2020/0259(COD) | [ParlTrack]

Proposal for a regulation
Recital 6

Amendment 11 #

Proposal for a regulation
Recital 7

(7) Directive 2002/58/EC does not contain any specific provisions concerning the processing of personal and other data in connection with the provision of electronic communication services for the purpose of detecting and reporting child sexual abuse online and removing child sexual abuse material. However, pursuant to Article 15(1) of Directive 2002/58/EC, Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in, inter alia, Articles 5 and 6 of that Directive, which concern confidentiality of communications and traffic data, for the purpose of prevention, investigation, detection and prosecution of criminal offences linked to child sexual abuse. In the absence of such national legislative measures, and pending the adoption of a new longer-term legal framework to tackle child sexual abuse effectively at Union level as announced in the Strategy, there would be no legal basis for providers of number-independent interpersonal communications services to continue to detect and report child sexual abuse online and ~~remove~~to detect, remove and report child sexual abuse material in their services beyond 21 December 2020.

Amendment 12 #

Hilde VAUTMANS, Abir AL-SAHLANI, María Soraya RODRÍGUEZ RAMOS

Proposal for a regulation
Recital 8

(8) This Regulation therefore provides for a temporary derogation from Article 5(1) and Article 6 of Directive 2002/58/EC, which protect the confidentiality of communications and traffic data. Voluntary measures by providers offering number-independent interpersonal communications services in the Union applied for the sole purpose of detecting and reporting child sexual abuse online and detecting, removing and reporting child sexual abuse material therefore become subject to the safeguards and conditions set out in this Regulation. Since Directive 2002/58/EC was adopted on the basis of Article 114 of the Treaty on the Functioning of the European Union, it is appropriate to adopt this Regulation on the same legal basis. Moreover, not all Member States have adopted legislative measures at national level to restrict the scope of the rights and obligations provided for in those provisions in accordance with Article 15(1) of Directive 2002/58/EC, and the adoption of such measures involves a significant risk of fragmentation likely to negatively affect the internal market and the protection of fundamental rights, notably the rights of children who fall victim to child sexual abuse online across the Union.

Amendment 13 #

Proposal for a regulation
Recital 11

(11) Since the sole objective of this Regulation is to enable the continuation of certain existing activities aimed at combating child sexual abuse online, the derogation provided for by this Regulation should be limited to well-established technology that is regularly used by number-independent interpersonal communications services for the purpose of detecting and reporting child sexual abuse online and removing child sexual abuse material before the entry into force of this Regulation. The reference to the technology includes where necessary any human review directly relating to the use of the technology and overseeing it. The use of the technology in question should therefore be common in the industry, without it necessarily being required that all providers use the technology and without precluding the further evolution of the technology in a privacy-friendly manner. In this respect, it should be immaterial whether or not a particular provider that seeks to rely on this derogation itself already uses such technology on the date of entry into force of this Regulation. The types of technologies deployed should be the least privacy-intrusive in accordance with the state of the art in the industry ~~and should not include systematic filtering and scanning of communications containing text but only look into specific communications in case of concrete elements of suspicion of~~. The technologies deployed must not be able to understand the content of the communications but solely be able to detect patterns of possible child sexual abuse.

Amendment 14 #

Proposal for a regulation
Recital 11

(11) Since the sole objective of this Regulation is to enable the continuation of certain existing activities aimed at combating child sexual abuse online, the derogation provided for by this Regulation should be limited to well-established technology that is regularly used by number-independent interpersonal communications services for the purpose of detecting and reporting child sexual abuse online and removing child sexual abuse material ~~before the entry into force of this Regulation~~. The reference to the technology includes where necessary any human review directly relating to the use of the technology and overseeing it. The use of the technology in question should therefore be common in the industry, without it necessarily being required that all providers use the technology and without precluding the further evolution of the technology in a privacy-friendly manner. In this respect, it should be immaterial whether or not a particular provider that seeks to rely on this derogation itself already uses such technology on the date of entry into force of this Regulation. The types of technologies deployed should be the least privacy-intrusive in accordance with the state of the art in the industry and should not include systematic filtering and scanning of communications containing text but only look into specific communications in case of concrete elements of suspicion of child sexual abuse.

Amendment 15 #

Proposal for a regulation
Recital 11 a (new)

(11a) In order to ensure the effectiveness of the declared objectives, providers of number-independent interpersonal communications services should be encouraged to incorporate effective measures for proper supervision in families;

Amendment 16 #

Proposal for a regulation
Recital 14

(14) In order to ensure transparency and accountability in respect of the activities undertaken pursuant to the derogation, the providers should publish reports on an annual basis on the processing falling within the scope of this Regulation, including on the type and volumes of data processed, number of cases ~~identified~~of child sexual abuse identified with gender- disaggregated data, when possible, measures applied to select and improve key indicators, the numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied.

Amendment 17 #

Proposal for a regulation
Article 1 – paragraph 1

Amendment 18 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point a

~~(a) material constituting child pornography as defined in Article 2, point (c), of Directive 2011/93/EU of the European Parliament and of the Council;~~deleted

Amendment 19 #

Hilde VAUTMANS, Abir AL-SAHLANI, María Soraya RODRÍGUEZ RAMOS

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point a

(a) material constituting child pornography as defined in Article 2, point (c), of Directive 2011/93/EU of the European Parliament and of the Council, this concept being extended to include any obscene image which shows or exhibits any intimate part of a child regardless of their gender and which promotes or incites a disruptive emotional disturbance, thereby violating one’s dignity as a human being;

Amendment 20 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point a a (new)

(a a) ‘solicitation’as: (i) the proposal by an adult to meet a child who has not reached the age of sexual consent, for the purpose of committing any of the offences referred to in Article 3(4) and Article 5(6) of Directive 2011/93/EU; (ii) an attempt to commit the offences provided for in Article 5(2) and (3) by an adult soliciting a child who has not reached the age of sexual consent to provide child pornography depicting that child.

Amendment 21 #

Hilde VAUTMANS, Abir AL-SAHLANI, María Soraya RODRÍGUEZ RAMOS

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point b

(b) solicitation of children for the purpose of engaging in sexual activities with a child or of producing child pornography by any of the following: (i) luring the child by means of offering gifts or other advantages; (ii) threatening the child with a negative consequence likely to have a significant impact on the child; (iii) presenting the child with pornographic materials or making them available to the child .deleted

Amendment 22 #

Hilde VAUTMANS, Abir AL-SAHLANI, María Soraya RODRÍGUEZ RAMOS

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point c

Amendment 23 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point c a (new)

(c a) ‘sex extortion’

Amendment 24 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 a (new)

(2 a) ‘child’means any person below the age of sexual consent;

Amendment 25 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 b (new)

(2 b) ‘child sexual abuse material’ means: (a) material constituting child pornography as defined in Article 2, point (c), of Directive 2011/93/EU of the European Parliament and of the Council; (b) material constituting ‘child prostitution’ as defined in Article 2, point (d), of Directive 2011/93/EU of the European Parliament and of the Council.

Amendment 26 #

Proposal for a regulation
Article 3 – paragraph 1 – introductory part

The specific obligations set out in Article 5(1) and Article 6 of Directive 2002/58/EC shall not apply to the processing of personal ~~and other~~ data in connection with the provision of number-independent interpersonal communications services strictly necessary for the use of technology for the sole purpose of detecting and removing child sexual abuse material and detecting ~~or reporting~~ child sexual abuse online or reporting both to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, provided that:

Amendment 27 #

Proposal for a regulation
Article 3 – paragraph 1 – point a

Amendment 28 #

Proposal for a regulation
Article 3 – paragraph 1 – point d

(d) the processing is limited to what is strictly necessary for the purpose of detection and reporting of child sexual abuse online and detection, reporting and removal of child sexual abuse material and~~, unless~~. Where no child sexual abuse online has been detected and confirmed as such, ~~is erased immediately;~~the relevant data shall be retained solely for the following purpose and only for the time period necessary:

Amendment 29 #

Proposal for a regulation
Article 3 – paragraph 1 – point d – indent 1 (new)

- for its reporting and to respond to proportionate requests by law enforcement and other relevant public authorities;

Amendment 30 #

Proposal for a regulation
Article 3 – paragraph 1 – point d – indent 2 (new)

- for the blocking of the concerned user’s account;

Amendment 31 #

Proposal for a regulation
Article 3 – paragraph 1 – point d – indent 3 (new)

- in relation to data reliably identified as child pornography, for the creation of a unique, non-reconvertible digital signature (‘hash’);

Amendment 32 #

Proposal for a regulation
Article 3 – paragraph 1 – point d – indent 4 (new)

- for proceedings of administrative or judicial review or remedy.

Amendment 33 #

Proposal for a regulation
Article 3 – paragraph 1 – point e

(e) the provider annually publishes a report on its related processing, including on the type and volumes of data processed, number of cases ~~identified~~of child sexual abuse and child sexual abuse material identified, reported and removed, showing gender disaggregated data, when possible, measures applied to select and improve key indicators, numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied.

Amendment 34 #

Proposal for a regulation
Article 3 – paragraph 2

As regards point (d), where child sexual abuse online has been detected and confirmed as such, the relevant data may be retained solely for the following purposes and only for the time period necessary: — for its reporting and to respond to proportionate requests by law enforcement and other relevant public authorities; — for the blocking of the concerned user’s account; — in relation to data reliably identified as child pornography, for the creation of a unique, non-reconvertible digital signature (‘hash’).deleted

Amendment 6 #

Proposal for a regulation
Recital 4

(4) Sexual abuse and sexual exploitation of children constitute serious violations of human rights, in particular of the rights of children to be protected from all forms of violence, abuse and neglect, maltreatment or exploitation, including sexual abuse, as provided for by the 1989 United Nations Convention on the Rights of the Child and by the Charter. Digitisation has brought about many benefits for society and the economy, but also challenges including an increase of child sexual abuse online. The protection of children online is one of the Union's priorities. On 24 July 2020, the Commission adopted an EU strategy for a more effective fight against child sexual abuse9 (“the Strategy”), which aims to provide an effective response, at Union level, to the crime of child sexual abuse. _________________ 9 Communication from the ComIn addition, the Istanbul Convention recognises that girls are often exposed to serious forms of gender-based violence including cyberviolence. Digitisation has brought about many benefits for society and the economy, but also challenges, notably increased child sexual abuse ans child sexual exploitation online, which has been exacerbated during the COVID- 19 pandemic, resulting from broader access to potential victims and a sharp rise in the exchange of child sexual abuse material between child sexual offenders. There is also a growing number of cases of grooming during the COVID-19 pandemic, including an increase of self- generated content. Moreover, the increased misuse of privacy-enhancing technologies by offenders to disguise their horrendous actions has made it more difficult for law-enforcement authorities to prevent, detect, investigate and prosecute child sexual exploitation online. According to Europol, the proliferation of anonymisation tools and the higher amount of child sexual abuse material may also lead to a higher risk of repeat victimissation to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, EU strategy for a more effective fight against child sexual abuse, 24.7.2020 COM(2020) 607 final8a. The protection of children online is one of the Union's priorities as they are the most vulnerable in our society and not able to defend themselves. _________________ 8aEuropol report "Exploiting isolation: Offenders and victims of online child sexual abuse during the Covid- 19pandemic", published on 19 June 2020.

