) TIn exceptional circumstances, the legitimate interests of a controller may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding. This would need careful assessment in particular where the data subject is a child, given that children deserve specific protection. The data subject should have the right to object the processing, on grounds relating to their particular situation and free of charge. To ensure transparency, the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object, and also be obliged to document these legitimate interests. Given that it is for the legislator to provide by law the legal basis for public authorities to process data, this legal ground should not apply for the processing by public authorities in the performance of their tasks.
Amendment 461 #
Proposal for a regulation
Recital 39 a (new)
Recital 39 a (new)
(39a) The enforcement of legal claims against a data subject, such as debt collection or civil damages and remedies, should constitute a legitimate interest, provided the legal claim was established prior to the collection and processing of personal data. The same principle also applies to the prevention or limitation of damages by the data subject suffered by the controller, for example to prevent payment default.
Amendment 469 #
Proposal for a regulation
Recital 40 a (new)
Recital 40 a (new)
(40a) Processing of personal data collected for another purpose should be made available for public scientific research when a scientific relevance of the processing of the collected data can be justified. Privacy by design should be taken into account when making data available for public scientific research.
Amendment 476 #
Proposal for a regulation
Recital 46 a (new)
Recital 46 a (new)
(46a) Data subjects should be informed about the data processing operations employed by the entity they are interacting with without being overwhelmed by the sheer amount of information they are provided with. A transparent and understandable information policy is therefore a pivotal element of every data processing framework. In order to allow a quicker understanding and better comparability of data protection policies, when providing information to the data subject, controllers should disclose short icon based information policies before laying down in detail their information policies. These icon based information policies should be standardized so that they can be provided in written and electronic form and be also easily readable on mobile devices. Detailed explanations or further remarks can follow as part of the more detailed information provisions to the data subjects. When provided electronically, the standardized information policies should be machine readable to allow for innovative implementation schemes.
Amendment 510 #
Proposal for a regulation
Recital 57
Recital 57
(57) Where personal data are processed for the purposes of direct marketingone or more specific purposes, the data subject should have the right to object to such processing in advance, free of charge and in a manner that can be easily and effectively invoked..
Amendment 538 #
Proposal for a regulation
Recital 67
Recital 67
(67) A personal data breach may, if not addressed in an adequate and timely manner, result in substantial economic loss and social harm, including identity fraud, to the individual concerned. Therefore, as soon as the controller becomes aware that such a breach has occurred, the controller should notify the breach to the supervisory authority without undue delay and, where feasible, within 724 hours. Where this cannot achieved within 724 hours, an explanation of the reasons for the delay should accompany the notification. The individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions. A breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in, for example, identity theft or fraud, physical harm, significant humiliation or damage to reputation. The notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects. Notifications to data subjects should be made as soon as reasonably feasible, and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities (e.g. law enforcement authorities). For example, the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay.
Amendment 562 #
Proposal for a regulation
Recital 75
Recital 75
(75) Where the processing is carried out in the public sector or where, in the private sector, processing is carried out by a large enterprise, it relates to more than 500 data subjects per year, or where its core activities, regardless of the size of the enterprise, involve processing operations on sensitive data, or processing operations which require regular and systematic monitoring, a person should assist the controller or processor to monitor internal compliance with this Regulation. When establishing whether data about a large number of data subjects are processed, archived data that is restricted in such a way that they are not subject to the normal data access and processing operations of the controller and can no longer be changed should not be taken into account. Such data protection officers, whether or not an employee of the controller and whether or not performing that task full time, should be in a position to perform their duties and tasks independently.
Amendment 573 #
Proposal for a regulation
Recital 77
Recital 77
(77) In order to enhance transparency and compliance with this Regulation, the establishment of certification mechanisms, data protection seals and marks should be encouraged, allowing data subjects to quickly assess the level of data protection of relevant products and servicessupervisory authorities should award controllers and processors which properly apply this Regulation with the same standardised data protection mark, the ‘European Data Protection Seal’. When certifying controllers, supervisory authorities should apply the same standards; the fee for the certification should be the same in all Member States and should be elaborated by the European Data Protection Board. The European Data Protection Seal should create trust among data subjects, legal certainty for controllers and at the same time export European data protection standards by allowing non-European companies to more easily enter European markets by being certified.
Amendment 585 #
Proposal for a regulation
Recital 87
Recital 87
(87) These derogations should in particular apply to data transfers required and necessary for the protection of important grounds of public interest, for example in cases of international data transfers between competition authorities, tax or customs administrations, financial supervisory authorities, between services competent for social security matters, or to competent public authorities for the prevention, investigation, detection and prosecution of criminal offences.
Amendment 587 #
Proposal for a regulation
Recital 88
Recital 88
Amendment 592 #
Proposal for a regulation
Recital 89
Recital 89
(89) In any case, where the Commission has taken no decision on the adequate level of data protection in a third country, the controller or processor should make use of solutions that provide data subjects with a legally binding guarantee that they will continue to benefit from the fundamental rights and safeguards as regards processing of their data in the Union once this data has been transferred.
Amendment 596 #
Proposal for a regulation
Recital 97
Recital 97
(97) Where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union takes place in more than one Member State, one single supervisory authority should be competent for monitoring the activities ofact as the single contact point for the controller or processor throughout the Union and taking the related decisions, in order to increase the consistent application, provide legal certainty and reduce administrative burden for such controllers and processors..
Amendment 599 #
Proposal for a regulation
Recital 98
Recital 98
(98) The competentlead authority, providing such one-stop shop, should be the supervisory authority of the Member State in which the controller or processor has its main establishment.
Amendment 606 #
Proposal for a regulation
Recital 107
Recital 107
(107) In order to ensure compliance with this Regulation, the Commission may adopt an opinion on this matter, or a decision, requiring the supervisory authority to suspend it reasoned recommendation on matters draft measureised.
Amendment 628 #
Proposal for a regulation
Recital 121
Recital 121
(121) TWhe processing of personal data solely for journalistic purposes, or for the purposes of artistic or liternever necessary, expression should qualify for exempemptions or derogations from the requirements of certain provisions of this Regulation for the processing of personal data should be possible in order to reconcile the right to the protection of personal data with the right to freedom of expression, and notably the right to receive and impart information, as guaranteed in particular by Article 11 of the Charter of Fundamental Rights of the European Union. This should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries. Therefore, Member States should adopt legislative measures, which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights. Such exemptions and derogations should be adopted by the Member States on general principles, on the rights of the data subject, on controller and processor, on the transfer of data to third countries or international organisations, on the independent supervisory authorities and on co-operation and consistency. This should not, however, lead Member States to lay down exemptions from the other provisions of this Regulation. In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly. Therefore, Member States should classify activities as ‘journalistic’ for the purpose of the exemptions and derogations to be laid down under this Regulation if the object of these activities is the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them. They should not be limited to media undertakings and may be undertaken for profit-making or for non- profit making purposes.
Amendment 637 #
Proposal for a regulation
Recital 124 a (new)
Recital 124 a (new)
(124a) In Member States where it has been left to the parties on the labour market to regulate wages and other work conditions through collective agreements, social partners´ obligations and rights under collective agreements should be taken into specific consideration when applying Article 6(1)f.
Amendment 655 #
Proposal for a regulation
Recital 132
Recital 132
Amendment 657 #
Proposal for a regulation
Recital 134
Recital 134
(134) Directive 95/46/EC should be repealed by this Regulation. However, Commission decisions adopted and authorisations by supervisory authorities based on Directive 95/46/EC should remain in force. Commission decisions and authorisations by supervisory authorities relating to transfers of personal data to third countries should remain in force for a transition period of two years.
