REPORT on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC

19.10.2017 - (COM(2017)0008 – C8‑0008/2017 – 2017/0002(COD)) - ***I

Committee on Civil Liberties, Justice and Home Affairs
Rapporteur: Cornelia Ernst

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC

(COM(2017)0008 – C8‑0008/2017 – 2017/0002(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

–  having regard to the Commission proposal to Parliament and the Council (COM(2017)0008),

–  having regard to Article 294(2) and Article 16(2) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C8‑0008/2017),

–  having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

–  having regard to the contributions submitted by the Czech Chamber of Deputies, the Spanish Parliament and the Portuguese Parliament on the draft legislative act,

–  having regard to Rule 59 of its Rules of Procedure,

–  having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs and the opinion of the Committee on Legal Affairs (A8-0313/2017),

1.  Adopts its position at first reading hereinafter set out;

2.  Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3.  Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Amendment    1 Proposal for a regulation Recital 1
Text proposed by the Commission	Amendment
(1)  The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning them.	(1)  The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning them. This right is also guaranteed under Article 8 of the European Convention on Human Rights.
Amendment    2 Proposal for a regulation Recital 5
Text proposed by the Commission	Amendment
(5)  It is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align as far as possible the data protection rules for Union institutions and bodies with the data protection rules adopted for the public sector in the Member States. Whenever the provisions of this Regulation are based on the same concept as the provisions of Regulation (EU) 2016/679, those two provisions should be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of Regulation (EU) 2016/679.	(5)  It is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align the data protection rules for Union institutions, bodies, offices and agencies with the data protection rules adopted for the public sector in the Member States. Whenever the provisions of this Regulation are based on the same concept as the provisions of Regulation (EU) 2016/679, those two provisions should under the case law of the Court of Justice of the European Union1a, be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of Regulation (EU) 2016/679.
	_________________
	1a Judgment of the Court of Justice of 9 March 2010, Commission v Germany, C-518/07, ECLI:EU:C:2010:125, paragraphs 26 and 28.
Amendment    3 Proposal for a regulation Recital 7 a (new)
Text proposed by the Commission	Amendment
	(7a)  The data protection legal framework for the processing of data in the course of activities of Union institutions and bodies in the areas of freedom, security and justice and of the common foreign and security policy remains fragmented and creates legal uncertainty. This Regulation should therefore provide for harmonised rules for the protection and the free movement of personal data processed by Union institutions and bodies carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of Part Three TFEU and Chapter 2 of Title V TEU.
Amendment    4 Proposal for a regulation Recital 8
Text proposed by the Commission	Amendment
(8)  In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection of personal data and the free movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU could prove necessary because of the specific nature of those fields. This Regulation should therefore apply to Union agencies carrying out activities in the fields of judicial cooperation in criminal matters and police cooperation only to the extent that Union law applicable to such agencies does not contain specific rules on the processing of personal data.	(8)  In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection of personal data and the free movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU could prove necessary because of the specific nature of those fields. Furthermore, the common foreign and security policy has a specific nature and specific rules on the protection of personal data and it could prove necessary to ensure the free movement of personal data in that field also. It is therefore appropriate to regulate the processing of operational personal data by Union agencies established on the basis of Chapters 4 and 5 of Title V of Part Three TFEU and by missions referred to in Article 42(1) and Articles 43 and 44 TEU by establishing specific rules that derogate from a number of general rules laid down in this Regulation.
Amendment    5 Proposal for a regulation Recital 14
Text proposed by the Commission	Amendment
(14)  Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.	(14)  Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. At the same time, the data subject should have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Amendment    6 Proposal for a regulation Recital 15
Text proposed by the Commission	Amendment
(15)  Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing. In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing.	(15)  Any processing of personal data should be lawful and fair and done for clear and well-defined purposes. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing. In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to, disclosure during the transmission of, or use of personal data and the equipment used for the processing.
Amendment    7 Proposal for a regulation Recital 18
Text proposed by the Commission	Amendment
(18)  The Union law including the internal rules referred to in this Regulation should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union and the European Court of Human Rights.	(18)  The Union law referred to in this Regulation should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the requirements set out in the Charter and the European Convention for the Protection of Human Rights and Fundamental Freedoms.
Amendment    8 Proposal for a regulation Recital 20
Text proposed by the Commission	Amendment
(20)  Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC14 a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.	(20)  Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC14 a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller, the purposes of the processing for which the personal data are intended and the categories of recipients of the data, and be informed on the right of access and of intervention in respect of the data. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.
_________________	_________________
14 Council Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts (OJ J 95, 21.4.1993, p.29).	14 Council Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts (OJ J 95, 21.4.1993, p.29).
Amendment    9 Proposal for a regulation Recital 22
Text proposed by the Commission	Amendment
(22)  When recipients established in the Union and subject to Regulation (EU) 2016/679 or Directive (EU) 2016/680, would like to have personal data transmitted to them by Union institutions and bodies, those recipients should demonstrate that the transmission is necessary for the attainment of their objective, is proportionate and does not go beyond what is necessary to attain that objective. Union institutions and bodies should demonstrate such necessity when they themselves initiate the transmission, in compliance with the principle of transparency.	(22)  When recipients established in the Union and subject to Regulation (EU) 2016/679 or Directive (EU) 2016/680, would like to have personal data transmitted to them by Union institutions and bodies, those recipients should provide the controller with a reasoned request for transmission which should serve as a basis for the controller to assess whether that transmission is necessary for the attainment of their objective, is proportionate and does not go beyond what is necessary to attain that objective. Union institutions and bodies should demonstrate such necessity when they themselves initiate the transmission, in compliance with the principle of transparency.
Amendment    10 Proposal for a regulation Recital 23
Text proposed by the Commission	Amendment
(23)  Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races. The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. In addition to the specific requirements for processing of sensitive data, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.	(23)  Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Such personal data should not be processed unless processing is allowed in specific cases set out in this Regulation. Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races. The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. In addition to the specific requirements for processing of sensitive data, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.
Amendment    11 Proposal for a regulation Recital 23 a (new)
Text proposed by the Commission	Amendment
	(23a)  Special categories of personal data which merit higher protection should be processed for health-related purposes only where necessary to achieve those purposes for the benefit of natural persons and society as a whole, in particular in the context of the management of health or social care services and systems. Therefore, this Regulation should provide for harmonised conditions for the processing of special categories of personal data concerning health, in respect of specific needs, in particular where the processing of such data is carried out for certain health-related purposes by persons subject to a legal obligation of professional secrecy. Union law should provide for specific and suitable measures so as to protect the fundamental rights and the personal data of natural persons.
Amendment    12 Proposal for a regulation Recital 24
Text proposed by the Commission	Amendment
(24)  The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subject to suitable and specific measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council15 , namely all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not result in personal data being processed for other purposes by third parties.	(24)  The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subject to suitable and specific measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council15 , namely all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not result in personal data being processed for other purposes.
__________________	__________________
15 Regulation (EC) No 1338/2008 of the European Parliament and of the Council of 16 December 2008 on Community statistics on public health and health and safety at work (OJ L 354, 31.12.2008, p. 70).	15 Regulation (EC) No 1338/2008 of the European Parliament and of the Council of 16 December 2008 on Community statistics on public health and health and safety at work (OJ L 354, 31.12.2008, p. 70).
Amendment    13 Proposal for a regulation Recital 37 – paragraph 1
Text proposed by the Commission	Amendment
Legal acts adopted on the basis of the Treaties or internal rules of Union institutions and bodies may impose restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, confidentiality of electronic communications as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, as far as necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.	Legal acts adopted on the basis of the Treaties may impose restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, confidentiality of electronic communications as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, as far as necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.
Amendment    14 Proposal for a regulation Recital 37 – paragraph 2
Text proposed by the Commission	Amendment
Where a restriction is not provided for in legal acts adopted on the basis of the Treaties or their internal rules, Union institutions and bodies may in a specific case impose an ad hoc restriction concerning specific principles and the rights of data subject if such a restriction respects the essence of the fundamental rights and freedoms and, in relation to a specific processing operation, is necessary and proportionate in a democratic society to safeguard one or more of the objectives mentioned in paragraph 1. The restriction should be notified to the data protection officer. All restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.	deleted
Amendment    15 Proposal for a regulation Recital 39 a (new)
Text proposed by the Commission	Amendment
	(39a)  Regulation (EU) 2016/679 provides for controllers to demonstrate compliance by adherence to approved certification mechanisms. Likewise, Union institutions and bodies should be able to demonstrate compliance with this Regulation by obtaining certification in accordance with Article 42 of Regulation (EU) 2016/679.
Amendment    16 Proposal for a regulation Recital 42
Text proposed by the Commission	Amendment