Amendment 7 #

Proposal for a regulation
Recital 4 a (new)

(4 a) Girls and young women are particularly exposed to the risks of sexual abuse, as well as sexual exploitation and account for the overwhelming majority of cases of child sexual abuse online. According to THORN and the Canadian Centre for Child Protection 80% of the children victim of sexual abuse were girls. Figures from a 2019 report from INHOPE show that 91 % of victims were girls, 7 % were boys and the medianage of victims is decreasing with 92 % of victims under the age of 13.According to End Child Prostitution, Child Pornography & Trafficking of Children for Sexual Purposes (ECPAT) international report from 2017 child sexual offenders are predominantly male10a, which is relevant when it comes to the definition of key indicators. It is therefore important that girls and boys have access to safe, accessible and age appropriate channels to report the abuse without fear, in particular when the abuser is in the inner circle of the victim, since in such instances the reporting is low. _________________ 10aECPAT Journal “End Child Sexual Exploitation international report”, published in April 2017; https://www.ecpat.org/wp- content/uploads/2017/04/Journal_No12- ebook.pdf

Amendment 8 #

Proposal for a regulation
Recital 4 b (new)

(4 b) On 24 July 2020, the Commission adopted an EU strategy for a more effective fight against child sexual abuse9b (“the Strategy”), which aims to provide an effective response, at Union level, to the crime of child sexual abuse with due regard to different forms of sexual abuse experienced by girls and boys. As part of the Strategy, the Commission announced that it will propose sector-specific legislation including “clear mandatory obligations to detect and report child and young girls sexual abuse online to bring more clarity and certainty to the work of both law enforcement and relevant actors in the private sector to tackle online abuse”. Nevertheless the strategy, there is a great need for preventive measures and a more targeted approach to take into account the specific circumstances and needs of various vulnerable groups of children, in particular girls. _________________ 9b Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, EU strategy fora more effective fight against child sexual abuse, 24.7.2020 COM(2020)0607 final.

Amendment 9 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Recital 5

(5) Number-independent communication services have a major role to play in detecting cases of child sexual abuse online and in removing at source child sexual abuse material from their networks to avoid further victimisation as every new visualisation of the material is harmful for the victim. Underaged children must have access to safe, accessible and age appropriate channels to report the abuse without fear, in particular when the abuser is in the inner circle of the victim. Certain providers of number- independent interpersonal communications services, such as webmail and messaging services, are already using specific technologies to detect and report child sexual abuse online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse~~, or to remove~~ and child exploitation, or to detect, remove and report child sexual abuse material in their services, on a voluntary basis. To enable the identification of the child victims and to properly identify detection errors by the providers, all the instances of possible child sexual abuse online should be reported to law enforcement authorities and to organisations acting in the public interest against child sexual abuse. Those organisations refer to national hotlines for reporting child sexual abuse material, as well as to organisations whose purpose is to reduce child sexual exploitation, and prevent child victimisation, located both within the Union and in third countries. Collectively, those voluntary activities play a valuable role in enabling the identification and rescue of victims, and reducing the further dissemination of child sexual abuse ans child sexual exploitation material, while also contributing to the identification and investigation of offenders, and the prevention of child sexual abuse and child sexual exploitation offences.

source: 660.099

2020/11/26 LIBE 161 amendments...

Amendment 100 #

Proposal for a regulation
Recital 9

(9) Given that electronic communications involving natural persons will normally qualify as personal data, this Regulation should also be based on Article 16 ~~of the Treaty~~TFEU, which provides a specific legal basis for the adoption of rules relating to the protection of individuals with regard to the processing of personal data by Union institutions and by the Member States when carrying out activities which fall within the scope of Union law, and rules relating to the free movement of such data.

Amendment 101 #

Proposal for a regulation
Recital 10

(10) To the extent that processing of personal data in connection with the provision of electronic communications services by number-independent interpersonal communications services for the sole purpose of detecting and reporting child sexual abuse ~~online~~and exploitation material and removing child sexual abuse and exploitation material falls within the scope of the derogation provided for by this Regulation, Regulation (EU) 2016/679 applies to such processing, including the requirement to carry out an assessment of the impact of the envisaged processing operations where appropriate pursuant to Article 35 of that Regulation prior to the deployment of the technologies concerned, and the requirement pursuant to Article 36 thereof to consult the competent supervisory authority prior to the processing.

Amendment 102 #

Proposal for a regulation
Recital 10 a (new)

(10a) Since this Regulation provides for a restriction to the right of confidentiality of communications, the consultation of the supervisory authority pursuant to Article 36 of Regulation (EU) 2016/679 should be mandatory.

Amendment 103 #

Amendment 104 #

Proposal for a regulation
Recital 11

(11) Since the sole objective of this Regulation is to enable the limited and targeted, modified continuation of certain existing activities aimed at combating child sexual abuse and exploitation online, the derogation provided for by this Regulation should be limited to well-established technology that is ~~regularly~~ used by number- independent interpersonal communications services for the purpose of detecting, reporting and re~~port~~moving child sexual abuse ~~online and removing child sexual abuse material before the entry into force of this Regul~~and exploitation material, which functions by matching images and videos against a database of unique, non-reconvertible digital signatures (“hashes”) of known child sexual abuse and exploitation material. This database should be operated by public authorities in the Union, so as to not be dependent on private entities in third countries with unclear legal grounds and obligations. The reference to the technology includes ~~where necessary any~~ human review directly relating to the use of the technology and overseeing it, and human review for each case of reporting detected child sexual abuse and exploitation material to law enforcement authorities. The use of the technology in question should therefore be common in the industry, without it necessarily being required that all providers use the technology and without precluding the further evolution of the technology in a privacy-friendly manner. In this respect, it should be i~~mmaterial~~rrelevant whether or not a particular provider that seeks to rely on th~~is derog~~e restriction provided for by this Regulation itself already uses such technology on the date of entry into force of this Regulation. The types of technologies deployed should be the least privacy-intrusive in accordance with the state of the art ~~in the industry~~ and should not include ~~systematic~~ filtering and scanning of communications containing text ~~but only look into specific communications in case of concrete elements of suspicion of child sexual abuse~~or audio.

Amendment 105 #

Proposal for a regulation
Recital 11

(11) Since the sole objective of this Regulation is to enable the continuation of ~~certain existing~~ activities aimed at combating child sexual abuse online which comply with Regulation (EU) 2016/679, the derogation provided for by this Regulation should be limited to ~~well-established~~ technology that is ~~regularly~~ used by number-independent interpersonal communications services for the purpose of detecting and reporting child sexual abuse online and ~~removing child sexual abuse material before the entry into force of this Regulation~~detecting, removing and reporting child sexual abuse material and has been subject to prior consultation in line with Article 36 of Regulation (EU) 2016/679. The reference to the technology includes where necessary any human review directly relating to the use of the technology and overseeing its functioning with a view to avoid unnecessary interference with fundamental rights. The use of the technology in question should therefore be common in the industry, without it necessarily being required that all providers use the technology and without precluding the further evolution of the technology in a privacy-friendly manner. In this respect, it should be immaterial whether or not a particular provider that seeks to rely on this derogation itself already uses such technology on the date of entry into force of this Regulation. The ~~types of~~ technologies deployed should be the least privacy-intrusive in accordance with the state of the art in the industry and should not include systematic filtering and scanning of communications containing text but only look into specific communications in case of concrete elements of suspicion ofin conformity with the principle of data protection by design and by default as defined in Regulation (EU) 2016/679. To the extent that they are used to scan communications containing text, they should not be able to understand the substance of the content but solely detect patterns which point to possible child sexual abuse.

Amendment 106 #

Proposal for a regulation
Recital 11

(11) Since the sole objective of this Regulation is to enable the continuation of certain existing activities aimed at combating child sexual abuse online, the derogation provided for by this Regulation should be limited to well-established technology that is regularly used by number-independent interpersonal communications services for the purpose of detecting and reporting child sexual abuse online and removing child sexual abuse material ~~before the entry into force of this Regulation~~. The reference to the technology includes where necessary any human review directly relating to the use of the technology and overseeing it. The use of the technology in question should therefore be common in the industry, without it necessarily being required that all providers use the technology and without precluding the further evolution of the technology in a privacy-friendly manner. In this respect, it should be immaterial whether or not a particular provider that seeks to rely on this derogation itself already uses such technology on the date of entry into force of this Regulation. The types of technologies deployed should be the least privacy-intrusive in accordance with the state of the art in the industry and should ~~not~~ include ~~systematic~~in particular filtering and scanning of communications containing text ~~but only look into specific communications in case of concrete elements of suspicion of child sexual abuse~~in cases where these key indicators are present (keywords and objectively identified risk factors).

Amendment 107 #

Proposal for a regulation
Recital 11

(11) Since the sole objective of this Regulation is to enable the continuation of certain existing activities aimed at combating child sexual abuse online, the derogation provided for by this Regulation should be limited to well-established technology that is regularly used by number-independent interpersonal communications services for the purpose of detecting and reporting child sexual abuse online and removing child sexual abuse material before the entry into force of this Regulation. The reference to the technology includes where necessary any human review directly relating to the use of the technology and overseeing it. The use of the technology in question should therefore be common in the industry, without it necessarily being required that all providers use the technology and without precluding the further evolution of the technology in a privacy-friendly manner. In this respect, it should be immaterial whether or not a particular provider that seeks to rely on this derogation itself already uses such technology on the date of entry into force of this Regulation. The types of technologies deployed should be the least privacy-intrusive in accordance with the state of the art in the industry and should not include systematic filtering and scanning of communications containing text but only look into specific communications in case of concrete elements of suspicion of child sexual abuse and child pornography.

Amendment 108 #

Proposal for a regulation
Recital 11

(11) Since the sole objective of this Regulation is to enable the continuation of certain existing activities aimed at ~~combat~~detecting, reporting and removing child sexual abuse material online, the derogation provided for by this Regulation should be limited to well-established technology that has been subject to prior evaluation by data protection supervisory authorities, is regularly used by number- independent interpersonal communications services for the purpose of detecting and reporting child sexual abuse online and removing child sexual abuse material before the entry into force of this Regulation. The reference to the technology includes where necessary any human review directly relating to the use of the technology and overseeing it. The use of the technology in question should therefore be common in the industry, without it necessarily being required that all providers use the technology and without precluding the further evolution of the technology in a privacy-friendly manner. In this respect, it should be immaterial whether or not a particular provider that seeks to rely on this derogation itself already uses such technology on the date of entry into force of this Regulation. The types of technologies deployed should be the least privacy-intrusive in accordance with the state of the art in the industry and should not include systematic filtering and scanning of communications containing text ~~but only look into specific communications in case of concrete elements of suspicion of child sexual abuse~~.

Amendment 109 #

Proposal for a regulation
Recital 11

(11) Since the sole objective of this Regulation is to enable the continuation of certain existing activities aimed at combating child sexual abuse online, the derogation provided for by this Regulation should be limited to well-established technology that is regularly used by number-independent interpersonal communications services for the purpose of detecting and reporting child sexual abuse online and removing child sexual abuse material before the entry into force of this Regulation. The reference to the technology includes where necessary any human review directly relating to the use of the technology and overseeing it. The use of the technology in question should therefore be common in the industry, without it necessarily being required that all providers use the technology and without precluding the further evolution of the technology in a privacy-friendly manner. In this respect, it should be immaterial whether or not a particular provider that seeks to rely on this derogation itself already uses such technology on the date of entry into force of this Regulation. The types of technologies deployed should be the least privacy-intrusive in accordance with the state of the art in the industry ~~and should not include systematic filtering and scanning of communications containing text but only look into specific communications in case of concrete elements of suspicion of~~. The technologies deployed should not be able to understand the content of the communications but solely be able to detect patterns of possible child sexual abuse.

Amendment 110 #

Proposal for a regulation
Recital 11 a (new)

Amendment 111 #

Proposal for a regulation
Recital 11 a (new)

(11a) EU Member States should provide for severe criminal penalties in their national law to more effectively combat sexual abuse of children, sexual exploitation of children and child pornography and to deter such crimes.

Amendment 112 #

Proposal for a regulation
Recital 12

(12) In order to ensure accuracy and reliability as much as possible, the technology used should, in accordance with the state of the art in the industry, be such as to limit the error rate of false positives to ~~the maximum exten~~at pmos~~sible~~t 1 in 50 billion and, where necessary, to rectify without delay any such errors that may nonetheless occur.

Amendment 113 #

Proposal for a regulation
Recital 12 a (new)

(12a) Providers of number-independent interpersonal communications services should respect the different rules regarding the age of consent in the Member States. If users have reached the age of consent according to the Member State of which they are citizens, no reporting on child solicitation to law enforcement authorities should be done.

Amendment 114 #

Proposal for a regulation
Recital 13

(13) The personal ~~and other~~ data used when carrying out the activities covered by the derogation set out in this Regulation, should be minimised so as to ensure that the interference with the confidentiality of communications as well as the period during which the relevant data is subsequently pre~~tain~~served in case of positive results~~, should be minimised so as to ensure that the derogation remains limited to what is strictly necessary.~~ remain limited to what is strictly necessary and proportionate. The preservation is necessary and justified for reporting to law enforcement and other relevant public authorities, including organisations acting in the public interest against child sexual abuse, and for responding to their requests, for the blocking of the account of the user concerned, for the creation of a unique, non-reconvertible digital signature (‘hash’) in relation to data reliably identified as child pornography, for improving and measuring the accuracy of the technology used, and for proceedings of administrative or judicial review or remedy. To ensure proportionality, the period of preservation should not exceed nine months but may be prolonged in justified cases.

Amendment 115 #

Proposal for a regulation
Recital 13

(13) The personal and other data used when carrying out the activities covered by the ~~derogation set out~~restriction provided for in this Regulation, as well as the period during which the data is subsequently retained in case of positive results, should be minimised so as to ensure that the ~~deroga~~restriction remains limited to what is strictly necessary. and proportionate. Therefore the providers should be allowed to scan the content of the communications only where this has been ordered by a judicial authority. Such orders should be strictly limited to the communication of persons for whom a prior suspicion based on factual evidence exists that they are involved in the distribution of child sexual abuse and exploitation material. These orders should also be limited in time to the shortest period possible for fulfilling the purpose.

Amendment 116 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Recital 13 a (new)

(13a) While implementing solutions aimed to protect children from on-line exploitation, it is necessary to take into account approach that assumes protection of individual rights, including the right to privacy and data protection.

Amendment 117 #

Proposal for a regulation
Recital 14

(14) In order to ensure transparency and accountability in respect of the activities undertaken pursuant to the ~~derogation, the providers should publish reports~~restriction, provided for by this Regulation, interpersonal communications service providers should publish and submit reports within six months after the entry into force of this Regulation, and thereafter on an annual basis, on the processing falling within the scope of this Regulation, including on the type and volumes of data processed, ~~number of cases identified, measures applied to select and improve key indicator~~the legal basis for the processing of data pursuant to Article 6 of Regulation (EU) 2016/679, the legal basis for the transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, the number of cases identified, the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of those proceedings, the numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679. Providers should also submit their reports to the supervisory authorities in accordance with Regulation (EU) 2016/679.

Amendment 118 #

Proposal for a regulation
Recital 14

(14) In order to ensure transparency and accountability in respect of the activities undertaken pursuant to the ~~derogation, th~~restriction provided for by this Regulation, interpersonal communications service providers should publish reports on an annual basis on the processing falling within the scope of this Regulation, including on the type and volumes of data processed, number of cases identified, number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of those proceedings, measures applied to select and improve key indicators, the numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied.

Amendment 119 #

Proposal for a regulation
Recital 14

(14) In order to ensure transparency and accountability in respect of the activities undertaken pursuant to the derogation, the providers should ~~publish~~make publicly available reports on an annual basis on the processing falling within the scope of this Regulation, including on the type and volumes of data processed, the legal basis for processing, number of cases identified, measures applied to select and improve key indicators, the numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied.

Amendment 120 #

(14a) In order to support the responsible supervisory authorities in their task, the European Data Protection Board should issue guidelines on compliance with Regulation (EU) 2016/679 of the processing falling within the scope of the restriction laid down in this Regulation. Those guidelines should in particular assist the supervisory authorities in providing advice in the framework of the prior consultation procedure set out in Article 36 of Regulation (EU) 2016/679, that should be carried out when assessing whether an established or new technology to be used is state-of-the-art, the least privacy-intrusive and operating on an adequate legal basis under Regulation (EU) 2016/679.

Amendment 121 #

Proposal for a regulation
Recital 15

(15) This Regulation should enter into force on the third day following that of its publication in the Official Journal of the European Union, in order to ensure that it is applicable as from 21 December 2020.deleted

Amendment 122 #

Proposal for a regulation
Recital 15

Amendment 123 #

Proposal for a regulation
Recital 16

(16) This Regulation restricts the right to protection of the confidentiality of communications and derogates from the decision taken in Directive (EU) 2018/1972 to subject number-independent interpersonal communications services to the same rules as all other electronic communications services as regards privacy. The period of application of this Regulation should, therefore, be limited until 31 December 2025, that is to say for a time period reasonably required for the adoption of a new long-term legal framework~~, with more elaborate safeguards~~. This new legal framework will provide a new legal basis and mandatory requirements for companies to detect and report child sexual abuse online and remove child sexual abuse and child sexual exploitation material online. The new legal framework should also incorporate more elaborate safeguards, as well as the creation of a European Centre to prevent and counter child sexual abuse, to improve transparency and accountability. In case the long-term legislation is adopted and will enter into force before that date, that legislation should repeal this Regulation.

Amendment 124 #

Proposal for a regulation
Recital 16

(16) This Regulation restricts the right to protection of the confidentiality of communications ~~and derogates from the decision taken in Directive (EU) 2018/1972 to subject~~for the sole purpose of combatting child sexual abuse and child sexual abuse material online. For all other activities by providers of number- independent interpersonal communications services t~~o the same rule~~hat fall within the scope of Directive 2002/58/EC, the decision taken in Directive (EU) 2018/1972 to subject those providers to the same rules and specific obligations as all other electronic communications services as regards privacy apply. The period of application of this Regulation should~~, therefore,~~ be limited until 31 December 2025~~, that is to say for a time period reasonably required~~ in order to provide for reasonable time for the adoption of a new long-term legal framework, with more elaborate safeguards. In case the long-term legislation is adopted and will enter into force before that date, that legislation should repeal this Regulation.

Amendment 125 #

Proposal for a regulation
Recital 16

(16) This Regulation restricts the right to protection of the confidentiality of communications and derogates from the decision taken in Directive (EU) 2018/1972 to subject number-independent interpersonal communications services to the same rules as all other electronic communications services as regards privacy. The period of application of this Regulation should, therefore, be limited until 31 December 2025, that is to say for a time period reasonably required for the adoption of a new long-term legal framework, with more elaborate safeguards, such as the creation of a European Centre to prevent and counter child sexual abuse, to improve transparency and accountability. In case the long-term legislation is adopted and will enter into force before that date, that legislation should repeal this Regulation.

Amendment 126 #

Proposal for a regulation
Recital 16

(16) This Regulation restricts the right to protection of the confidentiality of communications and derogates from the decision taken in Directive (EU) 2018/1972 to subject number-independent interpersonal communications services to the same rules as all other electronic communications services as regards privacy~~. The period of application of this Regulation should, the~~, for the sole purpose of removing child sexual abuse and exploitation material and detecting or refpor~~e, be limited until 31 December 2025, that is to say for a time period reasonably required for the adoption of a new long-term legal framework, with more elaborate safeguards~~ting child sexual abuse and exploitation material online to law enforcement authorities. The period of application of this Regulation should, therefore, be limited until 31 December 2022. In case the long- term legislation is adopted and will enter into force before that date, that legislation should repeal this Regulation.

Amendment 127 #

Proposal for a regulation
Recital 16

Amendment 128 #

Silvio LEGA, Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Recital 16

Amendment 129 #

Proposal for a regulation
Recital 17

(17) Providers of number-independent interpersonal communications services should be subject to the specific obligations set out in Directive 2002/58/EC with regard to any other activities that fall within its scope.deleted

Amendment 130 #

Proposal for a regulation
Recital 17 a (new)

(17a) The supervisory authorities responsible for monitoring the application of this Regulation should be the same as the independent supervisory authorities designated pursuant to Chapter VI of Regulation (EU) 2016/679.

Amendment 131 #

Proposal for a regulation
Recital 17 b (new)

(17b) End-to-end encryption is an important tool to guarantee secure and confidential communications of users, including that of children. Any weakening of encryption can potentially be abused by malicious third parties. Nothing in this Regulation should therefore be interpreted as prohibiting or weakening end-to-end encryption.

Amendment 132 #

(17c) The confidentiality of communications is a fundamental right guaranteed under Article 7 of the Charter. It is thus also a prerequisite for secure communications between victims of child sexual abuse and a trusted adult or organisations active in the fight against child sexual abuse as well as in communications between victims and their lawyers.

Amendment 133 #

Proposal for a regulation
Recital 17 d (new)

(17d) All communications between an accused or convicted person and their lawyer should be protected, in order to guarantee the fundamental rights to an effective remedy and to a fair trial pursuant to Article 47 of the Charter as well as the right to the presumption of innocence and the right of defence pursuant to Article 48 thereof.

Amendment 134 #

(17e) This Regulation should apply only to videos or images exchanged over messaging or email services. It should not apply to the scanning of text or audio communication.

Amendment 135 #

Proposal for a regulation
Recital 18 a (new)

(18a) Images and videos depicting child sexual abuse material concern the child's intimacy, and are therefore special categories of data; the acts of sharing, processing and disseminating those contents are unlawful. Thus there should be a clear legal basis allowing companies to take measures in order to prevent that processing, ensure that their services are not abused for the purpose of disseminating images and videos of child sexual abuse online, and delete those contents. The practices of those companies should register within the specific context of this Regulation, and respect the safeguards included in it.

Amendment 136 #

Proposal for a regulation
Recital 18 a (new)

(18a) The images and videos depicting child sexual abuse material concern the child's intimacy, and are therefore special categories of data whose processing to enable its dissemination is unlawful. Companies should not be prevented from taking measures to prevent that processing and ensure that their services are not abused for the purpose of disseminating images and videos of child sexual abuse.

Amendment 137 #

Proposal for a regulation
Recital 19

(19) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council7 and delivered its opinion on ~~[…]~~10 November 2020, _________________ 7 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ C 20, 21.1.2019, p. 1).

Amendment 138 #

Proposal for a regulation
Recital 19

Amendment 139 #

Proposal for a regulation
Article 1 – paragraph 1

This Regulation lays down temporary and strictly limited rules derogating from certain obligations laid down in Directive 2002/58/EC, with the sole objective of enabling providers of number-independent interpersonal communications services to ~~continue the use of technologi~~use specific technologies in limited cases for the processing of personal and other data to the extent strictly necessary to detect, report and re~~port~~move child sexual abuse ~~online and remove child sexual abuse material on their service~~and exploitation material consisting of images or videos on their services. This Regulation therefore creates a legal basis for the processing of that data pursuant to Article 6(1)(e) of Regulation (EU) 2016/679, and is without prejudice to that Regulation. This Regulation shall not apply to text or audio communications.

Amendment 140 #

Proposal for a regulation
Article 1 – paragraph 1

This Regulation lays down temporary and strictly limited rules derogating from certain obligations laid down in Directive 2002/58/EC, with the sole objective of enabling providers of number-independent interpersonal communications services to ~~continue the use of~~use technologies for the processing of personal ~~and other~~ data to the extent necessary and proportionate to detect and report child sexual abuse online and to detect, report and remove child sexual abuse material on their services, while fully respecting the rights and obligations laid down in Regulation (EU) 2016/679. It shall apply to the analysis of images, video, text and audio exchanged via number-independent interpersonal communications services.

Amendment 141 #

Proposal for a regulation
Article 1 – paragraph 1

This Regulation lays down temporary and strictly limited rules ~~derogating from certain~~restricting certain rights and obligations laid down in Directive 2002/58/EC, with the sole objective of enabling providers of certain number-independent interpersonal communications services ~~to continue~~, i.e. providers of messaging or web-based emailing services, to continue, without prejudice to Regulation (EU) 2016/679, the use of specific technologies, i.e. the use of a non- reconvertible digital signature (‘hash’)”, for the processing of personal ~~and other~~ data to the extent strictly necessary to detect and report child sexual abuse online and remove child sexual abuse material on their services.

Amendment 142 #

Proposal for a regulation
Article 1 – paragraph 1

This Regulation lays down temporary and strictly limited rules ~~derogating from certain~~restricting certain rights and obligations laid down in Directive 2002/58/EC, with the sole objective of enabling providers of number- independent interpersonal communications services to ~~continue the use of~~use technologies for the processing of personal and other data to the extent necessary to detect and report child sexual abuse online and remove child sexual abuse material on their services, without prejudice to Regulation (EU) 2016/679.

Amendment 143 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Article 1 – paragraph 1

Amendment 144 #

(2) ‘child sexual abuse ~~online~~and exploitation material’ means:

Amendment 145 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point a

~~(a) material constituting child pornography as defined in Article 2, point (c), of Directive 2011/93/EU of the European Parliament and of the Council;~~deleted

Amendment 146 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point a

Amendment 147 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point b

Amendment 148 #

Amendment 149 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point b – introductory part

(b) solicitation ~~of children for the purpose of engaging in sexual activities with a child or of producing child pornography by any of the following~~as:

Amendment 150 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point b – introductory part

(b) ‘solicitation of children ~~for the purpose of engaging in sexual activities with a child or of producing child pornography by any of the following:~~’ means any intentional conduct constituting a criminal offense under Article 6 of Directive 2011/93/EU;

Amendment 151 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point b – point i

(i) ~~luring the child by means of offering gifts or other advantages~~the proposal by an adult to meet a child for the purpose of committing any of the offences referred to in Articles 3(4) and 5(6) of Directive 2011/93/EU;

Amendment 152 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

(ii) ~~threatening the child with a negative consequence likely to have a significant impact on~~an attempt to commit the offences provided for in Article 5(2) and (3) of Directive 2011/93/EU by an adult soliciting a child to provide child pornography depicting theat child;

Amendment 153 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point b – point iii

~~(iii) presenting the child with pornographic materials or making them available to the child.~~deleted

Amendment 154 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point c

~~(c) ‘pornographic performance’ as defined in Article 2(e) of Directive 2011/93/EU.~~deleted

Amendment 155 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point c

~~(c) ‘pornographic performance’ as defined in Article 2(e) of Directive 2011/93/EU.~~deleted

Amendment 156 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Article 2 – paragraph 1 – point 2 – point c a (new)

(ca) 'child prostitution' as defined in Article 2(d) of Directive 2011/93/EU.

Amendment 157 #

(ca) ‘child prostitution’ as defined in Article 2, point (d), of Directive 2011/93/EU.

Amendment 158 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 a (new)

(2a) ‘positive hit’ means a match resulting from a comparison between an image or a video and a unique, non- reconvertible digital signature (a ‘hash’) from a data base containing verified child sexual abuse material online and maintained by an organisation recognised by the Commission pursuant to Article [...] of this Regulation.

Amendment 159 #

Proposal for a regulation
Article 2 – paragraph 1 – point 2 a (new)

(2a) ‘child sexual abuse material’ means: (a) material constituting 'child pornography' as defined in Article 2, point (c), of Directive 2011/93/EU; (b) material constituting ‘pornographic performance’ as defined in Article 2(e) of Directive 2011/93/EU.

Amendment 160 #

Proposal for a regulation
Article 3 – Title

Scope of the ~~deroga~~restriction

Amendment 161 #

Proposal for a regulation
Article 3 – paragraph 1 – introductory part

The s~~pecific~~cope of the specific rights and obligations set out in Article 5(1) and Article 6(1) of Directive 2002/58/EC shall ~~not apply to the processing of personal and other data in connection with the provision of~~be restricted with regard to the confidentiality of communications involving the processing of personal and other data in connection with the exchange of videos or images through messaging or web-based email services by number- independent interpersonal communications services, provided that such restriction is strictly necessary for the use of technology for the sole purpose of ~~removing child sexual abuse material and~~ detecting or, reporting ~~child sexual abuse online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, provided that:~~ to the judicial authority that ordered the processing, and removing child sexual abuse and exploitation material.

Amendment 162 #

Proposal for a regulation
Article 3 – paragraph 1 – introductory part

The s~~pecific~~cope of the specific rights and obligations set out in Article 5(1) and Article 6(1) of Directive 2002/58/EC shall ~~not apply~~be restricted with regard to the processing of personal and other data in connection with the provision of number-independent interpersonal communications services, provided that such a restriction is strictly necessary for the use of technology for the sole purpose of removing child sexual abuse material and detecting or reporting child sexual abuse online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, provided that:

Amendment 163 #

The specific obligations set out in Article 5(1) and Article 6 of Directive 2002/58/EC shall not apply to the processing of personal and other data in connection with the provision of number-independent interpersonal communications services strictly necessary for the use of technology for the sole purpose of removing child sexual abuse material and block these websites and detecting or reporting child sexual abuse online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, provided that:

Amendment 164 #

Proposal for a regulation
Article 3 – paragraph 1 – point a

Amendment 165 #

Proposal for a regulation
Article 3 – paragraph 1 – point a

(a) the processing is proportionate and limited to well-established technologies regularly used by providers of number- independent interpersonal communications services for that sole purpose ~~before the entry into force of this Regulation, and that are in accordance~~and provided that they fulfil all of the following conditions: (i) they are in accordance with state of the art used in the industry and are the least privacy-intrusive; (ii) a data protection impact assessment pursuant to Article 35 of Regulation (EU) 2016/679 and a prior consultation procedure pursuant to Article 36 of Regulation (EU) 2016/679 have been conducted in accordance with Article 3a of this Regulation; iii) the processing is based on point (d) or (e) of Article 6(1) of Regulation (EU)2016/679, provided that, without prejudice to Regulation (EU) 2016/ 679, all the conditions laid down in this Regulation have been complied with; iv) the categories of personal data to be processed for each processing operation are the content data, related traffic data as well as data generated through such processing; (v) the scope of the restriction to the rights to confidentiality and protection of personal data is clearly defined; (vi) there are internal procedures within the ~~state of the art used in the industry and are the least privacy-intrusive;~~ number-independent interpersonal communications service to prevent abuse, unauthorised access or transfers; (vii) the identity and categories of the controller or controllers are clearly specified; viii) following a 'positive hit', the maximum storage period of the content data, related traffic data and data generated through such processing is one month after which the data have to be automatically and permanently deleted, unless they are required for the establishment, exercise or defence of legal claims; ix) human oversight and intervention is ensured by the provider of number- independent interpersonal communications services for any processing of personal data, and no ʻpositive hitʼ is sent to law enforcement authorities or organisations acting in the public interest without prior human oversight; (x) appropriate procedures and redress mechanisms are in place to ensure that individuals can lodge complaints with the provider of a number-independent interpersonal communications service within a reasonable timeframe for the user to present their views in accordance with Article 3c; xi) without prejudice to the information provided for in Article 13 of Regulation (EU) 2016/679, the data subjects are informed about the restriction of the confidentiality of their communications for the sole purpose of removing child sexual abuse material and detecting or reporting child sexual abuse material, including the possibility that personal data is shared with law enforcement authorities and organisations acting in the public interest against child sexual abuse; xii) in the event of a ʻpositive hit', unless prejudicial to an ongoing investigation, in which case information may be delayed to the extent strictly necessary and the data subjects are informed without delay after the investigation is closed and without prejudice to the information provided for in Article 13 of Regulation (EU) 2016/679, the data subjects are given the following information: a) the competent law enforcement authorities and organisations acting in the public interest against child sexual abuse with whom their personal data have been shared; b) the avenues for redress with the provider of number-independent interpersonal communications services; and c) the possibility of lodging a complaint with the competent supervisory authority and of a judicial remedy, and the identity of those authorities in the case; (xiii) there is no interference with any communication protected by professional secrecy, such as between doctors and their patients, journalists and their sources or lawyers and their clients; (xiv) any transfer of personal data to third countries or international organisations complies with Chapter V of Regulation (EU) 2016/679;

Amendment 166 #

Proposal for a regulation
Article 3 – paragraph 1 – point a

(a) the processing is proportionate and limited to ~~well-established technologies regularly used by providers of~~technologies that fulfil all of the following conditions: i) they are in accordance with the state of the art used in the industry and are the least privacy-intrusive; ii) a data protection impact assessment pursuant to Article 35 of Regulation (EU) 2016/679 and a prior consultation procedure pursuant to Article 36 of Regulation (EU) 2016/679 have been conducted in accordance with Article 3a of this Regulation; iii) the processing is based on point (d) or (e) of Article 6(1) of Regulation (EU) 2016/679; iv) the categories of personal data to be processed are clearly defined for each processing operation; v) the scope of the restriction to the rights to confidentiality and protection of personal data is clearly defined; vi) there are internal procedures within the number- independent interpersonal communications service~~s for that purpose before the entry into force of this Regulation, and that are in accordance with the state of the art used in the industry and are the least privacy- intrusive;~~ to prevent abuse, unauthorised access or transfers; vii) the identity and categories of the controller or controllers are clearly specified; viii) the storage periods and the applicable safeguards are clearly specified; ix) human oversight and intervention is ensured for any processing of personal data, and no ʻpositive hitʼ is sent to law enforcement authorities or organisations acting in the public interest without prior human review; x) appropriate procedures and redress mechanisms are in place to ensure that individuals can lodge complaints with the provider of a number-independent interpersonal communications service within a reasonable timeframe for the user to present their views in accordance with Article 3c; xi) unless prejudicial to an ongoing investigation, in which case information may be delayed to the extent strictly necessary and the data subjects are informed without delay after the investigation is closed and without prejudice to the information provided for in Article 13 of Regulation (EU) 2016/679, the data subjects are informed about the following: a) the restriction of the confidentiality of their communications for the sole purpose of removing child sexual abuse material and detecting or reporting child sexual abuse material, including the possibility that personal data is shared with law enforcement authorities and organisations acting in the public interest against child sexual abuse; b) in the event of a ʻpositive hitʼ, the following information is given to the data subjects; c) the competent law enforcement authorities and organisations acting in the public interest against child sexual abuse with whom their personal data have been shared; d) the avenues for redress with the provider of number-independent interpersonal communications services; and e) the possibility of lodging a complaint with the competent supervisory authority and of a judicial remedy, and the identity of those authorities in the case.

Amendment 167 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Article 3 – paragraph 1 – point a

Amendment 168 #

Proposal for a regulation
Article 3 – paragraph 1 – point a

(a) the processing is proportionate and limited to ~~well-established~~ technologies ~~regularly~~ used by providers of number- independent interpersonal communications services for that purpose ~~before the entry into force of this Regulation, and that are in accordance with the state of the art used in the industry and are the least privacy-intrusive~~, and that are in conformity with the principle of data protection by design and by default as enshrined in Article 25 of Regulation (EU) 2016/679;

Amendment 169 #

Proposal for a regulation
Article 3 – paragraph 1 – point a a (new)

(aa) where the technology was not used before the entry into force of this Regulation, the prior consultation procedure set out in Article 36 of Regulation (EU) 2016/679 was conducted;

Amendment 170 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Article 3 – paragraph 1 – point a a (new)

(aa) the provider clarifies, in its annual reporting, the legal basis for the processing of personal data pursuant to Regulation (EU) 2016/679;

Amendment 171 #

(b) the technology used is in itself sufficiently reliable in that it limits to the maximum extent possible the rate of errors regarding the detection of content representing child sexual abuse, and where such occasional errors occur, their consequences are rectified without delay;deleted

Amendment 172 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Article 3 – paragraph 1 – point b

(b) the technology used is in itself sufficiently reliable in that it limits to the maximum extent possible the rate of errors regarding the detection of c~~ontent representing child sexual abuse, and where such occasional errors occur, their consequences are rectified without delay~~hild sexual abuse online;

Amendment 173 #

(b) the technology used is, while in itself sufficiently reliable in that it limits to the maximum extent possible the rate of errors regarding the detection of content representing child sexual abuse, and where such occasional errors occur, their consequences are rectified without delay, should be used in combination with human review;

Amendment 174 #

Proposal for a regulation
Article 3 – paragraph 1 – point b

(b) the technology used is in itself sufficiently reliable in that it limits to the maximum extent possible the rate of errors regarding the detection of c~~ontent representing~~hild sexual abuse or child sexual abuse material, and where ~~such occasional~~ errors occur, their consequences are rectified to the extent possible without delay;

Amendment 175 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

(ba) the provider puts in place redress mechanisms to ensure that users who believe that they have been wrongfully included in a report of child sexual abuse online can refer their cases to the provider for review, and, where an error has occurred, its consequences are rectified without delay;

Amendment 176 #

Proposal for a regulation
Article 3 – paragraph 1 – point b b (new)

(bb) all the instances of possible child sexual abuse online, after accurate human review, are reported to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, to enable the identification of the child victims and as a safeguard to identify detection errors by the providers;

Amendment 177 #

(c) the technology used to detect solicitation of children is limited to the use of relevant key indicators, such as keywords and objectively identified risk factors such as age difference, without prejudice to the right to human review;deleted

Amendment 178 #

Proposal for a regulation
Article 3 – paragraph 1 – point c

Amendment 179 #

Proposal for a regulation
Article 3 – paragraph 1 – point d

(d) the processing is limited to what is strictly necessary for the purpose of detection and reporting of child sexual abuse online and removal of child sexual abuse material and, unless child sexual abuse online has been detected and confirmed as such, is erased immediately;deleted

Amendment 180 #

Proposal for a regulation
Article 3 – paragraph 1 – point d

(d) the processing is limited to what is strictly necessary for the purpose of detection and reporting of child sexual abuse online and removal of child sexual abuse material ~~and, unless child sexual abuse online has been detected and confirmed as such, is erased immediately;~~ . Where no child sexual abuse online has been detected and confirmed as such, the relevant data shall be erased immediately after the processing. Where child sexual abuse has been detected and confirmed, the relevant data shall be preserved solely for the following purposes and only for the time period necessary: – for its reporting and transfer to law enforcement and other relevant public authorities, including organisations acting in the public interest against child sexual abuse, pursuant to Regulation (EU) 2016/679, and to respond to requests of these entities; – for the blocking of the concerned user’s account; – in relation to data reliably identified as child sexual abuse material, for the creation of a unique, non-reconvertible digital signature (‘hash’); – for improving and measuring the accuracy of the technology used; – for proceedings of administrative, or judicial review or remedy. The preservation period shall not exceed nine months, except in duly justified cases.

Amendment 181 #

Proposal for a regulation
Article 3 – paragraph 1 – point d

(d) the processing allowed by the restriction provided for in this Regulation is limited to what is strictly necessary for the sole purpose of detection and reporting of child sexual abuse online and removal of child sexual abuse material and, unless child sexual abuse online has been detected and confirmed as such, ~~is erased immediately~~content data, related traffic data and data generated through such processing is erased immediately; in any case these data shall be erased automatically after one month following the date of a positive hit, unless they are required for the establishment, exercise or defence of legal claims;

Amendment 182 #

Proposal for a regulation
Article 3 – paragraph 1 – point d

(d) the processing allowed by this Regulation is limited to what is strictly necessary for the sole purpose of detection and reporting of child sexual abuse online and removal of child sexual abuse material and, unless child sexual abuse online has been detected and confirmed as such, data generated through such processing is erased immediately;

Amendment 183 #

Proposal for a regulation
Article 3 – paragraph 1 – point e

(e) the provider annually publishes a report on its related processing, including on the type and volumes of data processed, number of cases identified, measures applied to select and improve key indicators, numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied.deleted

Amendment 184 #

(e) the provider ~~annually publishes a report on its related processing~~makes publicly available and submits a report to the supervisory authority in accordance with Regulation (EU) 2016/679 by ... [six months after the date of entry into force of this Regulation] and to the European Commission, and annually thereafter, of the processing of personal data allowed by the restriction provided for in this Regulation, including on the type and volumes of data processed, ~~number of cases identified~~the legal basis for the processing pursuant to Article 6 of Regulation (EU) 2016/679, the legal basis for the transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, the number of cases identified, the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of those proceedings, measures applied to select and improve key indicators, numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied pursuant to Regulation (EU)2016/679.

Amendment 185 #

(e) the provider ~~annually publishes a report on its related processing~~publishes and submits a report to the supervisory authority in accordance with Regulation (EU) 2016/679 by ... [six months after the date of entry into force of this Regulation], and annually thereafter, of the processing of personal data allowed by the restriction provided for in this Regulation, including on the type and volumes of data processed, ~~number of cases identified, measures applied to select and improve key indicator~~the legal basis for the processing pursuant to Article 6 of Regulation (EU) 2016/679, the legal basis for the transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, the number of cases identified, the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of those proceedings, numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679.

