Procedure completed
2011/0011(COD) Public limited liability companies: coordination of safeguards in respect of their formation and the maintenance and alteration of their capital. Recast
Lead committee dossier: JURI/7/05268
Legal Basis TFEU 050-p2
| Role | Committee | Rapporteur | Shadows |
|---|---|---|---|
| Lead | JURI | LEHNE Klaus-Heiner (PPE) |
Legal Basis TFEU 050-p2
Subjects
Activites
- 2012/11/14 Final act published in Official Journal
-
2012/10/25
Final act signed
-
2012/10/25
End of procedure in Parliament
- #3190
-
2012/10/10
Council Meeting
-
2012/10/10
Act adopted by Council after Parliament's 1st reading
-
2011/11/15
Results of vote in Parliament
- Results of vote in Parliament
-
T7-0477/2011
summary
The European Parliament adopted by 531 votes to 19, with 0 abstentions, a legislative resolution on the proposal for a directive of the European Parliament and of the Council on coordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 54 of the Treaty on the Functioning of the European Union, in respect of the formation of public limited liability companies and the maintenance and alteration of their capital, with a view to making such safeguards equivalent (recast). Parliament adopted its position at first reading, under the ordinary legislative procedure, taking into account the recommendations of the Consultative Working Party of the legal services of the European Parliament, the Council and the Commission. According to the Consultative Committee, the proposal in question does not include any substantive amendments other than those identified as such in the proposal and whereas, as regards the codification of the unchanged provisions of the earlier acts together with those amendments, the proposal contains a straightforward codification of the existing texts, without any change in their substance. The Commission proposed Article 50(2)(g) of the Treaty on the Functioning of the European Union as the legal basis. However, Parliament proposes that the legal basis by which the European Parliament and the Council shall adopt directives, in accordance with the ordinary legislative procedure, is set out in Article 50(1) TFEU.
- 2011/10/13 Committee report tabled for plenary, 1st reading/single reading
-
2011/10/11
Vote in committee, 1st reading/single reading
-
2011/02/14
Committee referral announced in Parliament, 1st reading/single reading
-
2011/02/01
Legislative proposal published
-
COM(2011)0029
summary
PURPOSE: to present a proposal on the coordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 54 of the Treaty on the Functioning of the European Union, in respect of the formation of public limited liability companies and the maintenance and alteration of their capital, with a view to making such safeguards equivalent (Recast).PROPOSED ACT: Directive of the European Parliament and the Council.IMPACT ASSESSMENT: no impact assessment was carried out.LEGAL BASIS: Article 50(2) of the Treaty on the Functioning of the European Union.CONTENT: on 16 September 2008, the Commission presented a proposal for a Directive of the European Parliament and of the Council codifying Second Council Directive 77/91/EEC on coordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 58 of the Treaty, in respect of the formation of public limited liability companies and the maintenance and alteration of their capital, with a view to making such safeguards equivalent.In its opinion of 16 October 2008 the Consultative Working Party of the Legal Services stated that the proposal does indeed confine itself to straightforward codification, without any substantive changes to the acts covered by it.On 26 August 2010 the Commission presented an amended proposal for the codification of Directive 77/91/EEC, following subsequent amendments to it. In its further opinion of 12 October 2010 the Consultative Working Party of the Legal Services stated that that amended proposal does indeed confine itself to straightforward codification, without any substantive changes to the acts covered by it.In that opinion the Consultative Working Party of the Legal Services also acknowledged that Article 6(3) of Directive 77/91/EEC, which corresponds to Article 6(2) in the proposed codified text, established a secondary legal basis. In the light of the judgment of the Court of Justice of 6 May 2008 in Case C-133/06, it was considered necessary to redraft Article 6(2) of the proposed codified text. Since such a redrafting would imply a substantive change, and would therefore go beyond straightforward codification, it is therefore appropriate to transform the codification of Directive 77/91/EEC into a recast in order to incorporate the necessary amendment.The amendment to be made to Article 6(2) of the proposed codified text concerns the insertion of the words "the European Parliament and" before the words "the Council", in order to confer on both institutions the competence to examine and, if need be, revise the minimum amount of EUR 25 000 required for a company to be incorporated or obtain authorisation to commence business. BUDGETARY IMPLICATION: this proposal has no implications on the EU budget.
- DG {'url': 'http://ec.europa.eu/dgs/legal_service/', 'title': 'Legal Service'}, BARROSO José Manuel
-
COM(2011)0029
summary
Documents
- Legislative proposal published: COM(2011)0029
- Committee report tabled for plenary, 1st reading/single reading: A7-0348/2011
- Results of vote in Parliament: Results of vote in Parliament
- Decision by Parliament, 1st reading/single reading: T7-0477/2011
- : Directive 2012/30
- : OJ L 315 14.11.2012, p. 0074
| Amendments | Dossier |
| 262 |
2011/0011(COD)
2013/03/06
LIBE
262 amendments...
Amendment 1829 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller
Amendment 1830 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller and processor
Amendment 1831 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller and processor and, if any, the controller's representative, shall maintain documentation of
Amendment 1832 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller
Amendment 1833 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller and processor and, if any, the controller's representative, shall
Amendment 1834 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller
Amendment 1835 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller and processor and, if any, the controller's representative, shall maintain regularly updated documentation of all processing operations under its responsibility.
Amendment 1836 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller
Amendment 1837 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller
Amendment 1838 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller and processor and, if any, the controller's representative, shall maintain documentation of all processing operations under its responsibility. The documentation shall be regularly updated.