(42)  In order to demonstrate compliance with this Regulation, controllers should maintain records of processing activities under their responsibility and processors should maintain records of categories of processing activities under their responsibility. Union institutions and bodies should be obliged to cooperate with the European Data Protection Supervisor and make their records, on request, available to it, so that they might serve for monitoring those processing operations. Union institutions and bodies should be able to establish a central register of records of their processing activities. For reasons of transparency, they should also be able to make such a register public.	(42)  In order to demonstrate compliance with this Regulation, controllers should maintain records of processing activities under their responsibility and processors should maintain records of categories of processing activities under their responsibility. Union institutions and bodies should be obliged to cooperate with the European Data Protection Supervisor and make their records, on request, available to it, so that they might serve for monitoring those processing operations. Union institutions and bodies should establish a central register of records of their processing activities. For reasons of transparency, they should make such a register public.
Amendment    17 Proposal for a regulation Recital 47
Text proposed by the Commission	Amendment
(47)  Regulation (EC) No 45/2001 provides for a general obligation of the controller to notify the processing of personal data to the data protection officer, who would in turn keep a register of processing operations notified. While that obligation produces administrative and financial burdens, it did not in all cases contribute to improving the protection of personal data. Such indiscriminate general notification obligations should therefore be abolished, and replaced by effective procedures and mechanisms which focus instead on those types of processing operations which are likely to result in a high risk to the rights and freedoms of natural persons by virtue of their nature, scope, context and purposes. Such types of processing operations could be those which in, particular, involve using new technologies, or are of a new kind and where no data protection impact assessment has been carried out before by the controller, or where they become necessary in the light of the time that has elapsed since the initial processing. In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation.	(47)  Regulation (EC) No 45/2001 provides for a general obligation of the controller to notify the processing of personal data to the data protection officer, who in turn keeps a register of processing operations notified. Besides this general obligation, effective procedures and mechanisms should be put in place to monitor processing operations that are likely to result in a high risk to the rights and freedoms of natural persons by virtue of their nature, scope, context and purposes. Such procedures should also be in place, in particular, where types of processing operations involve using new technologies, or are of a new kind and where no data protection impact assessment has been carried out before by the controller, or where they become necessary in the light of the time that has elapsed since the initial processing. In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation.
Amendment    18 Proposal for a regulation Recital 50
Text proposed by the Commission	Amendment
(50)  Regulation (EU) 2016/679 established the European Data Protection Board as an independent body of the Union with legal personality. The Board should contribute to the consistent application of Regulation (EU) 2016/679 and Directive 2016/680 throughout the Union, including by advising the Commission. At the same time, the European Data Protection Supervisor should continue to exercise its supervisory and advisory functions in respect of all Union institutions and bodies, including on its own initiative or upon request. In order to ensure consistency of data protection rules throughout the Union, a consultation by the Commission should be obligatory following the adoption of legislative acts or during the preparation of delegated acts and implementing acts as defined in Article 289, 290 and 291 TFEU and following the adoption of recommendations and proposals relating to agreements with third countries and international organisations as provided for in Article 218 TFEU, which have an impact on the right to personal data protection. In such cases, the Commission should be obliged to consult the European Data Protection Supervisor, except when the Regulation (EU) 2016/679 provides for mandatory consultation of the European Data Protection Board, for example on adequacy decisions or delegated acts on standardised icons and requirements for certification mechanisms. Where the act in question is of particular importance for the protection of individuals' rights and freedoms with regard to the processing of personal data, the Commission should be able, in addition, to consult the European Data Protection Board. In those cases, the European Data Protection Supervisor should, as a member of the European Data Protection Board, coordinate its work with the latter with a view to issue a joint opinion. The European Data Protection Supervisor, and where applicable, the European Data Protection Board should provide its written advice within eight weeks. That time-frame should be shorter in case of urgency or otherwise appropriate, for example when the Commission is preparing delegated and implementing acts.	(50)  Regulation (EU) 2016/679 established the European Data Protection Board as an independent body of the Union with legal personality. The Board should contribute to the consistent application of Regulation (EU) 2016/679 and Directive 2016/680 throughout the Union, including by advising the Commission. At the same time, the European Data Protection Supervisor should continue to exercise its supervisory and advisory functions in respect of all Union institutions and bodies, including on its own initiative or upon request. In order to ensure consistency of data protection rules throughout the Union, a consultation by the Commission should be obligatory when adopting proposals for a legislative act or during the preparation of delegated acts and implementing acts as defined in Article 289, 290 and 291 TFEU and when adopting recommendations and proposals relating to agreements with third countries and international organisations as provided for in Article 218 TFEU, which have an impact on the right to personal data protection. In such cases, the Commission should be obliged to consult the European Data Protection Supervisor, except when the Regulation (EU) 2016/679 provides for mandatory consultation of the European Data Protection Board, for example on adequacy decisions or delegated acts on standardised icons and requirements for certification mechanisms. Where the act in question is of particular importance for the protection of individuals' rights and freedoms with regard to the processing of personal data, the Commission should be able, in addition, to consult the European Data Protection Board. In those cases, the European Data Protection Supervisor should, as a member of the European Data Protection Board, coordinate its work with the latter with a view to issue a joint opinion. The European Data Protection Supervisor, and where applicable, the European Data Protection Board should provide its written advice within eight weeks. That time-frame should be shorter in case of urgency or otherwise appropriate, for example when the Commission is preparing delegated and implementing acts.
Amendment    19 Proposal for a regulation Recital 50 a (new)
Text proposed by the Commission	Amendment
	(50a)  In accordance with Article 75 of Regulation (EU) 2016/679, the European Data Protection Supervisor will provide the secretariat of the European Data Protection Board.
Amendment    20 Proposal for a regulation Recital 52
Text proposed by the Commission	Amendment
(52)  When personal data are transferred from the Union institutions and bodies to controllers, processors or other recipients in third countries or to international organisations, the level of protection of natural persons ensured in the Union by this Regulation should not be undermined, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. In any event, transfers to third countries and international organisations may only be carried out in full compliance with this Regulation. A transfer could take place only if, subject to the other provisions of this Regulation, the conditions laid down in the provisions of this Regulation relating to the transfer of personal data to third countries or international organisations are complied with by the controller or processor.	(52)  When personal data are transferred from the Union institutions and bodies to controllers, processors or other recipients in third countries or to international organisations, the level of protection of natural persons ensured in the Union by this Regulation should be guaranteed, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. In any event, transfers to third countries and international organisations may only be carried out in full compliance with this Regulation, with Regulation (EU) 2016/679 and with the fundamental rights and freedoms enshrined in the Charter. A transfer could take place only if, subject to the other provisions of this Regulation, the conditions laid down in the provisions of this Regulation relating to the transfer of personal data to third countries or international organisations are complied with by the controller or processor.
Amendment    21 Proposal for a regulation Recital 53
Text proposed by the Commission	Amendment
(53)  The Commission can decide, under Article 45 of Regulation (EU) 2016/679, that a third country, a territory or specified sector within a third country, or an international organisation, offers an adequate level of data protection. In such cases, transfers of personal data to that third country or international organisation by a Union institution or body can take place without the need to obtain any further authorisation.	(53)  The Commission can decide, under Article 45 of Regulation (EU) 2016/679 or to Article 36 of Directive (EU) 2016/680, that a third country, a territory or specified sector within a third country, or an international organisation, offers an adequate level of data protection. In such cases, transfers of personal data to that third country or international organisation by a Union institution or body can take place without the need to obtain any further authorisation.
Amendment    22 Proposal for a regulation Recital 64 a (new)
Text proposed by the Commission	Amendment
	(64a)  The Commission has proposed to amend Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC ('the IMI Regulation') to allow the IMI System to be used not only by the competent authorities of the Member States and the Commission, but also by Union bodies, offices and agencies1a. Pending this revision, the European Data Protection Supervisor and the European Data Protection Board should be able to use the Internal Market Information System for the purposes of administrative cooperation and information exchange stipulated in the General Data Protection Regulation in view of its entry into application on 25 May 2018.
	_________________
	1a See Article 36 of the Proposal for a Regulation of the European Parliament and of the Council on establishing a single digital gateway to provide information, procedures, assistance and problem solving services and amending Regulation (EU) No 1024/2012, COM(2017) 256 final, 2017/0086 (COD).
Amendment    23 Proposal for a regulation Recital 65
Text proposed by the Commission	Amendment
(65)  In certain instances, Union law provides for a model of coordinated supervision, shared between the European Data Protection Supervisor and the national supervisory authorities. Moreover, the European Data Protection Supervisor is the supervisory authority of Europol and a specific model of cooperation with the national supervisory authorities is established through a cooperation board with an advisory function. In order to improve the effective supervision and enforcement of substantive data protection rules, a single, coherent model of coordinated supervision should be introduced in the Union. The Commission should therefore, where appropriate, submit legislative proposals with a view to amending Union legal acts providing for a model of coordinated supervision, in order to align them with the coordinated supervision model of this Regulation. The European Data Protection Board should serve as a single forum for ensuring the effective coordinated supervision across the board.	(65)  In certain instances, Union law provides for a model of coordinated supervision, shared between the European Data Protection Supervisor and the national supervisory authorities. Moreover, the European Data Protection Supervisor is the supervisory authority of Europol and a specific model of cooperation with the national supervisory authorities is established through a cooperation board with an advisory function. In order to improve the effective supervision and enforcement of substantive data protection rules, this Regulation should introduce a single, coherent model of coordinated supervision. The European Data Protection Board should serve as a single forum for ensuring the effective coordinated supervision across the board.
