45 Amendments of Ewald STADLER related to 2012/0011(COD)
Amendment 711 #
Proposal for a regulation
Article 3 – paragraph 3
Article 3 – paragraph 3
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where the national law of a Member State applies by virtue of public international law. This shall be without prejudice to national provisions to which the controller is subject.
Amendment 720 #
Proposal for a regulation
Article 4 – paragraph 1 – point 1
Article 4 – paragraph 1 – point 1
(1) ‘'data subject’' means an identified natural person or a natural person who can be unequivocally identified, directly or indirectly, by means reasonably likely to be used by the controller or by any other natural or legal personavailable to the controller, in particular by reference to an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person;
Amendment 739 #
Proposal for a regulation
Article 4 – paragraph 1 – point 3
Article 4 – paragraph 1 – point 3
(3) ‘'processing’' means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, erasure, blocking or destruction;
Amendment 777 #
Proposal for a regulation
Article 4 – paragraph 1 – point 10
Article 4 – paragraph 1 – point 10
(10) ‘genetic data’ means all data, of whatever type, concerning the characteristics of an individualdata obtained by means of genetic testing or genetic analysis performed in connection with genetic testing regarding genetic characteristics. Genetic characteristics are hereditary information of human origin which areis inherited or acquired during early prenatal development,conception or up until birth;
Amendment 780 #
Proposal for a regulation
Article 4 – paragraph 1 – point 11
Article 4 – paragraph 1 – point 11
(11) ‘'biometric data’' means any data relating to the physical, physiological or behavioural characteristics of an individual which allow their unique identification, such as facial images, or dactyloscopic data, but not signatures;
Amendment 808 #
Proposal for a regulation
Article 4 – paragraph 1 – point 19 a (new)
Article 4 – paragraph 1 – point 19 a (new)
(19a) ‘anonymising’ means altering personal data in such a manner that all the information relating to a data subject becomes impossible to connect with a particular or identifiable natural person or can only be so connected by means of a disproportionate effort in terms of time, cost and labour;
Amendment 811 #
Proposal for a regulation
Article 4 – paragraph 1 – point 19 b (new)
Article 4 – paragraph 1 – point 19 b (new)
(19b) ‘pseudonymising’ means replacing the name and other identifying features with a mark for the purpose of preventing or seriously impeding the identification of the data subject;
Amendment 813 #
Proposal for a regulation
Article 4 – paragraph 1 – point 19 c (new)
Article 4 – paragraph 1 – point 19 c (new)
(19c) ‘third party’ means a natural or legal person, authority, institution or any other entity, with the exception of the data subject, the controller, the processor and persons who are authorised to process the data under the direct responsibility of the controller or of the processor;
Amendment 817 #
Proposal for a regulation
Article 5 – paragraph 1 – point a
Article 5 – paragraph 1 – point a
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject;
Amendment 826 #
Proposal for a regulation
Article 5 – paragraph 1 – point c
Article 5 – paragraph 1 – point c
(c) adequate, relevant, and limited to the minimum necessary in relation to the purposes for which they are processed; they shall only be processed if, and as long as, the purposes could not be fulfilled by processing information that does not involve personal data;
Amendment 831 #
Proposal for a regulation
Article 5 – paragraph 1 – point d
Article 5 – paragraph 1 – point d
(d) accurate and, if necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or, if this is not possible, blocked or rectified without delay;
Amendment 840 #
Proposal for a regulation
Article 5 – paragraph 1 – point e
Article 5 – paragraph 1 – point e
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods if statutory retention rules so require or insofar as the data will be processed solely for historical, statistical or scientific research purposes in accordance with the rules and conditions of Article 83 and if a periodic review is carried out to assess the necessity to continue the storage;
Amendment 847 #
Proposal for a regulation
Article 5 – paragraph 1 – point f
Article 5 – paragraph 1 – point f
(f) processed under the responsibility and liability of the controller, who shall ensure and demonstrate for each processing operation the compliance with the provisions of this Regulation.
