25 Amendments of Rebecca TAYLOR related to 2012/0011(COD)
Amendment 76 #
Proposal for a regulation
Recital 27
Recital 27
(27) The main establishment of a controller and/or a processor in the Union should be determinsignated according to objective criteria and should imply the effective and real exercise of managementdata activities determining the main decisions as to the purposes, conditions and means of processing through stable arrangements. This criterion shall apply both to data controllers and data processors and should not depend on whether the processing of personal data is actually carried out at that location; t. The presence and use of technical means and technologies for processing personal data or processing activities do not, in themselves, constitute such main establishment and are therefore no determining criteria for a main establishment. The main establishment of the processor should be the place of its central administration in the Union.
Amendment 85 #
Proposal for a regulation
Recital 53
Recital 53
(53) Any person should have the right to have personal data concerning them rectified and a ‘right to be forgotten’ where the retention of such data is not in compliance with this Regulation. In particular, data subjects should have the right that their personal data are erased and no longer processed, where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed, where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this Regulation. This right is particularly relevant, when the data subject has given their consent as a child, when not being fully aware of the risks involved by the processing, and later wants to remove such personal data especially on the Internet. However, the further retention of the data should be allowed where it is necessary for historical, statistical, aggregated and scientific research purposes, for reasons of public interest in the area of public health, for the purpose of processing health data for healthcare purposes, for exercising the right of freedom of expression, when required by law or where there is a reason to restrict the processing of the data instead of erasing them.
Amendment 89 #
Proposal for a regulation
Recital 58
Recital 58
(58) Every ndatural persona subject should have the right not to be subject to a measure which is based on profiling by means of automated processing and which produces adverse legal effects concerning the fundamental rights and freedoms of this natural person or affects the data subject in a significantly negative manner. However, such measure should be allowed when expressly authorised by law, carried out in the course of entering or performance of a contract, or when the data subject has given his consent. In any case, such processing should be subject to suitable safeguards, including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child.
Amendment 96 #
Proposal for a regulation
Recital 121 a (new)
Recital 121 a (new)
(121a) This Regulation allows the principle of public access to official documents to be taken into account when applying the provisions set out in this Regulation. Personal data in documents held by a public authority or a public body may be disclosed by this authority or body in accordance with Member State legislation to which the public authority or public body is subject. Such legislation shall reconcile the right to the protection of personal data with the principle of public access to official documents.
Amendment 117 #
Proposal for a regulation
Article 4 – point 10
Article 4 – point 10
(10) ‘genetic data’ means all data, of whatever type, concerning the characteristics of an individual which are inherited or acquired during early prenatal developmentinformation on the hereditary characteristics, or alteration thereof, of an identified or identifiable person, obtained through nucleid acid analysis;
Amendment 121 #
Proposal for a regulation
Article 4 – point 13
Article 4 – point 13
(13) ‘main establishment’ means as regards the controller, the place of its establishmentthe place of establishment of the controller, the processor or group of companies in the Union where the main decisions as to the purposes, conditions and means of the processing of personal data are taken; if no decisions as to the purposes, conditions and means of the processing of personal data are taken in the Union,. The controller, processor or group of companies shall designate the main establishment isfor the place where the main processing activities in the context of the activities of an establishment of a controller in the Union take place. As regards the processor, ‘main establishment’ means the place of its central administration in the Union;urpose of data protection compliance and shall notify this to the relevant national supervisory authority. The national supervisory authority can in cases of disagreement on the designation of the main establishment request the opinion and guidance of the European Data Protection Board.
Amendment 131 #
Proposal for a regulation
Article 5 – point e
Article 5 – point e
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the data will be processed solely for historical, statistical, aggregated or scientific research purposes in accordance with the rules and conditions of Articles 81 and 83 and if a periodic review is carried out to assess the necessity to continue the storage;
Amendment 153 #
Proposal for a regulation
Article 7 – paragraph 4
Article 7 – paragraph 4
4. Consent shall not provide a legal basis for the processing, where there is a significant, imbalance between the position of the data subject and the controller, which results in a lack of freedom in the provision of consent.
Amendment 156 #
Proposal for a regulation
Article 8 – paragraph 1
Article 8 – paragraph 1
1. For the purposes of this Regulation, in relation to the offering of information society services directly to a child, the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extentwould normally require that consent is given or authorised by the child's parent or custodian. The appropriate form for obtaining consent should be based on any risk posed to the child by the amount of data, its type and the nature of the processing. The controller shall make reasonable efforts to obtain verifiable consent, taking into consideration available technology.
Amendment 159 #
Proposal for a regulation
Article 8 – paragraph 4 a (new)
Article 8 – paragraph 4 a (new)
4a. Paragraphs 1, 2 and 3 shall not apply where the processing of personal data of a child concerns health data and where the Member State law in the field of health and social care prioritises the maturity and competence of an individual over physical age.