Amendment    24 Proposal for a regulation Article 1 – paragraph 2
Text proposed by the Commission	Amendment
2.  This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.	2.  This Regulation protects fundamental rights and freedoms of natural persons enshrined in the Charter and in particular their right to the protection of personal data.
Amendment    25 Proposal for a regulation Article 2 – paragraph 1
Text proposed by the Commission	Amendment
1.  This Regulation applies to the processing of personal data by all Union institutions and bodies insofar as such processing is carried out in the exercise of activities which fall, wholly or partially within the scope of Union law.	1.  This Regulation applies to the processing of personal data by all Union institutions and bodies.
Amendment    26 Proposal for a regulation Article 2 – paragraph 2 a (new)
Text proposed by the Commission	Amendment
	2a.  This Regulation shall also apply to Union agencies carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of Part Three TFEU, including where the founding acts of these Union agencies lay down a stand-alone data protection regime for the processing of operational personal data. Provisions relating to specific processing of operational personal data contained in the founding acts of these agencies may particularise and complement the application of this Regulation.
Amendment    27 Proposal for a regulation Article 3 – paragraph 1 – point a
Text proposed by the Commission	Amendment
(a)  the definitions in Regulation (EU) 2016/679, with the exception of the definition of ‘controller’ in point (7) of Article 4 of that Regulation;	(a)  the definitions in Regulation (EU) 2016/679, with the exception of the definition of 'controller' in point (7), 'main establishment' in point (16), 'enterprise' in point (18), 'group of undertaking' in point (19) of Article 4 of that Regulation; the definition of ‘electronic communication’ in point (a) of Article 4(2) of Regulation (EU) XX/XXXX [ePrivacy Regulation];
Amendment    28 Proposal for a regulation Article 3 – paragraph 2 – point d a (new)
Text proposed by the Commission	Amendment
	(da)  'operational personal data' means personal data processed by the Union agencies established on the basis of Chapters 4 and 5 of Title V of Part Three TFEU and by the missions referred to in Article 42(1), 43 and 44 TEU, for the purposes of meeting the objectives laid down in acts establishing those agencies or missions.
Amendment    29 Proposal for a regulation Article 4 – paragraph 1 – introductory part
Text proposed by the Commission	Amendment
1.  Personal data must be:	1.  Personal data shall be:
Amendment    30 Proposal for a regulation Article 4 – paragraph 1 – point d
Text proposed by the Commission	Amendment
(d)  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified without delay (‘accuracy’);	(d)  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
Amendment    31 Proposal for a regulation Article 5 – paragraph 2
Text proposed by the Commission	Amendment
2.  The tasks referred to in point (a) of paragraph 1 shall be laid down in Union law.	2.  The tasks referred to in point (a) of paragraph 1 shall be laid down in Union law. The basis for the processing referred to in point (b) of paragraph 1 shall be laid down in Union or Member State law to which the controller is subject.
Amendment    32 Proposal for a regulation Article 8 – title
Text proposed by the Commission	Amendment
Conditions applicable to children's consent in relation to information society services	Conditions applicable to a child's consent in relation to information society services
Amendment    33 Proposal for a regulation Article 8 a (new)
Text proposed by the Commission	Amendment
	Article 8a
	Transfer of personal data between Union institutions and bodies
	Without prejudice to Articles 4, 5, 6 and 10:
	1. Personal data shall only be transferred within or to other Union institutions or bodies if the data are necessary for the legitimate performance of tasks covered by the competence of the recipient.
	2. Where the data are transferred following a request from the recipient, both the controller and the recipient shall bear the responsibility for the legitimacy of this transfer.
	The controller shall be required to verify the competence of the recipient and to make a provisional evaluation of the necessity for the transfer of the data. If doubts arise as to this necessity, the controller shall seek further information from the recipient.
	The recipient shall ensure that the necessity for the transfer of the data can be subsequently verified.
	3. The recipient shall process the personal data only for the purposes for which they were transmitted.
.
Amendment    34 Proposal for a regulation Article 9 – paragraph 1 – introductory part
Text proposed by the Commission	Amendment
1.  Without prejudice to Articles 4, 5, 6 and 10, personal data shall only be transmitted to recipients established in the Union and subject to Regulation (EU) 2016/679 or to the national law adopted pursuant to Directive (EU) 2016/680, if the recipient establishes:	1.  Without prejudice to Articles 4, 5, 6, 10, 14, 15(3) and 16(4), personal data shall only be transmitted to recipients established in the Union and subject to Regulation (EU) 2016/679 or to the national law adopted pursuant to Directive (EU) 2016/680, if the controller establishes, on the basis of a reasoned request by the recipient:
Amendment    35 Proposal for a regulation Article 9 – paragraph 1 – point b
Text proposed by the Commission	Amendment
(b)  that it is necessary to have the data transmitted, it is proportionate to the purposes of the transmission and if there is no reason to assume that the data subject's rights and freedoms and legitimate interests might be prejudiced.	(b)  that it is proportionate and necessary for the purpose of serving a public interest such as transparency or good administration and, if there is any reason to assume that the data subject's legitimate interests might be prejudiced, after having demonstrably weighed the various competing interests;
Amendment    36 Proposal for a regulation Article 10 – paragraph 2 – point a
Text proposed by the Commission	Amendment
(a)  the data subject has given explicit consent to the processing of those data for one or more specified purposes, except where Union law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject, or	(a)  the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject, or
Amendment    37 Proposal for a regulation Article 10 – paragraph 3
Text proposed by the Commission	Amendment
3.  Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union law.	3.  Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies, or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
Amendment    38 Proposal for a regulation Article 11 – paragraph 1
Text proposed by the Commission	Amendment
Processing of personal data relating to criminal convictions and offences or related security measures pursuant to Article 5(1) may be carried out only if authorised by Union law, which may include internal rules, providing the appropriate specific safeguards for the rights and freedoms of data subjects.	Processing of personal data relating to criminal convictions and offences or related security measures pursuant to Article 5(1) shall be carried out only if authorised by Union law, providing the appropriate specific safeguards for the rights and freedoms of data subjects.
Amendment    39 Proposal for a regulation Article 14 – paragraph 5 – subparagraph 1
Text proposed by the Commission	Amendment
Information provided under Articles 15 and 16 and any communication and any actions taken under Articles 17 to 24 and 38 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may refuse to act on the request.	Information provided under Articles 15 and 16 and any communication and any actions taken under Articles 17 to 24 and 38 shall be provided free of charge.
Amendment    40 Proposal for a regulation Article 14 – paragraph 8
Text proposed by the Commission	Amendment
8.  If the Commission adopts delegated acts pursuant to Article 12(8) of Regulation (EU) 2016/679 determining the information to be presented by the icons and the procedures for providing standardised icons, Union institutions and bodies shall, where appropriate, provide the information pursuant to Articles 15 and 16 in combination with such standardised icons.	8.  The Commission shall be empowered to adopt delegated acts pursuant to Article 12(8) of Regulation (EU) 2016/679 determining the information to be presented by the icons and the procedures for providing standardised icons, Union institutions and bodies shall, where appropriate, provide the information pursuant to Articles 15 and 16 in combination with such standardised icons.
Amendment    41 Proposal for a regulation Article 16 – paragraph 5 – point b
Text proposed by the Commission	Amendment
(b)  the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing;	(b)  the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing.
Amendment    42 Proposal for a regulation Article 16 – paragraph 5 – point c
Text proposed by the Commission	Amendment
(c)  obtaining or disclosure is expressly laid down by Union law; or	(c)  obtaining or disclosure is expressly laid down by Union law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interest; or
Amendment    43 Proposal for a regulation Article 16 – paragraph 5 – point d
Text proposed by the Commission	Amendment
(d)  where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union law.	(d)  where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union law, including a statutory obligation of secrecy.
Amendment    44 Proposal for a regulation Article 16 – paragraph 5 a (new)
Text proposed by the Commission	Amendment
	5a.   In the cases referred to in paragraph 5(b) the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interest, including making the information publicly available.
Amendment    45 Proposal for a regulation Article 20 – paragraph 1 – point b
Text proposed by the Commission	Amendment
(b)  the processing is unlawful and the data subject opposes their erasure and requests the restriction of their use instead;	(b)  the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
Amendment    46 Proposal for a regulation Article 25 – paragraph 1 – introductory part
Text proposed by the Commission	Amendment
1.  Legal acts adopted on the basis of the Treaties or, in matters relating to the operation of the Union institutions and bodies, internal rules laid down by the latter may restrict the application of Articles 14 to 22, 34 and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:	1.  Legal acts adopted on the basis of the Treaties may restrict the application of Articles 14 to 22 and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
Amendment    47 Proposal for a regulation Article 25 – paragraph 1 a (new)
Text proposed by the Commission	Amendment
	1a.   Acts adopted under paragraph 1 shall be clear and precise. Their application shall be foreseeable to persons subject to it.
Amendment    48 Proposal for a regulation Article 25 – paragraph 1 b (new)
Text proposed by the Commission	Amendment
	1b.  In particular, any legal act adopted under paragraph 1 shall contain specific provisions at least, where relevant, as to:
	(a) the purposes of the processing or categories of processing;
	(b) the categories of personal data;
	(c) the scope of the restriction introduced;
	(d) the safeguards to prevent abuse or unlawful access or transfer;
	(e) the specification of the controller or categories of controllers;
	(f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
	(g) the risks to the rights and freedoms of data subjects; and
	(h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.
Amendment    49 Proposal for a regulation Article 25 – paragraph 2
Text proposed by the Commission	Amendment
2.  Where a restriction is not provided for by a legal act adopted on the basis of the Treaties or by an internal rule in accordance with paragraph 1, the Union institutions and bodies may restrict the application of Articles 14 to 22, 34 and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, if such a restriction respects the essence of the fundamental rights and freedoms, in relation to a specific processing operation, and is a necessary and proportionate measure in a democratic society to safeguard one or more of the objectives referred to in paragraph 1. The restriction shall be notified to the competent data protection officer.	deleted
Amendment    50 Proposal for a regulation Article 25 – paragraph 3
Text proposed by the Commission	Amendment
