19 Amendments of Baroness Sarah LUDFORD related to 2011/0011(COD)
Amendment 1926 #
Proposal for a regulation
Article 30 – paragraph 1
Article 30 – paragraph 1
1. The controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected, having regard to the state of the art and the costs of their implementationHaving regard to the state of technological development and the cost of implementation, the controller must implement appropriate technical and organisational measures to ensure a level of security in relation to the processing personal data that is appropriate to: (a) the harm that might result from unauthorised or unlawful processing or accidental loss, destruction or damage as mentioned in Article 5(1)(ea), and (b) the nature and scope of the data to be processed.
Amendment 1931 #
Proposal for a regulation
Article 30 – paragraph 2
Article 30 – paragraph 2
2. The controller and the processor shall, following an evaluation ofIn complying with the prisks, take the measures referred to in paragraph 1 to protect personal data against accidental or unlawful destruction or accidental loss and to prevent any unlawful forms of processing, in particular any unauthorised disclosure, dissemination or access, or alteration of personal datanciple as set out at Article 5(1)(ea), a controller must consider any relevant guidance drawn up by the supervisory authority under Article 38.
Amendment 1937 #
Proposal for a regulation
Article 30 – paragraph 3
Article 30 – paragraph 3
Amendment 1943 #
Proposal for a regulation
Article 30 – paragraph 4
Article 30 – paragraph 4
Amendment 1959 #
Proposal for a regulation
Article 31 – paragraph 1
Article 31 – paragraph 1
1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not lat where there is a significant risk that the personal data breach will adversely affect the rights and freedoms of data subjects, the controller tshan 24 hoursll without undue delay after having become aware of it, notify the personal data breach to the supervisory authority. The notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours.
Amendment 1967 #
Proposal for a regulation
Article 31 – paragraph 2 a (new)
Article 31 – paragraph 2 a (new)
Amendment 1968 #
Proposal for a regulation
Article 31 – paragraph 3
Article 31 – paragraph 3
Amendment 1974 #
Proposal for a regulation
Article 31 – paragraph 3 a (new)
Article 31 – paragraph 3 a (new)
3a. The national supervisory authority should provide guidance under Article 38 on the particular circumstances in which notification to the supervisory authority should take place. Furthermore, the level of detail and the specific information required when a controller notifies the supervisory authority of the data breach should be contained in guidance.
Amendment 1975 #
Proposal for a regulation
Article 31 – paragraph 4
Article 31 – paragraph 4
Amendment 1988 #
Proposal for a regulation
Article 31 – paragraph 5
Article 31 – paragraph 5
Amendment 1991 #
Proposal for a regulation
Article 31 – paragraph 6
Article 31 – paragraph 6
Amendment 2023 #
Proposal for a regulation
Article 33 – paragraph 1
Article 33 – paragraph 1
1. Where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, the controller or the processor acting on the controller's behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment shall be sufficient to address a set of processing operations that present similar risks.
Amendment 2027 #
Proposal for a regulation
Article 33 – paragraph 1 a (new)
Article 33 – paragraph 1 a (new)
1a. Such a requirement shall not apply to: (a) micro small and medium-sized enterprises that process data only as an activity ancillary to their main activities; (b) all micro, small and medium-sized enterprises for the first three years after the enterprise was founded.
Amendment 2040 #
Proposal for a regulation
Article 33 – paragraph 2 – point c
Article 33 – paragraph 2 – point c
(c) automated monitoring publicly accessible areas, especially when using optic-electronic devices (video surveillance) on a large scale;
Amendment 2043 #
Proposal for a regulation
Article 33 – paragraph 2 a (new)
Article 33 – paragraph 2 a (new)
2a. The supervisory authority shall establish and make public a list of the kind of processing for which a data protection impact assessment would be recommended. The supervisory authority shall communicate those lists to the European Data Protection Board.
Amendment 2046 #
Proposal for a regulation
Article 33 – paragraph 3
Article 33 – paragraph 3
3. The assessment shall contain at least a general description of the envisaged processing operations, an assessment of the risks to the rights and freedoms of data subjects, the measures envisaged to address the risks, safeguards, security measures and mechanisms to ensure th the likelihood of the processing operation giving rise to harm to the fundamental rights and freedoms of data subjects or any other person, and the seriousness of any such harm, and explain the measures the controller intends to take to mitigate the chance of that harm or its seriousness, including the security measures and other safeguards and mechanisms the controller intends to put in place to ensure protection of personal data and to demonstrate compliin accordance with this Regulation, taking into account the rights and legitimate interests of data subjects and other persons concerned.
Amendment 2057 #
Proposal for a regulation
Article 33 – paragraph 4
Article 33 – paragraph 4
Amendment 2078 #
Proposal for a regulation
Article 33 – paragraph 6
Article 33 – paragraph 6
Amendment 2088 #
Proposal for a regulation
Article 33 – paragraph 7
Article 33 – paragraph 7