Amendment 681 #
Proposal for a regulation
Article 2 – paragraph 2 – point e
Article 2 – paragraph 2 – point e
(e) by competent public authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.
Amendment 728 #
Proposal for a regulation
Article 4 – paragraph 1 – point 2 a (new)
Article 4 – paragraph 1 – point 2 a (new)
(2a) ‘pseudonym’ means a unique identifier which is specific to one given context and which does not permit the direct identification of a natural person, but allows the singling out of a data subject;
Amendment 741 #
Proposal for a regulation
Article 4 – paragraph 1 – point 3 a (new)
Article 4 – paragraph 1 – point 3 a (new)
(3a) ‘profiling’ means any form of automated processing of personal data intended to evaluate certain personal aspects relating to a natural person or to analyse or predict in particular that natural person’s performance at work, economic situation, location, health, personal preferences, reliability or behaviour;
Amendment 815 #
Proposal for a regulation
Article 5 – paragraph 1 – introductory part
Article 5 – paragraph 1 – introductory part
Personal data mustshall be:
Amendment 836 #
Proposal for a regulation
Article 5 – paragraph 1 – point e
Article 5 – paragraph 1 – point e
(e) kept in a form which permits identification or singling out of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the data will be processed solely for historical, statistical or scientific research purposes in accordance with the rules and conditions of Article 83 and if a periodic review is carried out to assess the necessity to continue the storage;
Amendment 846 #
Proposal for a regulation
Article 5 – paragraph 1 – point f
Article 5 – paragraph 1 – point f
(f) processed under the responsibility and liability of the controller, who shall ensure and be able to demonstrate for each processing operation the compliance with the provisions of this Regulation.;
Amendment 849 #
Proposal for a regulation
Article 5 – paragraph 1 a (new)
Article 5 – paragraph 1 a (new)
1a. Processing of personal data shall be organised and carried out in a way that ensures compliance with the principles referred to in paragraph 1.
Amendment 854 #
Proposal for a regulation
Article 6 – paragraph 1 – point a
Article 6 – paragraph 1 – point a
(a) the data subject has given explicit and informed consent to the processing of their personal data for one or more specific purposes;
Amendment 872 #
Proposal for a regulation
Article 6 – paragraph 1 – point f
Article 6 – paragraph 1 – point f
Amendment 905 #
Proposal for a regulation
Article 6 – paragraph 1 a (new)
Article 6 – paragraph 1 a (new)
1a. Only if none of the legal grounds for the processing of personal data referred to in paragraph 1 apply, processing of personal data for specific purposes can be based on the legitimate interests of the controller. The data controller shall in that case inform the data subject about the data processing explicitly and separately. The controller shall publish the reasons for believing that its interests override the interests or fundamental rights and freedoms of the data subject. This paragraph shall not apply to processing carried out by public authorities in the performance of their tasks.
Amendment 909 #
Proposal for a regulation
Article 6 – paragraph 1 b (new)
Article 6 – paragraph 1 b (new)
1b. The following interests of the controller are presumed to be legitimate: (a) processing of personal data is necessary for the prevention or limitation of damages suffered by the controller, or, in exceptional cases, by a third party; (b) the data subject has provided the personal data to the data controller on the legal ground referred to in point (b) of paragraph 1, the personal data are used for direct marketing for its own similar products and services and are not transferred, and the data controller is clearly identified towards the data subject.
Amendment 914 #
Proposal for a regulation
Article 6 – paragraph 1 c (new)
Article 6 – paragraph 1 c (new)
1c. Any legitimate interests pursued by the controller, must be balanced against the interests or fundamental rights and freedoms of the data subject. This fundamental rights and interests are presumed to override the legitimate interest of the controller, if: (a) the processing causes a serious risk of damage to the data subject; (b) the processing leads to a serious risk of infringement of any of the fundamental rights of the data subjects involved, as laid down in the Charter of Fundamental Rights of the European Union; (c) the processing involves location data or biometric data; (d) the processing entails the processing of personal data that are the result of profiling of the data subject; (e) there is a significant risk of processing of personal data without legal ground, in particular if personal data is made accessible for a large number of persons or if large amounts of personal data about the data subject are processed or combined with other data; or (f) the data subject is a child.
Amendment 915 #
Proposal for a regulation
Article 6 – paragraph 1 d (new)
Article 6 – paragraph 1 d (new)
1d. Processing is necessary due to national practices for the social partners concerning collective agreements.
Amendment 929 #
Proposal for a regulation
Article 6 – paragraph 3 – subparagraph 1 – point b a (new)
Article 6 – paragraph 3 – subparagraph 1 – point b a (new)
(ba) collective agreements in the employment context.
Amendment 940 #
Proposal for a regulation
Article 6 – paragraph 4
Article 6 – paragraph 4
Amendment 961 #
Proposal for a regulation
Article 6 – paragraph 5
Article 6 – paragraph 5
Amendment 1001 #
Proposal for a regulation
Article 7 – paragraph 4 a (new)
Article 7 – paragraph 4 a (new)
4a. The Commission shall be empowered to adopt, after requesting an opinion from the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the requirements and conditions for technical standards referred to in paragraph 2a, and for declaring that a technical standard is in line with this Regulation and has general validity within the Union.
Amendment 1010 #
Proposal for a regulation
Article 8 – paragraph 1
Article 8 – paragraph 1
1. For the purposes of this Regulation, in relation to the offering of information societygoods or services directly to a child, the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child's parent or custolegal guardian. The controller shall make reasonable efforts to obtain verifiable consent, taking into consideration available technology. The methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary.
Amendment 1029 #
Proposal for a regulation
Article 8 – paragraph 3
Article 8 – paragraph 3
3. The Commission shall, after requesting an opinion from the European Data Protection Board, be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the methods to obtain verifiable consent referred to in paragraph 1. In doing so, the Commission shall consider specific measures for micro, small and medium- sized enterprises.
Amendment 1042 #
Proposal for a regulation
Article 9 – paragraph 1
Article 9 – paragraph 1
1. The processing of personal data, revealing race or ethnic origin, political opinions, religion or beliefs, sexual orientation or gender identity, trade-union membership and activities, and the processing of genetic or biometric data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited.
Amendment 1051 #
Proposal for a regulation
Article 9 – paragraph 2 – point b
Article 9 – paragraph 2 – point b
(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment law in so far as it is authorised by Union law or Member State law or collective agreements providing for adequate safeguards; or
Amendment 1080 #
Proposal for a regulation
Article 9 – paragraph 2 – point j
Article 9 – paragraph 2 – point j
(j) processing of data relating to criminaladministrative sanctions, judgments, criminal offences, convictions or related security measures, is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject, or for the performance of a task carried out for important public interest reasons, and in so far as authorised by Union law or Member State law providing for adequate safeguards. A complete register of criminal convictions shall be kept only under the control of official authority.
Amendment 1093 #
Proposal for a regulation
Article 9 – paragraph 3
Article 9 – paragraph 3
3. The Commission shall be empowered to adopt, after requesting an opinion from the European Data Protection Board, delegated acts in accordance with Article 86, for the purpose of further specifying the criteria, conditions and appropriate safeguards for the processing of the special categories of personal data referred to in paragraph 1 and the exemptions laid down in paragraph 2.
Amendment 1101 #
Proposal for a regulation
Article 10 – paragraph 1
Article 10 – paragraph 1
If the data processed by a controller do not permit the controller to identify or single out a natural person, or consist only of data relating to pseudonyms, the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation.
Amendment 1140 #
Proposal for a regulation
Article 12 – paragraph 4
Article 12 – paragraph 4
4. The information and the actions taken on requests referred to in paragraph 1 shall be free of charge. Where requests are manifestly excessive, in particular because of their repetitive character, the controller may charge a fee for providing the information or taking the action requested, or the controller may notreasonable fee taking into account the administrative costs for providing the information or takeing the action requested. In that case, the controller shall bear the burden of proving the manifestly excessive character of the request.