Amendment 186 #

Proposal for a regulation
Article 3 – paragraph 1 – point e

(e) the provider ~~annually~~ publishes a ~~report on its related processing, including on the type and volumes of data processed, number of cases identified~~nd submits a report to the supervisory authority in accordance with Regulation (EU) 2016/679 by ..., and annually thereafter, on the processing of personal data allowed by this Regulation, including on the type and volumes of data processed, the legal basis for the processing pursuant to Article 6 of Regulation (EU) 2016/679, the legal basis for the transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, the number of cases identified, the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of those proceedings, measures applied to select and improve key indicators, numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679.

Amendment 187 #

Proposal for a regulation
Article 3 – paragraph 1 – point e

(e) the provider ~~annually publishes a report on its related processing~~makes publicly available a report on an annual basis on its processing of personal data within the scope of this Regulation, including on the type and volumes of data processed, the legal basis for processing, the number of cases identified, measures applied to select and improve key indicators, numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied.

Amendment 188 #

Proposal for a regulation
Article 3 – paragraph 1 a (new)

Providers of number-independent interpersonal communications services shall be permitted to process electronic communication data for the sole purpose of detecting, deleting and reporting to the judicial authority that ordered the processing child sexual abuse and exploitation material if: (a) they have been ordered to do so by a judicial authority of the Member State in which the provider is established; such orders and the processing of electronic communications data shall be strictly limited to the communications of persons for whom a prior suspicion based on factual evidence exists that they have communicated or are communicating child sexual abuse and exploitation material, and shall be limited in time to the shortest period possible for fulfilling the purpose; (b) the processing is proportionate and limited to well-established technologies regularly used by providers of number-independent interpersonal communications services for that sole purpose, and fulfil all of the following conditions: (i) they are state of the art used in the industry and are the least privacy- intrusive; (ii) the technology used is in itself sufficiently reliable in that it limits the rate of errors where content is wrongly identified as content representing child sexual abuse and exploitation material (“false positives”) to at most 1 in 50 billion, and where such occasional errors occur, their consequences are rectified without delay; (iii) the technology creates immediately a unique, non-reconvertible digital signature (ʻhashʼ) of electronically communicated pictures or videos for the sole purpose of immediately comparing that hash with a database containing hashes of material previously reliably identified as child sexual abuse and exploitation material, pursuant to Article 3a; (iv) a data protection impact assessment pursuant to Article 35 of Regulation (EU) 2016/679 and a prior consultation procedure pursuant to Article 36 of Regulation (EU) 2016/679 have been conducted in accordance with Article 3a of this Regulation. The prior consultation shall include access of the supervisory authority to the algorithm and the databases the content is matched against; and (c) the processing is limited to what is strictly necessary for the purpose of detection, reporting and removal of child sexual abuse and exploitation material and, unless child sexual abuse and exploitation material has been detected and confirmed as such, the data is erased immediately; (d) the processing does not interfere with or weaken the security of encrypted communications, and only applies to unencrypted communications; and (e) the data subjects are informed by the provider about the following: (i) the restriction of the confidentiality of their communications for the sole purpose of removing, detecting or reporting child sexual abuse and exploitation material, including the possibility that personal data is shared with law enforcement authorities; (ii) in the event personal data has been reported to the competent law enforcement authority, the following information is given to the data subjects; (iii) the fact that their data have been reported to the competent law enforcement authority as well as the name of that authority; (iv) the avenues for redress with the provider of number-independent interpersonal communications services; and (v) the possibility of seeking redress, and the identity of the competent authority;

Amendment 189 #

Proposal for a regulation
Article 3 – paragraph 1 a (new)

This Regulation shall not apply to the scanning of text or audio communications, other than on the basis of an appropriate legal base.

Amendment 190 #

Proposal for a regulation
Article 3 – paragraph 1 a (new)

This Regulation shall not apply to the scanning of text or audio communications.

Amendment 191 #

Proposal for a regulation
Article 3 – paragraph 1 b (new)

Providers using such technology shall annually publish a report on their related processing, including on the type and volumes of data processed, number of cases identified, number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of those proceedings, measures applied to select and improve key indicators, numbers and ratios of errors (false positives) of the different technologies deployed, measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied.

Amendment 192 #

As regards point (c) of paragraph 1a, where child sexual abuse or exploitation material has been detected and confirmed as such, the traffic data related to these communications may be preserved solely for the following purposes and for a period of no more than three months: - for its reporting to law enforcement authorities in the Member State where the provider is established, and to the authority or authorities operating the database pursuant to Article 3a, after human review in each case; - for the blocking of the concerned user’s account;

Amendment 193 #

Proposal for a regulation
Article 3 – paragraph 2

Amendment 194 #

Proposal for a regulation
Article 3 – paragraph 2

Amendment 195 #

AsWith regards to point (d) of the first subparagraph, where child sexual abuse online has been detected and confirmed as such, the ~~relevant data may be retained solely for the following purposes and only for the time period necessary~~strictly relevant personal data, i.e. the content data, the related traffic data and any result of processing of these data, may be retained solely for the following purposes and only for the time period strictly necessary, but in any case no longer than a month, after which they shall be deleted immediately, unless they are required for the establishment, exercise or defence of legal claims:

Amendment 196 #

Proposal for a regulation
Article 3 – paragraph 2 – introductory part

As regards point (d) of the first subparagraph, where child sexual abuse online has been detected and confirmed as such, the relevant data may be retained solely for the following purposes and only for the time period necessary, after which it shall be deleted immediately:

Amendment 197 #

— for its reporting and t~~o respond to proportionate requests by law enforcement and other relevant public authorities~~ransfer, pursuant to Directive (EU) 2016/680, to the competent authorities without undue delay;

Amendment 198 #

Proposal for a regulation
Article 3 – paragraph 2 – indent 2

— for the blocking or suspension of the concerned user’s account;

Amendment 199 #

Proposal for a regulation
Article 3 – paragraph 2 – indent 3

— in relation to data reliably identified as child ~~pornography~~sexual abuse material, for the creation of a unique, non-reconvertible digital signature (‘hash’).

Amendment 200 #

— for the purpose of seeking redress from the provider or pursuing administrative review or judicial proceedings.

Amendment 201 #

Proposal for a regulation
Article 3 a (new)

Article 3a Obligation for a data protection impact assessment and a prior consultation and authorisation of the supervisory authorities Providers of number-independent interpersonal communications services shall, in order to rely on the restriction provided for by this Regulation, conduct a data protection impact assessment pursuant to Article 35 of Regulation (EU) 2016/679 and a prior consultation procedure pursuant to Article 36 thereof by ... [three months after the date of entry into force of this Regulation]. Providers of number-independent interpersonal communications services deploying anti-grooming activities shall request prior authorisation from the supervisory authorities by ... [six months after the entry into force of this Regulation]. The Member States shall ensure that the supervisory authorities have sufficient resources for these procedures, in line with the requirements set out by Regulation (EU) 2016/679.

Amendment 202 #

Proposal for a regulation
Article 3 a (new)

Article 3a Obligation for a data protection impact assessment In order to rely on the derogation provided for by this Regulation, providers of number-independent interpersonal communications services shall conduct a data protection impact assessment where required by Article 35 of Regulation (EU) 2016/679 where: (a) processing falling within the requirements of Article 3 is already underway, by ... [three months after the date of entry into force of this Regulation]; or (b) processing falling within the requirements of Article 3 is not already underway, prior to commencing such processing. Point (a) shall not apply where a data protection impact assessment has been conducted prior to the entry into force of this Regulation. Point (a) shall not have the effect of requiring the suspension of such processing while the data protection impact assessment is conducted.

Amendment 203 #

Proposal for a regulation
Article 3 a (new)

Article 3a Databases of known child sexual abuse and exploitation material 1. Member States may designate a public authority that operates a database of known sexual abuse and exploitation material. The database shall contain no actual images or videos, but only the unique, non-reconvertible digital signatures (‘hashes’) of known child sexual abuse and exploitation material. 2. Before entering new data into the database, there shall be human review. For this purpose, the providers shall report the original material and the hashes pursuant to Article 3(4) to the authority. The authority shall review the content, and where it constitutes child sexual abuse or exploitation material, add the respective hash to the database, and store the original content separately, in a hardened secure environment, and offline.

Amendment 204 #

Proposal for a regulation
Article 3 a (new)

Article 3a Obligation for a data protection impact assessment and a prior consultation of the supervisory authorities By ... [three months after the date of entry into force of this Regulation], providers of number-independent interpersonal communications services shall, in order to rely on the restriction provided for by this Regulation, conduct a data protection impact assessment pursuant to Article 35 of Regulation (EU) 2016/679 and a prior consultation procedure pursuant to Article 36 thereof by ... [three months after the date of entry into force of this Regulation].

Amendment 205 #

Proposal for a regulation
Article 3 a (new)

Article 3a Complaint mechanism Providers of number-independent interpersonal communications services using technologies for the processing of personal data to detect and report child sexual abuse online and detect, report and remove child sexual abuse material shall establish an effective and accessible mechanism allowing users whose content has been removed or reported to law enforcement authorities or an organisation acting in the public interest against child sexual abuse to submit a complaint against the action of the provider.

Amendment 206 #

Proposal for a regulation
Article 3 b (new)

Article 3b Complaint mechanism Providers of number-independent interpersonal communications services shall establish an effective and accessible mechanism allowing users to submit a complaint against the action of the provider where: - their content or identity has been reported to an organisation acting in the public interest against child sexual abuse or to law enforcement authorities or which has been removed, where the material reported or removed does not constitute child sexual abuse online in accordance with this Regulation, or; - their identity has been reported to an organisation acting in the public interest against child sexual abuse or to law enforcement authorities, where the user received unsolicited child sexual abuse material.

Amendment 207 #

Proposal for a regulation
Article 3 b (new)

Article 3b Public interest and legitimate interest of providers For the purposes of this Regulation, the detection and reporting of child sexual abuse online and the removal of child sexual abuse material online shall be considered to be (a) a legitimate interest of providers of number-independent interpersonal communications services, within the meaning of point (f) of Article 6(1) of Regulation (EU) 2018/679; and (b) a task carried out in the public interest, within the meaning of point (e) of Article 6(1) of Regulation (EU) 2018/679.

Amendment 208 #

Proposal for a regulation
Article 3 b (new)

Article 3b European Data Protection Board guidelines Pursuant to Article 70 GDPR, the Commission shall request the European Data Protection Board to publish guidelines for the purpose of assisting the supervisory authorities responsible in accordance with Regulation (EU) 2016/679 to assess whether the processing falling within the scope of this Regulation, for existing as well as future technologies used for the sole purpose of combatting child sexual abuse online complies with Regulation (EU) 2016/679.

