2017/0002(COD) | [ParlTrack]

Proposal for a regulation
Article 2 – paragraph 1

1. This Regulation applies to the processing of personal data by all Union institutions and bodies ~~insofar as such processing is carried out in the exercise of activities which fall, wholly or partially within the scope of~~, except Eurojust, Europol and the European Public Prosecutor's Office. Specific data protection rules apply to these Union ~~law~~bodies.

Amendment 101 #

Proposal for a regulation
Article 2 – paragraph 1 a (new)

1a. This Regulation shall not apply to the processing of operational personal data by Union bodies, offices and agencies carrying out activities falling within the scope of Chapters 4 or 5 of Title V of Part Three of the TFEU where acts creating such bodies, offices and agencies provide for a comprehensive set of rules regarding the protection of physical persons with regard to the processing of their data.

Amendment 102 #

Proposal for a regulation
Article 2 – paragraph 1 a (new)

1a. Eurojust, Europol and the European Public Prosecutor's Office shall only be covered by this Regulation for the processing of administrative personal data. Separate provisions apply to the processing of operational personal data by Eurojust, EPPO and the European Public Prosecutor's Office. The before mentioned Union bodies are not subject to this Regulation for the processing of operational personal data.

Amendment 103 #

Proposal for a regulation
Article 2 – paragraph 1 b (new)

1b. This Regulation shall not apply to the processing of personal data in the context of the missions referred to in Articles 42(1), 43 and 44 of the TEU.

Amendment 104 #

Proposal for a regulation
Article 2 – paragraph 2

2. This Regulation shall apply to the processing of personal data, wholly or partially by automated means, and to the processing otherwise than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.deleted

Amendment 105 #

Proposal for a regulation
Article 2 – paragraph 2 a (new)

2a. This Regulation shall also apply to Union agencies carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of the Treaty, including where the founding acts of these Union agencies lay down a standalone data protection regime for the processing of operational personal data. The provisions in this Regulation shall take precedence over the conflicting provisions in the founding acts of these Union agencies.

Amendment 106 #

Proposal for a regulation
Article 3 – paragraph 1 – point a

(a) the definitions in Regulation (EU) 2016/679, with the exception of the definition of ‘'controller’' in point (7), , 'main establishment' in point (16), 'enterprise' in point (18), 'group of undertaking' in point (19) and 'binding cooperate rules' in point (5) of Article 4 of that Regulation;

Amendment 107 #

Proposal for a regulation
Article 3 – paragraph 2 – point d a (new)

(da) 'operational personal data' means personal data processed by the Union agencies established on the basis of Chapters 4 and 5 of Title V of Part Three of the TFEU and by the missions referred to in Article 42(1), 43 and 44 of the TEU, for the purposes of meeting the objectives laid down in acts establishing those agencies or missions.

Amendment 108 #

Proposal for a regulation
Article 3 – paragraph 2 – point d a (new)

Amendment 109 #

Proposal for a regulation
Article 3 – paragraph 2 – point a a (new)

(aa) 'operational personal data' means all personal data processed by the Union bodies, offices or agencies carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three of the TFEU to meet the objectives laid down in the acts establishing these bodies, offices or agencies;

Amendment 110 #

Proposal for a regulation
Article 3 – paragraph 2 – point a b (new)

(ab) 'administrative personal data' means all personal data processed by the Union bodies, offices or agencies which fall in the scope of this Regulation;

Amendment 111 #

Proposal for a regulation
Article 4 – paragraph 1 – introductory part

1. Personal data ~~must~~shall be:

Amendment 112 #

Proposal for a regulation
Article 5 – paragraph 1 – point a

(a) ~~processing is necessary for the performance of a task carried out in the public interest on the basis or in the exercise of official authority vested in the Union institution or body~~the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

Amendment 113 #

Proposal for a regulation
Article 5 – paragraph 1 – point b

(b) processing is necessary for ~~compliance with a legal obligation to which the controller is subje~~the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

Amendment 114 #

Proposal for a regulation
Article 5 – paragraph 1 – point c

(c) processing is necessary for ~~the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contra~~compliance with a legal obligation to which the controller is subject;

Amendment 115 #

Proposal for a regulation
Article 5 – paragraph 1 – point d

(d) ~~the data subject has given consent to the processing of his or her personal data for one or more specific purposes~~processing is necessary in order to protect the vital interests of the data subject or of another natural person;

Amendment 116 #

Proposal for a regulation
Article 5 – paragraph 1 – point e

(e) processing is necessary ~~in order to protect the vital~~for the performance of a task carried out in the public interests ofn the ~~data subject~~basis or in the exercise orf of ~~another natural person~~ficial authority vested in the Union institution or body.

Amendment 117 #

Proposal for a regulation
Article 8

Conditions applicable to children's consent in relation to information society 1. Where point (d) of Article 5(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 13 years old. Where the child is below the age of 13 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. 2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. 3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.Article 8 deleted services

Amendment 118 #

Proposal for a regulation
Article 8 – paragraph 1

1. Where point (d) of Article 5(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 136 years old. Where the child is below the age of 136 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Amendment 119 #

Proposal for a regulation
Article 8 a (new)

Article 8 a Article 8 a new Transfer of personal data within or between Community institutions or bodies Without prejudice to Articles 4, 5, 6 and 10: 1. Personal data shall only be transferred within or to other Community institutions or bodies if the data are necessary for the legitimate performance of tasks covered by the competence of the recipient. 2. Where the data are transferred following a request from the recipient, both the controller and the recipient shall bear the responsibility for the legitimacy of this transfer. The controller shall be required to verify the competence of the recipient and to make a provisional evaluation of the necessity for the transfer of the data. If doubts arise as to this necessity, the controller shall seek further information from the recipient. The recipient shall ensure that the necessity for the transfer of the data can be subsequently verified. 3. The recipient shall process the personal data only for the purposes for which they were transmitted.

Amendment 120 #

Proposal for a regulation
Article 9 – title

Transmissions of personal data to recipients, other than Union institutions and bodies, established in the Union ~~and subject to Regulation (EU) 2016/679 or Directive (EU) 2016/680~~

Amendment 121 #

Proposal for a regulation
Article 9 – paragraph 1 – introductory part

1. Without prejudice to Articles 4, 5, 6, 10, 14, 15(3) and 106(4), personal data shall only be transmitted to recipients established in the Union and subject to Regulation (EU) 2016/679 or to the national law adopted pursuant to Directive (EU) 2016/680, if the ~~recipient establishes~~controller demonstrates, on the basis of a reasoned request by the recipient:

Amendment 122 #

Proposal for a regulation
Article 9 – paragraph 1 – introductory part

1. Without prejudice to Articles 4, 5, 6 and 10, personal data shall only be transmitted to other recipients established in the Union ~~and subject to Regulation (EU) 2016/679 or to the national law adopted pursuant to Directive (EU) 2016/680,~~ if the recipient establishes:

Amendment 123 #

Proposal for a regulation
Article 9 – paragraph 1 – point b

(b) that it is strictly necessary to have the data transmitted~~, it is proportionate to the purposes of the transmission~~ having regard to the recipient's objectives, and ifthat there is not any reason to assume that the data subject's rights and freedoms and legitimate interests might be prejudiced by the requested data transfer or the reasonably to be expected further use of that personal data by the recipient.

Amendment 124 #

(b) that it is ~~necessary to have the data transmitted, it is proportionate to~~proportionate and necessary for the purposes of ~~the transmission and if there is no reason to assume that the data subject's rights and freedoms and legitimate interests might be prejudiced~~serving a public interest such as transparency or good administration.

Amendment 125 #

Proposal for a regulation
Article 10 – paragraph 2 – point a

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject, or

Amendment 126 #

Proposal for a regulation
Article 10 – paragraph 2 – point d

(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a non-profit- seeking body which constitutes an entity integrated in a Union institution or body and with a political, philosophical, religious or trade-union aim and on condition that the processing relates solely to the members or to former members of this body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects;deleted

Amendment 127 #

Proposal for a regulation
Article 11 – paragraph 1

Processing of personal data relating to criminal convictions and offences or related security measures pursuant to Article 5(1) ~~may~~shall be carried out only ifwhen authorised by Union law, which may include internal rules, providing the appropriate specific safeguards for the rights and freedoms of data subjects.

Amendment 128 #

Proposal for a regulation
Article 11 – paragraph 1

Processing of personal data relating to criminal convictions and offences or related security measures pursuant to Article 5(1) may be carried out only if authorised by Union law~~, which may include internal rules,~~ providing the appropriate specific safeguards for the rights and freedoms of data subjects.

Amendment 129 #

Proposal for a regulation
Article 11 – paragraph 1

Amendment 130 #

Proposal for a regulation
Article 14 – paragraph 1

1. The controller shall take appropriate measures to provide any information referred to in Articles 15 and 16 and any communication under Articles 17 to 24 and 38 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language~~, in particular for any information addressed specifically to a child~~. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.

Amendment 131 #

Proposal for a regulation
Article 14 – paragraph 5 – subparagraph 1

Information provided under Articles 15 and 16 and any communication and any actions taken under Articles 17 to 24 and 38 shall be provided free of charge. ~~Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may refuse to act on the request.~~

Amendment 132 #

Proposal for a regulation
Article 14 – paragraph 8

8. ~~If t~~The Commission shall be empowered to adopts delegated acts pursuant to Article 12(8) of Regulation (EU) 2016/679 determining the information to be presented by the icons and the procedures for providing standardised icons, Union institutions and bodies shall, where appropriate, provide the information pursuant to Articles 15 and 16 in combination with such standardised icons.

Amendment 133 #

Proposal for a regulation
Article 16 – paragraph 5 – point b

(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interest, including making the information publicly available;

Amendment 134 #

Proposal for a regulation
Article 16 – paragraph 5 – point c

(c) obtaining or disclosure is expressly laid down by Union law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interest; or

Amendment 135 #

Proposal for a regulation
Article 16 – paragraph 5 – point d

(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union law, including a statutory obligation of secrecy.

Amendment 136 #

Proposal for a regulation
Article 20 – paragraph 1 – point b

(b) the processing is unlawful and the data subject opposes their erasure of the personal data and requests the restriction of their use instead;

Amendment 137 #

Proposal for a regulation
Article 25 – paragraph 1 – introductory part

1. Legal acts adopted on the basis of the Treaties ~~or, in matters relating to the operation of the Union institutions and bodies, internal rules laid down by the latter~~ may restrict the application of Articles 14 to 22, 34 and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, when such a restriction respects the ~~essence of the~~ fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

Amendment 138 #

Proposal for a regulation
Article 25 – paragraph 1 – introductory part

1. Legal acts adopted on the basis of the Treaties ~~or, in matters relating to the operation of the Union institutions and bodies, internal rules laid down by the latter~~, which should be clear and precise and their application should be foreseeable to persons subject to it, may restrict the application of Articles 14 to 22~~, 34~~ and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

Amendment 139 #

Proposal for a regulation
Article 25 – paragraph 1 – point a

(a) the national security, public security or defence ~~of the Member States~~;

Amendment 140 #

Proposal for a regulation
Article 25 – paragraph 1 – point d

(d) the internal security of Union institutions and bodies, including of their servers, IT and electronic communication networks;

Amendment 141 #

Proposal for a regulation
Article 25 – paragraph 1 a (new)

1a. In particular, any legal act or internal rule referred to in paragraph 1 shall contain specific provisions, where relevant, as to : (a) the purposes of the processing or categories of processing; (b) the categories of personal data; (c) the scope of the restrictions introduced; (d) the safeguards to prevent abuse or unlawful access or transfer; (e) the specifications of the controller or categories of controllers; (f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; (g) the risks to the rights and freedoms of data subjects; and (h) the rights of the data subject to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

Amendment 142 #

Proposal for a regulation
Article 25 – paragraph 2

2. Where a restriction is not provided for by a legal act adopted on the basis of the Treaties or by an internal rule in accordance with paragraph 1, the Union institutions and bodies may restrict the application of Articles 14 to 22, 34 and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, if such a restriction respects the essence of the fundamental rights and freedoms, in relation to a specific processing operation, and is a necessary and proportionate measure in a democratic society to safeguard one or more of the objectives referred to in paragraph 1. The restriction shall be notified to the competent data protection officer.deleted

Amendment 143 #

Proposal for a regulation
Article 25 – paragraph 2

Amendment 144 #

Proposal for a regulation
Article 25 – paragraph 2

Amendment 145 #

Proposal for a regulation
Article 25 – paragraph 2

2. Where a restriction is not provided for by a legal act adopted on the basis of the Treaties ~~or by an internal rule in accordance with paragraph 1,~~ the Union institutions and bodies may restrict the application of Articles 14 to 22, 34 and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, if such a restriction respects the essence of the fundamental rights and freedoms, in relation to a specific processing operation, and is a necessary and proportionate measure in a democratic society to safeguard one or more of the objectives referred to in paragraph 1. The restriction shall be notified to the competent data protection officer.

Amendment 146 #

Proposal for a regulation
Article 25 – paragraph 3

3. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union law~~, which may include internal rules,~~ may provide for derogations from the rights referred to in Articles 17, 18, 20 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

Amendment 147 #

Proposal for a regulation
Article 25 – paragraph 3

3. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union law, which may include internal rules, adopted by Union institutions and bodies in matters relating to their operation, may provide for derogations from the rights referred to in Articles 17, 18, 20 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

Amendment 148 #

Proposal for a regulation
Article 25 – paragraph 4

4. Where personal data are processed for archiving purposes in the public interest, Union law, which may include internal rules adopted by Union institutions and bodies in matters relating to their operation, may provide for derogations from the rights referred to in Articles 17, 18, 20, 21, 22 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

Amendment 149 #

Proposal for a regulation
Article 25 – paragraph 4

4. Where personal data are processed for archiving purposes in the public interest, Union law~~, which may include internal rules,~~ may provide for derogations from the rights referred to in Articles 17, 18, 20, 21, 22 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

Amendment 150 #

Proposal for a regulation
Article 25 – paragraph 5

~~5. Internal rules referred to in paragraphs 1, 3 and 4 shall be sufficiently clear and precise and subject to appropriate publication.~~deleted

Amendment 151 #

Proposal for a regulation
Article 25 – paragraph 5

~~5. Internal rules referred to in paragraphs 1, 3 and 4 shall be sufficiently clear and precise and subject to appropriate publication.~~deleted

Amendment 152 #

Proposal for a regulation
Article 25 – paragraph 5

5. Internal rules referred to in paragraphs 1, 3 and 4 shall be ~~sufficiently clear and precise and subject to appropriate publicat~~clear and precise acts of general application, intended to produce legal effects vis-a-vis data subjects, adopted at the highest level of management of the Union institutions and bodies and subject to publication in the Official Journal of the European Union.