Amendment 1154 #
Proposal for a regulation
Article 12 – paragraph 5
Article 12 – paragraph 5
5. The Commission shall be empowered to adopt, after requesting an opinion the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for the manifestly excessive requests and the fees referred to in paragraph 4.
Amendment 1162 #
Proposal for a regulation
Article 12 – paragraph 6
Article 12 – paragraph 6
6. The Commission may lay down standard forms and specifying standard procedures for the communication referred to in paragraph 2, including the electronic format. In doing so, the Commission shall take the appropriate measures for micro, small and medium-sized enterprises. Those implementing acts shall be adopted after adopting an opinion of the European Data Protection Board in accordance with the examination procedure referred to in Article 87(2).
Amendment 1172 #
Proposal for a regulation
Article 14 a (new)
Article 14 a (new)
Article 13a Standardised information policies 1. Where personal data relating to a data subject are collected, the controller shall provide the data subject with the following particulars before providing information pursuant to Article 14: (a) whether personal data are collected beyond the minimum necessary for each specific purpose of the processing; (b) whether personal data are retained beyond the minimum necessary for each specific purpose of the processing; (c) whether personal data are processed for purposes other than the purposes for which they were collected; (d) whether personal data are disseminated to non-public third parties for purposes other than the purposes for which they were collected; (e) whether personal data are sold; (f) whether personal data are retained in encrypted form. 2. The particulars referred to in paragraph 1 shall be presented pursuant to Annex X in an aligned tabular format, using text and symbols, in the following three columns: (a) the first column depicts graphical forms symbolising those particulars; (b) the second column contains essential information describing those particulars; (c) the third column depicts graphical forms indicating whether a specific particular is met. 3. The information referred to in paragraphs 1 and 2 shall be presented in an easily visible and clearly legible way and shall appear in a language easily understood by the consumers of the Member States to whom the information is provided. Where the particulars are presented electronically, they shall be machine readable. 4. Additional particulars shall not be provided. Detailed explanations or further remarks regarding the particulars referred to in paragraph 1 may be provided together with the other information requirements pursuant to Article 14. 5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the particulars referred to in paragraph 1 and their presentation as referred to in paragraph 2 and in Annex X.
Amendment 1282 #
Proposal for a regulation
Article 14 – paragraph 7
Article 14 – paragraph 7
7. The Commission shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria for categories of recipients referred to in point (f) of paragraph 1, the requirements for the notice of potential access referred to in point (g) of paragraph 1, the criteria for the further information necessary referred to in point (h) of paragraph 1 for specific sectors and situations, and the conditions and appropriate safeguards for the exceptions laid down in point (b) of paragraph 5. In doing so, the Commission shall take the appropriate measures for micro, small and medium-sized-enterprises.
Amendment 1288 #
Proposal for a regulation
Article 14 – paragraph 8
Article 14 – paragraph 8
8. The Commission mayshall lay down standard forms for providing the information referred to in paragraphs 1 to 3, taking into account the specific characteristics and needs of various sectors and data processing situations where necessary. Those implementing acts shall be adopted as well as the needs of the relevant stakeholders. Those implementing acts shall be adopted, after requesting an opinion of the European Protection Board, in accordance with the examination procedure referred to in Article 87(2).
Amendment 1295 #
Proposal for a regulation
Article 15 – paragraph 1 – introductory part
Article 15 – paragraph 1 – introductory part
1. The data subject shall have the right to obtain from the controller at any time, on request, in clear and plain language, confirmation as to whether or not personal data relating to the data subject are being processed. Where such personal data a, and as to the existence of profiling and measures being processed,ased on profiling in respect of the data subject the controller shall provide the following information:
Amendment 1304 #
Proposal for a regulation
Article 15 – paragraph 1 – point c
Article 15 – paragraph 1 – point c
(c) the recipients or categories of recipients to whom the personal data are to be or have been disclosed, in particularcluding to recipients in third countries;
Amendment 1314 #
Proposal for a regulation
Article 15 – paragraph 1 – point h
Article 15 – paragraph 1 – point h
(h) the significance and envisaged consequences of such processing, at least in the case of measures referred to in Article 20profiling and of measures based on profiling.
Amendment 1321 #
Proposal for a regulation
Article 15 – paragraph 1 – point h a (new)
Article 15 – paragraph 1 – point h a (new)
(ha) intelligible information about the logic involved in any automated processing;
Amendment 1322 #
Proposal for a regulation
Article 15 – paragraph 1 – point h b (new)
Article 15 – paragraph 1 – point h b (new)
(hb) in the event of disclosure of personal data to a public authority as a result of a public authority request, confirmation of the fact that such a request has been made, information about whether or not the request has been fully or partly complied with and an overview of the data that were requested or disclosed.
Amendment 1330 #
Proposal for a regulation
Article 15 – paragraph 2
Article 15 – paragraph 2
2. The data subject shall have the right to obtain from the controller communication of the personal data undergoing processing. Where the data subject makes the request in electronic form, the information shall be provided in an electronic format which allows for further use by the data subject, unless otherwise requested by the data subject.
Amendment 1341 #
Proposal for a regulation
Article 15 – paragraph 2 a (new)
Article 15 – paragraph 2 a (new)
2a. Where the data subject has provided the personal data and the processing is based on consent or on a contract, the data subject shall have the right to transmit those personal data, where technically feasible and appropriate, and retained by an automated processing system, into another one, in an electronic format which is commonly used, without hindrance from the controller from whom the personal data are withdrawn.
Amendment 1349 #
Proposal for a regulation
Article 15 – paragraph 2 b (new)
Article 15 – paragraph 2 b (new)
2b. This Article shall be without prejudice to the obligation to delete data when no longer necessary under Article 5(1)(e).
Amendment 1352 #
Proposal for a regulation
Article 15 – paragraph 3
Article 15 – paragraph 3
Amendment 1366 #
Proposal for a regulation
Article 15 – paragraph 4
Article 15 – paragraph 4
4. The Commission may specify standard forms and procedures for requesting and granting access to the information referred to in paragraph 1, including for verification of the identity of the data subject and communicating the personal data to the data subject, taking into account the specific features and necessities of various sectors and data processing situations. Those implementing acts shall be adopted, after requesting an opinion of the European Protection Board, in accordance with the examination procedure referred to in Article 87(2).
Amendment 1369 #
Proposal for a regulation
Article 15 – paragraph 4 a (new)
Article 15 – paragraph 4 a (new)
4a. Subject to the necessary legal safeguards, especially in order to ensure that information are not used to take measures or decisions regarding specific persons, Member States can, in cases with no risk of violation of privacy, by law limit the rights following Article 15 only if these rights are processed as part of scientific research in compliance with Article 83 of this Regulation or only if these personal data are stored in the specific time frame it takes to make statistics.
Amendment 1439 #
Proposal for a regulation
Article 17 – paragraph 3 – point d
Article 17 – paragraph 3 – point d
Amendment 1484 #
Proposal for a regulation
Article 17 – paragraph 9 – introductory part
Article 17 – paragraph 9 – introductory part
9. The Commission shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying:
Amendment 1490 #
Proposal for a regulation
Article 18
Article 18
Amendment 1495 #
Proposal for a regulation
Article 18 – paragraph 1
Article 18 – paragraph 1
Amendment 1508 #
Proposal for a regulation
Article 18 – paragraph 2
Article 18 – paragraph 2
Amendment 1518 #
Proposal for a regulation
Article 18 – paragraph 3
Article 18 – paragraph 3
Amendment 1528 #
Proposal for a regulation
Article 19 – paragraph 1
Article 19 – paragraph 1
1. The data subject shall have the right to object, on grounds relating to their particular situation, at any time to the processing of personal data which is based on points (d), (e) and (fe) of Article 6(1), unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject.