3.  Where personal data are processed for scientific or historical research purposes or statistical purposes, Union law, which may include internal rules, may provide for derogations from the rights referred to in Articles 17, 18, 20 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.	3.  Where personal data are processed for scientific or historical research purposes or statistical purposes, Union law may provide for derogations from the rights referred to in Articles 17, 18, 20 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
Amendment    51 Proposal for a regulation Article 25 – paragraph 4
Text proposed by the Commission	Amendment
4.  Where personal data are processed for archiving purposes in the public interest, Union law, which may include internal rules, may provide for derogations from the rights referred to in Articles 17, 18, 20, 21, 22 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.	4.  Where personal data are processed for archiving purposes in the public interest, Union law may provide for derogations from the rights referred to in Articles 17, 18, 20, 21, 22 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
Amendment    52 Proposal for a regulation Article 25 – paragraph 5
Text proposed by the Commission	Amendment
5.  Internal rules referred to in paragraphs 1, 3 and 4 shall be sufficiently clear and precise and subject to appropriate publication.	deleted
Amendment    53 Proposal for a regulation Article 25 – paragraph 6
Text proposed by the Commission	Amendment
6.  If a restriction is imposed pursuant to paragraphs 1 or 2, the data subject shall be informed, in accordance with Union law, of the principal reasons on which the application of the restriction is based and of his or her right to lodge a complaint with the European Data Protection Supervisor.	6.  If a restriction is imposed pursuant to paragraph 1, the data subject shall be informed, in accordance with Union law, of the principal reasons on which the application of the restriction is based and of his or her right to lodge a complaint with the European Data Protection Supervisor.
Amendment    54 Proposal for a regulation Article 25 – paragraph 7
Text proposed by the Commission	Amendment
7.  If a restriction imposed pursuant to paragraphs 1 or 2 is relied upon to deny access to the data subject, the European Data Protection Supervisor shall, when investigating the complaint, only inform him or her of whether the data have been processed correctly and, if not, whether any necessary corrections have been made.	7.  If a restriction imposed pursuant to paragraph 1 is relied upon to deny access to the data subject, the European Data Protection Supervisor shall, when investigating the complaint, only inform him or her of whether the data have been processed correctly and, if not, whether any necessary corrections have been made.
Amendment    55 Proposal for a regulation Article 25 – paragraph 8
Text proposed by the Commission	Amendment
8.  Provision of the information referred to in paragraphs 6 and 7 and in Article 46(2) may be deferred, omitted or denied if it would cancel the effect of the restriction imposed pursuant to paragraph 1 or 2.	8.  Provision of the information referred to in paragraphs 6 and 7 and in Article 46(2) may be deferred, omitted or denied if it would cancel the effect of the restriction imposed pursuant to paragraph 1.
Amendment    56 Proposal for a regulation Article 26 – paragraph 2 a (new)
Text proposed by the Commission	Amendment
	2a.  Adherence to approved certification mechanisms as referred to in Article 42 of Regulation (EU) 2016/679 may be used as an element by which to demonstrate compliance with the obligations of the controller.
Amendment    57 Proposal for a regulation Article 27 – paragraph 2 a (new)
Text proposed by the Commission	Amendment
	2a.  An approved certification mechanism pursuant to Article 42 of Regulation (EU) 2016/679 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2 of this Article.
Amendment    58 Proposal for a regulation Article 28 – paragraph 3
Text proposed by the Commission	Amendment
3.  The data subject may exercise his or her rights under this Regulation in respect of and against one or more of the joint controllers, taking into account their roles as determined in the terms of the arrangement referred to in paragraph 1.	3.  Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.
Amendment    59 Proposal for a regulation Article 31 – paragraph 5
Text proposed by the Commission	Amendment
5.  Union institutions and bodies may decide to keep their records of processing activities in a central register. In this case, they may also decide to make the register publicly accessible.	5.  Union institutions and bodies shall keep their records of processing activities in a central register and make the register publicly accessible.
Amendment    60 Proposal for a regulation Chapter 4 – section 2 – title
Text proposed by the Commission	Amendment
SECURITY OF PERSONAL DATA AND CONFIDENTIALITY OF ELECTRONIC COMMUNICATIONS	SECURITY OF PERSONAL DATA
Amendment    61 Proposal for a regulation Article 33 – paragraph 3 a (new)
Text proposed by the Commission	Amendment
	3a.  Adherence to an approved certification mechanism as referred to in Article 42 of Regulation (EU) 2016/679 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.
Amendment    62 Proposal for a regulation Article 33 a (new)
Text proposed by the Commission	Amendment
	Article 33 a
	Adherence to an approved code of conduct as pursuant to Article 42 of Regulation (EU) 2016/679 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 and 2.
Amendment    63 Proposal for a regulation Article 34
Text proposed by the Commission	Amendment
Article 34	deleted
Confidentiality of electronic communications
Union institutions and bodies shall ensure the confidentiality of electronic communications, in particular by securing their electronic communication networks.
Amendment    64 Proposal for a regulation Article 36
Text proposed by the Commission	Amendment
Article 36	deleted
Directories of users
1.  Personal data contained in directories of users and access to such directories shall be limited to what is strictly necessary for the specific purposes of the directory.
2.  Union institutions and bodies shall take all the necessary measures to prevent personal data contained in those directories, regardless of whether they are accessible to the public or not, from being used for direct marketing purposes.
Amendment    65 Proposal for a regulation Chapter 4 – section 2 a (new)
Text proposed by the Commission	Amendment
	CONFIDENTIALITY OF ELECTRONIC COMMUNICATIONS
Amendment    66 Proposal for a regulation Article 38 a (new)
Text proposed by the Commission	Amendment
	Article 38a
	Confidentiality of electronic communications
	Union institutions and bodies shall ensure the confidentiality of electronic communications, in particular by securing their electronic communication networks.
Amendment    67 Proposal for a regulation Article 38 b (new)
Text proposed by the Commission	Amendment
	Article 38b
	Directories of users
	1. Personal data contained in directories of users and access to such directories shall be limited to what is strictly necessary for the specific purposes of the directory.
	2. Union institutions and bodies shall take all the necessary measures to prevent personal data contained in those directories from being used for direct marketing purposes, regardless of whether they are accessible to the public or not.
Amendment    68 Proposal for a regulation Article 41 – paragraph 1
Text proposed by the Commission	Amendment
The Union institutions and bodies shall inform the European Data Protection Supervisor when drawing up administrative measures and internal rules relating to the processing of personal data involving a Union institution or body alone or jointly with others.	The Union institutions and bodies shall inform the European Data Protection Supervisor when drawing up administrative measures relating to the processing of personal data involving a Union institution or body alone or jointly with others.
Amendment    69 Proposal for a regulation Article 42 – paragraph 1
Text proposed by the Commission	Amendment
1.  Following the adoption of proposals for a legislative act and of recommendations or proposals to the Council pursuant to Article 218 TFEU and when preparing delegated acts or implementing acts, which have an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission shall consult the European Data Protection Supervisor.	1.  When adopting proposals for a legislative act and recommendations or proposals to the Council pursuant to Article 218 TFEU and when preparing delegated acts or implementing acts relating to the protection of natural persons' rights and freedoms with regard to the processing of personal data, the Commission shall consult the European Data Protection Supervisor.
Amendment    70 Proposal for a regulation Article 44 – paragraph 4
Text proposed by the Commission	Amendment
4.  The data protection officer may be a staff member of the Union institution or body, or fulfil the tasks on the basis of a service contract.	4.  The data protection officer shall be a staff member of the Union institution or body. In exceptional circumstances, taking into account their size and if the conditions set out in paragraph 2 are not met, Union institutions and bodies may designate a data protection officer who fulfils his or her tasks on the basis of a service contract.
Amendment    71 Proposal for a regulation Article 45 – paragraph 5
Text proposed by the Commission	Amendment
5.  The data protection officer and his or her staff shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union law.	5.  The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union law.
Amendment    72 Proposal for a regulation Article 46 – paragraph 1 – point g a (new)
Text proposed by the Commission	Amendment
	(ga)  ensure that the rights and freedoms of data subjects are not adversely affected by processing operations.
Amendment    73 Proposal for a regulation Article 48 – paragraph 1
Text proposed by the Commission	Amendment
1.  A transfer of personal data to a third country or international organisation may take place where the Commission has decided pursuant to Article 45(3) of Regulation (EU) 2016/679 that an adequate level of protection is ensured in the third country, a territory or one or more specified sectors within that third country, or within the international organisation and the personal data are transferred solely to allow tasks covered by the competence of the controller to be carried out.	1.  A transfer of personal data to a third country or international organisation may take place where the Commission has decided pursuant to Article 45(3) of Regulation (EU) 2016/679 or to Article 36 of Directive (EU) 2016/680, that an adequate level of protection is ensured in the third country, a territory or one or more specified sectors within that third country, or within the international organisation and the personal data are transferred solely to allow tasks covered by the competence of the controller to be carried out. Such a transfer shall not require any specific authorisation.
Amendment    74 Proposal for a regulation Article 49 – paragraph 1
Text proposed by the Commission	Amendment
1.  In the absence of a decision pursuant to Article 45(3) of Regulation (EU) 2016/679, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.	1.  In the absence of a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 or to Article 36(3) of Directive (EU) 2016/680, within the respective scope of those legislative acts, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
Amendment    75 Proposal for a regulation Article 51 – paragraph 1 – introductory part
Text proposed by the Commission	Amendment
1.  In the absence of a decision pursuant to Article 45(3) of Regulation (EU) 2016/679, or of appropriate safeguards pursuant to Article 49, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:	1.  In the absence of a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 or to Article 36(3) of Directive (EU) 2016/680, within the respective scope of those legislative acts, or of appropriate safeguards pursuant to Article 49, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:
Amendment    76 Proposal for a regulation Article 54 – paragraph 1
Text proposed by the Commission	Amendment
1.  The European Parliament and the Council shall appoint the European Data Protection Supervisor by common accord for a term of five years, on the basis of a list drawn up by the Commission following a public call for candidates. The call for candidates shall enable all interested parties throughout the Union to submit their applications. The list of candidates drawn up by the Commission shall be public. On the basis of the list drawn up by the Commission, the competent committee of the European Parliament may decide to hold a hearing in order to enable it to express a preference.	1.  The European Parliament and the Council shall appoint the European Data Protection Supervisor by common accord for a term of five years, on the basis of a list drawn up jointly by the European Parliament, the Council and the Commission following a public call for candidates. The call for candidates shall enable all interested parties throughout the Union to submit their applications. The list of candidates shall be public and shall consist of at least five candidates. The competent committee of the European Parliament may decide to hold a hearing of the listed candidates in order to enable it to express a preference.
Amendment    77 Proposal for a regulation Article 54 – paragraph 2
Text proposed by the Commission	Amendment
2.  The list drawn up by the Commission from which the European Data Protection Supervisor shall be chosen shall be made up of persons whose independence is beyond doubt and who are acknowledged as having the experience and skills required to perform the duties of European Data Protection Supervisor, for example because they belong or have belonged to the supervisory authorities established under Article 41 of Regulation (EU) 2016/679.	2.  The list drawn up jointly by the European Parliament, the Council and the Commission from which the European Data Protection Supervisor shall be chosen shall be made up of persons whose independence is beyond doubt and who are acknowledged as having expert knowledge in data protection as well as the experience and skills required to perform the duties of European Data Protection Supervisor, for example because they belong or have belonged to the supervisory authorities established under Article 41 of Regulation (EU) 2016/679.
Amendment    78 Proposal for a regulation Article 55 – paragraph 4
Text proposed by the Commission	Amendment
4.  The European Data Protection Supervisor shall be assisted by a Secretariat. The officials and other staff members of the Secretariat shall be appointed by the European Data Protection Supervisor and their superior shall be the European Data Protection Supervisor. They shall be subject exclusively to his or her direction. Their numbers shall be decided each year as part of the budgetary procedure.	4.  The European Data Protection Supervisor shall be assisted by a Secretariat. The officials and other staff members of the Secretariat shall be appointed by the European Data Protection Supervisor and their superior shall be the European Data Protection Supervisor. They shall be subject exclusively to his or her direction. Their numbers shall be decided each year as part of the budgetary procedure. Article 75(2) of Regulation (EU) 2016/679 shall apply to the staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the European Data Protection Board by Union law.
Amendment    79 Proposal for a regulation Article 59 – paragraph 1 – point e
Text proposed by the Commission	Amendment
(e)  to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law;	(e)  to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union law;
Amendment    80 Proposal for a regulation Article 59 – paragraph 3 – point b a (new)
Text proposed by the Commission	Amendment
	(ba)  to authorise or not the processing operations as referred to in Article 40(4);
Amendment    81 Proposal for a regulation Article 61 – title
Text proposed by the Commission	Amendment
Cooperation with national supervisory authorities	Cooperation between the European Data Protection Supervisor and national supervisory authorities
Amendment    82 Proposal for a regulation Article 61 – paragraph 1
Text proposed by the Commission	Amendment
The European Data Protection Supervisor shall cooperate with supervisory authorities established under Article 41 of Regulation (EU) 2016/679 and Article 51 of Directive (EU) 2016/680 (hereinafter “national supervisory authorities”) and with the joint supervisory authority established under Article 25 of Council Decision 2009/917/JHA21 to the extent necessary for the performance of their respective duties, in particular by providing each other with relevant information, requesting national supervisory authorities to exercise their powers or responding to a request from such authorities.	The European Data Protection Supervisor shall cooperate with supervisory authorities established under Article 51 of Regulation (EU) 2016/679 and Article 41 of Directive (EU) 2016/680 (hereinafter "national supervisory authorities") to the extent necessary for the performance of their respective duties, in particular by providing each other with relevant information, requesting each other to exercise their powers or responding to each other's requests.
_________________
21 Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes, OJ L 323, 10.12.2009, p. 20–30.
Amendment    83 Proposal for a regulation Article 61 – paragraph 1 a (new)
Text proposed by the Commission	Amendment
	The European Data Protection Supervisor and the European Data Protection Board may use the Internal Market Information System established by Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC ('the IMI Regulation') for the purposes of administrative cooperation and information exchange pursuant to Articles 60 to 62, 64, 65 and 70 of Regulation (EU) 2016/679.
Amendment    84 Proposal for a regulation Article 62 – paragraph 1
Text proposed by the Commission	Amendment
1.  Where a Union act refers to this Article, the European Data Protection Supervisor shall cooperate actively with the national supervisory authorities, in order to ensure effective supervision of large IT systems or Union agencies.	1.  Where a Union act envisages that the European Data Protection Supervisor supervises the processing of personal data at Union level and national supervisory authorities supervise the processing of personal data at national level, the European Data Protection Supervisor and the national supervisory authorities, each acting within the scope of their respective competencies, shall cooperate actively in the framework of their responsibilities in order to ensure effective, coordinated supervision of large IT systems or Union bodies, offices or agencies.
Amendment    85 Proposal for a regulation Article 62 – paragraph 2
Text proposed by the Commission	Amendment
2.  The European Data Protection Supervisor shall, acting within the scope of its respective competences and in the framework of its responsibilities, exchange relevant information, assist in carrying out audits and inspections, examine difficulties of interpretation or application of this Regulation and other applicable Union acts, study problems with the exercise of independent supervision or in the exercise of the rights of data subjects, draw up harmonised proposals for solutions to any problems and promote awareness of data protection rights, as necessary, jointly with the national supervisory authorities.	2.  They shall, each acting within the scope of their respective competences and in the framework of their responsibilities, exchange relevant information, assist each other in carrying out audits and inspections, examine difficulties of interpretation or application of this Regulation and other applicable Union acts, study problems with the exercise of independent supervision or in the exercise of the rights of data subjects, draw up harmonised proposals for solutions to any problems and promote awareness of data protection rights, as necessary.
Amendment    86 Proposal for a regulation Article 62 – paragraph 3
Text proposed by the Commission	Amendment
3.  For the purposes laid down in paragraph 2, the European Data Protection Supervisor shall meet with the national supervisory authorities at least twice a year within the framework of the European Data Protection Board. The costs and servicing of those meetings shall be borne by the European Data Protection Board. Rules of procedure shall be adopted at the first meeting. Further working methods shall be developed jointly as necessary.	3.  For the purposes laid down in paragraph 2, the European Data Protection Supervisor and the national supervisory authorities shall meet at least twice a year within the framework of the European Data Protection Board. The costs and servicing of those meetings shall be borne by the European Data Protection Board. For these purposes, the European Data Protection Board may develop further working methods as necessary.
Amendment    87 Proposal for a regulation Chapter – VIII a (new) – Title
Text proposed by the Commission Amendment   CHAPTER VIIIa   Processing of operational personal data
Amendment    88 Proposal for a regulation Article – 69 a (new)
Text proposed by the Commission	Amendment
	Article 69a
	Scope
	By way of derogation from Articles 4, 5, 6, 7, 8, 10, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 41, 43, 49, 50 and 51, the provisions of this Chapter shall apply to processing of operational data by Union agencies established on the basis of Chapters 4 and 5 of Title V of Part Three TFEU and by missions referred to in Article 42(1) and Articles 43 and 44 TEU.
	Provisions relating to specific processing of operational personal data contained in the founding acts of these agencies may particularise and complement the application of this Regulation.
Amendment    89 Proposal for a regulation Article 69 b (new)
Text proposed by the Commission	Amendment
	Article 69b
	Principles relating to processing of operational personal data
	1.  Operational personal data shall be:
	(a)  processed lawfully and fairly ('lawfulness and fairness');
	(b)  collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes provided that the Union agencies and missions provide appropriate safeguards, in particular to ensure that data are not processed for any other purposes ('purpose limitation');
	(c)  adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');
	(d)  accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that operational personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy');
	(e)  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the operational personal data are processed;
	(f) processed in a manner that ensures appropriate security of the operational personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality').
	2.  Union agencies or missions shall make publicly available a document setting out in an intelligible form the provisions regarding the processing of operational personal data and the means available for the exercise of the rights of data subjects.
Amendment    90 Proposal for a regulation Article 69 c (new)
Text proposed by the Commission Amendment   Article 69c   Lawfulness of processing   Processing shall be lawful only if and to the extent that processing is necessary for the performance of a task carried out by Union agencies and missions and that it is based on Union law. Union law specifying and complementing this Regulation as regards the processing within the scope of this Chapter shall specify the objectives of processing, the operational personal data to be processed and the purposes of the processing.
Amendment    91 Proposal for a regulation Article 69 d (new)
Text proposed by the Commission Amendment   Article 69d   Distinction between different categories of data subjects   Union agencies or missions shall make a clear distinction between operational personal data of different categories of data subjects, such as:   (a)  persons who are suspected of having committed or having taken part in a criminal offence in respect of which the Union agencies or missions are competent, or who have been convicted of such an offence;   (b)  persons regarding whom there are factual indications or reasonable grounds to believe that they will commit criminal offences in respect of which Union agencies or missions are competent;   (c)  persons who have been the victims of one of the offences under consideration or with regard to whom certain facts give reason to believe that they could be the victim of a criminal offence;   (d)  persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings;   (e)  persons who can provide information on criminal offences; and   (f)  contacts or associates of one of the persons referred to in points (a) and (b).
Amendment    92 Proposal for a regulation Article 69 e (new)
Text proposed by the Commission Amendment   Article 69e   Distinction between operational personal data and verification of quality of operational personal data   Union agencies and missions shall distinguish operational personal data based on facts from operational personal data based on personal assessments. Union agencies and missions shall process operational personal data in such a way that, where applicable, it can be established which authority provided the data or where the data has been retrieved from. Union agencies and missions shall ensure that operational personal data which are inaccurate, incomplete or no longer up to date are not transmitted or made available. To that end, Union agencies and missions shall verify the quality of operational personal data before they are transmitted or made available. As far as possible, in all transmissions of operational personal data, Union agencies and missions shall add necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of operational personal data, and the extent to which they are up to date shall be added. If it emerges that incorrect operational personal data have been transmitted or operational personal data have been unlawfully transmitted, the recipient shall be notified without delay. In such a case, the operational personal data shall be rectified or erased or processing shall be restricted.
Amendment    93 Proposal for a regulation Article 69 f (new)
Text proposed by the Commission Amendment   Article 69f   Specific processing conditions   When Union agencies and missions provide for specific conditions for processing, they shall inform the recipient of such operational personal data of those conditions and the requirement to comply with them. Union agencies and missions shall comply with specific processing conditions for processing provided by a national authority in accordance with Article 9 (3) and (4) of Directive (EU) 2016/680.
Amendment    94 Proposal for a regulation Article 69 g (new)
Text proposed by the Commission Amendment   Article 69g   Transmission of operational personal data to other Union institutions and bodies   Union agencies and missions shall only transmit operational personal data to other Union institutions and bodies if the data are necessary for the performance of their tasks or those of the recipient Union agencies and missions. Where operational personal data are transmitted following a request from the other Union institution or body, both the controller and the recipient shall bear the responsibility for the legitimacy of this transfer. Union agencies and missions shall be required to verify the competence of the other Union institution or body and to make a provisional evaluation of the necessity for the transmission. If doubts arise as to this necessity, Union agencies and missions shall seek further information from the recipient. Other Union institutions and bodies shall ensure that the necessity for the transmission can be subsequently verified. Other Union institutions and bodies shall process the personal data only for the purposes for which they were transmitted.
Amendment    95 Proposal for a regulation Article 69 h (new)
Text proposed by the Commission Amendment   Article 69h   Processing of special categories of operational personal data   Processing of operational personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, operational personal data concerning health or operational personal data concerning a natural person's sex life or sexual orientation shall be prohibited, unless it is strictly necessary and proportionate for preventing or combating crime that falls within the Union agencies’ or missions’ objectives and if those data supplement other personal data processed by the Union agencies and missions. The selection of a particular group of persons solely on the basis of such personal data shall be prohibited. The data protection officer shall be informed immediately of recourse to this Article. Operational personal data as referred to in subparagraph above shall not be transmitted to Member States, Union bodies, third countries or international organisations unless such transmission is strictly necessary and proportionate in individual cases concerning crime that falls within the Union agencies’ and missions’ objectives and in accordance with Chapter V.
Amendment    96 Proposal for a regulation Article 69 i (new)
Text proposed by the Commission Amendment   Article 69i   Automated individual decision-making, including profiling   The data subject shall have the right not to be subject to a decision of Union agencies and missions based solely on automated processing, including profiling, which produces adverse legal effects concerning him or her or similarly significantly affects him or her.
Amendment    97 Proposal for a regulation Article 69 j (new)
Text proposed by the Commission Amendment   Article 69j   Information to be made available or given to the data subject   1.  Union agencies and missions shall make available to the data subject at least the following information:   (a)  the identity and the contact details of the Union agency or mission;   (b)  the contact details of the data protection officer;   (c)  the purposes of the processing for which the operational personal data are intended;   (d)  the right to lodge a complaint with the European Data Protection Supervisor and its contact details;   (e)  the existence of the right to request from Union agencies and missions access to and rectification or erasure of operational personal data and restriction of processing of the operational personal data concerning the data subject.   2.  In addition to the information referred to in paragraph 1, Union agencies and missions shall give to the data subject, in specific cases, the following further information to enable the exercise of his or her rights:   (a)  the legal basis for the processing;   (b)  the period for which the operational personal data will be stored, or, where that is not possible, the criteria used to determine that period;   (c)  the categories of recipients of the operational personal data, including in third countries or international organisations;   (d)  where necessary, further information, in particular where the operational personal data are collected without the knowledge of the data subject.   3.  Union agencies and missions may delay, restrict or omit the provision of the information to the data subject pursuant to paragraph 2 to the extent that, and for as long as, such a measure is provided for by a legal act adopted on the basis of the Treaties and constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned, in order to:   (a)  avoid obstructing official or legal inquiries, investigations or procedures;   (b)  avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;   (c)  protect public security of the Member States;   (d)  protect national security of the Member States;   (e)  protect the rights and freedoms of others.
Amendment    98 Proposal for a regulation Article 69 k (new)
Text proposed by the Commission Amendment   Article 69k   Right of access by the data subject   Any data subject shall have the right to obtain from Union agencies and missions confirmation as to whether or not operational personal data concerning him or her are processed, and be given access to the following information:   (a)  the purposes of and legal basis of the processing operation;   (b)  the categories of operational personal data concerned;   (c)  the recipients or categories of recipients to whom the operational personal data have been disclosed, in particular recipients in third countries or international organisations;   (d)  the envisaged period for which the operational personal data will be stored;   (e)  the existence of the right to request from Union agencies and missions rectification or erasure of operational personal data or restriction of processing of operational personal data concerning the data subject;   (f)  the right to lodge a complaint with the European Data Protection Supervisor and his or her contact details;   (g)  communication of the operational personal data undergoing processing and of any available information as to their sources.
Amendment    99 Proposal for a regulation Article 69 l (new)
Text proposed by the Commission Amendment   Article 69l   Limitations to the right of access   1.  Union agencies and missions may restrict, wholly or partly, the data subject's right of access to the extent that, and for as long as, such a partial or complete restriction is provided for by a legal act adopted on the basis of the Treaties and constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned, in order to:   (a)  avoid obstructing official or legal inquiries, investigations or procedures;   (b)  avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;   (c)  protect public security of the Member States;   (d)  protect national security of the Member States;   (f)  protect the rights and freedoms of others.   2.  In the cases referred to in paragraph 1, Union agencies and missions shall inform the data subject, without undue delay, in writing of any refusal or restriction of access and of the reasons for the refusal or the restriction. Such information may be omitted where its provision would undermine a purpose under paragraph 1. Union agencies and missions shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union. Union agencies and missions shall document the factual or legal reasons on which the decision is based. That information shall be made available to the European Data Protection Supervisor on request.
Amendment    100 Proposal for a regulation Article 69 m (new)
Text proposed by the Commission Amendment   Article 69m   Right to rectification or erasure of operational personal data and restriction of processing   1.  Any data subject shall have the right to obtain from Union agencies and missions without undue delay the rectification of inaccurate operational personal data relating to him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete operational personal data completed, including by means of providing a supplementary statement. Union agencies and missions shall erase operational personal data without undue delay and the data subject shall have the right to obtain from Union agencies and missions the erasure of operational personal data concerning him or her without undue delay where processing infringes Articles 68b, 69c or 69h, or where operational personal data must be erased in order to comply with a legal obligation to which Union agencies and missions are subject.     (a)  the accuracy of the personal data is contested by the data subject and their accuracy or inaccuracy cannot be ascertained; or   (b)  the personal data must be maintained for the purposes of evidence.   2.  Where processing is restricted pursuant to point (a) of the first subparagraph, Union agencies and missions shall inform the data subject before lifting the restriction of processing. Restricted data shall be processed only for the purpose that prevented their erasure.   3.  Union agencies and missions shall inform the data subject in writing of any refusal of rectification or erasure of operational personal data or restrict processing and of the reasons for the refusal. Union agencies and missions may restrict, wholly or partly, the obligation to provide such information to the extent that such a restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned in order to:   (a)  avoid obstructing official or legal inquiries, investigations or procedures;   (b)  avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;   (c)  protect public security of the Member States;   (d)  protect national security of the Member States;   (f)  protect the rights and freedoms of others.   4.  Union agencies and missions shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or seeking a judicial remedy from the Court of Justice of the European Union.   5.  Union agencies and missions shall communicate the rectification of inaccurate personal data to the competent authority from which the inaccurate operational personal data originate.   6.  Union agencies and missions shall, where operational personal data has been rectified or erased or processing has been restricted pursuant to paragraphs 1, 2 and 3, notify the recipients and inform them that they have to rectify or erase the operational personal data or restrict processing of the operational personal data under their responsibility.
Amendment    101 Proposal for a regulation Article 69 n (new)
Text proposed by the Commission Amendment   Article 69n   Exercise of rights by the data subject and verification by the European Data Protection Supervisor   In the cases referred to in Articles 69j(3), 69k and 69m(4), the rights of the data subject may also be exercised through the European Data Protection Supervisor.   Union agencies and missions shall inform the data subject of the possibility of exercising his or her rights through the European Data Protection Supervisor pursuant to paragraph 1.   Where the right referred to in paragraph 1 is exercised, the European Data Protection Supervisor shall at least inform the data subject that all necessary verifications or a review by it have taken place. The European Data Protection Supervisor shall also inform the data subject of his or her right to seek a judicial remedy in the Court of Justice of the European Union.
Amendment    102 Proposal for a regulation Article 69 o (new)
Text proposed by the Commission Amendment   Article 69o   Logging   Union agencies and missions shall keep logs for any of the following processing operations in automated processing systems: the collection, alteration, access, consultation, disclosure, including transfers, combination and erasure of operational personal data.   The logs of consultation and disclosure shall make it possible to establish the justification for, and the date and time of, such operations, the identification of the person who consulted or disclosed operational personal data, and, as far as possible, the identity of the recipients of such operational personal data. Such logs shall only be used for the control of data protection and for ensuring proper data processing as well as data integrity and security. It shall not be possible to modifying such logs. Such logs shall be deleted after three years, unless they are required for on-going control. Union agencies or missions shall make the logs available to the European Data Protection Supervisor and their respective data protection officers on request.