Amendment 153 #

Proposal for a regulation
Article 28 – paragraph 1

1. Where a Union institution or body together with one or more controllers, ~~which may be Union institutions or bodies or not,~~ jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the~~ir data protection oblig~~ obligations under this Regulations, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 15 and 16, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.

Amendment 154 #

Proposal for a regulation
Article 31 – paragraph 1 – point d

(d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in ~~Member States,~~ third countries or international organisations;

Amendment 155 #

Proposal for a regulation
Article 31 – paragraph 5

~~5. Union institutions and bodies may decide to keep their records of processing activities in a central register. In this case, they may also decide to make the register publicly accessible.~~deleted

Amendment 156 #

Proposal for a regulation
Article 31 – paragraph 5

5. Union institutions and bodies ~~may~~shall decide to keep their records of processing activities in a central register. In this case, they ~~may~~shall also decide to make the register publicly accessible.

Amendment 157 #

Proposal for a regulation
Article 33 a (new)

Article 33 a Adherence to an approved code of conduct as pursuant to article 42 of Regulation (EU) 2016/679 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 and 2 of this Article.

Amendment 158 #

Proposal for a regulation
Article 34 – title

Confidentiality of electronic communications data

Amendment 159 #

Proposal for a regulation
Article 34 – paragraph 1

Union institutions and bodies shall ensure the confidentiality of electronic communications, ~~in particular~~ by securing their electronic communication networks.

Amendment 160 #

Proposal for a regulation
Article 34 – paragraph 1

Union institutions and bodies shall ensure the confidentiality of electronic communications data, in particular by securing their electronic communication networks.

Amendment 161 #

Proposal for a regulation
Article 35 – paragraph 1

Union institutions and bodies shall protect the information related to ~~end–~~users’ terminal equipment accessing their publicly available websites and mobile applications in accordance with Regulation (EU) XX/XXXX [new ePrivacy Regulation], in particular Article 8 thereof.

Amendment 162 #

Proposal for a regulation
Article 36 – paragraph 2

2. Union institutions and bodies shall take all the necessary measures to prevent personal data contained in those directories, regardless of whether they are accessible to the public or not, from being used for direct marketing purposes.deleted

Amendment 163 #

Proposal for a regulation
Article 39

~~[...]~~deleted

Amendment 164 #

Proposal for a regulation
Article 40 – paragraph 1

1. The controller shall consult the European Data Protection Supervisor prior to processing where a data protection impact assessment under Article 39 indicates that the processing would~~, in the absence of safeguards, security measures and mechanisms to mitigate the risk,~~ result in a high risk toin the rights and freedoms of natural persons and the controller is of the opinion that the risk cannot be mitigated by reasonable means in terms of available technologies and costs of implementation. The controller shall seek the advice of the data protection officer about the need for prior consultationabsence of measures taken by the controller to mitigate the risk.

Amendment 165 #

4. The Commission may, by means of implementing act, determine a list of cases in which the controllers shall consult with, and obtain prior authorisation from, the European Data Protection Supervisor in relation to processing for the performance of a task carried out by the controller in the public interest~~, including the processing of such data in relation to social protection and public health~~.

Amendment 166 #

Proposal for a regulation
Article 41 – paragraph 1

The Union institutions and bodies shall inform the European Data Protection Supervisor when drawing up administrative measures ~~and internal rules~~ relating to the processing of personal data involving a Union institution or body alone or jointly with others.

Amendment 167 #

Proposal for a regulation
Article 41 – paragraph 1

Amendment 168 #

Proposal for a regulation
Article 41 – paragraph 1 a (new)

The Union institutions and bodies shall consult the European Data Protection Supervisor when drawing up the internal rules referred to in Article 25(5).

Amendment 169 #

Proposal for a regulation
Article 42

~~1. Following the adoption of proposals for a legislative act and of recommendations or proposals to the Council pursuant to Article 218 TFEU and when preparing~~Article 42 delegated acts or implementing acts, which have an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission shall consult the European Data Protection Supervisor. 2. Where an act referred to in paragraph 1 is of particular importance for the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission may also consult the European Data Protection Board. In such cases the European Data Protection Supervisor and the European Data Protection Board shall coordinate their work with a view to issue a joint opinion. 3. The advice referred to in paragraphs 1 and 2 shall be provided in writing within a period of up to eight weeks of receipt of the request for consultation referred to in paragraphs 1 and 2. In urgent cases, or otherwise appropriate, the Commission may shorten the deadline. 4. This Article shall not apply where the Commission is required, pursuant to Regulation (EU) 2016/679, to consult the European Data Protection Board.Legislative consultation

Amendment 170 #

Proposal for a regulation
Article 42 – paragraph 1

1. ~~Following the adoption of proposals for a~~In the course of the legislative ~~act~~process and of recommendations or proposals to the Council pursuant to Article 218 TFEU and when preparing delegated acts or implementing acts~~, which have an impact on~~ relating to the protection of ~~individuals’~~natural persons' rights and freedoms with regard to ~~the~~ processing ~~of personal data~~, the Commission shall consult the European Data Protection Supervisor.

Amendment 171 #

Proposal for a regulation
Article 42 – paragraph 2

2. Where an act referred to in paragraph 1 is of particular importance for the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission ~~may~~shall also consult the European Data Protection Board. In such cases the European Data Protection Supervisor and the European Data Protection Board shall coordinate their work with a view to issue a joint opinion.

Amendment 172 #

Proposal for a regulation
Article 43 – paragraph 1

Where the European Data Protection Supervisor exercises the powers provided for in points (a), (b) and (c) of Article 59(2), the controller or processor concerned shall inform the European Data Protection Supervisor of its views ~~within a reasonable period to be specified by the European Data Protection Supervisor~~, taking into account the circumstances of each case. The reply shall also include a description of the measures taken, if any, in response to the remarks of the European Data Protection Supervisor.

Amendment 173 #

Proposal for a regulation
Article 44 – paragraph 2

2. Union institutions and bodies may designate a single data protection officer for several of them, taking into account their organisational structure and size of the Union institutions and bodies.

Amendment 174 #

Proposal for a regulation
Article 44 – paragraph 4

4. The data protection officer may be a staff member of the Union institution or body, or, taking into account the organisational structure and size of the Union institution or body, fulfil the tasks on the basis of a service contract.

Amendment 175 #

Proposal for a regulation
Article 44 – paragraph 4

4. The data protection officer may be a staff member of the Union institution or body~~, or fulfil the tasks on the basis of a service contract~~.

Amendment 176 #

Proposal for a regulation
Article 45 – paragraph 5

5. The data protection officer ~~and his or her staff~~ shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union law.

Amendment 177 #

Proposal for a regulation
Article 45 – paragraph 8

8. The data protection officer shall be designated for a term of ~~three to~~ five years and shall be eligible for reappointment. The data protection officer may be dismissed from the post by the Union institution or body which designated him or her ~~only with the consent of the European Data Protection Supervisor~~, if he or she no longer fulfils the conditions required for the performance of his or her duties.

Amendment 178 #

(b) ~~ensure in an independent manner the internal application of this Regulation and~~ to monitor compliance with this Regulation, with other applicable Union law ~~containing~~ data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, ~~the raising of~~ awareness-raising and training of staff involved in processing operations, and the related audits;

Amendment 179 #

Proposal for a regulation
Article 46 – paragraph 1 – point f

(f) provide advice where requested as regards the need for prior consultation of the European Data Protection Supervisor pursuant to Article 40 and to consult the European Data Protection Supervisor in case of doubt as to the need for a prior consultation;deleted

Amendment 180 #

Proposal for a regulation
Article 46 – paragraph 1 – point g

(g) respond to requests from the European Data Protection Supervisor and, ~~within the sphere of his or her competence,~~ to cooperate and consult with the European Data Protection Supervisor ~~at the latter's request or on his or her own initiative~~.

Amendment 181 #

Proposal for a regulation
Article 46 – paragraph 1 – point g a (new)

(ga) Ensure that the rights and freedoms of the data subjects are unlikely to be adversely affected by the processing operations.

Amendment 182 #

Proposal for a regulation
Article 46 – paragraph 2

2. The data protection officer may make recommendations for the practical improvement of data protection to the controller and the processor and advise them on matters concerning the application of data protection provisions. Furthermore he or she may, on his or her own initiative or at the request of the controller or the processor, the Staff Committee concerned or any individual, investigate matters and occurrences directly relating to his or her tasks and which come to his or her notice, and report back to the person who commissioned the investigation or to the controller or the processor.

Amendment 183 #

Proposal for a regulation
Article 48 – paragraph 1

1. A transfer of personal data to a third country or international organisation may take place where the Commission has decided pursuant to Article 45(3) of Regulation (EU) 2016/679 or to Article 36 of Directive (EU) 2016/680 that an adequate level of protection is ensured in the third country, a territory or one or more specified sectors within that third country, or within the international organisation and the personal data are transferred solely to allow tasks covered by the competence of the controller to be carried out.

Amendment 184 #

Proposal for a regulation
Article 48 – paragraph 1

1. A transfer of personal data to a third country or international organisation may take place where the Commission has decided pursuant to Article 45(3) of Regulation (EU) 2016/679 that an adequate level of protection is ensured in the third country, a territory or one or more specified sectors within that third country, or within the international organisation ~~and the personal data are transferred solely to allow tasks covered by the competence of the controller to be carried out~~. Such a transfer shall not require any specific authorisation.

Amendment 185 #

Proposal for a regulation
Article 48 – paragraph 2

2. The Union institutions and bodies shall inform the Commission ~~and the European Data Protection Supervisor~~ of cases where they consider the third country or international organisation in question does not ensure an adequate level of protection within the meaning of paragraph 1.

Amendment 186 #

Proposal for a regulation
Article 49 – paragraph 5

5. Authorisations by the European Data Protection Supervisor on the basis of Article 9(7) of Regulation (EC) No 45/2001 shall remain valid until amended, replaced or repealed~~, if necessary, by the European Data Protection Supervisor~~.

Amendment 187 #

Proposal for a regulation
Chapter 5 a (new)

PROCESSING OF OPERATIONAL PERSONAL DATA

Amendment 188 #

Proposal for a regulation
Article 52 a (new)

Article 52 a Scope By way of derogation from Articles 4, 6, 7, 8, 10, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 35, 41, 43, 49, 50 and 51, the provisions of this Chapter shall apply to processing of operational data by Union agencies established on the basis of Chapters 4 and 5 of Title V of Part Three of the TFEU and by missions referred to in Article 42(1), 43 and 44 of the TEU.

Amendment 189 #

Proposal for a regulation
Article 52 b (new)

Article 52 b Principles relating to processing of personal data Personal data shall be: (a) processed lawfully and fairly ('lawfulness and fairness'); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes provided that the Union agencies and missions provide appropriate safeguards for the rights and freedoms of data subjects ('purpose limitation'); (c) adequate, relevant, and not excessive in relation to the purposes for which they are processed ('data minimisation'); (d) accurate and kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy'); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes provided that the agencies or missions provide appropriate safeguards for the rights and freedoms of data subjects, in particular by the implementation of the appropriate technical and organisational measures required by this Regulation ('storage limitation'); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality').

Amendment 190 #

Proposal for a regulation
Article 52 c (new)

Article 52 c Lawfulness of processing 1. Processing shall be lawful only if and to the extent that processing is necessary for the performance of a task carried out by Union agencies and missions and that it is based on Union law. 2. Union law specifying and complementing this Regulation as regards the processing within the scope of this Chapter shall specify the objectives of processing, the personal data to be processed and the purposes of the processing.

Amendment 191 #

Proposal for a regulation
Article 52 d (new)

Article 52 d Distinction between different categories of data subjects Union agencies or missions shall make a clear distinction between personal data of different categories of data subjects, such as: (a) persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence; (b) persons convicted of a criminal offence; (c) victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that they could be the victim of a criminal offence; and (d) other parties to a criminal offence, such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings, persons who can provide information on criminal offences, or contacts or associates of one of the persons referred to in points (a) and (b).

Amendment 192 #

Proposal for a regulation
Article 52 e (new)

Article 52 e Distinction between personal data and verification of quality of personal data 1. Union agencies and missions shall distinguish personal data based on facts from personal data based on personal assessments. 2. Union agencies and missions shall process personal data in such a way that it can be established which authority provided the data or where the data has been retrieved from. 3. Union agencies and missions shall ensure that personal data which are inaccurate, incomplete or no longer up to date are not transmitted or made available. To that end, Union agencies and missions shall verify the quality of personal data before they are transmitted or made available. As far as possible, in all transmissions of personal data, Union agencies and missions shall add necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of personal data, and the extent to which they are up to date shall be added. 4. If it emerges that incorrect personal data have been transmitted or personal data have been unlawfully transmitted, the recipient shall be notified without delay. In such a case, the personal data shall be rectified or erased or processing shall be restricted.

Amendment 193 #

Proposal for a regulation
Article 52 f (new)

Article 52 f Specific processing conditions 1. When Union agencies and missions provide for specific conditions for processing, they shall inform the recipient of such personal data of those conditions and the requirement to comply with them. 2. Union agencies and missions shall comply with specific processing conditions for processing provided by a national authority in accordance with Article 9 (3) and (4) of Directive (EU) 2016/680.

Amendment 194 #

Proposal for a regulation
Article 52 g (new)

Article 52 g Transmission of personal data to other Union institutions and bodies 1. Union agencies and missions shall only transmit personal data to other Union institutions and bodies if the data are necessary for the legitimate performance of tasks covered by the competence of other Union institutions and bodies. 2. Where personal data are transmitted following a request from the other Union institution or body, both the controller and the recipient shall bear the responsibility for the legitimacy of this transfer. 3. Union agencies and missions shall be required to verify the competence of the other Union institution or body and to make a provisional evaluation of the necessity for the transmission. If doubts arise as to this necessity, Union agencies and missions shall seek further information from the recipient. 4. Other Union institutions and bodies shall ensure that the necessity for the transmission can be subsequently verified. 5. Other Union institutions and bodies shall process the personal data only for the purposes for which they were transmitted.

Amendment 195 #

Proposal for a regulation
Article 52 h (new)

Article 52 h Processing of special categories of personal data 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, personal data concerning health or personal data concerning a natural person's sex life or sexual orientation shall be allowed only where strictly necessary for the performance of tasks of Union agencies and missions, subject to appropriate safeguards for the rights and freedoms of the data subject and only if they supplement other operational personal data already processed by Union agencies and missions. 2. The data protection officer shall be informed immediately of recourse to this Article.

Amendment 196 #

Proposal for a regulation
Article 52 i (new)

Article 52 i Automated individual decision-making, including profiling The data subject shall have the right not to be subject to a decision of Union agencies and missions based solely on automated processing, including profiling, which produces legal effects concerning him/her or similarly significantly affects him/her.