Amendment 1839 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller and processor and, if any, the controller's representative, shall maintain documentation of
Amendment 1840 #
Proposal for a regulation Article 28 – paragraph 1 1. Each controller
Amendment 1841 #
Proposal for a regulation Article 28 – paragraph 1 a (new) 1a. Without prejudice to the other provisions of this Regulation, each controller and processor shall maintain documentation on transfers of data to a third country or an international organisation, including the identification of that third country or international organisation, the organisation, enterprise, public organisation or competent authority concerned, the legal basis of the transfer, and, in case of transfers referred to in point (h) of Article 44(1), the documentation of appropriate safeguards.
Amendment 1842 #
Proposal for a regulation Article 28 – paragraph 1 a (new) 1a. The obligation made to the controller shall not apply to SMEs processing data only as an activity ancillary to the sale of goods or services. Ancillary activity should be defined as business or non- trade activity that is not associated with the core activities of a firm. In relation to data protection, data processing activities which do not represent more than 50% of company's turnover shall be considered ancillary.
Amendment 1843 #
Proposal for a regulation Article 28 – paragraph 2 Amendment 1844 #
Proposal for a regulation Article 28 – paragraph 2 – introductory part 2.
Amendment 1845 #
Proposal for a regulation Article 28 – paragraph 2 – introductory part 2. The
Amendment 1846 #
Proposal for a regulation Article 28 – paragraph 2 – introductory part 2. The documentation shall contain at least the
Amendment 1847 #
Proposal for a regulation Article 28 – paragraph 2 – introductory part 2. The documentation sh
Amendment 1848 #
Proposal for a regulation Article 28 – paragraph 2 – introductory part 2.
Amendment 1849 #
Proposal for a regulation Article 28 – paragraph 2 – point a (a) the name and contact details of the controller
Amendment 1850 #
Proposal for a regulation Article 28 – paragraph 2 – point a (a) the name and contact details of the
Amendment 1851 #
Proposal for a regulation Article 28 – paragraph 2 – point b Amendment 1852 #
Proposal for a regulation Article 28 – paragraph 2 – point b Amendment 1853 #
Proposal for a regulation Article 28 – paragraph 2 – point b (b) the name and contact details of the data protection organisation or data protection officer, if any;
Amendment 1854 #
Proposal for a regulation Article 28 – paragraph 2 – point c Amendment 1855 #
Proposal for a regulation Article 28 – paragraph 2 – point c (c) the generic purposes of the processing
Amendment 1856 #
Proposal for a regulation Article 28 – paragraph 2 – point c (c) the
Amendment 1857 #
Proposal for a regulation Article 28 – paragraph 2 – point d Amendment 1858 #
Proposal for a regulation Article 28 – paragraph 2 – point d (d)
Amendment 1859 #
Proposal for a regulation Article 28 – paragraph 2 – point e Amendment 1860 #
Proposal for a regulation Article 28 – paragraph 2 – point e Amendment 1861 #
Proposal for a regulation Article 28 – paragraph 2 – point e Amendment 1862 #
Proposal for a regulation Article 28 – paragraph 2 – point e (e) the recipients
Amendment 1863 #
Proposal for a regulation Article 28 – paragraph 2 – point f Amendment 1864 #
Proposal for a regulation Article 28 – paragraph 2 – point f Amendment 1865 #
Proposal for a regulation Article 28 – paragraph 2 – point f (f) where applicable, transfers of personal data to a
Amendment 1866 #
Proposal for a regulation Article 28 – paragraph 2 – point g Amendment 1867 #
Proposal for a regulation Article 28 – paragraph 2 – point g Amendment 1868 #
Proposal for a regulation Article 28 – paragraph 2 – point g (new) (g) a general indication of the time limits for erasure o
Amendment 1869 #
Proposal for a regulation Article 28 – paragraph 2 – point g (g) a general indication of the time limits for erasure or archiving of the different categories of data;
Amendment 1870 #
Proposal for a regulation Article 28 – paragraph 2 – point g (g) a general indication of the time limits for erasure of the different categories of data, wherever possible;
Amendment 1871 #
Proposal for a regulation Article 28 – paragraph 2 – point g (g) a general indication of the time limits for erasure and conservation of the different categories of data;
Amendment 1872 #
Proposal for a regulation Article 28 – paragraph 2 – point g a (new) (ga) where the processor processes personal data in a third country a general indication of the national obligations of the law in the third country;
Amendment 1873 #
Proposal for a regulation Article 28 – paragraph 2 – point h Amendment 1874 #
Proposal for a regulation Article 28 – paragraph 2 – point h Amendment 1875 #
Proposal for a regulation Article 28 – paragraph 2 – point h Amendment 1876 #
Proposal for a regulation Article 28 – paragraph 3 Amendment 1877 #
Proposal for a regulation Article 28 – paragraph 3 Amendment 1878 #
Proposal for a regulation Article 28 – paragraph 3 3. The controller and the processor and, if any, the controller's representative, shall make the documentation available, on request, to the data subject and the supervisory authority.
Amendment 1879 #
Proposal for a regulation Article 28 – paragraph 3 3. The controller
Amendment 1880 #
Proposal for a regulation Article 28 – paragraph 3 3. The controller
Amendment 1881 #
Proposal for a regulation Article 28 – paragraph 3 3. The controller
Amendment 1882 #
Proposal for a regulation Article 28 – paragraph 3 3. The controller and the processor and, if any, the controller's representative, shall make the documentation available, on request, to the supervisory authority. However, equal emphasis and significance must be placed on good practice and compliance and not just the completion of documentation.