Amendment 170 #
Proposal for a regulation
Article 12 – paragraph 2
Article 12 – paragraph 2
2. The controller shall inform the data subject without delay and, at the latest within one month40 calendar days of receipt of the request, whether or not any action has been taken pursuant to Article 13 and Articles 15 to 19 and shall provide the requested information. This period may be prolonged for a further monthurther, if several data subjects exercise their rights resulting in a large and exceptional number of requests and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller. The information shall be given in writingHowever, the controller must comply with the requests as soon as practicable and, if requested, should justify this extension to the supervisory authority. The information shall be given in writing or, where feasible, the data controller may provide access to a secure online platform which would provide the data subject with direct access their personal data. Where the data subject makes the request in electronic form, the information shall be provided in electronic form, unless otherwise requested by the data subject or not available in that format.
Amendment 205 #
Proposal for a regulation
Article 17 – paragraph 3 – point a
Article 17 – paragraph 3 – point a
(a) for exercising the right of freedom of expression in accordance with Article 80; or when providing an information society service to facilitate the accessing of such expression.
Amendment 206 #
Proposal for a regulation
Article 17 – paragraph 3 – point b
Article 17 – paragraph 3 – point b
(b) for healthcare purposes or for reasons of public interest in the area of public health in accordance with Article 81;
Amendment 220 #
Proposal for a regulation
Article 20 – paragraph 1
Article 20 – paragraph 1
1. Every ndatural persona subject shall have the right not to be subject to a measuredecision which produces legal effects concerning this ndatural person or significanta subject or negatively affects this ndatural persona subject, and which is based solely on automated processing intended to evaluate certain personal aspects relating to this ndatural persona subject or to analyse or predict in particular the natural person's performance at work, economic situation, location, health, personal preferences, reliability or behaviour.
Amendment 241 #
Proposal for a regulation
Article 22 – paragraph 2 – introductory wording
Article 22 – paragraph 2 – introductory wording
2. The measures provided for in paragraph 1 shallcould in particular include:
Amendment 268 #
Proposal for a regulation
Article 28 – paragraph 1 a (new)
Article 28 – paragraph 1 a (new)
1a. The obligation provided for in paragraph 1 shall not apply to SMEs who process data only as an activity ancillary to the sale of goods and services.
Amendment 308 #
Proposal for a regulation
Article 35 – paragraph 1 – point b
Article 35 – paragraph 1 – point b
Amendment 313 #
Proposal for a regulation
Article 35 – paragraph 1 a (new)
Article 35 – paragraph 1 a (new)
1a. SME controllers and processors shall designate a data protection officer only where the SMEs' core activities consist of data processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects.
Amendment 386 #
Proposal for a regulation
Article 73 – paragraph 1
Article 73 – paragraph 1
1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with athe supervisory authority in any Member Statethe Member State of his habitual residence or in the Member State where the data controller has its main establishment; if they consider that the processing of personal data relating to them does not comply with this Regulation.
Amendment 434 #
Proposal for a regulation
Article 80 – paragraph 1
Article 80 – paragraph 1
1. Member States shall provide for exemptions or derogations from the provisions on the general principles in Chapter II, the rights of the data subject in Chapter III, on controller and processor in Chapter IV, on the transfer of personal data to third countries and international organisations in Chapter V, the independent supervisory authorities in Chapter VI and on co-operation and consistency in Chapter VII for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression.
Amendment 438 #
Proposal for a regulation
Article 80 a (new)
Article 80 a (new)
Article 80a Processing of personal data and the principle of public access to official documents Personal data in documents held by a public authority or a public body may be disclosed by this authority or body in accordance with Member State legislation regarding public access to official documents, which reconciles the right to the protection of personal data with the principle of public access to official documents.
Amendment 444 #
Proposal for a regulation
Article 83 – paragraph 1 – point a
Article 83 – paragraph 1 – point a
(a) these purposes cannot be otherwise fulfilled by processing data which does not permit or not any longer permit the identification of the data subject data subject has given consent, subject to the conditions laid down in Article 7;
Amendment 445 #
Proposal for a regulation
Article 83 – paragraph 1 – point b
Article 83 – paragraph 1 – point b
(b) data enabling the dattribution of information to an identified or identifiable data subject is kept separately from the other information as long as these purposes can be fulfilled in this mannera has been rendered sufficiently anonymous.
Amendment 447 #
Proposal for a regulation
Article 83 – paragraph 2 – introductory wording
Article 83 – paragraph 2 – introductory wording
2. Bodies conducting historical, statistical, aggregated or scientific research may publish or otherwise publicly disclose personal data only if:
Amendment 448 #
Proposal for a regulation
Article 83 – paragraph 2 a (new)
Article 83 – paragraph 2 a (new)
2a. Within the limits of this Regulation, where the purposes of historical, statistical, aggregated or scientific research cannot be fulfilled by the disclosure of data which is rendered sufficiently anonymous and consent for disclosure has not been obtained from data subjects then approval for disclosure must be granted by an independent and competent body which has had its authority conferred by legal provision.