Amendment 1534 #
Proposal for a regulation
Article 19 – paragraph 2
Article 19 – paragraph 2
2. WhereProcessing of personal data are processed for direct marketing purposes, the data subject shall have the right to object free of charge to the processing of their personal data for such marketing shall require the explicit consent of the data subject. The data shall not be given to third parties. A withdrawal of consent shall be possible at all times and free of charge. This right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information.
Amendment 1563 #
Proposal for a regulation
Article 20 – paragraph 2 – point a
Article 20 – paragraph 2 – point a
(a) is carried out in the course of the entering into, or performance of, a contract, where the request for the entering into or the performance of the contract, lodged by the data subject, has been satisfied or where suitable measures to safeguard the data subject's legitimate interests have been adduced, such asincluding the right to be provided with meaningful information about the logic used in the profiling and the right to obtain human intervention; or
Amendment 1569 #
Proposal for a regulation
Article 20 – paragraph 2 – point a b (new)
Article 20 – paragraph 2 – point a b (new)
(ab) Profiling shall not be used to identify or single out children;
Amendment 1581 #
Proposal for a regulation
Article 20 – paragraph 2 – point c
Article 20 – paragraph 2 – point c
(c) is based on the data subject's consent, subject to the conditions laid down in Article 7 and to suitable safeguards, including the possibility to withdraw consent at any time and effective protection against possible discrimination resulting from measures described in paragraph 1.
Amendment 1597 #
Proposal for a regulation
Article 20 – paragraph 3
Article 20 – paragraph 3
3. Automated processing of personal data intended to evaluate certain personal aspectProfiling activities relating to a natural person shall not be based solely on the special categories of personal data referred to in Article 9.
Amendment 1622 #
Proposal for a regulation
Article 21 – paragraph 1 – introductory part
Article 21 – paragraph 1 – introductory part
1. Union or Member State law may restrict by way of a legislative measure the scope of the obligations and rights provided for in points (a) to (e) of Article 5 andin Articles 11 to 20 and Article 32, when such a restriction constitutes a necessary and proportionate measure in a democratic society to safeguard:
Amendment 1636 #
Proposal for a regulation
Article 21 – paragraph 1 – point c
Article 21 – paragraph 1 – point c
(c) other public interests of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters and the protection of market stability and integrity;
Amendment 1648 #
Proposal for a regulation
Article 21 – paragraph 2
Article 21 – paragraph 2
2. In particular, any legislative measure referred to in paragraph 1 must be necessary and proportionate in a democratic society and shall contain specific provisions at least as to: (a) the objectives to be pursued by the processing and; (b) the determination of the controller; (c) the specific purposes and means of processing; (d) the categories of persons authorised to process the data; (e) the procedure to be followed for the processing; (f) the safeguards to prevent abuse; (g) the right of data subjects to be informed about the restriction.
Amendment 1696 #
Proposal for a regulation
Article 22 – paragraph 3
Article 22 – paragraph 3
3. The controller shall implement mechanisms to ensure the verification ofbe able to demonstrate the effectiveness of the measures referred to in paragraphs 1 and 2. If proportionate, this verification shall be carried outshall be verified by independent internal or external auditors.
Amendment 1705 #
Proposal for a regulation
Article 22 – paragraph 4
Article 22 – paragraph 4
4. The Commission shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of specifying any further criteria and requirements for appropriate measures referred to in paragraph 1 other than those already referred to in paragraph 2, the conditions for the verification and auditing mechanisms referred to in paragraph 3 and as regards the criteria for proportionality under paragraph 3, and considering specific measures for micro, small and medium-sized-enterprises.
Amendment 1727 #
Proposal for a regulation
Article 23 – paragraph 2
Article 23 – paragraph 2
2. The controller shall implement mechanisms for ensuringe that, by default, only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes, both in terms of the amount of the data and the time of their storage. In particular, those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals and that data subjects are able to control the distribution of their personal data; pseudonymisation shall be used where possible.
Amendment 1738 #
Proposal for a regulation
Article 23 – paragraph 3
Article 23 – paragraph 3
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purposeEuropean Data Protection Board shall be entrusted with the task of specifying any further criteria and requirements for appropriate measures and mechanisms referred to in paragraphs 1, 2, and 2a, in particular for data protection by design requirements applicable across sectors, products and services, in accordance with Article 66.
Amendment 1744 #
Proposal for a regulation
Article 23 – paragraph 4
Article 23 – paragraph 4
Amendment 1760 #
Proposal for a regulation
Article 25 – paragraph 2 – point b
Article 25 – paragraph 2 – point b
(b) an enterprise processing personal data relating to fewer than 500 data subject per year, or by an enterprise employing fewer than 250 persons; or
Amendment 1771 #
Proposal for a regulation
Article 25 – paragraph 3
Article 25 – paragraph 3
3. The representative shall be established in one of those Member States where the data subjects whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, reside.
Amendment 1819 #
Proposal for a regulation
Article 26 – paragraph 5
Article 26 – paragraph 5
Amendment 2100 #
Proposal for a regulation
Article 34 – paragraph 1
Article 34 – paragraph 1
1. The controller or the processor as the case may be shall obtain an authorisation from the supervisory authority prior to the processing of personal data, in order to ensure the compliance of the intended processing with this Regulation and in particular to mitigate the risks involved for the data subjects where a controller or processor adopts contractual clauses as provided for in point (d) of Article 42(2) or does not provide for the appropriate safeguards in a legally binding instrument as referred to in Article 42(5) for thewhere it transfer ofs personal data to a third country or an international organisation based on the derogations in Article 44.
Amendment 2123 #
Proposal for a regulation
Article 34 – paragraph 5
Article 34 – paragraph 5
Amendment 2134 #
Proposal for a regulation
Article 34 – paragraph 8
Article 34 – paragraph 8
Amendment 2139 #
Proposal for a regulation
Article 34 – paragraph 9
Article 34 – paragraph 9
9. The Commission may set out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and 2, and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6. Those implementing acts shall be adopted, after requesting an opinion of the European Data Protection Board, in accordance with the examination procedure referred to in Article 87(2).
Amendment 2169 #
Proposal for a regulation
Article 35 – paragraph 1 – point b
Article 35 – paragraph 1 – point b
(b) the processing is carried out by an enterprise employing 250 persons or more legal person and relates to more than 500 data subjects per year, or by an enterprise employing 250 persons or more, or processing is carried out on special categories of personal data as referred to in Article 9(1); or
Amendment 2228 #
Proposal for a regulation
Article 35 – paragraph 7
Article 35 – paragraph 7
7. The controller or the processor shall designate a data protection officer for a period of at least twofour years. The data protection officer may be reappointed for further terms. During their term of office, the data protection officer may only be dismissed, if the data protection officer no longer fulfils the conditions required for the performance of their duties.
Amendment 2265 #
Proposal for a regulation
Article 36 – paragraph 2
Article 36 – paragraph 2
2. The controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function. The data protection officer shall directly report to the executive management of the controller or the processor.
Amendment 2276 #
Proposal for a regulation
Article 36 – paragraph 3
Article 36 – paragraph 3
3. The controller or the processor shall support the data protection officer in performing the tasks and shall provide staff, premises, equipment, continuous professional training and any other resources necessary to carry out the duties and tasks referred to in Article 37.
Amendment 2282 #
Proposal for a regulation
Article 36 – paragraph 3 a (new)
Article 36 – paragraph 3 a (new)
3a. Data protection officers shall be bound by professional secrecy concerning the identity of data subjects and concerning circumstances enabling data subjects to be identified, unless they are released from that obligation by the data subject.
Amendment 2320 #
Proposal for a regulation
Article 37 – paragraph 1 – point h a (new)
Article 37 – paragraph 1 – point h a (new)
(ha) to inform the workers representatives on data processing of the workers.
Amendment 2325 #
Proposal for a regulation
Article 37 – paragraph 2
Article 37 – paragraph 2
Amendment 2344 #
Proposal for a regulation
Article 38 – paragraph 4
Article 38 – paragraph 4
4. The Commission may adopt implementing actsshall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for deciding that the codes of conduct and amendments or extensions to existing codes of conduct submitted to it pursuant to paragraph 3 are in line with this Regulation and have general validity within the Union. Those implementingis delegated acts shall be adopted in accordance with the examination procedure set out in Article 87(2)confer enforceable rights on data subjects.
Amendment 2356 #
Proposal for a regulation
Article 39 – paragraph 1
Article 39 – paragraph 1
1. The Member States and the Commission shall encourage, in particular at European level, the establishment of data protection certification mechanisms and of data protection seals and marks, allowing data subjects to quickly assess the level of data protection provided by controllers and processors. The data protection certifications mechanisms shall contribute to the proper application ofAny controller or processor may request any supervisory authority in the Union, for a fixed fee, to certify that the processing of personal data is performed in compliance with this Regulation, taking account of the specific features of the various sectors and differents well as the contexts of and risks represented by the data processing operations.
Amendment 2360 #
Proposal for a regulation
Article 39 – paragraph 1 a (new)
Article 39 – paragraph 1 a (new)
Amendment 2361 #
Proposal for a regulation
Article 39 – paragraph 1 a (new)
Article 39 – paragraph 1 a (new)
1a. The supervisory authorities shall co- operate with each other in accordance with Articles 46 and 57. In this regard, supervisory authorities shall grant controllers and processors which comply with this Regulation the standardised data protection mark, the "European Data Protection Seal".
Amendment 2363 #
Proposal for a regulation
Article 39 – paragraph 1 c (new)
Article 39 – paragraph 1 c (new)
1c. The "European Data Protection Seal" shall be valid for as long as the data protection level of the certified controller or processor fully complies with this Regulation.
Amendment 2364 #
Proposal for a regulation
Article 39 – paragraph 1 d (new)
Article 39 – paragraph 1 d (new)
1d. Notwithstanding paragraph 1c, the "European Data Protection Seal" shall be valid for maximum five years.
Amendment 2370 #
Proposal for a regulation
Article 39 – paragraph 2
Article 39 – paragraph 2
2. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1, including conditions for granting and withdrawal, and requirements for recognition within the Union and in third countries. These delegated acts shall confer enforceable rights on data subjects.
Amendment 2376 #
Proposal for a regulation
Article 39 – paragraph 3
Article 39 – paragraph 3
3. The Commission may lay down technicalshall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of laying down standards for certification mechanisms and data protection seals and marks and mechanisms to promote and recognize certification mechanisms and data protection seals and marks. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).
Amendment 2390 #
Proposal for a regulation
Article 41 – paragraph 1 a (new)
Article 41 – paragraph 1 a (new)
1a. All transfers of data from a Cloud in European Union jurisdiction to a Cloud under the jurisdiction of a third country shall be accompanied with a notification to the data subject of such transfer and its legal effects.
Amendment 2392 #
Proposal for a regulation
Article 41 – paragraph 2 – point a
Article 41 – paragraph 2 – point a
(a) the rule of law, relevant legislation in force, both general and sectoral, including concerning public security, defence, national security and criminal law, case law of the Courts, the professional rules and security measures which are complied with in that country or by that international organisation, as well as effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred;
Amendment 2398 #
Proposal for a regulation
Article 41 – paragraph 3
Article 41 – paragraph 3
3. The Commission may decideshall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of deciding that a third country, or a territory or a processing sector within that third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
Amendment 2400 #
Proposal for a regulation
Article 41 – paragraph 4
Article 41 – paragraph 4
4. The implementingdelegated act shall specify its geographical and secterritorial application, and, where applicable, identify the supervisory authority mentioned in point (b) of paragraph 2.
Amendment 2404 #
Proposal for a regulation
Article 41 – paragraph 5
Article 41 – paragraph 5
5. The Commission may decideshall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of deciding that a third country, or a territory or a processing sector within that third country, or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, in particular in cases where the relevant legislation, both general and sectoral, in force in the third country or international organisation, does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2), or, in cases of extreme urgency for individuals with respect to their right to personal data protection, in accordance with the procedure referred to in Article 87(3).
Amendment 2409 #
Proposal for a regulation
Article 41 – paragraph 7
Article 41 – paragraph 7
7. The Commission shall publish in the Official Journal of the European Union, and on its website, a list of those third countries, territories and processing sectors within a third country and international organisations where it has decided that an adequate level of protection is or is not ensured.
Amendment 2413 #
Proposal for a regulation
Article 41 – paragraph 8
Article 41 – paragraph 8
8. Decisions adopted by the Commission on the basis of Article 25(6) or Article 26(4) of Directive 95/46/EC shall remain in force, until amended, replaced or repealed by the Commisstwo years after the entry into force of this Regulation.
Amendment 2423 #
Proposal for a regulation
Article 42 – paragraph 2 – point a a (new)
Article 42 – paragraph 2 – point a a (new)
(aa) a valid "European Data Protection Seal" pursuant to Article 39;
Amendment 2425 #
Proposal for a regulation
Article 42 – paragraph 2 – point b
Article 42 – paragraph 2 – point b
Amendment 2444 #
Proposal for a regulation
Article 42 – paragraph 3
Article 42 – paragraph 3
3. A transfer based on standard data protection clauses or binding corporate rules as referred to in points (a), (b) or (c) of paragraph 2 shall not require any further authorisation.
Amendment 2456 #
Proposal for a regulation
Article 42 – paragraph 5
Article 42 – paragraph 5
Amendment 2476 #
Proposal for a regulation
Article 43 – paragraph 2 – point a
Article 43 – paragraph 2 – point a
(a) the structure and contact details of the group of undertakings and its members; and their external subcontractors;
Amendment 2485 #
Proposal for a regulation
Article 43 – paragraph 3
Article 43 – paragraph 3
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purposeEuropean Data Protection Board shall be entrusted with the task of further specifying the criteria and requirements for binding corporate rules within the meaning of this Article, in particular as regards the criteria for their approval, the application of points (b), (d), (e) and (f) of paragraph 2 to binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned, in accordance with Article 66.
Amendment 2489 #
Proposal for a regulation
Article 43 – paragraph 4
Article 43 – paragraph 4
4. The Commission mayshall, after requesting an opinion of the European Data Protection Board, be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying the format and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules within the meaning of this Article. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).
Amendment 2500 #
Proposal for a regulation
Article 44 – paragraph 1 – point h
Article 44 – paragraph 1 – point h
Amendment 2511 #
Proposal for a regulation
Article 44 – paragraph 3
Article 44 – paragraph 3
Amendment 2514 #
Proposal for a regulation
Article 44 – paragraph 4
Article 44 – paragraph 4
4. Points (b), (c) and (hc) of paragraph 1 shall not apply to activities carried out by public authorities in the exercise of their public powers.
Amendment 2521 #
Proposal for a regulation
Article 44 – paragraph 6
Article 44 – paragraph 6
Amendment 2528 #
Proposal for a regulation
Article 44 – paragraph 7
Article 44 – paragraph 7
7. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying ‘'important grounds of public interest’' within the meaning of point (d) of paragraph 1 as well as the criteria and requirements for appropriate safeguards referred to in point (h) of paragraph 1.
Amendment 2530 #
Proposal for a regulation
Article 44 a (new)
Article 44 a (new)
Article 44a Disclosures not authorized by Union law 1. No judgment of a court or tribunal and no decision of an administrative authority of a third country requiring a controller or processor to disclose personal data shall be recognized or be enforceable in any manner, without prejudice to a mutual assistance treaty or an international agreement in force between the requesting third country and the Union or a Member State. 2. Where a judgment of a court or tribunal or a decision of an administrative authority of a third country requests a controller or processor to disclose personal data, the controller or processor and, if any, the controller's representative, shall notify the supervisory authority of the request without undue delay and must obtain prior authorisation for the transfer by the supervisory authority. 3. The supervisory authority shall assess the compliance of the requested disclosure with the Regulation and in particular whether the disclosure is necessary and legally required in accordance with points (d) and (e) of paragraph 1 and paragraph 5 of Article 44. 4. The supervisory authority shall inform the competent national authority of the request. The controller or processor shall also inform the data subject of the request and of the authorisation by the supervisory authority. 5. The Commission may lay down the standard format of the notifications to the supervisory authority referred to in paragraph 2 and the information of the data subject referred to in paragraph 4 as well as the procedures applicable to the notification and information. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
Amendment 2595 #
Proposal for a regulation
Article 51 – paragraph 3
Article 51 – paragraph 3
3. The supervisory authority shall notmay be competent to supervise processing operations of courts acting in their judicial capacity.
Amendment 2623 #
Proposal for a regulation
Article 53 – paragraph 1 – point i a (new)
Article 53 – paragraph 1 – point i a (new)
(ia) to certify controllers and processors pursuant to Article 39;
Amendment 2639 #
Proposal for a regulation
Article 54
Article 54
Each supervisory authority must draw up an annual report on its activities at least every two years. The report shall be presented to the national parliament and shall be made be available to the public, the Commission and the European Data Protection Board.
Amendment 2640 #
Proposal for a regulation
Article 54 a (new)
Article 54 a (new)
Article 54a Lead Authority 1. Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union, and the controller or processor is established in more than one Member State, or where personal data of the residents in several Member States are processed, the supervisory authority of the main establishment of the controller or processor shall act as a single contact point for the controller or processor. 2. The lead authority shall ensure coordination with the authorities involved at any stage of supervisory proceedings against a controller or a processor within the meaning of paragraph 1. For that purpose it shall in particular submit any relevant information and consult the other authorities before it adopts a measure intended to produce legal effects vis-à-vis a controller or a processor within the meaning of paragraph 1. 3. Where the controller is not established in the Union, and residents in different Member States are affected by processing operations within the scope of this Regulation, the supervisory authorities of the Member States concerned shall designate the supervisory authority that will act as a single contact point for the controller or processor.
Amendment 2646 #
Proposal for a regulation
Article 55 – paragraph 1
Article 55 – paragraph 1
1. Supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective co- operation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and prompt information on the opening of cases and ensuing developments where the controller or processor has establishments in several Member States or where data subjects in several Member States are likely to be affected by processing operations. The lead authority as defined in Article 54a shall ensure the coordination with involved supervisory authorities and shall act as the single contact point for the controller or processor.
Amendment 2657 #
Proposal for a regulation
Article 55 – paragraph 10
Article 55 – paragraph 10
10. The CommissionEuropean Data Protection Board may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the European Data Protection Board, in particular the standardised format referred to in paragraph 6. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
Amendment 2659 #
Proposal for a regulation
Article 56 – paragraph 2
Article 56 – paragraph 2
2. In cases where the controller or processor has establishments in several Member States or where data subjects in several Member States are likely to be affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in the joint investigative tasks or joint operations, as appropriate. The competent supervisory authoritylead authority as defined in Article 54a shall invite the supervisory authority of each of those Member States to take part in the respective joint investigative tasks or joint operations and respond to the request of a supervisory authority to participate in the operations without delay. The lead authority shall act as the single contact point for the controller or processor.
Amendment 2670 #
Proposal for a regulation
Article 58 – paragraph 3
Article 58 – paragraph 3
3. Any supervisory authority or the European Data Protection Board may request that any matter shall be dealt with in the consistency mechanism, in particular where a supervisory authority does not submit a draft measure referred to in paragraph 2 or does not comply with the obligations for mutual assistance in accordance with Article 55 or for joint operations in accordance with Article 56, or where a competent supervisory authority does not agree with the draft measure proposed by the lead authority.
Amendment 2677 #
Proposal for a regulation
Article 58 – paragraph 7
Article 58 – paragraph 7
7. The European Data Protection Board shall issue an opinion on the matter, if the European Data Protection Board so decides by simple majority of its members or any supervisory authority or the Commission so requests within onetwo weeks after the relevant information has been provided according to paragraph 5. The opinion shall be adopted within one monthsix weeks by simple majority of the members of the European Data Protection Board. The chair of the European Data Protection Board shall inform, without undue delay, the supervisory authority referred to, as the case may be, in paragraphs 1 and 3, the Commission and the supervisory authority competent under Article 51 of the opinion and make it public.
Amendment 2680 #
Proposal for a regulation
Article 58 – paragraph 8
Article 58 – paragraph 8
8. The supervisory authority referred to in paragraph 1 and the supervisory authority competent under Article 51 shall take the utmost account of the opinions of the European Data Protection Board and shall within two weeks after the information on the opinion by the chair of the European Data Protection Board, electronically communicate to the chair of the European Data Protection Board and to the Commission whether it maintains or amends its draft measure and, if any, the amended draft measure, using a standardised format.
Amendment 2684 #
Proposal for a regulation
Article 58 – paragraph 8 a (new)
Article 58 – paragraph 8 a (new)
8a. Where the lead authority pursuant to Article 54a intends not to follow the opinion of the European Data Protection Board, it shall inform the European Data Protection Board thereof in writing within one month and provide a reasoned justification.
Amendment 2685 #
Proposal for a regulation
Article 58 – paragraph 8 b (new)
Article 58 – paragraph 8 b (new)
8b. In a case where the European Data Protection Board still objects to the measure of the supervisory authority as referred to in paragraph 9, it may inform the Commission and invite it to submit a reasoned recommendation to the lead authority.
Amendment 2688 #
Proposal for a regulation
Article 59 – paragraph 1
Article 59 – paragraph 1
Amendment 2690 #
Proposal for a regulation
Article 59 – paragraph 2
Article 59 – paragraph 2
Amendment 2692 #
Proposal for a regulation
Article 59 – paragraph 3
Article 59 – paragraph 3
Amendment 2695 #
Proposal for a regulation
Article 59 – paragraph 4
Article 59 – paragraph 4
Amendment 2700 #
Proposal for a regulation
Article 60
Article 60
Amendment 2716 #
Proposal for a regulation
Article 61 a (new)
Article 61 a (new)
Article 61a Intervention by the Commission 1. Within ten weeks after a matter has been raised under Article 58, or at the latest within six weeks in the case of Article 61, the Commission may adopt, in order to ensure correct and consistent application of this Regulation, a reasoned recommendation in relation to matters raised pursuant to Articles 58 or 61. 2. Where the Commission has adopted a reasoned recommendation, in accordance with paragraph 1, the supervisory authority concerned shall take the utmost account of the Commission's recommendation and inform the Commission and the European Data Protection Board whether it intends to maintain or amend its draft measure 3. Where the supervisory authority concerned intends not to follow the opinion of the Commission, it shall inform the Commission and the European Data Protection Board thereof within one month and provide a reasoned justification. This reasoned justification shall be made publicly available. The supervisory authority may withdraw the draft measure at any stage of the procedure.