Amendment 848 #
Proposal for a regulation
Article 5 – paragraph 1 – point f a (new)
Article 5 – paragraph 1 – point f a (new)
(fa) personal data shall only be processed if, and as long as, the purposes could not be fulfilled by processing information that does not involve personal data, for example pseudonymised or anonymised data;
Amendment 865 #
Proposal for a regulation
Article 6 – paragraph 1 – point c
Article 6 – paragraph 1 – point c
(c) processing is necessary for compliance with a legal obligata law or other legal provision to which the controller is subject requires or allows processing;
Amendment 884 #
Proposal for a regulation
Article 6 – paragraph 1 – point f
Article 6 – paragraph 1 – point f
(f) processing is necessary for the purposes of the legitimate interests pursued by a controller or an entitled third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This shall not apply to processing carried out by public authorities in the performance of their tasks.
Amendment 947 #
Proposal for a regulation
Article 6 – paragraph 4
Article 6 – paragraph 4
4. Where the purpose of further processing is not compatible with the one for which the personal data have been collected, the processing must have a legal basis at least in one of the grounds referred to in points (a) to (ef) of paragraph 1. This shall in particular apply to any change of terms and general conditions of a contract.
Amendment 980 #
Proposal for a regulation
Article 7 – paragraph 3
Article 7 – paragraph 3
3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. In accordance with the principle of good faith, withdrawal of consent shall not be permitted when the consent is required for the completion of a contract.
Amendment 996 #
Proposal for a regulation
Article 7 – paragraph 4
Article 7 – paragraph 4
4. Consent shall not provide a legal basis for the processing, where there is a significant imbalance between the position of the data subject and the controller. In this connection the interests of the data subjects shall be taken into account.
Amendment 1060 #
Proposal for a regulation
Article 9 – paragraph 2 – point d
Article 9 – paragraph 2 – point d
(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other non-profit-seeking body with a political, philosophical, religious or trade- union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that bodyto third parties without the consent of the data subjects;
Amendment 1072 #
Proposal for a regulation
Article 9 – paragraph 2 – point h
Article 9 – paragraph 2 – point h
(h) processing of data concerning health is necessary for health purposes and subject to the conditions and safeguards referred to in Article 81 for the purposes referred to there or for the completion of contracts related thereto;
Amendment 1085 #
Proposal for a regulation
Article 9 – paragraph 2 – point j a (new)
Article 9 – paragraph 2 – point j a (new)
(ja) For the purposes of conformity with compliance rules, persons subject to such rules shall be entitled to process data to the extent necessary for the implementation of the compliance rules.
Amendment 1096 #
Proposal for a regulation
Article 10 – title
Article 10 – title
Processing not allowing identificationdure for automated processing
Amendment 1098 #
Proposal for a regulation
Article 10
Article 10
Amendment 1099 #
Proposal for a regulation
Article 10
Article 10
Amendment 1356 #
Proposal for a regulation
Article 15 – paragraph 3
Article 15 – paragraph 3
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the communication to the data subject of the cParagraphs 1 and 2 shall not apply where: (a) the data are stored only because they cannot be deleted on account of statutory, statutes-based or contractual periods for which they are required to be kept; (b) the data serve solely to provide a data backup or to monitor data protection, and providing information would involve a disproportionate effort; (c) the data must be kept secret in accordance with legislation or by virtue of their nature, particularly because of the overriding legal interest of a third party; (d) the data storage is necessary solely for purposes of academic or scientific research and providing information would involve a disproportionate effort; (e) the data have been derived from generally accessible sources and notification would be disproportionate on account of the personal data referred to in point (g) of paragraph 1. large number of cases concerned; (f) notification would seriously jeopardise the commercial objectives or other fundamental rights and freedoms of the controller, unless the interest in notification outweighs the risk.
Amendment 1362 #
Proposal for a regulation
Article 15 – paragraph 4
Article 15 – paragraph 4
Amendment 1455 #
Proposal for a regulation
Article 17 – paragraph 4 – introductory part
Article 17 – paragraph 4 – introductory part
4. Instead of erasure, the controller shall restrict processing ofblock personal data where:
Amendment 1466 #
Proposal for a regulation
Article 17 – paragraph 4 – point d a (new)
Article 17 – paragraph 4 – point d a (new)
(da) for technical reasons, erasure would be impossible or would involve disproportionate efforts.