Amendment 197 #

Proposal for a regulation
Article 52 j (new)

Article 52 j Information to be made available or given to the data subject 1. Union agencies and missions shall make available to the data subject at least the following information: (a) the identity and the contact details of the Union agency or mission; (b) the contact details of the data protection officer; (c) the purposes of the processing for which the personal data are intended; (d) the right to lodge a complaint with the European Data Protection Supervisor and its contact details; (e) the existence of the right to request from Union agencies and missions access to and rectification or erasure of personal data and restriction of processing of the personal data concerning the data subject. 2. In addition to the information referred to in paragraph 1, Union agencies and missions shall give to the data subject, in specific cases, the following further information to enable the exercise of his or her rights: (a) the legal basis for the processing; (b) the period for which the personal data will be stored, or, where that is not possible, the criteria used to determine that period; (c) the categories of recipients of the personal data, including in third countries or international organisations; (d) where necessary, further information, in particular where the personal data are collected without the knowledge of the data subject. 3. Union agencies and missions may delay, restrict or omit the provision of the information to the data subject pursuant to paragraph 2 to the extent that, and for as long as, such a measure is provided for by a legal act adopted on the basis of the Treaties and constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned, in order to: (a) avoid obstructing official or legal inquiries, investigations or procedures; (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties; (c) protect public security of the Member States; (d) protect national security of the Member States; (e) protect the rights and freedoms of others.

Amendment 198 #

Proposal for a regulation
Article 52 k (new)

Article 52 k Right of access by the data subject The data subject shall have the right to obtain from Union agencies and missions confirmation as to whether or not personal data concerning that subject are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of and legal basis for the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from Union agencies and missions rectification or erasure of personal data or restriction of processing of personal data concerning the data subject; (f) the right to lodge a complaint with the European Data Protection Supervisor and his or her contact details; (g) communication of the personal data undergoing processing and of any available information as to their origin.

Amendment 199 #

Proposal for a regulation
Article 52 l (new)

Article 52 l Limitations to the right of access 1. Union agencies and missions may restrict, wholly or partly, the data subject's right of access to the extent that, and for as long as, such a partial or complete restriction is provided for by a legal act adopted on the basis of the Treaties and constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned, in order to: (a) avoid obstructing official or legal inquiries, investigations or procedures; (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties; (c) protect public security of the Member States; (d) protect national security of the Member States; (e) protect the rights and freedoms of others. 2. In the cases referred to in paragraph 1, Union agencies and missions shall inform the data subject, without undue delay, in writing of any refusal or restriction of access and of the reasons for the refusal or the restriction. Such information may be omitted where the provision thereof would undermine a purpose under paragraph 1. Union agencies and missions shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or seeking a judicial remedy in the Court of Justice of the European Union. 3. Union agencies and missions shall document the factual or legal reasons on which the decision is based. That information shall be made available to the European Data Protection Supervisor on request.

Amendment 200 #

Proposal for a regulation
Article 52 m (new)

Article 52 m Right to rectification or erasure of personal data and restriction of processing 1. The data subject shall have the right to obtain from Union agencies and missions without undue delay the rectification of inaccurate personal data relating to that subject. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. 2. Union agencies and missions shall erase personal data without undue delay and the data subject shall have the right to obtain from Union agencies and missions the erasure of personal data concerning that subject without undue delay where processing infringes Articles 52b, 52c or 52h, or where personal data must be erased in order to comply with a legal obligation to which Union agencies and missions are subject. 3. Instead of erasure, Union agencies and missions shall restrict processing where: (a) the accuracy of the personal data is contested by the data subject and their accuracy or inaccuracy cannot be ascertained; or (b) the personal data must be maintained for the purposes of evidence. Where processing is restricted pursuant to point (a) of the first subparagraph, Union agencies and missions shall inform the data subject before lifting the restriction of processing. Restricted data shall be processed only for the purpose that prevented their erasure. 4. Union agencies and missions shall inform the data subject in writing of any refusal of rectification or erasure of personal data or restrict processing and of the reasons for the refusal. Union agencies and missions may restrict, wholly or partly, the obligation to provide such information to the extent that such a restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned in order to: (a) avoid obstructing official or legal inquiries, investigations or procedures; (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties; (c) protect public security of the Member States; (d) protect national security of the Member States; (e) protect the rights and freedoms of others. 5. Union agencies and missions shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or seeking a judicial remedy from the Court of Justice of the European Union. 6. Union agencies and missions shall communicate the rectification of inaccurate personal data to the competent authority from which the inaccurate personal data originate. 7. Union agencies and missions shall, where personal data has been rectified or erased or processing has been restricted pursuant to paragraphs 1, 2 and 3, notify the recipients and inform them that they have to rectify or erase the personal data or restrict processing of the personal data under their responsibility.

Amendment 201 #

Proposal for a regulation
Article 52 n (new)

Article 52 n Exercise of rights by the data subject and verification by the European Data Protection Supervisor 1. In the cases referred to in Articles 52i(3) , 52k and 52m(4), the rights of the data subject may also be exercised through the European Data Protection Supervisor. 2. Union agencies and missions shall inform the data subject of the possibility of exercising his or her rights through the European Data Protection Supervisor pursuant to paragraph 1. 3. Where the right referred to in paragraph 1 is exercised, the European Data Protection Supervisor shall at least inform the data subject that all necessary verifications or a review by it have taken place. The European Data Protection Supervisor shall also inform the data subject of his or her right to seek a judicial remedy in the Court of Justice of the European Union.

Amendment 202 #

Proposal for a regulation
Article 52 o (new)

Article 52 o Logging 1. Union agencies and missions shall keep logs for any of the following processing operations in automated processing systems: collection, alteration, consultation, disclosure including transfers, combination and erasure. The logs of consultation and disclosure shall make it possible to establish the justification for, and the date and time of, such operations, the identification of the person who consulted or disclosed personal data, and, as far as possible, the identity of the recipients of such personal data. 2. The logs shall be used solely for verification of the lawfulness of processing, self-monitoring, ensuring the integrity and security of the personal data, and for criminal proceedings. Such logs shall be deleted after three years, unless they are required for on-going control. 3. Union agencies or missions shall make the logs available to their data protection officer and to the European Data Protection Supervisor on request.

Amendment 203 #

Proposal for a regulation
Article 52 p (new)

Article 52 p Transfers subject to appropriate safeguards 1. In the absence of an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 or Article 36 of Directive (EU) 2016/680, Union agencies and missions may transfer personal data to a third country or an international organisation where: (a) appropriate safeguards with regard to the protection of personal data are provided for in a legally binding instrument; or (b) Union agencies and missions have assessed all the circumstances surrounding the transfer of personal data and conclude that appropriate safeguards exist with regard to the protection of personal data. 2. Union agencies and missions shall seek authorisation from the European Data Protection Supervisor when transferring personal data under point (b) of paragraph 1. 3. When a transfer is based on point (b) of paragraph 1, such a transfer shall be documented and the documentation shall be made available to the European Data Protection Supervisor on request, including the date and time of the transfer, information about the receiving competent authority, the justification for the transfer and the personal data transferred.

Amendment 204 #

Proposal for a regulation
Article 52 q (new)

Article 52 q Derogations for specific situations 1. In the absence of an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 or Article 36 of Directive (EU) 2016/680, or of appropriate safeguards pursuant to Article 52p, Union agencies and missions may, on a case-by-case basis, transfer personal data to a third country or an international organisation only on the condition that the transfer is proportionate and necessary: (a) in order to protect the vital interests of the data subject or another person; (b) to safeguard legitimate interests of the data subject; (c) for the prevention of an immediate and serious threat to public security of a Member State or a third country; or (d) in individual cases for the performance of the tasks of Union agencies and missions, unless they determine that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer. 2. Union agencies shall seek authorisation from the European Data Protection Supervisor when transferring personal data under point (b) of paragraph 1. 3. Where a transfer is based on paragraph 1, such a transfer shall be documented and the documentation shall be made available to the European Data Protection Supervisor on request, including the date and time of the transfer, and information about the receiving competent authority, about the justification for the transfer and about the personal data transferred.

Amendment 205 #

Proposal for a regulation
Chapter 5 a (new)

CHAPTER Va PROCESSING OF OPERATIONAL PERSONAL DATA Article 52a Scope By way of derogation from Articles 4, 6, 7, 8, 10, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 35, 41, 43, 49, 50 and 51, the provisions of this Chapter shall apply to processing of operational data by Union agencies established on the basis of Chapters 4 and 5 of Title V of Part Three of the TFEU and by missions referred to in Article 42(1), 43 and 44 of the TEU. Article 52b Principles relating to processing of personal data 1. Personal data shall be: (a) processed lawfully and fairly ('lawfulness and fairness'); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes provided that the Union agencies and missions provide appropriate safeguards for the rights and freedoms of data subjects ('purpose limitation'); (c) adequate, relevant, and not excessive in relation to the purposes for which they are processed ('data minimisation'); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy'); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes provided that the agencies or missions provide appropriate safeguards for the rights and freedoms of data subjects, in particular by the implementation of the appropriate technical and organisational measures required by this Regulation ('storage limitation'); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality'). 2. Processing by Union agencies or missions for any of the purposes of processing personal data laid down in their founding acts other than that for which the personal data are collected shall be permitted in so far as: (a) the Union agencies or missions are authorised to process such personal data for such a purpose in accordance with Union law; and (b) processing is necessary and proportionate to that other purpose in accordance with Union law. Article 52c Lawfulness of processing Processing shall be lawful only if and to the extent that processing is necessary for the performance of a task carried out by Union agencies and missions and that it is based on Union law. Union law specifying and complementing this Regulation as regards the processing within the scope of this Chapter shall specify the objectives of processing, the personal data to be processed and the purposes of the processing. Article 52d Distinction between different categories of data subjects Union agencies or missions shall, where applicable and as far as possible, make a clear distinction between personal data of different categories of data subjects, such as: (a) persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence; (b) persons convicted of a criminal offence; (c) victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that they could be the victim of a criminal offence; and (d) other parties to a criminal offence, such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings, persons who can provide information on criminal offences, or contacts or associates of one of the persons referred to in points (a) and (b). Article 52e Distinction between personal data and verification of quality of personal data Union agencies and missions shall distinguish, as far as possible, personal data based on facts from personal data based on personal assessments. Union agencies and missions shall process personal data in such a way that it can be established which authority provided the data or where the data has been retrieved from. Union agencies and missions shall take all reasonable steps to ensure that personal data which are inaccurate, incomplete or no longer up to date are not transmitted or made available. To that end, Union agencies and missions shall, as far as practicable, verify the quality of personal data before they are transmitted or made available. As far as possible, in all transmissions of personal data, Union agencies and missions shall add necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of personal data, and the extent to which they are up to date shall be added. If it emerges that incorrect personal data have been transmitted or personal data have been unlawfully transmitted, the recipient shall be notified without delay. In such a case, the personal data shall be rectified or erased or processing shall be restricted. Article 52f Specific processing conditions When Union agencies and missions provide for specific conditions for processing, they shall inform the recipient of such personal data of those conditions and the requirement to comply with them. Union agencies and missions shall comply with specific processing conditions for processing provided by a national authority in accordance with Article 9 (3) and (4) of Directive (EU) 2016/680. Article 52g Transmission of personal data to other Union institutions and bodies Union agencies and missions shall only transmit personal data to other Union institutions and bodies if the data are necessary for the legitimate performance of tasks covered by the competence of other Union institutions and bodies. Where personal data are transmitted following a request from the other Union institution or body, both the controller and the recipient shall bear the responsibility for the legitimacy of this transfer. Union agencies and missions shall be required to verify the competence of the other Union institution or body and to make a provisional evaluation of the necessity for the transmission. If doubts arise as to this necessity, Union agencies and missions shall seek further information from the recipient. Other Union institutions and bodies shall ensure that the necessity for the transmission can be subsequently verified. Other Union institutions and bodies shall process the personal data only for the purposes for which they were transmitted. Article 52h Processing of special categories of personal data Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, personal data concerning health or personal data concerning a natural person's sex life or sexual orientation shall be allowed only where strictly necessary for the performance of tasks of Union agencies and missions, subject to appropriate safeguards for the rights and freedoms of the data subject and only if they supplement other operational personal data already processed by Union agencies and missions. The data protection officer shall be informed immediately of recourse to this Article. Article 52i Automated individual decision-making, including profiling The data subject shall have the right not to be subject to a decision of Union agencies and missions based solely on automated processing, including profiling, which produces legal effects concerning him/her or similarly significantly affects him/her. Article 52j Information to be made available or given to the data subject 1. Union agencies and missions shall make available to the data subject at least the following information: (a) the identity and the contact details of the Union agency or mission; (b) the contact details of the data protection officer; (c) the purposes of the processing for which the personal data are intended; (d) the right to lodge a complaint with the European Data Protection Supervisor and its contact details; (e) the existence of the right to request from Union agencies and missions access to and rectification or erasure of personal data and restriction of processing of the personal data concerning the data subject. 2. In addition to the information referred to in paragraph 1, Union agencies and missions shall give to the data subject, in specific cases, the following further information to enable the exercise of his or her rights: (a) the legal basis for the processing; (b) the period for which the personal data will be stored, or, where that is not possible, the criteria used to determine that period; (c) where applicable, the categories of recipients of the personal data, including in third countries or international organisations; (d) where necessary, further information, in particular where the personal data are collected without the knowledge of the data subject. 3. Union agencies and missions may delay, restrict or omit the provision of the information to the data subject pursuant to paragraph 2 to the extent that, and for as long as, such a measure is provided for by a legal act adopted on the basis of the Treaties or by an internal rule of the Union agency or mission and constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned, in order to: (a) avoid obstructing official or legal inquiries, investigations or procedures; (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties; (c) protect public security of the Member States; (d) protect national security of the Member States; (e) protect the objectives of the common foreign and security policy of the Union; (f) protect the rights and freedoms of others. Article 52k Right of access by the data subject The data subject shall have the right to obtain from Union agencies and missions confirmation as to whether or not personal data concerning that subject are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of and legal basis for the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from Union agencies and missions rectification or erasure of personal data or restriction of processing of personal data concerning the data subject; (f) the right to lodge a complaint with the European Data Protection Supervisor and his or her contact details; (g) communication of the personal data undergoing processing and of any available information as to their origin. Article 52l Limitations to the right of access 1. Union agencies and missions may restrict, wholly or partly, the data subject's right of access to the extent that, and for as long as, such a partial or complete restriction is provided for by a legal act adopted on the basis of the Treaties or by an internal rule of the Union agency or mission and constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned, in order to: (a) avoid obstructing official or legal inquiries, investigations or procedures; (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties; (c) protect public security of the Member States; (d) protect national security of the Member States; (e) protect the objectives of the common foreign and security policy of the Union; (f) protect the rights and freedoms of others. 2. In the cases referred to in paragraph 1, Union agencies and missions shall inform the data subject, without undue delay, in writing of any refusal or restriction of access and of the reasons for the refusal or the restriction. Such information may be omitted where the provision thereof would undermine a purpose under paragraph 1. Union agencies and missions shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or seeking a judicial remedy in the Court of Justice of the European Union. Union agencies and missions shall document the factual or legal reasons on which the decision is based. That information shall be made available to the European Data Protection Supervisor on request. Article 52m Right to rectification or erasure of personal data and restriction of processing 1. The data subject shall have the right to obtain from Union agencies and missions without undue delay the rectification of inaccurate personal data relating to that subject. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Union agencies and missions shall erase personal data without undue delay and the data subject shall have the right to obtain from Union agencies and missions the erasure of personal data concerning that subject without undue delay where processing infringes Articles 52b, 52c or 52h, or where personal data must be erased in order to comply with a legal obligation to which Union agencies and missions are subject. Instead of erasure, Union agencies and missions shall restrict processing where: (a) the accuracy of the personal data is contested by the data subject and their accuracy or inaccuracy cannot be ascertained; or (b) the personal data must be maintained for the purposes of evidence. 2. Where processing is restricted pursuant to point (a) of the first subparagraph, Union agencies and missions shall inform the data subject before lifting the restriction of processing. 3. Union agencies and missions shall inform the data subject in writing of any refusal of rectification or erasure of personal data or restrict processing and of the reasons for the refusal. Union agencies and missions may restrict, wholly or partly, the obligation to provide such information to the extent that such a restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned in order to: (a) avoid obstructing official or legal inquiries, investigations or procedures; (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties; (c) protect public security of the Member States; (d) protect national security of the Member States; (e) protect the objectives of the common foreign and security policy of the Union; (f) protect the rights and freedoms of others. 4. Union agencies and missions shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or seeking a judicial remedy from the Court of Justice of the European Union. 5. Union agencies and missions shall communicate the rectification of inaccurate personal data to the competent authority from which the inaccurate personal data originate. Union agencies and missions shall, where personal data has been rectified or erased or processing has been restricted pursuant to paragraphs 1, 2 and 3, notify the recipients and inform them that they have to rectify or erase the personal data or restrict processing of the personal data under their responsibility. Article 52n Exercise of rights by the data subject and verification by the European Data Protection Supervisor In the cases referred to in Articles 52i(3) , 52k and 52m(4), the rights of the data subject may also be exercised through the European Data Protection Supervisor. Union agencies and missions shall inform the data subject of the possibility of exercising his or her rights through the European Data Protection Supervisor pursuant to paragraph 1.Where the right referred to in paragraph 1 is exercised, the European Data Protection Supervisor shall at least inform the data subject that all necessary verifications or a review by it have taken place. The European Data Protection Supervisor shall also inform the data subject of his or her right to seek a judicial remedy in the Court of Justice of the European Union. Article 52o Logging Union agencies and missions shall keep logs for any of the following processing operations in automated processing systems: collection, alteration, consultation, disclosure including transfers, combination and erasure. The logs of consultation and disclosure shall make it possible to establish the justification for, and the date and time of, such operations, the identification of the person who consulted or disclosed personal data, and, as far as possible, the identity of the recipients of such personal data. The logs shall be used solely for verification of the lawfulness of processing, self-monitoring, ensuring the integrity and security of the personal data, and for criminal proceedings. Such logs shall be deleted after three years, unless they are required for on-going control. Union agencies or missions shall make the logs available to the European Data Protection Supervisor on request. Article 52p Transfers subject to appropriate safeguards 1. In the absence of an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 or Article 36 of Directive (EU) 2016/680, Union agencies and missions may transfer personal data to a third country or an international organisation where: (a) appropriate safeguards with regard to the protection of personal data are provided for in a legally binding instrument; or (b) Union agencies and missions have assessed all the circumstances surrounding the transfer of personal data and conclude that appropriate safeguards exist with regard to the protection of personal data. 2. Union agencies and missions shall inform the European Data Protection Supervisor about categories of transfers under point (b) of paragraph 1.When a transfer is based on point (b) of paragraph 1, such a transfer shall be documented and the documentation shall be made available to the European Data Protection Supervisor on request, including the date and time of the transfer, information about the receiving competent authority, the justification for the transfer and the personal data transferred. Article 52q Derogations for specific situations 1. In the absence of an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 or Article 36 of Directive (EU) 2016/680, or of appropriate safeguards pursuant to Article 52p, Union agencies and missions may transfer personal data to a third country or an international organisation only on the condition that the transfer is necessary: (a) in order to protect the vital interests of the data subject or another person; (b) to safeguard legitimate interests of the data subject; (c) for the prevention of an immediate and serious threat to public security of a Member State or a third country; or (d) in individual cases for the performance of the tasks of Union agencies and missions, unless they determine that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer. 2. Where a transfer is based on paragraph 1, such a transfer shall be documented and the documentation shall be made available to the European Data Protection Supervisor on request, including the date and time of the transfer, and information about the receiving competent authority, about the justification for the transfer and about the personal data transferred.