Amendment 2719 #
Proposal for a regulation
Article 62 – paragraph 1 – subparagraph 1 – introductory part
Article 62 – paragraph 1 – subparagraph 1 – introductory part
1. The Commission may adopt implementing acts, after requesting an opinion of the European Data Protection Board, for:
Amendment 2720 #
Proposal for a regulation
Article 62 – paragraph 1 – subparagraph 1 – point a
Article 62 – paragraph 1 – subparagraph 1 – point a
Amendment 2723 #
Proposal for a regulation
Article 62 – paragraph 1 – subparagraph 1 – point b
Article 62 – paragraph 1 – subparagraph 1 – point b
Amendment 2725 #
Proposal for a regulation
Article 62 – paragraph 1 – subparagraph 1 – point c
Article 62 – paragraph 1 – subparagraph 1 – point c
Amendment 2729 #
Proposal for a regulation
Article 62 – paragraph 2
Article 62 – paragraph 2
Amendment 2736 #
Proposal for a regulation
Article 66 – paragraph 1 – introductory part
Article 66 – paragraph 1 – introductory part
1. The European Data Protection Board shall ensure the consistent application of this Regulation. To this effect, the European Data Protection Board shall, on its own initiative or at the request of the European Parliament, Council and the Commission, in particular:
Amendment 2738 #
Proposal for a regulation
Article 66 – paragraph 1 – point a
Article 66 – paragraph 1 – point a
(a) advise the CommissEuropean Institutions on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Regulation;
Amendment 2740 #
Proposal for a regulation
Article 66 – paragraph 1 – point b
Article 66 – paragraph 1 – point b
(b) examine, on its own initiative or on request of one of its members or on request of the European Parliament, the Council or the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this Regulation, including on the use of enforcement powers;
Amendment 2743 #
Proposal for a regulation
Article 66 – paragraph 1 – point d a (new)
Article 66 – paragraph 1 – point d a (new)
(da) provide an opinion on which authority should be the lead authority pursuant to Article 54a(3);
Amendment 2744 #
Proposal for a regulation
Article 66 – paragraph 1 – point g a (new)
Article 66 – paragraph 1 – point g a (new)
(ga) give its opinion to the Commission in the preparation of delegated and implementing acts based on this Regulation;
Amendment 2749 #
Proposal for a regulation
Article 66 – paragraph 1 – point g b (new)
Article 66 – paragraph 1 – point g b (new)
(gb) give an opinion on codes of conduct drawn up at Union level;
Amendment 2751 #
Proposal for a regulation
Article 66 – paragraph 1 – point g c (new)
Article 66 – paragraph 1 – point g c (new)
(gc) elaborate with the supervisory authorities the fixed fee for the granting of the standardised data protection mark, the "European Data Protection Seal".
Amendment 2753 #
Proposal for a regulation
Article 66 – paragraph 2
Article 66 – paragraph 2
2. Where the European Parliament, the Council or the Commission requests advice from the European Data Protection Board, it may lay out a time limit within which the European Data Protection Board shall provide such advice, taking into account the urgency of the matter.
Amendment 2758 #
Proposal for a regulation
Article 68 – paragraph 1
Article 68 – paragraph 1
1. The European Data Protection Board shall take decisions by a simple majority of its members, unless otherwise provided in its rules of procedure.
Amendment 2820 #
Proposal for a regulation
Article 77 – paragraph 1
Article 77 – paragraph 1
1. Any person who has suffered material or immaterial damage as a result of an unlawful processing operation or of an action incompatible with this Regulation shall have the right to receive compensation from the controller or the processor for the damage suffered. It is in the responsibility of the processor to prove that the damage was not caused by him.
Amendment 2842 #
Proposal for a regulation
Article 78 – paragraph 2 a (new)
Article 78 – paragraph 2 a (new)
2a. In applying the penalties referred to in paragraph 1 Member States shall show full respect for the principle of ne bis in idem, meaning that penalties may not be imposed twice regarding the same infringement of this Regulation.
Amendment 2850 #
Proposal for a regulation
Article 79 – paragraph 1
Article 79 – paragraph 1
1. Each supervisory authority shall be empowered to impose administrative sanctions in accordance with this Article. The supervisory authorities shall cooperate with each other in accordance with Articles 46 and 57 to guarantee a consistent level of sanctions within the Union.
Amendment 2862 #
Proposal for a regulation
Article 79 – paragraph 2
Article 79 – paragraph 2
2. The administrative sanction shall be in each individual case effective, proportionate and dissuasive. The amount of the administrative fine shall be fixed with due regard to the nature, gravity and duration of the breach, the intentional or negligent character of the infringement, the degree of responsibility of the natural or legal person and of previous breaches by this person, the technical and organisational measures and procedures implemented pursuant to Article 23 and the degree of co-operation with the supervisory authority in order to remedy the breach.
Amendment 2868 #
Proposal for a regulation
Article 79 – paragraph 2 a (new)
Article 79 – paragraph 2 a (new)
2a. In order to determine the type, the level and the amount of the administrative sanction, the supervisory authority shall take into account all relevant circumstances, with due regard to the following criteria: (a) the possession of a valid "European Data Protection Seal" pursuant to Article 39, by the controller or the processor; (b) the nature, gravity and duration of the infringement; (c) the intentional or negligent character of the infringement; (d) the degree of responsibility of the natural or legal person and of previous infringements by this person; (e) the technical and organisational measures and procedures implemented pursuant to Articles 23 and 30, such as pseudonymisation; (f) the specific categories of personal data affected by the infringement; (g) the repetitive nature of the infringement; (h) the degree of harm suffered by data subjects, (i) the pecuniary interest leading to the infringement by the person responsible and the level of the profits gained or losses avoided by the person responsible, insofar as they can be determined; (j) the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate the possible adverse effects of the infringement; and (k) the refusal to cooperate with or obstruction of inspections, audits and controls carried out by the supervisory authority pursuant to Article 53.
Amendment 2888 #
Proposal for a regulation
Article 79 – paragraph 4 – introductory part
Article 79 – paragraph 4 – introductory part
4. The supervisory authority shall impose a fine up tothat shall not exceed 250 000 EUR, or in case of an enterprise up to 0,51 % of its annual worldwide turnover, to anyone who, intentionally or negligently: (a) does not provide the mechanisms for requests by data subjects or does not respond promptly or not in the required format to data subjects pursuant to infringes Articles 12(1) and (2); (b) charges a fee for the information or for responses to the requests of data subjects in violation of Article 12(4).
Amendment 2901 #
Proposal for a regulation
Article 79 – paragraph 5 – introductory part
Article 79 – paragraph 5 – introductory part
5. The supervisory authority shall impose a fine up tothat shall not exceed 500 000 EUR, or in case of an enterprise up to 12 % of its annual worldwide turnover, to anyone who, intentionally or negligently: (a) does not provide the information, or does provide incomplete information, or does not provide the information in a sufficiently transparent manner, to the data subject pursuant to Article 11, Article 12(3) and Article 14; (b) does not provide access for the data subject or does not rectify personal data pursuant to Articles 15 and 16 or does not communicate the relevant information to a recipient pursuant to Article 13; (c) does not comply with the right to be forgotten or to erasure, or fails to put mechanisms in place to ensure that the time limits are observed or does not take all necessary steps to inform third parties that a data subjects requests to erase any links to, or copy or replication of the personal data pursuant Article 17; (d) does not provide a copy of the personal data in electronic format or hinders the data subject to transmit the personal data to another application in violation of Article 18; (e) does not or not sufficiently determine the respective responsibilities with co- controllers pursuant to Article 24; (f) does not or not sufficiently maintain the documentation pursuant to Article 28, Article 31(4), and Article 44(3); (g) does not comply, in cases where special categories of data are not involved, pursuant to Articles 80, 82 and 83 with rules in relation to freedom of expression or with rules on the processing in the employment context or with the conditions for processing for historical, statistical and scientific research purposes infringes Articles 11, 12(3) and (4), 13, 14, 15, 16, 17, 18, 24, 28, 31(4), 44(3), 80, 82, 83.
Amendment 2921 #
Proposal for a regulation
Article 79 – paragraph 6
Article 79 – paragraph 6
6. The supervisory authority shall impose a fine up tothat shall not exceed 1 000 000 EUR or, in case of an enterprise up to 25 % of its annual worldwide turnover, to anyone who, intentionally or negligently: (a) processes personal data without any or sufficient legal basis for the processing or does not comply with the conditions for consent pursuant to Articles 6, 7 and 8; (b) processes special categories of data in violation of Articles 9 and 81; (c) does not comply with an objection or the requirement pursuant to Article 19; (d) does not comply with the conditions in relation to measures based on profiling pursuant to Article 20; (e) does not adopt internal policies or does not implement appropriate measures for ensuring and demonstrating compliance pursuant to Articles 22, 23 and 30; (f) does not designate a representative pursuant to Article 25; (g) processes or instructs the processing of personal data in violation of the obligations in relation to processing on behalf of a controller pursuant to Articles 26 and 27; (h) does not alert on or notify a personal data breach or does not timely or completely notify the data breach to the supervisory authority or to the data subject pursu infringes the provisions of this Regulation other thant to Articles 31 and 32; (i) does not carry out a data protection impact assessment pursuant or processes personal data without prior authorisation or prior consultation of the supervisory authority pursuant to Articles 33 and 34; (j) does not designate a data protection officer or does not ensure the conditions for fulfilling the tasks pursuant to Articles 35, 36 and 37; (k) misuses a data protection seal or mark in the meaning of Article 39; (l) carries out or instructs a data transfer to a third country or an international organisation that is not allowed by an adequacy decision or by appropriate safeguards or by a derogation pursuant to Articles 40 to 44; (m) does not comply with an order or a temporary or definite ban on processing or the suspension of data flows by the supervisory authority pursuant to Article 53(1); (n) does not comply with the obligations to assist or respond or provide relevant information to, or access to premises by, the supervisory authority pursuant to Article 28(3), Article 29, Article 34(6) and Article 53(2); (o) does not comply with the rules for safeguarding professional secrecy pursuant to Article 84hose referred to in paragraphs 4 and 5.
Amendment 2945 #
Proposal for a regulation
Article 79 – paragraph 7
Article 79 – paragraph 7
7. The Commission shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of updating the absolute amounts of the administrative fines referred to in paragraphs 4, 5 and 6, taking into account the criteria referred to in paragraph 2. and the development of standard costs of living.
Amendment 2955 #
Proposal for a regulation
Article 80 – paragraph 1
Article 80 – paragraph 1
1. Member States shall provide for exemptions or derogations from the provisions on the general principles in Chapter II, the rights of the data subject in Chapter III, on controller and processor in Chapter IV, on the transfer of personal data to third countries and international organisations in Chapter V, the independent supervisory authorities in Chapter VI and on co-operation and consistency in Chapter VII for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expressionwhenever it is necessary in order to reconcile the right to the protection of personal data with the rules governing freedom of expression in accordance with the Charter of Fundamental Rights of the European Union.
Amendment 2996 #
Proposal for a regulation
Article 81 – paragraph 3
Article 81 – paragraph 3
3. The Commission shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point (b) of paragraph 1, as well as criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1.
Amendment 3005 #
Proposal for a regulation
Article 82 – paragraph 1
Article 82 – paragraph 1
1. WIn accordance within the limits ofrules set out in this Regulation, Member States may adopt by law, in accordance with national law and practices, adopt specific rules regulating the processing of employees‘' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. This is without prejudice to the Member States right to promote or permit collective agreements concluded between social partners which are more favourable to workers. The level of protection of this Regulation is to be the minimum standard by law or collective agreements.
Amendment 3034 #
Proposal for a regulation
Article 82 – paragraph 2 a (new)
Article 82 – paragraph 2 a (new)
Amendment 3037 #
Proposal for a regulation
Article 82 – paragraph 2 b (new)
Article 82 – paragraph 2 b (new)
2b. Open optical – electronic control or biometric devices are only allowed in exceptional cases and only with the consent of the workers representatives. The conditions for control are to be laid down through law or collective agreements.
Amendment 3041 #
Proposal for a regulation
Article 82 – paragraph 3
Article 82 – paragraph 3
Amendment 3045 #
Proposal for a regulation
Article 82 – paragraph 3 a (new)
Article 82 – paragraph 3 a (new)
3a. Trade unions have the right to represent the workers concerned when taking a complaint to the supervisory authority, or when seeking a judicial remedy.
Amendment 3046 #
Proposal for a regulation
Article 82 – paragraph 3 b (new)
Article 82 – paragraph 3 b (new)
3b. On a proposal from the Commission, the European Parliament and the Council shall review this Article no later than 2 years after the date referred to in Article 91(2).
Amendment 3078 #
Proposal for a regulation
Article 83 – paragraph 2 a (new)
Article 83 – paragraph 2 a (new)
2a. Member States can adopt specific measures to regulate the processing of personal data for historical, statistical or scientific purposes while respecting the provisions of paragraphs 1 and 2 of this Article as well as respecting fundamental rights as enshrined in the Charter of fundamental rights of the European Union.
Amendment 3081 #
Proposal for a regulation
Article 83 – paragraph 2 b (new)
Article 83 – paragraph 2 b (new)
2b. Each Member State shall notify to the Commission those provisions which it adopts pursuant to paragraph 1b, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.
Amendment 3091 #
Proposal for a regulation
Article 83 – paragraph 3
Article 83 – paragraph 3
Amendment 3107 #
Proposal for a regulation
Article 85 a (new)
Article 85 a (new)
Article 85a General provision on Fundamental Rights The provisions of this Regulation shall guarantee the consistent application of the Charter of Fundamental Rights of the European Union and fundamental legal principles as enshrined in Article 6 of the Treaty on European Union.
Amendment 3112 #
Proposal for a regulation
Article 86 – paragraph 2
Article 86 – paragraph 2
2. The delegation of power referred to in Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(7), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 336), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3)[Articles XXX] shall be conferred on the Commission for an indeterminate period of time from the date of entry into force of this Regulation.
Amendment 3114 #
Proposal for a regulation
Article 86 – paragraph 3
Article 86 – paragraph 3
3. The delegation of power referred to in Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(7), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 33(6), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3)[Articles XXX] may be revoked at any time by the European Parliament or by the Council. A decision of revocation shall put an end to the delegation of power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
Amendment 3118 #
Proposal for a regulation
Article 86 – paragraph 5
Article 86 – paragraph 5
5. A delegated act adopted pursuant to Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(7), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 33(6), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3)[Articles XXX] shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of twofour months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or the Council.
Amendment 3122 #
Proposal for a regulation
Article 87 – paragraph 3
Article 87 – paragraph 3
Amendment 3130 #
Proposal for a regulation
Article 89 a (new)
Article 89 a (new)
Article 89a Data processing by EU Institutions, bodies, offices and agencies The Commission shall present by the date specified in Article 91(2) at the latest and, without delay a proposal for the revision of the legal framework applicable to the processing of personal data by the Union institutions, bodies, offices and agencies, to bring them in line with this Regulation with a view to ensuring consistent and homogeneous legal rules relating to the fundamental right to the protection of personal data in the European Union.
Amendment 3133 #
Proposal for a regulation
Annex 1 (new)
Annex 1 (new)