Amendment 1883 #
Proposal for a regulation Article 28 – paragraph 3 3. The controller
Amendment 1884 #
Proposal for a regulation Article 28 – paragraph 3 3. The controller
Amendment 1885 #
Proposal for a regulation Article 28 – paragraph 3 a (new) 3a. In the case of a group of undertakings where each data controller within the group of undertakings carries out substantively the same type of processing operation, only one set of documentation shall be kept at group level.
Amendment 1886 #
Proposal for a regulation Article 28 – paragraph 3 b (new) 3b. Where a controller engages a processor, the controller shall be responsible for maintaining the documentation referred to in Article 28(1) and can require the processor to provide assistance in compiling the information.
Amendment 1887 #
Proposal for a regulation Article 28 – paragraph 4 4. The obligations referred to in paragraphs 1 and 2 shall not apply to
Amendment 1888 #
Proposal for a regulation Article 28 – paragraph 4 4. The obligation
Amendment 1889 #
Proposal for a regulation Article 28 – paragraph 4 4. The obligations referred to in paragraphs 1 and 2 shall not apply to
Amendment 1890 #
Proposal for a regulation Article 28 – paragraph 4 4. The obligations referred to in paragraphs
Amendment 1891 #
Proposal for a regulation Article 28 – paragraph 4 – introductory part 4. The obligations referred to in paragraphs 1 and 2 shall not apply to the following controllers
Amendment 1892 #
Proposal for a regulation Article 28 – paragraph 4 – introductory part 4. The obligations referred to in paragraphs 1, 2 and
Amendment 1893 #
Proposal for a regulation Article 28 – paragraph 4 – introductory part 4. The obligations referred to in paragraph
Amendment 1894 #
Proposal for a regulation Article 28 – paragraph 4 – introductory part 4. The obligations referred to in paragraphs 1 and 2 shall not apply to the following controllers
Amendment 1895 #
Proposal for a regulation Article 28 – paragraph 4 – introductory part 4. The obligations referred to in paragraphs 1 and 2 shall not apply to the following
Amendment 1896 #
Proposal for a regulation Article 28 – paragraph 4 – point a Amendment 1897 #
Proposal for a regulation Article 28 – paragraph 4 – point a (a) a natural person processing personal data without a commercial interest
Amendment 1898 #
Proposal for a regulation Article 28 – paragraph 4 – point b Amendment 1899 #
Proposal for a regulation Article 28 – paragraph 4 – point b Amendment 1900 #
Proposal for a regulation Article 28 – paragraph 4 – point b (b) an enterprise or an organisation employing fewer than 250 persons that is processing personal data only as an activity ancillary to its main activities, unless the enterprise or organisation is processing certain categories of sensitive personal data, as defined under Article 9(1).
Amendment 1901 #
Proposal for a regulation Article 28 – paragraph 4 – point b (b) an enterprise or an organisation
Amendment 1902 #
Proposal for a regulation Article 28 – paragraph 4 – point b (b) an enterprise or an organisation employing fewer than
Amendment 1903 #
Proposal for a regulation Article 28 – paragraph 4 – point b (b) an enterprise or an organisation employing fewer than
Amendment 1904 #
Proposal for a regulation Article 28 – paragraph 5 Amendment 1905 #
Proposal for a regulation Article 28 – paragraph 5 Amendment 1906 #
Proposal for a regulation Article 28 – paragraph 5 Amendment 1907 #
Proposal for a regulation Article 28 – paragraph 5 Amendment 1908 #
Proposal for a regulation Article 28 – paragraph 5 Amendment 1909 #
Proposal for a regulation Article 28 – paragraph 5 Amendment 1910 #
Proposal for a regulation Article 28 – paragraph 5 Amendment 1911 #
Proposal for a regulation Article 28 – paragraph 5 Amendment 1912 #
Proposal for a regulation Article 28 – paragraph 5 5. The Commission shall
Amendment 1913 #
Proposal for a regulation Article 28 – paragraph 6 Amendment 1914 #
Proposal for a regulation Article 28 – paragraph 6 Amendment 1915 #
Proposal for a regulation Article 28 – paragraph 6 6. The Commission
Amendment 1916 #
Proposal for a regulation Article 28 – paragraph 6 6. To ensure harmonized requirements within the Union, the Commission may lay down standard forms for the documentation referred to in paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
Amendment 1917 #
Proposal for a regulation Article 28 – paragraph 6 6. The
Amendment 1918 #
Proposal for a regulation Article 29 – paragraph 1 1. The controller and, where appropriate, the processor and, if any, the representative of the controller, shall co-operate, on request, with the supervisory authority in the performance of its duties, in particular by providing the information referred to in point (a) of Article 53(2) and by granting access as provided in point (b) of that paragraph.
Amendment 1919 #
Proposal for a regulation Article 29 – paragraph 1 1. The controller and the processor and, if any, the representative of the controller, shall co-operate, on request, with the supervisory authority in the performance of its duties, in particular by providing the information referred to in point (a) of Article 53(2) and by granting access as provided in point (b) of that paragraph. The controller and the processor and, if any, the representative of the controller, shall make the documentation available, on the basis of a request outlining the reasons for requiring access to the documents, to the supervisory authority.