Amendment 206 #

Proposal for a regulation
Article 53 – paragraph 3

3. The European Data Protection Supervisor shall be responsible for monitoring and ensuring the application of the provisions of this Regulation and any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body, and for adprovisding suggestions to Union institutions and bodies ~~and data subjects on all~~on matters concerning the processing of personal data. To those ends the European Data Protection Supervisor shall fulfil the tasks provided for in Article 58 and exercise the powers granted in Article 59.

Amendment 207 #

Proposal for a regulation
Article 54 – paragraph 2

2. The list drawn up by the Commission from which the European Data Protection Supervisor shall be chosen shall be made up of persons whose independence is beyond doubt and who are acknowledged as having the experience and skills required to perform the duties of European Data Protection Supervisor~~, for example because they belong or have belonged to the supervisory authorities established under Article 41 of Regulation (EU) 2016/679~~.

Amendment 208 #

Proposal for a regulation
Article 58 – paragraph 1 – point a

(a) monitor and en~~forc~~sure the application of this Regulation ~~and other Union acts relating to the protection of natural persons with regard to the processing of personal data by a Union institution or body, with~~by a Union institution or body, with the exception of the processing of personal data by the Court of Justice of the European Union acting in its judicial capacity and the exception of the processing of operational personal data by ~~the Court of Justice of the European Union acting in its judicial capacity~~Europol, Eurojust and the European Public Prosecutor's Office;

Amendment 209 #

Proposal for a regulation
Article 58 – paragraph 1 – point b

(b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing~~. Activities addressed specifically to children shall receive specific attention~~ of personal data;

Amendment 210 #

Proposal for a regulation
Article 58 – paragraph 1 – point e

(e) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 67, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;

Amendment 211 #

Proposal for a regulation
Article 58 – paragraph 1 – point g

(g) advise all Union institutions and bodies, on ~~legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to~~its own initiative or on request, on measures concerning the processing of personal data;

Amendment 212 #

Proposal for a regulation
Article 58 – paragraph 1 – point h

(h) monitor relevant developments, insofar as they have an impact on the protection of personal data~~, in particular the development of information and communication technologies~~;

Amendment 213 #

Proposal for a regulation
Article 58 – paragraph 1 – point p

~~(p) fulfil any other tasks related to the protection of personal data; an~~deleted

Amendment 214 #

Proposal for a regulation
Article 59 – paragraph 1 – point a

(a) to ~~order~~request from the controller and the processor ~~to provide any~~ information it requires for the performance of its tasks;

Amendment 215 #

Proposal for a regulation
Article 59 – paragraph 1 – point d

(d) to obtain, from the controller and the processor, access to all personal administrative data and ~~to all~~ information necessary for the performance of its tasks, operational personal data shall be excluded from this provision;

Amendment 216 #

Proposal for a regulation
Article 59 – paragraph 1 – point e

(e) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union ~~or Member State procedural~~ law;

Amendment 217 #

Proposal for a regulation
Article 59 – paragraph 2 – point h

(h) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 18, 19 and 20 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 19(2) and Article 21;deleted

Amendment 218 #

Proposal for a regulation
Article 59 – paragraph 2 – point i

(i) to impose an administrative fine pursuant to Article 66, subject to non- compliance by the Union institution or body with one of the measures referred to in this paragraph and depending on the circumstances of each individual case;deleted

Amendment 219 #

Proposal for a regulation
Article 59 – paragraph 2 – point j

~~(j) to order the suspension of data flows to a recipient in a Member State, a third country or to an international organisation.~~deleted

Amendment 220 #

Proposal for a regulation
Article 59 – paragraph 3 – point b a (new)

(ba) to authorise or not the processing operations as referred to in Article 40(4);

Amendment 221 #

Proposal for a regulation
Article 59 – paragraph 3 – point c

(c) to issue, on its own initiative or on request, opinions to the Union institutions and bodies ~~and to the public on any~~ issue related to the protection of personal data;

Amendment 222 #

Proposal for a regulation
Article 61 – title

Cooperation ~~with~~between the European Data Protection Supervisor and national supervisory authorities

Amendment 223 #

Proposal for a regulation
Article 61 – paragraph 1

The European Data Protection Supervisor shall cooperate with supervisory authorities established under Article 41 of Regulation (EU) 2016/679 and Article 51 of Directive (EU) 2016/680 (hereinafter “"national supervisory authorities”") ~~and with the joint supervisory authority established under Article 25 of Council Decision 2009/917/JHA21~~ to the extent necessary for the performance of their respective duties, in particular by providing each other with relevant information, requesting ~~national supervisory authorities~~each other to exercise their powers or responding to ~~a request from such authorities. _________________ 21 Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes, OJ L 323, 10.12.2009, p. 20–30~~each other's requests.

Amendment 224 #

Proposal for a regulation
Article 61 – paragraph 1

The European Data Protection Supervisor shall cooperate with supervisory authorities established under Article 41 of Regulation (EU) 2016/679 and Article 51 of Directive (EU) 2016/680 (hereinafter “national supervisory authorities”) ~~and with the joint supervisory authority established under Article 25 of Council Decision 2009/917/JHA21~~ to the extent necessary for the performance of their respective duties, in particular by providing each other with relevant information, requesting ~~national supervisory authorities~~each other to exercise their powers or responding to ~~a request from such authorities. _________________ 21 Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes, OJ L 323, 10.12.2009, p. 20–30~~each other's requests.

Amendment 225 #

Cornelia ERNST

Proposal for a regulation
Article 61 – paragraph 1

The European Data Protection Supervisor shall cooperate with supervisory authorities established under Article 451 of Regulation (EU) 2016/679 and Article 541 of Directive (EU) 2016/680 (hereinafter “national supervisory authorities”) and with the joint supervisory authority established under Article 25 of Council Decision 2009/917/JHA21 to the extent necessary for the performance of their respective duties, in particular by providing each other with relevant information, requesting national supervisory authorities to exercise their powers or responding to a request from such authorities. _________________ 21 Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes, OJ L 323, 10.12.2009, p. 20–30.

Amendment 226 #

Cornelia ERNST

Proposal for a regulation
Article 61 – paragraph 1 a (new)

The European Data Protection Supervisor and the European Data Protection Board may use the Internal Market Information System established by Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC ('the IMI Regulation') for the purposes of administrative cooperation and information exchange pursuant to Articles 60-62, 64, 65 and 70 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Amendment 227 #

Proposal for a regulation
Article 62 – paragraph 1

1. Where a Union act ~~refers to this Article,~~envisages that the European Data Protection Supervisor s~~hall cooper~~upervises the processing of personal datea a~~ctively with the~~t the Union level and national supervisory authorities, supervise the processing o~~rder to ensure effective supervision of large IT systems or Union agencies~~f personal data at national level in a large IT system or a Union body, office or agency, the European Data Protection Supervisor and the national supervisory authorities, each acting within the scope of their respective competencies, shall cooperate actively in the framework of their responsibilities and shall ensure coordinated supervision.

Amendment 228 #

Proposal for a regulation
Article 62 – paragraph 1

Amendment 229 #

Proposal for a regulation
Article 62 – paragraph 1

1. Where a Union act refers to this Article, the European Data Protection Supervisor shall cooperate ~~actively~~ with the national supervisory authorities, in order to ensure effective supervision of large IT systems or Union bodies and agencies.

Amendment 230 #

Proposal for a regulation
Article 62 – paragraph 2

2. The ~~European Data Protection Supervisor~~y shall, each acting within the scope of its respective competences and in the framework of ~~its~~their responsibilities, exchange relevant information, assist each other in carrying out audits and inspections, examine difficulties of interpretation or application of this Regulation and other applicable Union acts, study problems with the exercise of independent supervision or in the exercise of the rights of data subjects, draw up harmonised proposals for solutions to any problems and promote awareness of data protection rights, as necessary~~, jointly with the national supervisory authorities~~.

Amendment 231 #

Proposal for a regulation
Article 62 – paragraph 2

~~2. The European Data Protection 2. Supervisor~~They shall, each acting within the scope of its respective competences and in the framework of ~~its~~their responsibilities, exchange relevant information, assist each other in carrying out audits and inspections, examine difficulties of interpretation or application of this Regulation and other applicable Union acts, study problems with the exercise of independent supervision or in the exercise of the rights of data subjects, draw up harmonised proposals for solutions to any problems and promote awareness of data protection rights, as necessary~~, jointly with the national supervisory authorities~~.

Amendment 232 #

Proposal for a regulation
Article 62 – paragraph 3

3. For the purposes laid down in paragraph 2, the European Data Protection Supervisor ~~shall meet with~~and the national supervisory authorities shall meet at least twice a year within the framework of the European Data Protection Board. The costs and servicing of those meetings shall be borne by the European Data Protection Board. Rules of procedure shall be adopted at the first meeting. Further working methods shall be developed jointlyFor these purposes, the European Data Protection Board may develop further working methods as necessary.

Amendment 233 #

Proposal for a regulation
Article 62 – paragraph 3

3. For the purposes laid down in paragraph 2, the European Data Protection Supervisor ~~shall meet with~~and the national supervisory authorities shall meet at least twice a year within the framework of the European Data Protection Board. The costs and servicing of those meetings shall be borne by the European Data Protection Board. ~~Rules of procedure shall be adopted at the first meeting. Further working methods shall be developed jointly~~For these purposes, the European Data Protection Board may develop further working methods as necessary.