Amendment 209 #

Proposal for a regulation
Article 3 c (new)

Article 3c Complaint mechanism Providers of number-independent interpersonal communications services shall establish an effective and accessible mechanism allowing users whose content has been reported to an organisation acting in the public interest against child sexual abuse or to law enforcement authorities or which has been removed to submit a complaint against the action of the provider where the material reported or removed does not constitute child sexual abuse online in accordance with this Regulation.

Amendment 210 #

Proposal for a regulation
Article 3 c (new)

Article 3c Reporting back by law enforcement authorities and organisations acting in the public interest against child sexual abuse to the providers of number- independent interpersonal communications services Law enforcement authorities and organisations acting in the public interest against child sexual abuse shall report back to the providers of number- independent interpersonal communications services with general information to improve the accuracy of their activities, without providing personal data.

Amendment 211 #

Proposal for a regulation
Article 3 d (new)

Article 3d Statistics By ... [six months after entry into force of Regulation] the Member States shall make publicly available and submit reports to the Commission, and thereafter on an annual basis, with statistics on all of the following elements: (a) the total number of reports with detected child sexual abuse provided by number-independent interpersonal communications services and/or organisations acting in the public interest against child sexual abuse to law enforcement authorities in the Member States; (b) the number of children rescued by means of the activities mentioned in Article 3; (c) the number of perpetrators arrested and convicted; (d) the number of false positives; (e) the breakdown of methods used to detect child sexual abuse; The Commission shall aggregate these statistics and take them into account when reviewing this Regulation, pursuant to [Article 3f (new)].

Amendment 212 #

Proposal for a regulation
Article 3 d (new)

Article 3d Effective remedies Users who have been adversely affected by the use of specific technologies for the processing of personal data to detect and report child sexual abuse online and remove child sexual abuse material from number-independent interpersonal communications services on their services, shall have the right to an effective remedy. Member States shall put in place effective procedures for the exercise of that right.

Amendment 213 #

Proposal for a regulation
Article 3 e (new)

Article 3e Review 1. On the basis of the reports provided by the data protection authorities pursuant to [Article 3(1)(e)] and the statistics provided by Member States pursuant to [Article 3d (new)], the Commission shall by ... [one year after entry into force of Regulation], and thereafter annually, conduct a review of this Regulation and submit and present a report to the European Parliament and Council. 2. In conducting its review, the Commission shall pay special attention to: (a) all conditions for processing data enumerated under [Article 3 (1)(a)]; (b) the proportionality of activities set out in this Regulation, including an assessment of the statistics submitted by the Member States under [Article 3d]; (c) developments in technological progress regarding such activities, and the extent to which these improve accuracy and reduce false positives.

Amendment 214 #

Proposal for a regulation
Article 3 e (new)

Article 3e Supervisory authorities The supervisory authorities responsible for monitoring the application of this Regulation shall be the same as the independent supervisory authorities designated pursuant to Chapter VI of Regulation (EU) 2016/679.

Amendment 215 #

Proposal for a regulation
Article 3 f (new)

Article 3f Terms and conditions Providers of number-independent interpersonal communications services that use technologies falling within the scope of this Regulation shall include in their terms and conditions clear and exhaustive information on the functioning of such measures and the impact on users’ confidentiality of communications

Amendment 216 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH, Dragoş PÎSLARU

It shall apply from 21 December 2020 until 31 December 20252.

Amendment 217 #

Proposal for a regulation
Article 4 – paragraph 2

It shall apply from 21 December 2020 until 31 December 20252.

Amendment 218 #

Proposal for a regulation
Article 4 – paragraph 2

It shall apply from 21 December 2020 until 31 December 20252.

Amendment 58 #

Proposal for a regulation
–

The European Parliament rejects the Commission proposal.

Amendment 59 #

Proposal for a regulation
–

The European Parliament rejects the Commission proposal.

Amendment 60 #

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on a temporary ~~deroga~~restriction of~~rom~~ certain ~~provis~~rights and obligations of Directive 2002/58/EC of the European Parliament and of the Council as regards the use of technologies by number- independent interpersonal communications service providers for the processing of personal ~~and other~~ data for the purpose of combatting child sexual abuse and exploitation material online

Amendment 61 #

Proposal for a regulation
Title

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on a temporary derogation from certain provisions of Directive 2002/58/EC of the European Parliament and of the Council as regards the use of technologies by number-independent interpersonal communications service providers for the processing of personal ~~and other~~ data for the purpose of combatting child sexual abuse online

Amendment 62 #

Proposal for a regulation
Citation 4 a (new)

having regard to the principles established by the 1989 United Nations Convention on the Rights of the Child and its optional protocol on sale of children, child prostitution and child pornography,

Amendment 63 #

Proposal for a regulation
Recital 2

(2) Directive 2002/58/EC applies to the processing of personal data in connection with the provision of publicly available electronic communication services. TUp until 21 December 2020, the definition of electronic communication service ~~is currently to be found~~set out in Article 2, point (c), of Directive 2002/21/EC of the European Parliament and of the Council4. applied. On that date, Directive (EU) 2018/1972 of the European Parliament and of the Council5 repealsed Directive 2002/21/EC ~~with effect from 21 December 2020. From that date, t~~. The definition of electronic communications services ~~will be replaced by a new definition,~~ in Article 2(4) of Directive (EU) 2018/1972~~, which~~ includes number- independent interpersonal communications services as defined in Article 2(7) of that Directive. Those services, which include, for example, voice over IP, messaging and web-based e-mail services, ~~will~~have therefore ~~fall~~been within the scope of Directive 2002/58/EC, as of 21 December 2020 _________________ 4 Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) (OJ L 108, 24.4.2002, p. 33). 5Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36).

Amendment 64 #

Dragoş TUDORACHE

Proposal for a regulation
Recital 3

(3) In accordance with Article 6(1) of the Treaty on European Union, the Union recognises the rights, freedoms and principles set out in the Charter of Fundamental Rights of the European Union. Article 7 of the Charter of Fundamental Rights of the European Union (“the Charter”) protects the fundamental right of everyone to the respect for his or her private and family life, home and communications, which includes the confidentiality of communications. Article 8 of the Charter contains the right to protection of personal data. Article 3(1) of the 1989 United Nations Convention on the Rights of the Child ("UNCRC") and Article 24(2) of the Charter provides that, in all actions relating to children, whether taken by public authorities or private institutions, the child’s best interests must be a primary consideration. Articles 3(3) of the UNCRC and 24(1) of the Charter furthermore evoke the right of children to protection and care as is necessary for their well-being.

Amendment 65 #

Proposal for a regulation
Recital 4

(4) Sexual abuse and sexual exploitation of children constitute serious violations of ~~human~~fundamental rights, in particular of the rights of children to be protected from all forms of violence, abuse and neglect, maltreatment or exploitation, including sexual abuse, as provided for by the 1989 United Nations Convention on the Rights of the Child and by the Charter. Digitisation has brought about many benefits for society and the economy, but also challenges ~~including~~, notably an increase of child sexual abuse online. The protection of children online is one of the Union's priorities. On 24 July 2020, the Commission adopted an EU strategy for a more effective fight against child sexual abuse6 (“the Strategy”), which aims to provide an effective response, at Union level, to the crime of child sexual abuse _________________ 6 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, EU strategy for a more effective fight against child sexual abuse, 24.7.2020 COM(2020) 607 final resulting from broader access to potential victims and a sharp rise in the exchange of child sexual abuse material between child sexual offenders. Moreover, the increased misuse of privacy-enhancing technologies by offenders to disguise their horrendous actions has made it more difficult for law- enforcement authorities to prevent, detect, investigate and prosecute child sexual abuse and exploitation online. According to Europol, the proliferation of anonymisation tools and the higher amount of child sexual abuse material may also lead to a higher risk of repeat victimisation6a. _________________ 6aEuropol report ‚Exploiting isolation: Offenders and victims of online child sexual abuse during the Covid-19 pandemic’, published on 19 June 2020.

Amendment 66 #

Proposal for a regulation
Recital 4

(4) The protection of children is one of the Union's priorities. Sexual abuse and sexual exploitation of children constitute serious violations of human rights, in particular of the rights of children to be protected from all forms of violence, abuse and neglect, maltreatment or exploitation, including sexual abuse, as provided for by the 1989 United Nations Convention on the Rights of the Child and by the Charter. Digitisation has brought about many benefits for society and the economy, but also challenges including an increase of child sexual abuse online. The protection of children online is one of the Union's priorities. On 24 July 2020, the Commission adopted an EU strategy for a more effective fight against child sexual abuse6 (“the Strategy”), which aims to providand exploitation material online. Child sexual abuse material is based on actual abuse in the offline world, where most abuses are committed by persons belonging to the family or being close to it. The rise ain effective response, at Union level, to the crime of child sexual abuse. _________________ 6 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, EU strategy for a more effective fight against child sexual abuse, 24.7.2020 COM(2020) 607 finalreported numbers is also partially due to the emerging practice of teenagers who, in the development of their sexual identity and experiences, take explicit pictures of videos of themselves and send them to peers, or share such material without a sexual motivation.

Amendment 67 #

Proposal for a regulation
Recital 4

(4) Sexual abuse ~~and~~, sexual exploitation of children and child pornography constitute serious violations of human rights, in particular of the rights of children to be protected from all forms of violence, abuse and neglect, maltreatment or exploitation, including sexual abuse, as provided for by the 1989 United Nations Convention on the Rights of the Child and by the Charter. Digitisation has brought about many benefits for society and the economy, but also challenges including an increase of child sexual abuse online. The protection of children online is one of the Union's priorities. On 24 July 2020, the Commission adopted an EU strategy for a more effective fight against child sexual abuse6 (“the Strategy”), which aims to provide an effective response, at Union level, to the crime of child sexual abuse, the sexual exploitation of children, child pornography, as these abuses have become more widespread in recent times and have become more widespread through the use of new technologies and the Internet. _________________ 6 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, EU strategy for a more effective fight against child sexual abuse, 24.7.2020 COM(2020) 607 final.

Amendment 68 #

Proposal for a regulation
Recital 4

Amendment 69 #

Proposal for a regulation
Recital 4 a (new)

(4a) The protection of children online is one of the Union's priorities. On 24 July 2020, the Commission adopted an EU strategy for a more effective fight against child sexual abuse1a (the ʻStrategyʼ), which aims to provide an effective response, at Union level, to the crime of child sexual abuse. As part of the Strategy, the Commission announced that it would propose sector-specific legislation, including “clear mandatory obligations to detect and report child sexual abuse online to bring more clarity and certainty to the work of both law enforcement and relevant actors in the private sector to tackle online abuse”. The new legislation should fully respect fundamental rights, notably the rights to freedom of expression, to private life and data protection, and include mechanisms to ensure accountability and transparency. _________________ 1a Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, EU strategy for a more effective fight against child sexual abuse, 24.7.2020 COM(2020) 607 final.