Amendment    103 Proposal for a regulation Article 69 p (new)
Text proposed by the Commission Amendment   Article 69p   Transfer of operational personal data to third countries and international organisations   1  Subject to any possible restrictions pursuant to Article 69l, Union agencies or missions may transfer operational personal data to an authority of a third country or to an international organisation insofar as such transfer is necessary for the performance of the tasks of the Union agencies or missions, on the basis of one of the following:   (a)  a decision of the Commission adopted in accordance with Article 36 of Directive (EU) 2016/680, finding that the third country or a territory or a processing sector within that third country or the international organisation in question ensures an adequate level of protection (‘adequacy decision’);   (b)  an international agreement concluded between the Union and that third country or international organisation pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals;   (c)  a cooperation agreement allowing for the exchange of operational personal data concluded, before the date of application of the respective funding legal act of the Union agencies, between Union agencies or missions and that third country or international organisation in accordance with Article 23 of Decision 2009/371/JHA. Union agencies and missions may conclude administrative arrangements to implement such agreements or adequacy decisions.   2.  Where applicable, the Executive Director shall inform the Management Board about exchanges of operational personal data on the basis of adequacy decisions pursuant to point (a) of paragraph 1.   3.  Union agencies and missions shall publish on their website and keep up to date a list of adequacy decisions, agreements, administrative arrangements and other instruments relating to the transfer of operational personal data in accordance with paragraph 1.   4.  By 14 June 2021, the Commission shall assess the provisions contained in the cooperation agreements referred to in point (c) of paragraph 1, in particular those concerning data protection. The Commission shall inform the European Parliament and the Council about the outcome of that assessment and may, if appropriate, submit to the Council a recommendation for a decision authorising the opening of negotiations for the conclusion of an international agreement as referred to in point (b) of paragraph 1.   5.  By way of derogation from paragraph 1, where applicable, the Executive Director may authorise the transfer of operational personal data to third countries or international organisations on a case-by-case basis if the transfer is:   (a)  necessary in order to protect the vital interests of the data subject or of another person;   (b)  necessary to safeguard the legitimate interests of the data subject where the law of the Member State transferring the personal data so provides;   (c)  essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country;   (d)  necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions; or   (e)  necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence or the execution of a specific criminal sanction.   Operational personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e).   Derogations may not be applicable to systematic, massive or structural transfers.   6.  By way of derogation from paragraph 1, where applicable, the Management Board may, in agreement with the EDPS, authorise for a period not exceeding one year, which shall be renewable, a set of transfers in accordance with points (a) to (e) of paragraph 5, taking into account the existence of adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Such authorisation shall be duly justified and documented.   7.  The Executive Director shall inform the Management Board and the European Data Protection Supervisor as soon as possible of the cases in which paragraph 5 has been applied.   8.  Union agencies and missions shall keep detailed records of all transfers made pursuant to this Article.
Amendment    104 Proposal for a regulation Chapter IX a (new) – Title
Text proposed by the Commission	Amendment
	Chapter IXa
	Review
Amendment    105 Proposal for a regulation Article 70 a (new)
Text proposed by the Commission	Amendment
	Article 70a
	Review clause
	1.  No later than 1 June 2021, and every five years thereafter, the Commission shall present to the European Parliament a report on the application of this Regulation, accompanied, if necessary, by appropriate legislative proposals.
	2.  The ex-post evaluation outlined in paragraph 1 shall pay particular attention to the appropriateness of the scope of this Regulation, its consistency with other legislative acts in the field of data protection and assess, in particular, the implementation of Chapter V of this Regulation.
	3.  No later than 1 June 2021, and every five years thereafter, the Commission shall report to the European Parliament on the application of Chapter VIII of this Regulation and the penalties and sanctions applied.
Justification
In the light of better law-making and in particular the effective use of ex-post evaluations to capture the whole legislative cycle, it is of particular interest to follow the transposition, implementation and enforcement of EU law, and more generally, to monitor the impact, operation and effectiveness of its law. A comprehensive review clause, requesting an appropriate evaluation on the application of the Regulation, its scope and the foreseen derogation of powers as well as constituting proportionate reporting obligations serves this purpose.
Amendment    106 Proposal for a regulation Article 70 b (new)
Text proposed by the Commission	Amendment
	Article 70b
	Review of Union legal acts
	By 25 May 2021, the Commission shall review other legal acts adopted on the basis of the Treaties which regulate the processing of personal data, in particular by agencies established under Chapters 4 and 5 of Title V of Part Three TFEU, in order to assess the need to align them with this Regulation and to make, where appropriate, the necessary proposal to amend those acts in order to ensure a consistent approach to the protection of personal data within the scope of this Regulation.
Amendment    107 Proposal for a regulation Article 71 a (new)
Text proposed by the Commission	Amendment
	Article 71 a
	Amendments to Regulation (EC) No 1987/2006
	Regulation (EC) No 1987/2006 of the European Parliament and of the Council 1a is amended as follows:
	Article 46 is replaced by the following:
	"National supervisory authorities and the European Data Protection Supervisor shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".
	_________________
	1a Regulation (EC) No 1987/2006 of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II) (OJ L 381, 28.12.2006, p. 4).
Amendment    108 Proposal for a regulation Article 71 b (new)
Text proposed by the Commission	Amendment
	Article 71 b
	Amendments to Council Decision 2007/533/JHA
	Council Decision 2007/533/JHA1a is amended as follows:
	Article 62 of is replaced by the following:
	"National supervisory authorities and the European Data Protection Supervisor shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".
	_________________
	1a Council Decision 2007/533/JHA1b of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II) (OJ L 205, 7.8.2007, p. 63).
Amendment    109 Proposal for a regulation Article 71 c (new)
Text proposed by the Commission	Amendment
	Article 71c
	Amendments to Regulation (EC) No 767/2008
	Regulation (EC) No 767/2008 of the European Parliament and the Council1a is amended as follows:
	Article 43 is replaced by the following:
	"National supervisory authorities and the European Data Protection Supervisor shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".
	_________________
	1a Regulation (EC) No 767/2008 of the European Parliament and the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) (OJ L 218, 13.8.2008, p. 60).
Amendment    110 Proposal for a regulation Article 71 d (new)
Text proposed by the Commission	Amendment
	Article 71d
	Amendments to Council Regulation (EC) No 515/97
	Council Regulation (EC) No 515/971a is amended as follows:
	In Article 37, paragraph 4 is replaced by the following:
	"National supervisory authorities and the European Data Protection Supervisor shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".
	_________________
	1a Council Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters (OJ L 82, 22.3.1997, p. 1).
Amendment    111 Proposal for a regulation Article 71 e (new)
Text proposed by the Commission	Amendment
	Article 71e
	Amendments to Council decision 2009/917/JHA
	Council Decision 2009/917/JHA1a is amended as follows:
	(1)  Article 25 is deleted.
	(2)  In Article 26, paragraphs 2 and 3 are replaced by the following:
	"National supervisory authorities and the European Data Protection Supervisor shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".
	_________________
	1a Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes (OJ L 323, 10.12.2009, p. 20).
Amendment    112 Proposal for a regulation Article 71 f (new)
Text proposed by the Commission	Amendment
	Article 71f
	Amendments to Regulation (EU) No 1024/2012
	Regulation (EU) No 1024/2012 of the European Parliament and of the Council1a is amended as follows:
	In Article 21, paragraphs 3 and 4 are deleted.
	_________________
	1a Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (‘the IMI Regulation’) (OJ L 316, 14.11.2012, p. 1).
Amendment    113 Proposal for a regulation Article 71 g (new)
Text proposed by the Commission	Amendment
	Article 71g
	Amendments to Commission Implementing Regulation (EU) 2015/2447
	Commission Implementing Regulation (EU) 2015/24471a is amended as follows:
	In Article 83, paragraph 8 is deleted.
	_________________
	1a Commission Implementing Regulation (EU) 2015/2447 of 24 November 2015 laying down detailed rules for implementing certain provisions of Regulation (EU) No 952/2013 of the European Parliament and of the Council laying down the Union Customs Code (OJ L 343, 29.12.2015, p. 558).
Amendment    114 Proposal for a regulation Article 71 h (new)
Text proposed by the Commission	Amendment
	Article 71h
	Amendments to Regulation (EU) 2016/794
	Regulation (EU) 2016/794 of the European Parliament and of the Council1a is amended as follows:
	(1)  Articles 25, 28, 30, 36, 37, 40, 41 and 46 are deleted.
	(2)  Article 44 is replaced by the following:
	"National supervisory authorities and the EDPS shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".
	_________________
	1a Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53).
Amendment    115 Proposal for a regulation Article 71 i (new)
Text proposed by the Commission	Amendment
	Article 71 i
	Amendments to Council Regulation (EU) 2017/XX
	Council Regulation (EU) 2017/...1a is amended as follows:
	(1)  Articles 36e, 36f, 37, 37b, 37c, 37cc, 37ccc, 37d, 37e, 37f, 37g, 37h, 37i, 37j, 37k, 37n, 37o, 41, 41a, 41b, 43a, 43b, 43c, 43d, 43e and 46 of are deleted.
	(2)  Article 45 is replaced by the following:
	"National supervisory authorities and the European Data Protection Supervisor shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".
	_________________
	1a Council Regulation (EU) 2017/... of ... of implementing enhanced cooperation on the establishment of the European Public Prosecutor's Office ("the EPPO") (OJ L ...).
Amendment    116 Proposal for a regulation Article 71 j (new)
Text proposed by the Commission	Amendment
	Article 71 j
	Amendments to Regulation (EU) 2017/XX
	Regulation (EU) 2017/... of the European Parliament and of the Council1a is amended as follows:
	(1)  Articles 27, 29, 30, 31, 33, 36 and 37 are deleted.
	(2)  Article 35 is replaced by the following:
	"National supervisory authorities and the European Data Protection Supervisor shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".
	_________________
	1a Regulation (EU) 2017/... of the European Parliament and of the Council on the European Union Agency for Criminal Justice Cooperation (Eurojust) (OJ L ...).
Amendment    117 Proposal for a regulation Article 71 k (new)
Text proposed by the Commission	Amendment
	Article 71 k
	Amendments to Eurodac Regulation (EU) 2017/XX
	Regulation (EU) 2017/... of the European Parliament and of the Council1a is amended as follows:
	(1)  Articles 29, 30, 31, and 39 are deleted.
	(2)  Article 34 is replaced by the following:
	"National supervisory authorities and the European Data Protection Supervisor shall, each acting within their respective competences, cooperate with each other in accordance with Article 62 of [New Regulation 45/2001]".
	_________________
	1a Regulation (EU) 2017/... of the European Parliament and of the Council on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person], for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes (OJ L ...)