Amendment 234 #

Proposal for a regulation
Article 63 – paragraph 1

1. Without prejudice to any ~~judicial,~~ administrative or ~~non-~~judicial remedy, every data subject shall have the right to lodge a complaint with the European Data Protection Supervisor if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

Amendment 235 #

Proposal for a regulation
Article 64 – paragraph 1

~~The Court of Justice of the European Union shall have jurisdiction to hear all disputes relative to the provisions of this Regulation, including claims for damages.~~deleted

Amendment 236 #

Proposal for a regulation
Article 64 – paragraph 1 a (new)

Actions against decisions of the European Data Protection Supervisor, including decisions referred to in Article 63(3), shall be brought before the Court of Justice of the European Union.

Amendment 237 #

Proposal for a regulation
Article 64 – paragraph 1 b (new)

The Court of Justice of the European Union shall have jurisdiction to hear all disputes relative to the provisions of this Regulation, including claims for damages.

Amendment 238 #

Proposal for a regulation
Article 66

~~[...]~~deleted

Amendment 239 #

Proposal for a regulation
Article 66

~~[...]~~deleted

Amendment 240 #

Proposal for a regulation
Article 66 – paragraph 2

2. Infringements of the obligations of the Union institution or body pursuant to Articles 8, 12 27, 28, 29, 30, 31, 32, 33, 37, 38, 39, 40, 44, 45 and 46 shall, in accordance with paragraph 1, be subject to administrative fines up to 25 000 EUR per infringement and up to a total of 2~~50 000 EUR~~% of the annual budget of the Union institution or body per year.

Amendment 241 #

3. Infringements of the following provisions by the Union institution or body shall, in accordance with paragraph 1, be subject to administrative fines up to 50 000 EUR per infringement and up to a total of ~~500 000 EUR~~4% of the annual budget of the Union institution or body per year:

Amendment 242 #

Proposal for a regulation
Article 67

The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with Union law or the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint with the European Data Protection Supervisor on his or her behalf, to exercise the rights referred to in Articles 63 on his or her behalf, and to exercise the right to receive compensation referred to in Article 65 on his or her behalf.Article 67 deleted Representation of data subjects

Amendment 243 #

Proposal for a regulation
Article 68

Complaints by Union staff Any person employed by a Union institution or body may lodge a complaint with the European Data Protection Supervisor regarding an alleged infringement of the provisions of this Regulation, without acting through official channels. No one shall suffer prejudice on account of a complaint lodged with the European Data Protection Supervisor alleging such an infringement.Article 68 deleted

Amendment 244 #

Proposal for a regulation
Article 71 a (new)

Article 71 a Amendments to SIS II Regulation (EC) No 1987/2006 and SIS II Council Decision 2007/533/JHA Article 46 of Regulation (EC) No 1987/2006 of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II) and Article 62 of Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II) are replaced with the following: "national supervisory authorities and the EDPS shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".

Amendment 245 #

Proposal for a regulation
Article 71 a (new)

Amendment 246 #

Proposal for a regulation
Article 71 b (new)

Article 71 b Amendments to VIS Regulation (EC) No 767/2008 Article 43 of Regulation (C) No 767/2008 of the European Parliament and the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) is replaced with the following: "national supervisory authorities and the EDPS shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".

Amendment 247 #

Proposal for a regulation
Article 71 b (new)

Amendment 248 #

Proposal for a regulation
Article 71 c (new)

Article 71 c Amendments to Customs Information System Council Regulation (EC) No 515/97 and Council decision 2009/917/JHA 1. Paragraph (4) of Article 37 of Council Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters is replaced with the following: "national supervisory authorities and the EDPS shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]". 2. Article 25 of Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes is hereby deleted. Paragraphs (2) and (3) of Article 26 of that Council Decision are replaced with the following: "national supervisory authorities and the EDPS shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".

Amendment 249 #

Proposal for a regulation
Article 71 d (new)

Article 71 d Amendments to Customs Information System Council Regulation (EC) No 515/97 and Council decision 2009/917/JHA 1. Paragraphs (4) and (5) of Article 37 of Council Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters are hereby deleted. 2. Articles 25 of paragraphs (2) and (3) of Article 26 of Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes are hereby deleted.

Amendment 250 #

Proposal for a regulation
Article 71 c (new)

Article 71 c Amendments to Internal Market Information System Regulation (EU) No 1024/2012 Paragraphs (3) and (4) of Article 21 of Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (the IMI Regulation) are hereby deleted.

Amendment 251 #

Proposal for a regulation
Article 71 d (new)

Article 71 d Amendments to Europol Regulation (EU) 2016/794 Articles 28, 30, 33, 34, 35, 36, 37, 40, 41, 45, and 46 of Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA are hereby deleted. Article 44 of that Regulation is replaced with the following: "national supervisory authorities and the EDPS shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".

Amendment 252 #

Proposal for a regulation
Article 71 f (new)

Article 71 f Amendments to Europol Regulation (EU) 2016/794 Articles 28, 32, 33, 34, 35, 36, 37, 39, 40, 41, 44, 45, and 46 of Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing the repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA are hereby deleted.

Amendment 253 #

Proposal for a regulation
Article 71 e (new)

Article 71 e Amendments to Council Regulation (EU) 2017/XX on EPPO Articles 36e, 36f, 37, 37b, 37c, 37cc, 37ccc, 37d, 37e, 37f, 37g, 37h, 37i, 37j, 37k, 37n, 37o, 41, 41a, 41b, 43a, 43b, 43c, 43d, 43e and 46 of Council Regulation (EU) 2017/... of implementing enhanced cooperation on the establishment of the European Public Prosecutor's Office ("the EPPO") are hereby deleted. Article 45 of that Regulation is replaced with the following: "national supervisory authorities and the EDPS shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".

Amendment 254 #

Proposal for a regulation
Article 71 g (new)

Article 71 g Amendments to Council Regulation (EU) 2017/XX on EPPO Articles 47, 48(1) and 51 to 89 of Council Regulation (EU) 2017/... of implementing enhanced cooperation on the establishment of the European Public Prosecutor's Office ("the EPPO") are hereby deleted.

Amendment 255 #

Proposal for a regulation
Article 71 e (new)

Article 71 e Amendments to Commission Implementing Regulation (EU) 2015/428 Paragraph 8 of Article 69c of Commission Implementing Regulation (EU) 2015/428 of 10 March 2015 amending Regulation (EEC) No 2454/93 and Regulation (EU) No 1063/2010 a regards the rules of origin relating to the scheme of generalised tariff preferences and preferential tariff measures for certain countries or territories is hereby deleted.

Amendment 256 #

Proposal for a regulation
Article 71 f (new)

Article 71 f Amendments to Eurojust Regulation (EU) 2017/XX Articles 27, 29, 30, 31, 33, 36 and 37 of Regulation (EU) 2017/... of the European Parliament and of the Council on the European Union Agency for Criminal Justice Cooperation (Eurojust) are hereby deleted. Article 35 of that Regulation is replaced with the following: "national supervisory authorities and the EDPS shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".

Amendment 257 #

Proposal for a regulation
Article 71 g (new)

Article 71 g Amendments to Eurodac Regulation (EU) 2017/XX Articles 29, 30, 31, and 39 of Regulation (EU) 2017/... of the European Parliament and of the Council on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person], for identifying an illegally staying third- country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes (recast) are hereby deleted. Article 34 of that Regulation is replaced with the following: "national supervisory authorities and the EDPS shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".

Amendment 59 #

Proposal for a regulation
Recital 7 a (new)

(7a) The data protection legal framework for processing in the course of activities of Union institutions and bodies in the areas of freedom, security and justice and of the common foreign and security policy remains fragmented and creates legal uncertainty. This Regulation should therefore provide for harmonised rules for the protection and the free movement of personal data processed by the Union institutions and bodies carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of Part Three of the TFEU and Chapter 2 of Title V of the TEU.

Amendment 60 #

Proposal for a regulation
Recital 7 a (new)

(7a) The data protection legal framework for processing in the course of activities of Union institutions and bodies which fall outside the scope of Community law remains fragmented and creates legal uncertainty. This Regulation should therefore provide for harmonised rules for the protection and the free movement of personal data processed by the Union institutions and bodies carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of Part Three of the TFEU and Chapter 2 of Title V of the TEU.

Amendment 61 #

Proposal for a regulation
Recital 8

(8) In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection of personal data and the free movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU could prove necessary because of the specific nature of those fields. ~~This Regulation should therefore apply to Union agencies carrying out activities in the fields of judicial cooperation in crimi~~Furthermore, the field of common foreign and security policy also has a specific nature and specific rules on the protection of personal data and the free movement of personal data could prove necessary as well. It is therefore appropriate to regulate the processing of operational personal mdat~~ters and police cooperation only to the extent that Union law applicable to such agencies does not contain specific rules on the processing of personal data.~~ a, such as personal data processed for criminal investigation purposes, by Union agencies established on the basis of Chapters 4 and 5 of Title V of Part Three of the TFEU and by missions referred to in Article 42(1), 43 and 44 of the TEU by specific rules, derogating from a number of general rules of this Regulation. Those specific rules are aligned with the provisions of the Directive (EU) 2016/680 and should be interpreted homogenously. Processing of administrative personal data by those bodies, offices or agencies, such as staff data, should be covered by this Regulation.

Amendment 62 #

Proposal for a regulation
Recital 8

(8) In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection of personal data and the free movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU could prove necessary because of the specific nature of those fields. This Regulation should therefore apply to Union agencies carrying out activities in the fields of judicial cooperation in criminal matters and police cooperation only to the extent that Union law applicable to such agencies does not contain specific rules on the processing of personal dataFurthermore, the field of common foreign and security policy also has a specific nature and specific rules on the protection of personal data and the free movement of personal data could prove necessary as well. It is therefore appropriate to regulate the processing of operational personal data by Union agencies established on the basis of Chapters 4 and 5 of Title V of Part Three of the TFEU and by missions referred to in Article 42(1), 43 and 44 of the TEU by specific rules, derogating from a number of general rules of this Regulation. Those specific rules are aligned with the provisions of the Directive (EU) 2016/680 and should be interpreted homogenously.

Amendment 63 #

Proposal for a regulation
Recital 8

(8) In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection of personal data and the free movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU could prove necessary because of the specific nature of those fields. This Regulation should not therefore apply to Union agencies carrying out activities in the fields of judicial cooperation in criminal matters and police cooperation only to the extent that Union law applicable to such agencies does not contain specific rulthe processing of operational personal data, such as personal data processed for the purpose of a criminal investigations by Union bodies, offices and agencies carrying out activities falling within the scope of Chapters 4 and 5 of Title V of Part Three of the TFEU where acts creating such bodies, offices and agencies provide for a comprehensive set of rules for data protection applicable to the processing of such data, such as the acts establishing Europol and Eurojust, and the European Public Prosecutor's Office. This Regulation does, on the ~~processing of personal data~~other hand, cover the processing of administrative personal data, such as staff data, by those bodies, offices and agencies.

Amendment 64 #

Proposal for a regulation
Recital 8

(8) In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection of personal data and the free movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU could prove necessary because of the specific nature of those fields. This Regulation should therefore not apply to Union agencies carrying out activities in the fields of judicial cooperation in criminal matters and police cooperation only to the extent that Union law applicable to such agencies does not contain specific rules on the processing of personal datathe processing of operational personal data, such as personal data processed for criminal investigation purposes by Union bodies, offices or agencies carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of Part Three of the TFEU where the acts establishing these bodies, offices or agencies provide for comprehensive data protection rules applicable to the processing of such data, such as the acts establishing Eurojust, Europol and the European Public Prosecutor's Office. Processing of administrative personal data by those bodies, offices or agencies, such as staff data, should be covered by this Regulation.

Amendment 65 #

Proposal for a regulation
Recital 9

(9) Directive (EU) 2016/680 provides harmonised rules for the protection and the free movement of personal data processed for the purposes of the prevention, investigation, detection or prosecution of criminal offences or execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. In order to foster the same level of protection for natural persons through legally enforceable rights throughout the Union and to prevent divergences hampering the exchange of personal data between Union bodies, offices and agencies carrying out activities ~~in the fields of judicial cooperation in criminal mat~~falling within the scope of Chapters 4 and ~~police cooperation~~5 of Title V of Part Three of the TFEU and competent authorities in Member States, the rules for the protection and the free movement of operational personal data processed by such Union ~~agencies should draw on the principl~~bodies, offices uand~~erpinning this Regulation an~~ agencies should be consistent with Directive (EU) 2016/680.

Amendment 66 #

Proposal for a regulation
Recital 9

(9) Directive (EU) 2016/680 provides harmonised rules for the protection and the free movement of personal data processed for the purposes of the prevention, investigation, detection or prosecution of criminal offences or execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. In order to foster the same level of protection for natural persons through legally enforceable rights throughout the Union and to prevent divergences hampering the exchange of personal data between Union bodies, offices and agencies carrying out activities ~~in the fields of judicial cooperation in criminal mat~~which fall within the scope of Chapters 4 and ~~police cooperation~~5 of Title V of Part Three of the TFEU and competent authorities in Member States, the rules for the protection and the free movement of operational personal data processed by such Union ~~agencies should draw on the principl~~bodies, offices uand~~erpinning this Regulation an~~ agencies should be consistent with Directive (EU) 2016/680.

Amendment 67 #

Proposal for a regulation
Recital 10

(10) Where the founding act of a Union agency carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of the Treaty lays down a standalone data protection regime for the processing of operational personal data such regimes should be unaffected by this Regulation. However, the Commission should, in accordance with Article 62 of Directive (EU) 2016/680, by 6 May 2019 review Union acts which regulate processing by the competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and, where appropriate, make the necessary proposals to amend those acts to ensure a consistent approach to the protection of personal data in the area of judicial cooperation in criminal matters and police cooperation.deleted

Amendment 68 #

Proposal for a regulation
Recital 10

Amendment 69 #

Proposal for a regulation
Recital 10

(10) Where the founding act of a Union agency carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of the Treaty lays down a standalone data protection regime for the processing of operational personal data, such regimes should be ~~unaffected by~~overridden by the provisions in this Regulation. This Regulation should therefore repeal specific articles in specific acts that could potentially conflict with the provisions in this Regulation. However, the Commission should, in accordance with Article 62 of Directive (EU) 2016/680, by 6 May 2019 review Union acts which regulate processing by the competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and, where appropriate, make the necessary proposals to amend those acts to ensure a consistent approach to the protection of personal data in the area of judicial cooperation in criminal matters and police cooperation.

Amendment 70 #

Proposal for a regulation
Recital 10 a (new)

(10a) This Regulation should apply to the processing of personal data by Union institutions, bodies, offices and agencies carrying out activities falling within the scope of Chapter 2 of Title V of the TEU. This Regulation does not apply to the processing of personal data in the context of the missions referred to in Articles 42(1), 43 and 44 of the TEU, which implement the common security and defence policy. Where appropriate, relevant proposals could be submitted to further regulate the processing of personal data in the area of the common security and defence policy.

Amendment 71 #

Proposal for a regulation
Recital 10 a (new)

(10a) This Regulation should apply to the processing of personal data by Union institutions, bodies, offices or agencies carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU. This Regulation does not apply to the processing of personal data by missions referred to in Articles 42(1), and 43 and 44 of the TEU, which implement the common security and defence policy. Where appropriate, relevant proposals could be put forward to further regulate the processing of personal data in the field of the common security and defence policy.

Amendment 72 #

Proposal for a regulation
Recital 14

(14) Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. At the same time, it should only be possible for the electronic request to be completed and processed after the person concerned has been informed clearly and precisely of the purpose for its being processed.

Amendment 73 #

Proposal for a regulation
Recital 15

(15) Any processing of personal data should be lawful and fair and done for clear and well-defined purposes. . It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing. In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to, disclosure during the transmission of, or use of personal data and the equipment used for the processing.

Amendment 74 #

Proposal for a regulation
Recital 16

(16) In accordance with the principle of accountability, where Union institutions and bodies transmit personal data within or to other Union institutions or bodies, they should verify whether such personal data is required for the legitimate performance of tasks covered by the competence of the recipient where the recipient is not part of the controller. In particular, following a recipient’s request for transmission of personal data, the controller should verify the existence of a relevant EU legal ground ofor its lawful processing of personal data, the competence of the recipient and should make a provisional evaluation of the necessity for the transmission of the data. If doubts arise as to this necessity, the controller should seek further information from the recipient. The recipient should ensure that the necessity for the transmission of the data can be subsequently verified.

Amendment 75 #

Proposal for a regulation
Recital 17

(17) In order for processing to be lawful, personal data should be processed on the basis of the necessity of performance of a task carried out in the public interest by Union institutions and bodies or in the exercise of their official authority, the necessity for compliance with the legal obligation to which the controller is subject or some other legitimate basis as referred to in this Regulation, including the consent of the data subject concerned or the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Processing of personal data for the performance of tasks carried out in the public interest by the Union institutions and bodies includes the processing of personal data necessary for the management and functioning of those institutions and bodies. The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis, or where the processing is necessary to protect the life, physical integrity or health of the person concerned in the event of that person being physically or legally unable to give consent. Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters.

Amendment 76 #

Proposal for a regulation
Recital 18

(18) The Union law ~~including the internal rules~~ referred to in this Regulation should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the ~~case-law of the Court of Justice of~~requirements set out in the Charter and the European UnConvention ~~and~~for the ~~European Court~~Protection of Human Rights and Fundamental Freedoms.

Amendment 77 #

Proposal for a regulation
Recital 18

(18) The Union law ~~including the internal rules referred to in this Regulation~~ should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union and the European Court of Human Rights.

Amendment 78 #

Proposal for a regulation
Recital 18

Amendment 79 #

Proposal for a regulation
Recital 18 a (new)

(18a) The internal rules referred to in this Regulation should be clear and precise acts of general application intended to produce legal effects vis-à-vis data subjects, adopted at the highest level of management of the Union institutions and bodies within their competencies and in matters relating to their operation and should be published in the Official Journal of the European Union. The application of these rules should be foreseeable to persons subject to them in accordance with the requirements set out in the Charter and the European Convention for the Protection of Human Rights and Freedoms. Internal rules may take the form of decisions, in particular when adopted by Union institutions.

Amendment 80 #

Proposal for a regulation
Recital 20

(20) Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC14 a declaration of consent pre- formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller ~~and~~, the purposes of the processing for which the personal data are intended and the categories of recipients of the data, and be informed on the right of access and of intervention in respect of the data. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. _________________ 14 Council Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts (OJ J 95, 21.4.1993, p.29).

Amendment 81 #

Proposal for a regulation
Recital 21

(21) Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to creating personality profiles and the collection of personal data with regard to children when using services offered directly to a child on websites of Union institutions and bodies, such as interpersonal communication services or online selling of tickets and when the processing of personal data is based on consent.deleted

Amendment 82 #

Proposal for a regulation
Recital 21

(21) Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Data concerning children should be handled with particular care, as the risks relating to it are less well less known to children than to adults. Such specific protection should, in particular, apply to creating personality profiles and the collection of personal data with regard to children when using services offered directly to a child on websites of Union institutions and bodies, such as interpersonal communication services or online selling of tickets and when the processing of personal data is based on consent.

Amendment 83 #

Proposal for a regulation
Recital 24

(24) The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subject to suitable and specific measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council15 , namely all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not result in personal data being processed for other purposes by third parties such as employers or insurances and banking companies. _________________ 15 Regulation (EC) No 1338/2008 of the European Parliament and of the Council of 16 December 2008 on Community statistics on public health and health and safety at work (OJ L 354, 31.12.2008, p. 70).

Amendment 84 #

Proposal for a regulation
Recital 26

(26) The processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be subject to appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. Those safeguards should ensure that technical and organisational measures are in place in order to ensure, in particular, the principle of data minimisation. The further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist (such as, for instance, pseudonymisation of the data). Union institutions and bodies should provide for appropriate safeguards for the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in Union law~~, which may include internal rules~~.

Amendment 85 #

Proposal for a regulation
Recital 26

Amendment 86 #

Proposal for a regulation
Recital 27

(27) Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data, without its being adversely affected, and the exercise of the right to object. The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means. The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month and to give reasons where the controller does not intend to comply with any such requests, in an electronic communication or by post, in accordance with the relevant legal provisions. .

Amendment 87 #

Proposal for a regulation
Recital 37 – paragraph 1

Legal acts adopted on the basis of the Treaties ~~or internal rules of Union institutions and bodies~~ may impose ad hoc restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, confidentiality of electronic communications as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, as far as limited in time, necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.

Amendment 88 #

Proposal for a regulation
Recital 37 – paragraph 1

Legal acts adopted on the basis of the Treaties ~~or internal rules of Union institutions and bodies~~ may impose restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, confidentiality of electronic communications as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, as far as necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.

Amendment 89 #

Proposal for a regulation
Recital 37 – paragraph 1

Legal acts adopted on the basis of the Treaties or internal rules ofadopted by Union institutions and bodies, in matters relating to their operation, may impose restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, confidentiality of electronic communications as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, as far as necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.

Amendment 90 #

Proposal for a regulation
Recital 37 – paragraph 2

Where a restriction is not provided for in legal acts adopted on the basis of the Treaties or their internal rules, Union institutions and bodies may in a specific case impose an ad hoc restriction concerning specific principles and the rights of data subject if such a restriction respects the essence of the fundamental rights and freedoms and, in relation to a specific processing operation, is necessary and proportionate in a democratic society to safeguard one or more of the objectives mentioned in paragraph 1. The restriction should be notified to the data protection officer. All restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.deleted

Amendment 91 #

Proposal for a regulation
Recital 44

(44) Union institutions and bodies should ensure the confidentiality of electronic communications as provided for by Article 7 of the Charter. In particular, Union institutions and bodies should ensure the security of their electronic communication networks, protect the information related to end-users’ terminal equipment accessing their publicly available websites and mobile applications in accordance with Regulation (EU) XXXX/XX [new ePrivacy Regulation] and protect the personal data in directories of users, whilst maintaining full accessibility for citizens and interest groups to the institutions, its staff and in particular its political representatives.

Amendment 92 #

Proposal for a regulation
Recital 49

(49) The European Data Protection Supervisor should be informed about administrative measures ~~and internal rules~~ of Union institutions and bodies which provide for the processing of personal data, lay down conditions for restrictions of data subject rights or provide appropriate safeguards for data subject rights, in order to ensure compliance of the intended processing with this Regulation and in particular to mitigate the risk involved for the data subject.

Amendment 93 #

Proposal for a regulation
Recital 49

(49) The European Data Protection Supervisor should be informed about administrative measures and consulted on internal rules ofadopted by Union institutions and bodies, in matters relating to their operation, which provide for the processing of personal data, lay down conditions for restrictions of data subject rights or provide appropriate safeguards for data subject rights, in order to ensure compliance of the intended processing with this Regulation and in particular to mitigate the risk involved for the data subject.

Amendment 94 #

Cornelia ERNST

Proposal for a regulation
Recital 64 a (new)

(64a) The Commission has proposed to amend Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC ('the IMI Regulation') to allow the IMI System to be used not only by the competent authorities of the Member States and the Commission, but also by Union bodies, offices and agencies1a. Pending this revision, the European Data Protection Supervisor and the European Data Protection Board should be able to use the Internal Market Information System for the purposes of administrative cooperation and information exchange stipulated in the General Data Protection Regulation in view of its entry into application on 25 May 2018. _________________ 1a See Article 36 of the Proposal for a Regulation of the European Parliament and of the Council on establishing a single digital gateway to provide information, procedures, assistance and problem solving services and amending Regulation (EU) No 1024/2012, COM(2017) 256 final, 2017/0086 (COD).

Amendment 95 #

Proposal for a regulation
Recital 65

(65) In certain instances, Union law provides for a model of coordinated supervision, shared between the European Data Protection Supervisor and the national supervisory authorities. Moreover, the European Data Protection Supervisor is the supervisory authority of Europol and a specific model of cooperation with the national supervisory authorities is established through a cooperation board with an advisory function. In order to improve the effective supervision and enforcement of substantive data protection rules, ~~a single, coherent model of coordinated supervis~~this Regulation should be introduce~~d in the Union. The Commission should therefor~~ a single, wcohere appropriate, submit legislative proposals with a view to amending Union legal acts providing for a model of coordinated supervision, in order to align them with the coordinated supervision model of this Regulatnt model of coordinated supervision. The European Data Protection Board should serve as a single forum for ensuring the effective coordinated supervision across the board.

Amendment 96 #

Proposal for a regulation
Recital 65

Amendment 97 #

Proposal for a regulation
Recital 68

(68) In order to strengthen the supervisory role of the European Data Protection Supervisor and the effective enforcement of this Regulation, the European Data Protection Supervisor should, as a sanction of last resort, have the power to impose administrative fines. The fines should aim at sanctioning the institution or body – rather than individuals – for non-compliance with this Regulation, to deter future violations of this Regulation and to foster a culture of personal data protection within the Union institutions and bodies. This Regulation should indicate infringements and the upper limits and criteria for setting the related administrative fines. The European Data Protection Supervisor should determine the amount of fines in each individual case, by taking into account all relevant circumstances of the specific situation, with due regard to the nature, gravity and duration of the infringement and of its consequences and the measures taken to ensure compliance with the obligations under this Regulation and to prevent or mitigate the consequences of the infringement. When imposing an administrative fine on a Union body, the European Data Protection Supervisor should consider the proportionality of amount of the fine. The administrative procedure for the imposition of fines on Union institutions and bodies should respect the general principles of Union law as interpreted by the Court of Justice of the European Union.deleted

Amendment 98 #

Proposal for a regulation
Article 1 – paragraph 1

1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and rules relating to the free movement of personal data between themselves or to recipients established in the Union and subject to Regulation (EU) 2016/67918 or the provisions of national law adopted pursuant to Directive (EU) 2016/68019 . _________________ 18 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, p. 1– 88. 19 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89– 131.

Amendment 99 #

Proposal for a regulation
Article 2 – paragraph 1

1. This Regulation applies to the processing of personal data by all Union institutions, agencies and bodies ~~insofar as such processing is carried out in the exercise of activities which fall, wholly or partially within the scope of Union law~~.

source: 608.066

2017/07/18 JURI 103 amendments...

Amendment 10 #

Proposal for a regulation
Recital 10

Amendment 100 #

Proposal for a regulation
Article 54 – paragraph 2

2. The list drawn up byjointly by the European Parliament, the Council and the Commission from which the European Data Protection Supervisor shall be chosen shall be made up of persons whose independence is beyond doubt and who are acknowledged as having expert knowledge in data protection as well as the experience and skills required to perform the duties of European Data Protection Supervisor, for example because they belong or have belonged to the supervisory authorities established under Article 41 of Regulation (EU) 2016/679.

Amendment 101 #

Proposal for a regulation
Article 59 – paragraph 1 – point d

(d) to obtain, from the controller and the processor, access to all personal administrative data and ~~to all~~ information necessary for the performance of its tasks, with the exception of operational personal data;

Amendment 102 #

Proposal for a regulation
Article 63 – paragraph 1 a (new)

1a. In cases where the data subject is a child, Member States shall provide for specific safeguards, in particular with regard to legal aid.

Amendment 103 #

Proposal for a regulation
Chapter IX a (new)

Chapter IXa Article 70a Review Clause 1. No later than 1 June 2021, and every five years thereafter, the Commission shall present to the European Parliament a report on the application of this Regulation, accompanied, if necessary, by appropriate legislative proposals. 2. The ex-post evaluation outlined in paragraph 1 shall pay particular attention to the appropriateness of the scope of this Regulation, the consistency with other legislative acts in the field of data protection and assess, in particular, the implementation of Chapter V of this Regulation. 3. No later than 1 June 2021, and every five years thereafter, the Commission shall report to the European Parliament on the application of Chapter VIII of this Regulation and the penalties and sanctions applied.

Amendment 104 #

Proposal for a regulation
Article 72 a (new)

Article 72a Review of Union legal acts By 25 May 2021, the Commission shall review other legal acts adopted on the basis of the Treaties which regulate processing of personal data, in particular by agencies established under Chapters 4 and 5 of Title V of Part Three TFEU, in order to assess the need to align them with this Regulation and to make, where appropriate, the necessary proposals to amend those acts in order to ensure a consistent approach to the protection of personal data within the scope of this Regulation.

Amendment 11 #

Proposal for a regulation
Recital 10

Amendment 12 #

Proposal for a regulation
Recital 10

(10) Where the founding act of a Union agency carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of the Treaty lays down a standalone data protection regime for the processing of operational personal data such regimes should be unaffected by this Regulation, as long as they are consistent with the provisions of Regulation (EU) 2016/679. However, the Commission should, in accordance with Article 62 of Directive (EU) 2016/680, by 6 May 2019 review Union acts which regulate processing by the competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and, where appropriate, make the necessary proposals to amend those acts to ensure a consistent approach to the protection of personal data in the area of judicial cooperation in criminal matters and police cooperation.

Amendment 13 #

Proposal for a regulation
Recital 10

(10) Where the founding act of a Union agency carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of the Treaty lays down a standalone data protection regime for the processing of operational personal data such regimes should be unaffected by this Regulation. However, the Commission should, in accordance with Article 62 of Directive (EU) 2016/680, by 6 May 2019 review Union acts which regulate processing by the competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and, where appropriate, make the necessary proposals to amend those acts to ensure a coherent, transparent and consistent approach to the protection of personal data and the transmission thereof in the area of judicial cooperation in criminal matters and police cooperation.