Amendment 70 #

Proposal for a regulation
Recital 4 a (new)

(4a) Whereas this proposal does not undermine the principal of end-to-end encryption, since the aim of this proposal is to allow providers of communications to continue their voluntary detection and reporting of child sexual abuse online and removal of child sexual abuse material. Thus, limitations to end-to-end encryptions should not be addressed here.

Amendment 71 #

Proposal for a regulation
Recital 4 a (new)

(4a) Teenagers have the right to discover their sexual identity in a safe and private environment.

Amendment 72 #

Proposal for a regulation
Recital 5

(5) Certain providers of number- independent interpersonal communications services, such as webmail and messaging services, ~~are already~~have been using specific technologies ~~to detect and report child sexual abuse online~~, notably hashing technology for images and videos, tools using classifiers and artificial intelligence, and technologies analysing text and/or metadata, to detect child sexual abuse online on their services and report it to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, or to ~~remove~~detect, remove and report child sexual abuse material~~, on a voluntary basis. Those organisation~~. Those measures have been applied on a voluntary basis, while relying on Article 6 of Regulation (EU) 2016/679 as the legal basis for processing. The providers refer to national hotlines for reporting child sexual abuse material, as well as to organisations whose purpose is to reduce child sexual exploitation, and prevent child victimisation, located both within the Union and in third countries. Collectively, those voluntary activities play a ~~valuable~~crucial role in enabling the identification and rescue of victims, whose fundamental rights to human dignity and to physical and mental integrity were severely violated, and reducing the further dissemination of child sexual abuse material, while also contributing to the identification and investigation of offenders, and the prevention, detection, investigation and prosecution of child sexual abuse offences.

Amendment 73 #

Proposal for a regulation
Recital 5

(5) Certain providers of number- independent interpersonal communications services, such as webmail and messaging services, ~~are already using specific~~have been using technologies to detect and report child sexual abuse and exploitation material online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, or to remove child sexual abuse and exploitation material, on a voluntary basis. Those organisations refer to national hotlines for reporting child sexual abuse material, as well as to organisations whose purpose is to reduce child sexual exploitation, and prevent child victimisation, located both within the Union and in third countrie, by scanning either the content, such as pictures and text, or the metadata of communications using, in some instances, historical data. Those providers refer detected child sexual abuse and exploitation material to national hotlines dedicated to this task, as well as to organisations whose purpose is to reduce child sexual exploitation, and prevent child victimisation, located both within the Union and in third countries, in particular the National Center for Missing and Exploited Children (NCMEC) in the United States. When they are established in third countries, they do not fall into the scope of the EU data protection acquis. Collectively, those voluntary activities play a ~~valuable~~ role in enabling the identification and rescue of victims, and reducing the further dissemination of child sexual abuse and exploitation material, while also contributing to the identification and investigation of offenders, and the prevention of child sexual abuse and exploitation offences.

Amendment 74 #

Dragoş TUDORACHE, Ioan-Rareş BOGDAN, Anna Júlia DONÁTH

Proposal for a regulation
Recital 5

(5) Certain providers of number- independent interpersonal communications services, such as webmail and messaging services, are already using specific technologies to detect and report child sexual abuse online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse and child sexual exploitation, or to remove child sexual abuse and child sexual exploitation material, on a voluntary basis. Those organisations refer to national hotlines for reporting child sexual abuse and child sexual exploitation material, as well as to organisations whose purpose is to reduce child sexual abuse and child sexual exploitation, and prevent child victimisation, located both within the Union and in third countries. Collectively, those voluntary activities play a valuable role in enabling the identification and rescue of victims, and reducing the further dissemination of child sexual abuse ~~material~~and child sexual exploitation material, which constitutes a gross violation of the right to privacy of the child, while also contributing to the identification and investigation of offenders, and the prevention of child sexual abuse and child sexual exploitation offences.

Amendment 75 #

Proposal for a regulation
Recital 5

(5) Certain providers of number- independent interpersonal communications services, such as webmail and messaging services, are already using specific technologies to detect and report child sexual abuse online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, or to remove child sexual abuse material, on a voluntary basis by scanning either the content, such as pictures and text, or the meta data of communications using, in some instances, historical data . Those organisations refer to national hotlines for reporting child sexual abuse material, as well as to organisations whose purpose is to reduce child sexual exploitation, and prevent child victimisation, located both within the Union and in third countries. Collectively, those voluntary activities play a valuable role in enabling the identification and rescue of victims, and reducing the further dissemination of child sexual abuse material, while also contributing to the identification and investigation of offenders, and the prevention of child sexual abuse offences.

Amendment 76 #

(5) Certain providers of number- independent interpersonal communications services, such as webmail and messaging services, are already using specific technologies to detect and report child sexual abuse online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse, or to remove child sexual abuse material, on a voluntary basis. Those organisations refer to national hotlines for reporting child sexual abuse material, as well as to organisations whose purpose is to identify, to reduce child sexual exploitation, and prevent child victimisation, located both within the Union and in third countries. Collectively, those voluntary activities play a valuable role in enabling the identification and rescue of victims, and reducing the further dissemination of child sexual abuse material, while also contributing to the identification ~~and~~, investigation and punishment of offenders, and the prevention of child sexual abuse offences.

Amendment 77 #

Proposal for a regulation
Recital 5 a (new)

(5a) Notwithstanding their legitimate objective, those measures unequivocally interfere with the fundamental rights to respect for private life and data protection of the individuals concerned, namely users, perceived perpetrators and victims. Such interference is only possible under certain conditions. It needs to be provided for by law, respect the essence of the rights to data protection and privacy and, in compliance with the principle of proportionality, be necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others as enshrined in Article 52 (1) of the Charter.

Amendment 78 #

Proposal for a regulation
Recital 5 a (new)

(5a) The Covid-19 crisis has significantly exacerbated the production and distribution of child sexual abuse material (CSAM) online which hit a record level during the spring lockdown within Europe1a.. A 106 % increase of such activity across the globe was detected 2a. About one in five children falls victim to violence including sexual abuse. _________________ 1aExploiting isolation: offenders and victims of online child sexual abuse during the COVID-19 pandemic, EUROPOL, 2020. 2aExploiting isolation: offenders and victims of online child sexual abuse during the COVID-19 pandemic, EUROPOL, 2020.

Amendment 79 #

Proposal for a regulation
Recital 5 a (new)

(5a) Certain providers of number- independent interpersonal communications services are deploying such technologies on basis of Regulation (EU) 2016/679, referring to legitimate interest, which is a very questionable legal basis for processing sensitive data. Nevertheless, data protection authorities have not taken any enforcement action.

Amendment 80 #

Proposal for a regulation
Recital 5 a (new)

(5a) Acting in the child's best interest should be a priority; therefore underlines the necessity to ensure the safety of using new technologies, electronic communication services, in particular the protection of children against sexual exploitation on the Internet.

Amendment 81 #

(5b) Directive 2011/93/EU obliges Member States to take measures against child sexual abuse, at the latest by 18 December 2013. 23 Member States have failed to implement this Directive, and the Commission has failed to act as custodian of the treaties by starting infringement procedures against these Member States only in July and October 2019, almost six years after the deadline of transposition, and has failed to act following the calls by Parliament in its resolution of 14 December 20171. ___________________ 1European Parliament resolution of 14 December 2017 on the implementation of Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography (OJ C 369, 11.10.2018, p. 96).

Amendment 82 #

Proposal for a regulation
Recital 5 b (new)

(5b) Patterns of on-line criminalities are changing rapidly and the activity by sexual predators seeking child exploitation materials, especially during COVID-19 increased online, therefore there is a priority need to implement solution protecting children from on-line exploitation;

Amendment 83 #

Proposal for a regulation
Recital 6

Amendment 84 #

Proposal for a regulation
Recital 6

(6) Until 20 December 2020, the processing of personal data by providers of number-independent interpersonal communications services by means of voluntary measures for the purpose of detecting and reporting child sexual abuse ~~online and removing child sexual abuse material is governed by Regulation (EU) 2016/679.~~ and exploitation material and removing such material is subject to Regulation (EU) 2016/679 (GDPR). The data protection authorities are investigating a complaint for non-compliance of current voluntary measures with the GDPR, and data subjects have so far not been informed in accordance with Articles 13 and 14 of that Regulation. Directive (EU) 2018/1972 will have no direct effect on providers which apply such voluntary measures.

Amendment 85 #

Proposal for a regulation
Recital 6 a (new)

(6a) The voluntary measures applied by providers so far constitute an interference with the fundamental rights to respect for private life and data protection of all users of popular electronic communications services, such as instant messaging platforms and applications. Where such measures permanently involve a general and indiscriminate monitoring and analysis of content of communications of all users, they violate the right to confidentiality of communications, as the Court of Justice has ruled in the joined Cases C-511/18, C-512/18 and C-520/18 - La Quadrature et al.

Amendment 86 #

(6a) The measures provided for in this Regulation constitute an interference with the fundamental rights to respect for private life and data protection of all users of popular electronic communications services, such as instant messaging platforms and applications. Even voluntary measures by private companies constitute an interference with those rights when the measures involve monitoring and analysis of content of communications and processing of personal data.

Amendment 87 #

Proposal for a regulation
Recital 6 b (new)

(6b) Any limitation to the right of the confidentiality of communications must register within the very specific aim of this proposal, which is the fight against child sexual abuse online.

Amendment 88 #

(6b) Any limitation to the fundamental right to the confidentiality of communications cannot be justified merely on the ground that certain technologies were previously deployed when the services concerned did not, from a legal perspective, constitute electronic communications services.

Amendment 89 #

Proposal for a regulation
Recital 6 b (new)

Amendment 90 #

Proposal for a regulation
Recital 7

(7) Directive 2002/58/EC does not contain any specific provisions concerning the processing of personal and other data in connection with the provision of electronic communication services for the purpose of detecting and reporting child sexual abuse online and removing child sexual abuse material. However, pursuant to Article 15(1) of Directive 2002/58/EC, Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in, inter alia, Articles 5 and 6 of that Directive, which concern confidentiality of communications and traffic data, for the purpose of prevention, investigation, detection and prosecution of criminal offences linked to child sexual abuse. In the absence of such legislative measures, and pending the adoption of a new longer-term legal framework to tackle child sexual abuse effectively at Union level as announced in the Strategy, there would be no legal basis for providers of number-independent interpersonal communications services to continue to detect and report child sexual abuse online and remove child sexual abuse material in their services beyond 21 December 2020.

Amendment 91 #