Amendment 1920 #
Proposal for a regulation Article 29 – paragraph 2 2. In response to the supervisory authority's exercise of its powers under Article 53(2), the controller, either in person or through his representative, and the processor shall reply to the supervisory authority within a reasonable period to be specified by the supervisory authority. The reply shall include a description of the measures taken and the results achieved, in response to the remarks of the supervisory authority.
Amendment 1921 #
Proposal for a regulation Article 29 – paragraph 2 a (new) 2a. The controller, his representative and the processor shall make available to the supervisory authority, on request, the documentation referred to in Article 14 or 28 as the case may be.
Amendment 1922 #
Proposal for a regulation Article 30 – paragraph 1 1. The controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing
Amendment 1923 #
Proposal for a regulation Article 30 – paragraph 1 1. The controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing
Amendment 1924 #
Proposal for a regulation Article 30 – paragraph 1 1. The controller and the processor shall implement appropriate technical and organisational measures, including pseudonymisation, to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected, having regard to the state of the art and the costs of their implementation.
Amendment 1925 #
Proposal for a regulation Article 30 – paragraph 1 1. The controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected, having regard to the state of the art
Amendment 1926 #
Proposal for a regulation Article 30 – paragraph 1 1.
Amendment 1927 #
Proposal for a regulation Article 30 – paragraph 1 a (new) Amendment 1928 #
Proposal for a regulation Article 30 – paragraph 2 2. The
Amendment 1929 #
Proposal for a regulation Article 30 – paragraph 2 2. The controller and the processor shall, following an evaluation of the risks, take the measures referred to in paragraph 1 to protect personal data against accidental or unlawful destruction or accidental loss and to prevent any unlawful forms of processing, in particular any unauthorised disclosure, dissemination or access, or alteration of personal data. Where a controller has carried a data protection impact assessment pursuant to Article 33, the results of this assessment shall be taken into account in the evaluation of the risks.
Amendment 1930 #
Proposal for a regulation Article 30 – paragraph 2 2. The controller and the processor shall
Amendment 1931 #
Proposal for a regulation Article 30 – paragraph 2 2.
Amendment 1932 #
Proposal for a regulation Article 30 – paragraph 2 a (new) 2a. The legal obligations, as referred to in paragraphs 1 and 2, which would require processing of personal data to the extent strictly necessary for the purposes of ensuring network and information security, constitute a legitimate interest pursued by or on behalf of a data controller or processor, as referred to in Article 6(1)(f).
Amendment 1933 #
Proposal for a regulation Article 30 – paragraph 2 a (new) 2a. The legal obligations, as referred to in paragraphs 1 and 2, which would require processing of personal data to the extent strictly necessary for the purposes of ensuring network and information security, constitute a legitimate interest pursued by, or on behalf of a data controller or processor.
Amendment 1934 #
Proposal for a regulation Article 30 – paragraph 3 Amendment 1935 #
Proposal for a regulation Article 30 – paragraph 3 Amendment 1936 #
Proposal for a regulation Article 30 – paragraph 3 Amendment 1937 #
Proposal for a regulation Article 30 – paragraph 3 Amendment 1938 #
Proposal for a regulation Article 30 – paragraph 3 3. The
Amendment 1939 #
Proposal for a regulation Article 30 – paragraph 3 3. The
Amendment 1940 #
Proposal for a regulation Article 30 – paragraph 4 Amendment 1941 #
Proposal for a regulation Article 30 – paragraph 4 Amendment 1942 #
Proposal for a regulation Article 30 – paragraph 4 Amendment 1943 #
Proposal for a regulation Article 30 – paragraph 4 Amendment 1944 #
Proposal for a regulation Article 30 – paragraph 4 Amendment 1945 #
Proposal for a regulation Article 30 – paragraph 4 – subparagraph 1 – introductory part The Commission
Amendment 1946 #
Proposal for a regulation Article 30 – paragraph 4 – subparagraph 2 Amendment 1947 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach, when the breach is likely to adversely affect the protection of the personal data or privacy of the data subject, the controller shall without undue delay and, where feasible, not later than 24 hours after having become aware of it, notify the personal data breach to the supervisory authority. The notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours.
Amendment 1948 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach, the controller shall without undue delay
Amendment 1949 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach, the controller shall without undue delay and
Amendment 1950 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach
Amendment 1951 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a major personal data breach, the controller shall without undue delay and, where feasible, not later than 24 hours after having become aware of it, notify the personal data breach to the supervisory authority. The notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours.
Amendment 1952 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach which is likely to adversely affect the data subject and the protection of the personal data of the data subject, the controller shall without undue delay and, where feasible, not later than 24 hours after having become aware of it, notify the personal data breach to the supervisory
Amendment 1953 #
Proposal for a regulation Article 31 – paragraph 1 1.
Amendment 1954 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72
Amendment 1955 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach,
Amendment 1956 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach
Amendment 1957 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach
Amendment 1958 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than
Amendment 1959 #
Proposal for a regulation Article 31 – paragraph 1 1. In the case of a personal data breach
Amendment 1960 #
Proposal for a regulation Article 31 – paragraph 1 a (new) 1a. Controllers shall notify the supervisory authority of the Member State in which they are established. Where the notification is carried out in accordance with paragraph 4, the supervisory authority of the Member State in which the controller responsible for the personal data breach is established shall be notified. Controllers which are not established on the territory of the European Union, shall notify the supervisory authority of the Member State in which their representative is established.
Amendment 1961 #
Proposal for a regulation Article 31 – paragraph 1 a (new) 1a. The controller shall keep a list of minor breaches and make that list available to the supervisory authority.
Amendment 1962 #
Proposal for a regulation Article 31 – paragraph 2 2.
Amendment 1963 #
Proposal for a regulation Article 31 – paragraph 2 2. Pursuant to point (f) of Article 26(2), the processor shall alert and inform the controller immediately after the
Amendment 1964 #
Proposal for a regulation Article 31 – paragraph 2 2. Pursuant to point (f) of Article 26(2), the processor shall alert and inform the controller
Amendment 1965 #
Proposal for a regulation Article 31 – paragraph 2 2. Pursuant to point (f) of Article 26(2), the processor shall alert and inform the controller
Amendment 1966 #
Proposal for a regulation Article 31 – paragraph 2 a (new) 2a. Controllers shall notify the supervisory authority of the Member State in which they are established. Where the notification is carried out in accordance with paragraph 4, the supervisory authority of the Member State in which the controller responsible for the personal data breach is established shall be notified. Controllers which are not established on the territory of the European Union, shall notify the supervisory authority of the Member State in which their representative is established.
Amendment 1967 #
Proposal for a regulation Article 31 – paragraph 2 a (new) Amendment 1968 #
Proposal for a regulation Article 31 – paragraph 3 Amendment 1969 #
Proposal for a regulation Article 31 – paragraph 3 – introductory part 3. The notification
Amendment 1970 #
Proposal for a regulation Article 31 – paragraph 3 – introductory part 3. The notification referred to in paragraph 1 must
Amendment 1971 #
Proposal for a regulation Article 31 – paragraph 3 – point b (b) communicate the
Amendment 1972 #
Proposal for a regulation Article 31 – paragraph 3 – point e (e) describe the measures proposed or taken by the controller to address the
Amendment 1973 #
Proposal for a regulation Article 31 – paragraph 3 a (new) 3a. The notification referred to in paragraph 1 shall not be required if the controller or the processor has implemented appropriate technological measures, which were applied to the data concerned by the personal data breach, such as measures which render the data unintelligible to any person who is not authorised to access it.
Amendment 1974 #
Proposal for a regulation Article 31 – paragraph 3 a (new) 3a. The national supervisory authority should provide guidance under Article 38 on the particular circumstances in which notification to the supervisory authority should take place. Furthermore, the level of detail and the specific information required when a controller notifies the supervisory authority of the data breach should be contained in guidance.
Amendment 1975 #
Proposal for a regulation Article 31 – paragraph 4 Amendment 1976 #
Proposal for a regulation Article 31 – paragraph 4 4. The controller shall document any personal data breaches referred to in paragraph 1 of this article, comprising the facts surrounding the breach, its effects and the remedial action taken.
Amendment 1977 #
Proposal for a regulation Article 31 – paragraph 4 4. The controller shall document any personal data breaches, comprising the facts surrounding the breach, its effects and the remedial action taken. This documentation must be sufficient to enable the supervisory authority to verify compliance with this Article. The documentation shall only include the information necessary for that purpose.
Amendment 1978 #
Proposal for a regulation Article 31 – paragraph 4 4. The controller shall document any personal data breaches without undue delay when asked to be provided, comprising the facts surrounding the breach, its effects and the remedial action taken. This documentation must enable the supervisory
Amendment 1979 #
Proposal for a regulation Article 31 – paragraph 4 4. The controller shall document
Amendment 1980 #
Proposal for a regulation Article 31 – paragraph 4 – subparagraph 1 a (new) In case the controller is part of a group of undertakings or of joint controllers, the personal data breach may be notified by the main establishment, or by another controller or undertaking designated by the joint controllers or group of undertakings.
Amendment 1981 #
Proposal for a regulation Article 31 – paragraph 4 – subparagraph 1 a (new) Cases in which it is highly probable that a breach of personal data protection will have a negative impact on the data subject’s privacy shall be deemed serious breaches.
Amendment 1982 #
Proposal for a regulation Article 31 – paragraph 4 a (new) 4a. The supervisory authority should maintain a publicly accessible register of identified and closed serious breaches.
Amendment 1983 #
Proposal for a regulation Article 31 – paragraph 4 a (new) 4a. The supervisory authority shall keep a public register of the types of breaches notified.
Amendment 1984 #
Proposal for a regulation Article 31 – paragraph 4 b (new) 4b. Notification of a breach of personal data protection shall, exceptionally, not be required where the controller has, without delay, implemented appropriate technological measures to safeguard the personal data concerned by the breach, and where such measures ensure that the at-risk data are rendered unintelligible to any person not authorised to access them,
Amendment 1985 #
Proposal for a regulation Article 31 – paragraph 5 Amendment 1986 #
Proposal for a regulation Article 31 – paragraph 5 Amendment 1987 #
Proposal for a regulation Article 31 – paragraph 5 Amendment 1988 #
Proposal for a regulation Article 31 – paragraph 5 Amendment 1989 #
Proposal for a regulation Article 31 – paragraph 5 5. The Commission shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal
Amendment 1990 #
Proposal for a regulation Article 31 – paragraph 6 Amendment 1991 #
Proposal for a regulation Article 31 – paragraph 6 Amendment 1992 #
Proposal for a regulation Article 31 – paragraph 6 6. The Commission
Amendment 1993 #
Proposal for a regulation Article 31 – paragraph 6 6. The Commission may lay down the standard format of
Amendment 1994 #
Proposal for a regulation Article 31 – paragraph 6 6. The Commission may lay down the standard format of such notification to the supervisory authority, the procedures applicable to the notification requirement and the form and the modalities for the documentation referred to in paragraph 4, including the time limits for erasure of the information contained therein. Those implementing acts shall be adopted, after requesting an opinion of the European Data Protection Board, in accordance with the examination procedure referred to in Article 87(2).