Amendment 1483 #
Proposal for a regulation
Article 17 – paragraph 9
Article 17 – paragraph 9
Amendment 1488 #
Proposal for a regulation
Article 17 – paragraph 9 – point c
Article 17 – paragraph 9 – point c
(c) the criteria and conditions for restricting the processing ofblocking personal data referred to in paragraph 4.
Amendment 1554 #
Proposal for a regulation
Article 20 – paragraph 1
Article 20 – paragraph 1
1. Every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affectplaces this natural person at a legal disadvantage, and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person's performance at work, economic situation, location, health, personal preferences, reliability or behaviour.
Amendment 1661 #
Proposal for a regulation
Article 22 – paragraph 1
Article 22 – paragraph 1
1. The controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this Regulation.
Amendment 1717 #
Proposal for a regulation
Article 23 – paragraph 1
Article 23 – paragraph 1
1. Having regard to the risk, the type of data requiring protection, the state of the art and the cost of implementation, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.
Amendment 1775 #
Proposal for a regulation
Article 26 – paragraph 1
Article 26 – paragraph 1
1. Where a processing operation is to be carried out on behalf of a controller, the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject, in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and; the controller shall also ensure compliance with those measuresthat those measures have been complied with.
Amendment 1794 #
Proposal for a regulation
Article 26 – paragraph 2 – point f
Article 26 – paragraph 2 – point f
(f) assist the controller in ensuring compliance with the obligations pursuant to ADoes not affect English text. The German original corrects ‘den Auftragsverarbeiter’ (the processor) to ‘den für die Verarbeitung Verantwortlicles 30 to 34;hen’ (the data controller).
Amendment 1799 #
Proposal for a regulation
Article 26 – paragraph 2 – point g
Article 26 – paragraph 2 – point g
(g) hand overreturn all results to the controller after the end of the processing and not process the personal data otherwiseerase stored data;
Amendment 1810 #
Proposal for a regulation
Article 26 – paragraph 4
Article 26 – paragraph 4
Amendment 1822 #
Proposal for a regulation
Article 26 – paragraph 5
Article 26 – paragraph 5
Amendment 2174 #
Proposal for a regulation
Article 35 – paragraph 1 – point b
Article 35 – paragraph 1 – point b
(b) the processing is carried out by an enterprise employing 250 persons or more;
Amendment 2182 #
Proposal for a regulation
Article 35 – paragraph 1 – point c
Article 35 – paragraph 1 – point c
(c) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjectfor transfer, anonymised transfer, market research or opinion polling purposes.
Amendment 2268 #
Proposal for a regulation
Article 36 – paragraph 2
Article 36 – paragraph 2
Amendment 2509 #
Proposal for a regulation
Article 44 – paragraph 1 – point h a (new)
Article 44 – paragraph 1 – point h a (new)
(ha) if an appropriate level of data protection pursuant to Article 41 or 42 does not exist, transfer or a category of transfer of personal data to a third country or to an international organisation or authority is permissible only if the transfer takes place to comply with a statutory obligation or authorisation, a requirement pertaining to supervision or another legislative provision to which the controller is subject.
Amendment 2894 #
Proposal for a regulation
Article 79 – paragraph 4 – introductory part
Article 79 – paragraph 4 – introductory part
4. The supervisory authority shall impose a fine up to 250.0 000 EUR or, in case of an enterprise up to 0,5 % of its annual worldwide turnover, to anyone who, intentionally or negligently:
Amendment 2926 #
Proposal for a regulation
Article 79 – paragraph 6 – introductory part
Article 79 – paragraph 6 – introductory part
6. The supervisory authority shall impose a fine up to 1.000.000 EUR or, in case of a breach with intent to make a profit by an enterprise, up to 2 % of its annual worldwide turnover, to anyone who, intentionally or negligently: