BETA

32 Amendments of Sari ESSAYAH related to 2012/2011(COD)

Proposal for a regulation
Recital 34

(34) Consent should not provide a valid legal ground for the processing of personal data, where there is a clear imbalance between the data subject and the controller. This is especially the case where the data subject is in a situation of dependence from the controller, among others, where personal data are processed by the employer of employees‘ personal data in the employment context. Where the controller is a public authority, there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given, taking into account the interest of the data subject.deleted

2012/12/18
Committee: EMPL

Proposal for a regulation
Recital 124

(124) ~~The general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context. Therefore, in order to regulate~~In order to regulate the processing of employees' personal data in the employment context. Member States should be able to adopt by legal provisions specific rules for the processing of personal data in the employment sector. The processing of personal data in the employment context should qualify for exemption from the requirements of this Regulation. Therefore, when adopting by legal provisions specific rules for the processing of ~~employees‘~~ personal data in ~~the~~ employment context,. Member States ~~should be able, within the limits of this Regulation, to adopt by law specific rules for the processing of personal data in the employment sector~~may adopt legal provisions which should lay down exemptions and derogations. It should be also possible for the Member States to provide for that the matters referred to in Article 82(1) can be defined also by collective agreements negotiated and concluded at national level by social partners.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 6 – paragraph 1 – point f a (new)

(f a) processing is directly necessary for the employee's employment relationship and the data is connected with managing the rights and obligations of the parties to the relationship or with the benefits provided by the controller for the employee or arises from the special nature of the work concerned.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 6 – paragraph 4

4. Where the purpose of further processing is not compatible with the one for which the personal data have been collected, the processing must have a legal basis at least in one of the grounds referred to in points (a) to (efa) of paragraph 1. This shall in particular apply to any change of terms and general conditions of a contract.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 6 – paragraph 5

~~5. The Commission shall be empowered to adopt~~ delegated acts in accordance with Article 86 for the purpose of further specifying the conditions referred to in point (f) of paragraph 1 for various sectors and data processing situations, including as regards the processing of personal data related to a child.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 7 – paragraph 3

3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal nor shall it affect the lawfulness of processing of data based on other grounds referred to in article 6(1).

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 7 – paragraph 4

~~4. Consent shall not provide a legal basis for the processing, where there is a significant imbalance between the position of the data subject and the controller.~~deleted

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 7 – paragraph 4 a (new)

4a. An employee can only consent to processing of personal data that is of minor importance to him or her.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 22 – paragraph 2 – point d

(d) complying with the requirements for prior ~~authoris~~notification or prior consultation of the supervisory authority pursuant to Article 34(1) and (2);

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 22 – paragraph 3

3. The controller shall implement mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2. ~~If proportionate, this verification shall be carried out by independent internal or external auditors.~~

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 22 – paragraph 4

~~4. The Commission shall be empowered to adopt~~ delegated acts in accordance with Article 86 for the purpose of specifying any further criteria and requirements for appropriate measures referred to in paragraph 1 other than those already referred to in paragraph 2, the conditions for the verification and auditing mechanisms referred to in paragraph 3 and as regards the criteria for proportionality under paragraph 3, and considering specific measures for micro, small and medium-sized-enterprises.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 23 – paragraph 4

4. The Commission may lay down technical standards for the requirements laid down in paragraph 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).deleted

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 28 – paragraph 4 – point b

(b) an enterprise or an organisation ~~employing fewer than 250 persons~~ that is processing personal data only as an activity ancillary to its main activities.

2012/12/18
Committee: EMPL

Proposal for a regulation
Chapter 4 – section 3 – title

DATA PROTECTION IMPACT ASSESSMENT AND PRIOR ~~AUTHORIS~~NOTIFICATION

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 33 – paragraph 5

5. Where the controller is a public authority or body and where the processing results from a legal obligation pursuant to point (c) of Article 6(1) providing for rules and procedures pertaining to the processing operations and regulated by Union or national law, paragraphs 1 to 4 shall not apply, unless Member States deem it necessary to carry out such assessment prior to the processing activities.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 33 – paragraph 6

~~6. The Commission shall be empowered to adopt~~ delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for the processing operations likely to present specific risks referred to in paragraphs 1 and 2 and the requirements for the assessment referred to in paragraph 3, including conditions for scalability, verification and auditability. In doing so, the Commission shall consider specific measures for micro, small and medium- sized enterprises.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 33 – paragraph 7

7. The Commission may specify standards and procedures for carrying out and verifying and auditing the assessment referred to in paragraph 3. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).deleted

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 34 – title

Prior ~~authoris~~notification and prior consultation

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 34 – paragraph 1

1. The controller or the processor as the case may be shall ~~obtain an authorisation from~~notify the supervisory authority prior to the processing of personal data, in order to ensure the compliance of the intended processing with this Regulation and in particular to mitigate the risks involved for the data subjects where a controller or processor adopts contractual clauses as provided for in point (d) of Article 42(2) or does not provide for the appropriate safeguards in a legally binding instrument as referred to in Article 42(5) for the transfer of personal data to a third country or an international organisation.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 35 – paragraph 2

2. ~~In the case~~A group of organizations referred to in point (a) and (b) of paragraph 1~~, a group of undertakings~~ may appoint a single data protection officer.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 35 – paragraph 7

7. The controller or the processor shall designate a data protection officer for a period of at least two years. The data protection officer may be reappointed for further terms. During their term of office, the data protection officer may only be dismissed, if the data protection officer no longer fulfils the conditions required for the performance of their duties.deleted

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 35 – paragraph 11

~~11. The Commission shall be empowered to adopt~~ delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the core activities of the controller or the processor referred to in point (c) of paragraph 1 and the criteria for the professional qualities of the data protection officer referred to in paragraph 5.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 79 – paragraph 3 – point b

(b) an enterprise or an organisation ~~employing fewer than 250 persons~~ is processing personal data only as an activity ancillary to its main activities.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 81 – paragraph 1 – point b

(b) reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety, inter alia for medicinal products or medical devices; or

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 81 – paragraph 1 – point c

(c) other reasons of public interest in areas such as social protection, especially in order to ensure the quality and cost- effectiveness of the procedures used for settling claims for benefits and services in the health insurance system.; or

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 81 – paragraph 1 – point c a (new)

(c a) paying sick pay or other comparable health-related benefits or establishing whether there is a justifiable reason for absence or if processing is needed to enforce other rights and obligations related to the contract of employment.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 81 – paragraph 3

3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point (b) of paragraph ~~1, as well as criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph~~ 1.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 82 – paragraph 1

1. ~~Within the limits of this Regulation,~~ Member States may adopt by lawegal provisions specific rules regulating the processing of employees‘ personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 82 – paragraph 1 a (new)

1 a. When adopting legal provisions referred to in paragraph 1, Member States may provide for exemptions or derogations from the provisions of this Regulation for the processing of personal data in the employment context.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 82 – paragraph 1 b (new)

1 b. Member States may provide for that the matters referred to in Article 82(1) can be defined also by collective agreements negotiated and concluded at national level by social partners.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 82 – paragraph 2

2. Each Member State shall notify to the Commission those legal provisions ~~of its law~~ which it adopts pursuant to paragraphs 1 and 1a, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.

2012/12/18
Committee: EMPL

Proposal for a regulation
Article 82 – paragraph 3

~~3. The Commission shall be empowered to adopt~~ delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1.

2012/12/18
Committee: EMPL