Amendment 1995 #
Proposal for a regulation Article 31 – paragraph 6 6. The Commission may lay down the
Amendment 1996 #
Proposal for a regulation Article 32 – paragraph 1 1. When the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject, the controller shall, after the notification referred to in Article 31, communicate the personal data breach to the data subject with
Amendment 1997 #
Proposal for a regulation Article 32 – paragraph 1 1. When the personal data breach is likely to have an adverse
Amendment 1998 #
Proposal for a regulation Article 32 – paragraph 1 1. When the personal data breach causes or is likely to cause significant adverse
Amendment 1999 #
Proposal for a regulation Article 32 – paragraph 1 1. When the personal data breach is likely
Amendment 2000 #
Proposal for a regulation Article 32 – paragraph 3 3. The communication of a personal data breach to the data subject shall not be required if the data breach has not produced significant harm to citizens and the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures, and that those measures were applied to the data concerned by the personal data breach. Such technological protection measures shall render the data unintelligible, unusable or anonymised to any person who is not authorised to access it.
Amendment 2001 #
Proposal for a regulation Article 32 – paragraph 3 3. The communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures, and that those measures were applied to the data concerned by the personal data breach. Such technological protection measures shall have the purpose to render the data unintelligible to any person who is not authorised to access
Amendment 2002 #
Proposal for a regulation Article 32 – paragraph 3 3. The communication of a personal data breach to the data subject
Amendment 2003 #
Proposal for a regulation Article 32 – paragraph 3 3. The communication of a personal data breach to the data subject shall not be required if the
Amendment 2004 #
Proposal for a regulation Article 32 – paragraph 3 a (new) 3a. If after the implementation of the suggested technological measures another data breach were to occur, the controller shall always be obliged to communicate this without undue delay to the data subject.
Amendment 2005 #
Proposal for a regulation Article 32 – paragraph 4 – subparagraph 1 a (new) Those concerned shall not be notified in cases where this could clearly obstruct current investigations or hinder or delay measures to resolve the security breach. More detailed provision for such eventualities may be made under EU law and Member State legislation, the objective being at all times to uphold the public interest and comply with the spirit of data protection law.
Amendment 2006 #
Proposal for a regulation Article 32 – paragraph 5 Amendment 2007 #
Proposal for a regulation Article 32 – paragraph 5 Amendment 2008 #
Proposal for a regulation Article 32 – paragraph 5 Amendment 2009 #
Proposal for a regulation Article 32 – paragraph 5 5. The Commission shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements as to the circumstances in which a personal data breach is likely to adversely affect the personal data referred to in paragraph 1.
Amendment 2010 #
Proposal for a regulation Article 32 – paragraph 6 Amendment 2011 #
Proposal for a regulation Article 32 – paragraph 6 6. The Commission
Amendment 2012 #
Proposal for a regulation Article 32 – paragraph 6 6. The Commission may lay down the format of the communication to the data subject referred to in paragraph 1 and the procedures applicable to that communication, with a particular focus on cases affecting large numbers of people. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).
Amendment 2013 #
Proposal for a regulation Article 32 – paragraph 6 6. The Commission may lay down the format of the communication to the data subject referred to in paragraph 1 and the procedures applicable to that communication. Those implementing acts shall be adopted, after requesting an opinion of the European Data Protection Board, in accordance with the examination procedure referred to in Article 87(2).
Amendment 2014 #
Proposal for a regulation Chapter 4 – section 3 – title LIFECYCLE DATA PROTECTION
Amendment 2015 #
Proposal for a regulation Article 32 a (new) Article 32a Communication of a personal data breach to other organisations A controller that communicates a personal data breach to a data subject pursuant to Article 32 may notify another organisation, a government institution or a part of a government institution of the personal data breach if that organisation, government institution or part may be able to reduce the risk of the harm that could result from it or mitigate that harm. Such notifications can be done without informing the data subject if the disclosure is made solely for the purposes of reducing the risk of the harm to the data subject that could result from the breach or mitigating that harm.
Amendment 2016 #
Proposal for a regulation Article 32 a (new) Article 32a Data protection risk analysis 1. The controller shall carry out a risk analysis with regard to data processing operations, assessing whether at least two of the risk factors referred to under Article 5b(1) to (10) exist. 2. Where at least two of the risk factors referred to under Article 5b(1) to (10) exist, the controller or the processor acting on the controller's behalf shall carry out a data protection impact assessment pursuant to Article 33. 3. Where less than two of the risk factors referred to under Article 5b(1) to (10) exist, the risk analysis and its findings shall be documented. 4. The risk analysis shall be reviewed at the latest after one year, or immediately, if the nature, the scope or the purposes of the data processing operations change significantly.