Amendment 14 #

Proposal for a regulation
Recital 10 a (new)

(10a) This Regulation should apply to the processing of personal data by Union institutions, bodies, offices or agencies carrying out activities which fall within the scope of Chapter 2 of Title V TEU. However, this Regulation should not apply to the processing of personal data in the context of the tasks referred to in Articles 42(1), 43 and 44 TEU, which implement the common security and defence policy. Where appropriate, relevant proposals could be put forward to further regulate the processing of personal data in the field of the common security and defence policy.

Amendment 15 #

Proposal for a regulation
Recital 14

(14) Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. At the same time, the data subject may withdraw consent at any time without affecting the legality of using data based on consent prior to withdrawal thereof.

Amendment 16 #

Proposal for a regulation
Recital 18

(18) The Union law ~~including the internal rules~~ referred to in this Regulation should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union and the European Court of Human Rights. The same applies to rules applicable inter-institutional level and those laid down under the national law of the Member States.

Amendment 17 #

Proposal for a regulation
Recital 18

Amendment 18 #

Proposal for a regulation
Recital 18

Amendment 19 #

Proposal for a regulation
Recital 21

Amendment 2 #

Proposal for a regulation
Recital 1

(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning them. This right is also guaranteed under Article 8 of the European Convention on Human Rights.

Amendment 20 #

Proposal for a regulation
Recital 22

(22) When recipients established in the Union and subject to Regulation (EU) 2016/679 or Directive (EU) 2016/680, would like to have personal data transmitted to them by Union institutions and bodies, those recipients should ~~dem~~provide the constr~~ate that the~~oller with a reasoned request for transmission which should serve as a basis for the controller to assess whether that transmission is necessary for the attainment of their objective, is proportionate and does not go beyond what is necessary to attain that objective. Union institutions and bodies should demonstrate such necessity when they themselves initiate the transmission, in compliance with the principle of transparency.

Amendment 21 #

Proposal for a regulation
Recital 23

(23) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Such personal data should not be processed unless processing is allowed in specific cases as laid down in this Regulation. Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races. The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. In addition to the specific requirements for processing of sensitive data, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.

Amendment 22 #

Proposal for a regulation
Recital 23

(23) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Such personal data should not be processed unless processing is allowed in specific cases as set out in this Regulation. Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races. The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. In addition to the specific requirements for processing of sensitive data, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.

Amendment 23 #

Proposal for a regulation
Recital 23 a (new)

(23a) Special categories of personal data which merit higher protection should be processed for health-related purposes only where necessary to achieve those purposes for the benefit of natural persons and society as a whole, in particular in the context of the management of health or social care services and systems. Therefore, this Regulation should provide for harmonised conditions for the processing of special categories of personal data concerning health, in respect of specific needs, in particular where the processing of such data is carried out for certain health-related purposes by persons subject to a legal obligation of professional secrecy. Union law should provide for specific and suitable measures so as to protect the fundamental rights and the personal data of natural persons.

Amendment 24 #

Proposal for a regulation
Recital 24

(24) The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subject to proportionate, suitable and specific measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council15, namely all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not ~~result in personal data being~~lead to any further processeding for other purposes, including processing by third parties. _________________ 15 Regulation (EC) No 1338/2008 of the European Parliament and of the Council of 16 December 2008 on Community statistics on public health and health and safety at work (OJ L 354, 31.12.2008, p. 70).

Amendment 25 #

Proposal for a regulation
Recital 24

(24) The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subject to suitable and specific measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council15, namely all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not result in personal data being processed for other purposes ~~by third parties~~. _________________ 15 Regulation (EC) No 1338/2008 of the European Parliament and of the Council of 16 December 2008 on Community statistics on public health and health and safety at work (OJ L 354, 31.12.2008, p. 70).

Amendment 26 #

Proposal for a regulation
Recital 35

(35) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the ~~interests or the fundamental rights and freedoms~~right to personal data protection of the data subject.

Amendment 27 #

Legal acts adopted on the basis of the Treaties ~~or internal rules of Union institutions and bodies~~ may impose restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, confidentiality of electronic communications as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, for a limited period of time and as far as necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, ~~in particular an important economic or financial interest of the Union or of a Member State,~~ the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.

Amendment 28 #

Proposal for a regulation
Recital 37 – paragraph 1

Legal acts adopted on the basis of the Treaties ~~or internal rules of Union institutions and bodies~~ may impose restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability~~, confidentiality of electronic communications~~ as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, as far as necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.

Amendment 29 #

Max ANDERSSON

Proposal for a regulation
Recital 37 – paragraph 2

Amendment 3 #

Proposal for a regulation
Recital 2

(2) Regulation (EC) No 45/2001 of the European Parliament and of the Council11 provides natural persons with legally enforceable rights, specifies the data processing obligations of controllers within the Community institutions and bodies, and creates an independent supervisory authority, the European Data Protection Supervisor, responsible for monitoring the processing of personal data by the Union institutions and bodies. ~~However, it does not apply to the processing of personal data in the course of an activity of Union institutions and bodies which fall outside the scope of Union law. _________________ 11~~At the same time, Regulation (EC) No 45/2001 of the European Parliament and of the Council ~~of 18 December 2000 on the protection of individuals with regard~~seeks to achieve two objectives: to protect the fundamental right to data protection and to guarantee the free flow of personal data throughout the Union. However, it does not apply to the processing of personal data byin the ~~Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p.1)~~course of an activity of Union institutions and bodies which fall outside the scope of Union law.

Amendment 30 #

Proposal for a regulation
Recital 37 – paragraph 2

Amendment 31 #

Proposal for a regulation
Recital 42

(42) In order to demonstrate compliance with this Regulation, controllers should maintain records of processing activities under their responsibility and processors should maintain records of categories of processing activities under their responsibility. Union institutions and bodies should be obliged to cooperate with the European Data Protection Supervisor and make their records, on request, available to it, so that they might serve for monitoring those processing operations. Union institutions and bodies should be able to establish a central register of records of their processing activities. For reasons of transparency, they should ~~also be able to~~ make such a register public. Data subjects should have the possibility to consult that register through the data protection officer of the controller.

Amendment 32 #

Proposal for a regulation
Recital 42

(42) In order to demonstrate compliance with this Regulation, controllers should maintain records of processing activities under their responsibility and processors should maintain records of categories of processing activities under their responsibility. Union institutions and bodies should be obliged to cooperate with the European Data Protection Supervisor and make their records, on request, available to it, so that they might serve for monitoring those processing operations. Union institutions and bodies should ~~be able to~~ establish a central register of records of their processing activities. For reasons of transparency, they should also ~~be able to~~ make such a register public so that the individual concerned can consult it without prejudice to the rights of other concerned parties.

Amendment 33 #

Proposal for a regulation
Recital 42

(42) In order to demonstrate compliance with this Regulation, controllers should maintain records of processing activities under their responsibility and processors should maintain records of categories of processing activities under their responsibility. Union institutions and bodies should be obliged to cooperate with the European Data Protection Supervisor and make their records, on request, available to it, so that they might serve for monitoring those processing operations. Union institutions and bodies should be able to establish a central register of records of their processing activities. For reasons of transparency, they should also be able to make such a register public. Data subjects should be able to consult the register upon request.

Amendment 34 #

Proposal for a regulation
Recital 44

Amendment 35 #

Proposal for a regulation
Recital 46

(46) The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions. The communication is confidential and should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the European Data Protection Supervisor, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities.

Amendment 36 #

Proposal for a regulation
Recital 50

(50) Regulation (EU) 2016/679 established the European Data Protection Board as an independent body of the Union with legal personality. The Board should contribute to the consistent application of Regulation (EU) 2016/679 and Directive 2016/680 throughout the Union, including by advising the Commission. At the same time, the European Data Protection Supervisor should continue to exercise its supervisory and advisory functions in respect of all Union institutions and bodies, including on its own initiative or upon request. In order to ensure consistency of data protection rules throughout the Union, a consultation by the Commission should be obligatory ~~following t~~when adopti~~on of~~ng proposals for legislative acts or during the preparation of delegated acts and implementing acts as defined in Article 289, 290 and 291 TFEU and ~~following t~~when adopti~~on of~~ng recommendations and proposals relating to agreements with third countries and international organisations as provided for in Article 218 TFEU, which have an impact on the right to personal data protection. In such cases, the Commission should be obliged to consult the European Data Protection Supervisor, except when the Regulation (EU) 2016/679 provides for mandatory consultation of the European Data Protection Board, for example on adequacy decisions or delegated acts on standardised icons and requirements for certification mechanisms. Where the act in question is of particular importance for the protection of individuals' rights and freedoms with regard to the processing of personal data, the Commission should be able, in addition, to consult the European Data Protection Board. In those cases, the European Data Protection Supervisor should, as a member of the European Data Protection Board, coordinate its work with the latter with a view to issue a joint opinion. The European Data Protection Supervisor, and where applicable, the European Data Protection Board should provide its written advice within eight weeks. That time-frame should be shorter in case of urgency or otherwise appropriate, for example when the Commission is preparing delegated and implementing acts.

Amendment 37 #

Proposal for a regulation
Recital 52

(52) When personal data are transferred from the Union institutions and bodies to controllers, processors or other recipients in third countries or to international organisations, the level of protection of natural persons ensured in the Union by this Regulation should ~~not be undermin~~be guaranteed, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. In any event, transfers to third countries and international organisations may only be carried out in full compliance with this Regulation and with the fundamental rights and freedoms enshrined in the EU Charter of Fundamental Rights. A transfer could take place only if, subject to the other provisions of this Regulation, the conditions laid down in the provisions of this Regulation relating to the transfer of personal data to third countries or international organisations are complied with by the controller or processor.

Amendment 38 #

Proposal for a regulation
Recital 52

(52) When personal data are transferred from the Union institutions and bodies to controllers, processors or other recipients in third countries or to international organisations, the level of protection of natural persons ensured in the Union by this Regulation should not be undermined, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. In any event, transfers to third countries and international organisations may only be carried out in full compliance with this Regulation and in accordance with Regulation (EU) 2016/679. A transfer could take place only if, subject to the other provisions of this Regulation, the conditions laid down in the provisions of this Regulation relating to the transfer of personal data to third countries or international organisations are complied with by the controller or processor.

Amendment 39 #

Proposal for a regulation
Recital 54

(54) In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject. Such appropriate safeguards can consist of making use of standard data protection clauses adopted by the Commission, standard data protection clauses adopted by the European Data Protection Supervisor or contractual clauses authorised by the European Data Protection Supervisor. Where the processor is not a Union Institution or body those appropriate safeguards can also consist of binding corporate rules, codes of conduct and certification mechanisms used for international transfers under Regulation (EU) 2016/679. Those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default. Transfers may also be carried out by Union institutions and bodies to public authorities or bodies in third countries or to international organisations with corresponding duties or functions, including on the basis of provisions to be inserted into administrative arrangements, such as a memorandum of understanding, providing for enforceable and effective rights for data subjects. Authorisation by the European Data Protection Supervisor should be obtained when the safeguards are provided for in administrative arrangements that are not legally binding.deleted

Amendment 4 #

Proposal for a regulation
Recital 5

(5) It is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align as far as possible the data protection rules for Union institutions ~~and bod~~, bodies, offices and agencies with the data protection rules adopted for the public sector in the Member States. Whenever the provisions of this Regulation are based on the same concept as the provisions of Regulation (EU) 2016/679, those two provisions should under CJEU case law1a, be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of Regulation (EU) 2016/679. _________________ 1aSee CJEU judgment of 9 March 2010, Commission v Germany, Case C-518/07, ECLI:EU:C:2010:125, paragraphs 26 and 28.

Amendment 40 #

Proposal for a regulation
Article 1 – paragraph 1

1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and rules relating to the free movement of personal data between themselves or to recipients established in the Union and subject to Regulation (EU) 2016/67918 or the provisions of national law adopted pursuant to Directive (EU) 2016/68019. _________________ 18Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, p. 1– 88. 19Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89– 131.

Amendment 41 #

Proposal for a regulation
Article 1 – paragraph 2

(2) This Regulation protects fundamental rights and freedoms of natural persons enshrined in the EU Charter of Fundamental Rights and in particular their right to the protection of personal data.

Amendment 42 #

Proposal for a regulation
Article 2 – paragraph 1

Amendment 43 #

Proposal for a regulation
Article 2 – paragraph 1

Amendment 44 #

Proposal for a regulation
Article 2 – paragraph 1

Amendment 45 #

Proposal for a regulation
Article 2 – paragraph 1 a (new)

1a. Eurojust, Europol and the European Public Prosecutor's Office shall only be covered by this Regulation for the processing of administrative personal data. Separate provisions apply to the processing of operational personal data by Eurojust, Europol and the European Public Prosecutor's Office. Those Union bodies are not subject to this Regulation for the processing of operational personal data.

Amendment 46 #

Proposal for a regulation
Article 2 – paragraph 1 a (new)

1a. This Regulation shall not apply to the processing of operational data by EU agencies and bodies active in the field of judicial cooperation in criminal matters and police cooperation.

Amendment 47 #

Max ANDERSSON

Proposal for a regulation
Article 2 – paragraph 2 a (new)

2a. This Regulation shall also apply to Union agencies carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of Part Three TFEU, including where the founding acts of those Union agencies lay down a standalone data protection regime for the processing of operational personal data. The provisions of this Regulation shall take precedence over the conflicting provisions in the founding acts of those Union agencies.

Amendment 48 #

Proposal for a regulation
Article 3 – paragraph 2 – point a a (new)

(aa) 'operational personal data' means all personal data processed by the Union bodies, offices or agencies carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU to meet the objectives laid down in the acts establishing those bodies, offices or agencies;

Amendment 49 #

Proposal for a regulation
Article 3 – paragraph 2 – point a b (new)

(ab) 'administrative personal data' means all personal data processed by the Union bodies, offices or agencies which fall within the scope of this Regulation;

Amendment 5 #

Proposal for a regulation
Recital 5

(5) It is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align ~~as far as possible~~ the data protection rules for Union institutions and bodies with the data protection rules adopted for the public sector in the Member States. Whenever the provisions of this Regulation are based on the same concept as the provisions of Regulation (EU) 2016/679, those two provisions should be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of Regulation (EU) 2016/679.