Amendment 2017 #
Proposal for a regulation Article 33 – paragraph 1 1. Where
Amendment 2018 #
Proposal for a regulation Article 33 – paragraph 1 1. Where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, the controller
Amendment 2019 #
Proposal for a regulation Article 33 – paragraph 1 1. Where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, the controller or the processor acting on the controller
Amendment 2020 #
Proposal for a regulation Article 33 – paragraph 1 1. Where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, the controller
Amendment 2021 #
Proposal for a regulation Article 33 – paragraph 1 1. Where processing operations
Amendment 2022 #
Proposal for a regulation Article 33 – paragraph 1 1. Where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, the controller
Amendment 2023 #
Proposal for a regulation Article 33 – paragraph 1 1. Where processing operations present specific risks to the rights and freedoms of
Amendment 2024 #
Proposal for a regulation Article 33 – paragraph 1 1. Where processing operations present specific high degree of risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes
Amendment 2025 #
Proposal for a regulation Article 33 – paragraph 1 1. Where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, the controller or the processor acting on the controller's behalf shall carry out a
Amendment 2026 #
Proposal for a regulation Article 33 – paragraph 1 a (new) 1a. SMEs shall only be required to perform an impact assessment after their 3rd year of incorporation if data processing is deemed as a core activity of their business. That is, where sale or revenue from processing makes up for 50% of the SMEs revenue.
Amendment 2027 #
Proposal for a regulation Article 33 – paragraph 1 a (new) 1a. Such a requirement shall not apply to: (a) micro small and medium-sized enterprises that process data only as an activity ancillary to their main activities; (b) all micro, small and medium-sized enterprises for the first three years after the enterprise was founded.
Amendment 2028 #
Proposal for a regulation Article 33 – paragraph 2 Amendment 2029 #
Proposal for a regulation Article 33 – paragraph 2 – introductory part 2. The following processing operations
Amendment 2030 #
Proposal for a regulation Article 33 – paragraph 2 – point a (a) a systematic and extensive evaluation of personal aspects relating to a natural person or for analysing or predicting in particular the natural person's economic situation, location, health, personal preferences, reliability or behaviour, which is based on automated processing and on which measures are based that produce adverse legal effects
Amendment 2031 #
Proposal for a regulation Article 33 – paragraph 2 – point a (a) respecting the exceptions of Article 20(2)(c) and Article 21 a systematic and extensive evaluation of personal aspects relating to a natural person or for analysing or predicting in particular the natural person's economic situation, location, health, personal preferences, reliability or behaviour, which is based on automated processing and on which measures are based that produce legal effects concerning the individual or significantly negative affect the individual;
Amendment 2032 #
Proposal for a regulation Article 33 – paragraph 2 – point a (a) taking into account the exceptions of Article 20(2)(c) and the restrictions of Article 21, a systematic and extensive evaluation of personal aspects relating to a natural person or for analysing or predicting in particular the natural person's economic situation, location, health, personal preferences, or reliability
Amendment 2033 #
Proposal for a regulation Article 33 – paragraph 2 – point b (b) information on sex life, health, political opinions, religious beliefs, criminal convictions, race and ethnic origin or for the provision of health care, epidemiological researches, or surveys of mental or infectious diseases, where the data are processed for taking measures or decisions regarding specific individuals on a large scale;
Amendment 2034 #
Proposal for a regulation Article 33 – paragraph 2 – point b (b) information on sex life, health, race and ethnic origin, socio-economic status, or for the provision of health care, epidemiological researches, or surveys of mental or infectious diseases, where the data are processed for taking measures or decisions regarding specific individuals
Amendment 2035 #
Proposal for a regulation Article 33 – paragraph 2 – point c Amendment 2036 #
Proposal for a regulation Article 33 – paragraph 2 – point c Amendment 2037 #
Proposal for a regulation Article 33 – paragraph 2 – point c Amendment 2038 #
Proposal for a regulation Article 33 – paragraph 2 – point c (c) monitoring publicly accessible areas,
Amendment 2039 #
Proposal for a regulation Article 33 – paragraph 2 – point c (c) monitoring publicly accessible areas, especially when using optic-electronic devices (video surveillance) o
Amendment 2040 #
Proposal for a regulation Article 33 – paragraph 2 – point c (c) automated monitoring publicly accessible areas
Amendment 2041 #
Proposal for a regulation Article 33 – paragraph 2 – point d (d) p
Amendment 2042 #
Proposal for a regulation Article 33 – paragraph 2 – point e Amendment 2043 #
Proposal for a regulation Article 33 – paragraph 2 a (new) 2a. The supervisory authority shall establish and make public a list of the kind of processing for which a data protection impact assessment would be recommended. The supervisory authority shall communicate those lists to the European Data Protection Board.
Amendment 2044 #
Proposal for a regulation Article 33 – paragraph 3 Amendment 2045 #
Proposal for a regulation Article 33 – paragraph 3 3. The assessment shall
Amendment 2046 #
Proposal for a regulation Article 33 – paragraph 3 3. The assessment shall contain at least a general description of the envisaged processing operations,
Amendment 2047 #
Proposal for a regulation Article 33 – paragraph 3 3. The assessment shall contain at least a general description of the envisaged processing operations, an assessment of the risks to the rights and freedoms of data subjects, the measures envisaged to address the risks, safeguards, security measures and mechanisms to ensure the protection of personal data
Amendment 2048 #
Proposal for a regulation Article 33 – paragraph 3 3. The assessment shall contain at least a
Amendment 2049 #
Proposal for a regulation Article 33 – paragraph 3 3. The assessment shall contain at least a
Amendment 2050 #
Proposal for a regulation Article 33 – paragraph 3 a (new) 3a. If the controller or the processor has designated a data protection organisation or a data protection officer, he/she should be involved in the impact assessment proceeding.
Amendment 2051 #
Proposal for a regulation Article 33 – paragraph 4 Amendment 2052 #
Proposal for a regulation Article 33 – paragraph 4 Amendment 2053 #
Proposal for a regulation Article 33 – paragraph 4 Amendment 2054 #
Proposal for a regulation Article 33 – paragraph 4 Amendment 2055 #
Proposal for a regulation Article 33 – paragraph 4 Amendment 2056 #
Proposal for a regulation Article 33 – paragraph 4 Amendment 2057 #
Proposal for a regulation Article 33 – paragraph 4 Amendment 2058 #
Proposal for a regulation Article 33 – paragraph 4 4. The controller shall seek the views of data subjects or their representatives on the intended processing
Amendment 2059 #
Proposal for a regulation Article 33 – paragraph 5 Amendment 2060 #
Proposal for a regulation Article 33 – paragraph 5 Amendment 2061 #
Proposal for a regulation Article 33 – paragraph 5 5. Where the controller is a public authority or body and where the processing results from a legal obligation pursuant to
Amendment 2062 #
Proposal for a regulation Article 33 – paragraph 5 5. Where the controller is a public authority or
Amendment 2063 #
Proposal for a regulation Article 33 – paragraph 5 5. Where the controller is a public authority or body or an authority or body responsible for performing a public interest task, and where the processing results from a legal obligation pursuant to
Amendment 2064 #
Proposal for a regulation Article 33 – paragraph 5 5. Where the controller is a public authority or body and where the processing results from a legal obligation pursuant to point (c) of Article 6(1) providing for rules and procedures pertaining to the processing operations and regulated by Union or Member State law, paragraphs 1 to 4 shall not apply, unless Member States deem it necessary to carry out such assessment prior to the processing activities.
Amendment 2065 #
Proposal for a regulation Article 33 – paragraph 5 5. Where the controller is a public authority or body and where the processing results from a legal obligation pursuant to point (c) of Article 6(1) providing for rules and procedures pertaining to the processing operations and regulated by Union or Member State law, paragraphs 1 to 4 shall not apply, unless Member States deem it necessary to carry out such assessment prior to the processing activities.
Amendment 2066 #
Proposal for a regulation Article 33 – paragraph 5 a (new) 5a. The assessment shall be documented and lay down a schedule for regular periodic data protection compliance reviews pursuant to Article 33a(1).
Amendment 2067 #
Proposal for a regulation Article 33 – paragraph 5 b (new) 5b. The assessment shall be updated without undue delay, if the results of the data protection compliance review referred to in Article 33a show compliance inconsistencies.
Amendment 2068 #
Proposal for a regulation Article 33 – paragraph 5 c (new) 5c. The controller and the processor and, if any, the controller's representative, shall make the assessment available, on request, to the supervisory authority.
Amendment 2069 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2070 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2071 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2072 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2073 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2074 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2075 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2076 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2077 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2078 #
Proposal for a regulation Article 33 – paragraph 6 Amendment 2079 #
Proposal for a regulation Article 33 – paragraph 6 6. The Commission shall
Amendment 2080 #
Proposal for a regulation Article 33 – paragraph 6 6. The Commission shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for the processing operations likely to present specific risks referred to in paragraphs 1 and 2 and the requirements for the assessment, referred to in paragraph 3, including conditions and procedures for scalability, verification and auditability. In doing so, the Commission shall consider specific measures for micro, small and medium-
Amendment 2081 #
Proposal for a regulation Article 33 – paragraph 7 Amendment 2082 #
Proposal for a regulation Article 33 – paragraph 7 Amendment 2083 #
Proposal for a regulation Article 33 – paragraph 7 Amendment 2084 #
Proposal for a regulation Article 33 – paragraph 7 Amendment 2085 #
Proposal for a regulation Article 33 – paragraph 7 Amendment 2086 #
Proposal for a regulation Article 33 – paragraph 7 Amendment 2087 #
Proposal for a regulation Article 33 – paragraph 7 Amendment 2088 #
Proposal for a regulation Article 33 – paragraph 7 Amendment 2089 #
Proposal for a regulation Article 33 – paragraph 7 7. The
Amendment 2090 #
Proposal for a regulation Article 33 a (new) Article 33a Data protection compliance review 1. At the latest two years after the carrying out of an impact assessment pursuant to Article 33(1), the controller or the processor acting on the controller's behalf shall carry out a compliance review. This compliance review shall demonstrate that the processing of personal data is performed in compliance with the data protection impact assessment. It shall further demonstrate the ability of the data controller to comply with the autonomous choices of data subjects in accordance with Article 23a. 2. The compliance review shall be carried out periodically at least once every two years, or immediately when there is a change in the specific risks presented by the processing operations. 3. Where the compliance review results show compliance inconsistencies, the compliance review shall include recommendations on how to achieve full compliance. 4. The compliance review and its recommendations shall be documented. The controller and the processor and, if any, the controller's representative, shall make the compliance review available, on request, to the supervisory authority.
source: PE-506.166
|
History
(these mark the time of scraping, not the official date of the change)
2015-11-04Show (3) Changes | Timetravel
| activities/0/docs/0/celexid |
CELEX:52011PC0029:EN
|
| activities/0/docs/0/url |
Old
http://www.europarl.europa.eu/registre/docs_autres_institutions/commission_europeenne/com/2011/0029/COM_COM(2011)0029_EN.pdfNew
http://www.europarl.europa.eu/RegData/docs_autres_institutions/commission_europeenne/com/2011/0029/COM_COM(2011)0029_EN.pdf |
| links/European Commission/title |
Old
PreLexNew
EUR-Lex |
2014-11-09Show (5) Changes
| activities |
|
| committees |
|
| links |
|
| other |
|
| procedure |
|