Amendment 50 #

Proposal for a regulation
Article 4 – paragraph 1 – point d

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data which are inaccurate or incomplete, having regard to the purposes for which they ~~were collected or for which they are further~~are processed, are erased or rectified without delay (‘accuracy’);

Amendment 51 #

Proposal for a regulation
Article 5 – paragraph 2

2. The tasks referred to in point (a) of paragraph 1 shall be laid down in Union law. The basis for the processing referred to in point (b) of paragraph 1 shall be laid down in Union or Member State law to which the controller is subject.

Amendment 52 #

Proposal for a regulation
Article 8

Article 8 Conditions applicable to children's consent in relation to information society services 1. applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 13 years old. Where the child is below the age of 13 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. 2. reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. 3. general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.deleted Where point (d) of Article 5(1) The controller shall make Paragraph 1 shall not affect the

Amendment 53 #

Proposal for a regulation
Article 8 – title

Conditions applicable to child~~ren~~'s consent in relation to information society services

Amendment 54 #

Proposal for a regulation
Article 8 – paragraph 1

Amendment 55 #

Proposal for a regulation
Article 8 – paragraph 1

(1) Where point (d) of Article 5(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 136 years old. Where the child is below the age of 136 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Amendment 56 #

Jiří MAŠTÁLKA

Proposal for a regulation
Article 8 a (new)

Article 8a Transfer of personal data between Union institutions and bodies 1. Without prejudice to Articles 4, 5, 6 and 10, personal data shall only be transferred within or to other Union institutions or bodies if the data are necessary for the legitimate performance of tasks covered by the competence of the recipient. 2. Where the data are transferred under this Article following a request from the recipient, both the controller and the recipient shall bear the responsibility for the legitimacy of this transfer. The controller shall be required to verify the competence of the recipient and to make a provisional evaluation of the necessity for the transfer of the data. If doubts arise as to this necessity, the controller shall seek further information from the recipient. The recipient shall ensure that the necessity for the transfer of the data can be subsequently verified. 3. The recipient shall process the personal data only for the purposes for which they were transferred.

Amendment 57 #

Proposal for a regulation
Article 9 – title

Transmissions of personal data to recipients, other than Union institutions and bodies, established in the Union ~~and subject to Regulation (EU) 2016/679 or Directive (EU) 2016/680~~

Amendment 58 #

Proposal for a regulation
Article 9 – paragraph 1 – point b

Amendment 59 #

Proposal for a regulation
Article 9 – paragraph 1 – point b

(b) that it is necessary to have the data transmitted, i~~t is proportionate to the purposes of the transmission and if there is no reason to assume that the data subject's rights and freedoms and legitimate interests might be prejudiced~~n particular where the transmission serves a public interest such as transparency or good administration, and it is proportionate to the purposes of the transmission.

Amendment 6 #

Proposal for a regulation
Recital 8

(8) In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection of personal data and the free movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU could prove necessary because of the specific nature of those fields. This Regulation should therefore not apply to Union agencies carrying out activities in the fields of judicial cooperation in criminal matters and police cooperation only to the extent that Union law applicable to such agencies does not contain specific rules on the processing of personal datathe processing of operational personal data, such as personal data processed for criminal investigation purposes by Union bodies, offices or agencies carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of Part Three TFEU where the acts establishing those bodies, offices or agencies provide for comprehensive data protection rules applicable to the processing of such data, such as the acts establishing Eurojust, Europol and the European Public Prosecutor's Office. Processing of administrative personal data by those bodies, offices or agencies, such as staff data, should be covered by this Regulation.

Amendment 60 #

Proposal for a regulation
Article 10 – paragraph 3

3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union ~~law~~or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

Amendment 61 #

Proposal for a regulation
Article 11 – paragraph 1

Amendment 62 #

Proposal for a regulation
Article 16 – paragraph 5 – point b

Amendment 63 #

Proposal for a regulation
Article 23 – paragraph 1

(1) The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (a) of Article 5(1), including profiling based on that provision. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the ~~interests, rights and freedoms of the data subject~~right of the individual concerned to the protection of personal data, or for the establishment, exercise or defence of legal claims.

Amendment 64 #

Proposal for a regulation
Article 25 – paragraph 1 – introductory part

Amendment 65 #

Proposal for a regulation
Article 25 – paragraph 1 – introductory part

1. Legal acts adopted on the basis of the Treaties ~~or, in matters relating to the operation of the Union institutions and bodies, internal rules laid down by the latter~~ may restrict the application of Articles 14 to 22~~, 34~~ and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

Amendment 66 #

Proposal for a regulation
Article 25 – paragraph 1 a (new)

1a. In particular, any legal act referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to : (a) the purposes of the processing or categories of processing; (b) the categories of personal data; (c) the scope of the restriction introduced; (d) the safeguards to prevent abuse or unlawful access or transfer; (e) the specification of the controller or categories of controllers; (f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; (g) the risks to the rights and freedoms of data subjects; and (h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

Amendment 67 #

Proposal for a regulation
Article 25 – paragraph 1 a (new)

(1a) In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to: (a) the purposes of the processing or categories of processing; (b) the categories of personal data; (c) the scope of the restrictions introduced; (d) the safeguards to prevent abuse or unlawful access or transfer; (e) the specification of the controller or categories of controllers; (f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; (g) the risks to the rights and freedoms of data subjects. and (h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

Amendment 68 #

Proposal for a regulation
Article 25 – paragraph 2

Amendment 69 #

Proposal for a regulation
Article 25 – paragraph 2

Amendment 7 #

Proposal for a regulation
Recital 8

Amendment 70 #

Proposal for a regulation
Article 25 – paragraph 3

Amendment 71 #

Proposal for a regulation
Article 25 – paragraph 4

Amendment 72 #

Proposal for a regulation
Article 25 – paragraph 5

~~5. Internal rules referred to in paragraphs 1, 3 and 4 shall be sufficiently clear and precise and subject to appropriate publication.~~deleted

Amendment 73 #

Proposal for a regulation
Article 25 – paragraph 5

~~5. Internal rules referred to in paragraphs 1, 3 and 4 shall be sufficiently clear and precise and subject to appropriate publication.~~deleted

Amendment 74 #

Proposal for a regulation
Article 25 – paragraph 6

6. If a restriction is imposed pursuant to paragraphs 1 ~~or 2~~, the data subject shall be informed, in accordance with Union law, of the principal reasons on which the application of the restriction is based and of his or her right to lodge a complaint with the European Data Protection Supervisor.

Amendment 75 #

Proposal for a regulation
Article 25 – paragraph 7

7. If a restriction imposed pursuant to paragraphs 1 ~~or 2~~ is relied upon to deny access to the data subject, the European Data Protection Supervisor shall, when investigating the complaint, only inform him or her of whether the data have been processed correctly and, if not, whether any necessary corrections have been made.

Amendment 76 #

Proposal for a regulation
Article 25 – paragraph 8

8. Provision of the information referred to in paragraphs 6 and 7 and in Article 46(2) may be deferred, omitted or denied if it would cancel the effect of the restriction imposed pursuant to paragraph 1 ~~or 2~~.

Amendment 77 #

Proposal for a regulation
Article 31 – paragraph 5

(5) Union institutions and bodies ~~may decide to~~shall keep their records of processing activities in a central register. ~~In this case, they may also decide t~~For reasons of transparency, they should also make ~~the~~such a register public~~ly accessible~~ so that the individual concerned can consult it without prejudice to the rights of other concerned parties.

Amendment 78 #

Proposal for a regulation
Article 31 – paragraph 5

5. Union institutions and bodies ~~may decide to~~shall keep their records of processing activities in a central register. ~~In this case, they may also decide to~~They shall make the register publicly accessible.

Amendment 79 #

Proposal for a regulation
Article 31 – paragraph 5

Amendment 8 #

Proposal for a regulation
Recital 9

(9) Directive (EU) 2016/680 provides harmonised rules for the protection and the free movement of personal data processed for the purposes of the prevention, investigation, detection or prosecution of criminal offences or execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. In order to foster the same level of protection for natural persons through legally enforceable rights throughout the Union and to prevent divergences hampering the exchange of personal data between Union agencies carrying out activities in the fields of judicial cooperation in criminal matters and police cooperation and competent authorities in Member States, the rules for the protection and the free movement of operational personal data processed by such Union agencies should draw on the principles underpinning this Regulation and be consistent with Directive (EU) 2016/680.deleted

Amendment 80 #

Proposal for a regulation
Article 31 – paragraph 5 a (new)

5a. Data subjects shall be able to consult the central register referred to in paragraph 5 through the data protection officer of the controller.

Amendment 81 #

Proposal for a regulation
Chapter IV – section 2 – title

SECURITY OF PERSONAL DATA ~~AND CONFIDENTIALITY OF ELECTRONIC COMMUNICATIONS~~

Amendment 82 #

Proposal for a regulation
Article 34 – paragraph 1

~~Union institutions and bodies shall ensure the confidentiality of electronic communications, in particular by securing their electronic communication networks.~~deleted

Amendment 83 #

Proposal for a regulation
Article 34 – paragraph 1

Union institutions and bodies shall ensure the confidentiality of electronic communications, in ~~particular by securing their electronic communication networks~~accordance with Regulation (EU) 2017/XXXX.

Amendment 84 #

Union institutions and bodies shall protect the information related to end–users’ terminal equipment accessing their publicly available websites and mobile applications in accordance with Regulation (EU) XX/XXXX [new ePrivacy Regulation], in particular Article 8 thereof.deleted

Amendment 85 #

Proposal for a regulation
Article 36

Article 36 Directories of users 1. directories of users and access to such directories shall be limited to what is strictly necessary for the specific purposes of the directory. 2. take all the necessary measures to prevent personal data contained in those directories, regardless of whether they are accessible to the public or not, from being used for direct marketing purposes.deleted Personal data contained in Union institutions and bodies shall

Amendment 86 #

Article 38a Confidentiality of electronic communications Union institutions and bodies shall ensure the confidentiality of electronic communications, in particular by securing their electronic communication networks.

Amendment 87 #

Proposal for a regulation
Article 38 b (new)

Article 38b Directories of users 1. Personal data contained in directories of users and access to such directories shall be limited to what is strictly necessary for the specific purposes of the directory. 2. Union institutions and bodies shall take all the necessary measures to prevent personal data contained in those directories, regardless of whether they are accessible to the public or not, from being used for direct marketing purposes.

Amendment 88 #

Proposal for a regulation
Article 42

Article 42 Legislative consultation 1. Following the adoption of proposals for a legislative act and of recommendations or proposals to the Council pursuant to Article 218 TFEU and when preparing delegated acts or implementing acts, which have an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission shall consult the European Data Protection Supervisor. 2. paragraph 1 is of particular importance for the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission may also consult the European Data Protection Board. In such cases the European Data Protection Supervisor and the European Data Protection Board shall coordinate their work with a view to issue a joint opinion. 3. The advice referred to in paragraphs 1 and 2 shall be provided in writing within a period of up to eight weeks of receipt of the request for consultation referred to in paragraphs 1 and 2. In urgent cases, or otherwise appropriate, the Commission may shorten the deadline. 4. This Article shall not apply where the Commission is required, pursuant to Regulation (EU) 2016/679, to consult the European Data Protection Board.deleted Where an act referred to in

Amendment 89 #

Proposal for a regulation
Article 42 – paragraph 1

1. ~~Following t~~When adopti~~on of~~ng proposals for a legislative act and of recommendations or proposals to the Council pursuant to Article 218 TFEU and when preparing delegated acts or implementing acts~~, which have an impact on~~ on legislative and administrative measures relating to the protection of ~~individual~~natural persons’ rights and freedoms with regard to the processing of personal data, the Commission shall consult the European Data Protection Supervisor.

Amendment 9 #

Proposal for a regulation
Recital 9

(9) Directive (EU) 2016/680 provides harmonised rules for the protection and the free movement of personal data processed for the purposes of the prevention, investigation, detection or prosecution of criminal offences or execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. In order to foster the same level of protection for natural persons through legally enforceable rights throughout the Union and to prevent divergences hampering the exchange of personal data between Union bodies, offices and agencies carrying out activities ~~in the fields of judicial~~ which fall within the scoope~~ration in criminal mat~~ of Chapters 4 and ~~police cooperation~~5 of Title V of Part Three TFEU and competent authorities in Member States, the rules for the protection and the free movement of operational personal data processed by such Union ~~agencies should draw on the principl~~bodies, offices uand~~erpinning this Regulation an~~ agencies should be consistent with Directive (EU) 2016/680.

Amendment 90 #

Proposal for a regulation
Article 42 – paragraph 2

Amendment 91 #

Proposal for a regulation
Article 44 – paragraph 4

4. The data protection officer ~~may~~shall be a staff member of the Union institution or, body, o~~r fulfil the tasks on the basis of a service contract~~ffice or agency.

Amendment 92 #

Proposal for a regulation
Article 44 – paragraph 4

4. The data protection officer ~~may~~shall be a staff member of the Union institution or body, or fulfil the tasks on the basis of a service contract.

Amendment 93 #

Proposal for a regulation
Article 46 – paragraph 1 – point b a (new)

(ba) ensure that the fundamental rights and freedoms of data subjects are not adversely affected by processing operations.

Amendment 94 #

Proposal for a regulation
Article 46 – paragraph 1 – point g a (new)

(ga) ensure that the rights and freedoms of data subjects are not adversely affected by processing operations.

Amendment 95 #

Proposal for a regulation
Article 46 – paragraph 1 – point g a (new)

(ga) ensure that the rights and freedoms of data subjects are not adversely affected by the processing.

Amendment 96 #

Proposal for a regulation
Article 48 – paragraph 1

1. A transfer of personal data to a third country or international organisation may take place where the Commission has ~~decided~~adopted an implementing act pursuant to Article 45(3) of Regulation (EU) 2016/679 which stipulates that an adequate level of protection is ensured in the third country, a territory or one or more specified sectors within that third country, or within the international organisation and the personal data are transferred solely to allow tasks covered by the competence of the controller to be carried out. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or the international organisation. The implementing act shall further indicate its territorial and sectorial application and shall identify the supervisory authority. Chapter V of Regulation (EU) 2016/679 shall apply.

Amendment 97 #

Proposal for a regulation
Article 49 – paragraph 5

Amendment 98 #

Proposal for a regulation
Article 54 – paragraph 1

1. The European Parliament and the Council shall appoint the European Data Protection Supervisor by common accord for a term of five years, on the basis of a list drawn up byjointly by the European Parliament, the Council and the Commission following a public call for candidates. The call for candidates shall enable all interested parties throughout the Union to submit their applications. The list of candidates ~~drawn up by the Commission~~ shall be public~~. On the ba~~ and shall consist of ~~the list drawn up by the Commission, t~~at least five candidates. The competent committee of the European Parliament may decide to hold a hearing of the listed candidates in order to enable it to express a preference.

Amendment 99 #