EXPLANATORY STATEMENT

I.  Context of the Proposal

Article 16(1) of the Treaty on the Functioning of the European Union (“TFEU”), as introduced by the Lisbon Treaty, establishes the principle that everyone has the right to the protection of personal data concerning them. Moreover, in Article 16(2) TFEU, the Lisbon Treaty introduced a specific legal basis for adopting rules on the protection of personal data. Article 8 of the Charter of Fundamental Rights of the European Union enshrines the protection of personal data as a fundamental right, and Article 7 enshrines the right to respect for everyone’s private and family life, home and communications.

The right to the protection of personal data also applies to the processing of personal data by EU institutions, bodies, offices and agencies. Regulation (EC) No 45/2001, the main piece of existing EU legislation on personal data protection in the Union institutions, was adopted in 2001 with two objectives in mind: to protect the fundamental right to data protection and to guarantee the free flow of personal data throughout the Union. It was complemented by Decision No 1247/2002/EC.

On 27 April 2016, the European Parliament and the Council adopted the General Data Protection Regulation (EU) 2016/679 (“GDPR”), which will become applicable on 25 May 2018. This Regulation, in Article 98 calls for Regulation (EC) No 45/2001 to be adapted to the principles and rules laid down in the GDPR in order to provide a strong and coherent data protection framework in the Union and to enable both instruments to be applicable at the same time. Also on 27 April 2016, the European Parliament and the Council adopted the Directive (EU) 2016/680 (“Directive”) on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data. This Directive provides for a comprehensive framework for the protection of personal data in the area of law enforcement. Its Article 62 calls for Union legislation regulating the processing of personal data by competent authorities to be adapted to the Directive. Nevertheless, some Union agencies operating in the area of law enforcement continue to have standalone regimes for the protection of personal data.

It is consistent with the coherent approach to personal data protection throughout the Union to align, as far as possible, the data protection rules for Union institutions, bodies, offices and agencies with the data protection rules adopted for the Member States. Whenever the provisions of the proposal are based on the same concept as the provisions of the GDPR, these two provisions should be interpreted homogeneously, in particular because the scheme of the proposal should be understood as the equivalent of the scheme of the GDPR.

The review of the Regulation (EC) No 45/2001 (“Regulation”) also takes into account the results of enquiries and stakeholder consultations, and the evaluation study on its application over the last 15 years.

II.  Rapporteur's changes

The Rapporteur generally believes that the proposed revision is a big step towards harmonizing data protection rules and provides a sound basis to work on.

However, the Rapporteur is disappointed that the European Commission did not opt for a full-blown single instrument covering all data processing operations of all Union bodies, agencies and institutions, thus missing a historical chance to create one strong and uniform standard for the protection of the fundamental right to data protection. The rapporteur believes that Union's citizens deserve such a clear uniform standard and has hence proposed to clarify the scope of this Regulation.

In order to ensure a strong and coherent framework for data protection throughout the Union, this Regulation should be applicable to all processing of personal data that is performed by any Union institution, body, office, or agency. At the same time, your Rapporteur acknowledges that the legislator has, on 27 April 2016, opted for a double-track approach as regards processing for law enforcement purposes. In so far as processing of personal data for law enforcement purposes by Union agencies is consistent with the rules laid down in Directive (EU) 2016/680, the standalone regimes for certain agencies should continue to apply, until brought in line with this Regulation.

Your Rapporteur has also undertaken a stringent alignment of this revision of the Regulation with the GDPR in order to streamline as much as possible the two texts, thus giving expression to the idea that the Union is held to the same standards when it comes to data protection as the Member States. The Rapporteur has therefore submitted a number of amendments aiming at streamlining the two instruments. Divergences between this Regulation and the GDPR should be well justified and kept to a minimum.

In the recent years, on the matter of the relation of Regulation (EC) 45/2001 and Regulation (EC) 1049/2001, the European Court of Justice (“ECJ”) has held in several cases that there is a balance to be found between the two fundamental rights and has implicitly appealed to the legislator to clarify better the link between Article 4 of the Regulation (EC) 1049/2001 and article 8 (now 9) of the Regulation (EC) 45/2001. The rapporteur has taken the approach to introduce in the text several elements of the recent court cases - Bavarian Lager, Dennekamp, ClientEarth - which essentially lay out the current ECJ case law elements and aim to specify some aspects that were brought up by the ECJ and the Advocate General itself in the several verdicts.

With regard to the exercise of rights of the data subject, the GDPR requires that restrictions to the exercise of these rights must be based on legal acts. Consequently, the Rapporteur proposes to delete here the possibility for Union institutions, bodies, offices and agencies to restrict the exercise of data subject’s rights by way of internal rules.

Under Regulation (EC) 45/2001 required the Data Protection Officer (“DPO”) of Union institutions to keep a register of processing activities. The rapporteur believes that there is an added value in obliging EU institutions, bodies, offices and agencies to keep a central register of processing operations. Data subjects should be able to consult that register through the DPO.

The GDPR provides for the possibility of controllers to demonstrate compliance with the Regulation by adherence to approved certification mechanisms or codes of conduct. While your rapporteur believes that codes of conduct are not appropriate for public administration, she proposes to insert the necessary provisions for controllers under this Regulation to demonstrate compliance by way of adhering to approved certification mechanisms.

Your Rapporteur believes in the enormous contribution of the European Data Protection Supervisor (“EDPS”) in upholding the provisions of the Regulation, and has therefore kept the wording of the Regulation (EC) 45/2001 in allowing the Commission to consult the EDPS in the preparatory phases of adopting a proposal, leaving the Commission enough leeway, thus respecting its right of initiative. The rapporteur notes that independent supervision of data protection rules is a requirement of the Treaties. Accordingly, all institutions and bodies, including the Court of Justice, should be subject to independent supervision by the EDPS. In order to safeguard the independence of the EDPS, the Rapporteur proposes a slight modification to the nomination procedure.

The Commission proposal includes provisions concerning confidentiality of communications. The Rapporteur believes that in general, Union legislation on this matter should be applicable to Union institutions, bodies, offices and agencies as well. Only additional rules to particularise and complement the general framework should be inserted here. These rules should be part of a separate section of the text.

Finally, your Rapporteur welcomes the inclusion of the possibility of the EDPS to fine those Union institutions, bodies and agencies which do not uphold the Regulation's strict provisions, thus sending a strong signal to the data subjects and holding the Union to an equally high moral and legal obligation as the Member States' administrations.

OPINION of the Committee on Legal Affairs (5.10.2017)

for the Committee on Civil Liberties, Justice and Home Affairs

on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC
(COM(2017)0008 – C8‑0008/2017 – 2017/0002(COD))

Rapporteur for opinion: Angel Dzhambazki

SHORT JUSTIFICATION

The principle that everyone has the right to the protection of personal data concerning them is established by Article 16(1) of the Treaty on the Functioning of the European Union (TFEU). A specific legal basis for adopting rules on the protection of personal data is introduced in Article 16(2) TFEU. In addition, Article 8 of the Charter of Fundamental Rights of the European Union enshrines the protection of personal data as a fundamental right.

The right to the protection of personal data also applies to the processing of personal data by EU institutions, bodies, offices and agencies. Regulation (EC) No 45/2001, the main piece of existing EU legislation on personal data protection in the Union institutions, was adopted in 2001 with two objectives in mind: to protect the fundamental right to data protection and to guarantee the free flow of personal data throughout the Union.

The European Parliament and the Council adopted on 27 April 2016 Regulation (EU) 2016/697 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) The General Data Protection Regulation will become applicable on 25 May 2018. This Regulation calls for Regulation (EC) No 45/2001 to be adapted to the principles and rules laid down in Regulation (EU) 2016/679 in order to provide a strong and coherent data protection framework in the Union and to enable both instruments to be applicable at the same time.

In the Proposal, the Commission has set the changes necessary for the adaption of the 2001 Regulation to the General Data Protection Regulation in a fair and balanced way. However, on one point, the proposal deviates in an unfounded way from the General Data Protection Regulation and that is in relation to the age for consent for minors.

AMENDMENTS

The Committee on Legal Affairs calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take into account the following amendments:

Amendment    1 Proposal for a regulation Recital 1
Text proposed by the Commission	Amendment
(1)  The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning them.	(1)  The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning them. This right is also guaranteed under Article 8 of the European Convention on Human Rights.
Amendment    2 Proposal for a regulation Recital 2
Text proposed by the Commission	Amendment
(2)  Regulation (EC) No 45/2001 of the European Parliament and of the Council11 provides natural persons with legally enforceable rights, specifies the data processing obligations of controllers within the Community institutions and bodies, and creates an independent supervisory authority, the European Data Protection Supervisor, responsible for monitoring the processing of personal data by the Union institutions and bodies. However, it does not apply to the processing of personal data in the course of an activity of Union institutions and bodies which fall outside the scope of Union law.	(2)  Regulation (EC) No 45/2001 of the European Parliament and of the Council11 provides natural persons with legally enforceable rights, specifies the data processing obligations of controllers within the Community institutions and bodies, and creates an independent supervisory authority, the European Data Protection Supervisor, responsible for monitoring the processing of personal data by the Union institutions and bodies. At the same time, Regulation (EC) No 45/2001 seeks to achieve two objectives: to protect the fundamental right to data protection and to guarantee the free flow of personal data throughout the Union. However, it does not apply to the processing of personal data in the course of an activity of Union institutions and bodies which fall outside the scope of Union law.
_________________	_______________
11 Regulation (EC) No 45/2001 of the European Parliament and the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p.1).	11 Regulation (EC) No 45/2001 of the European Parliament and the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p.1).
Amendment    3 Proposal for a regulation Recital 5
Text proposed by the Commission	Amendment
(5)  It is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align as far as possible the data protection rules for Union institutions and bodies with the data protection rules adopted for the public sector in the Member States. Whenever the provisions of this Regulation are based on the same concept as the provisions of Regulation (EU) 2016/679, those two provisions should be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of Regulation (EU) 2016/679.	(5)  It is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align the data protection rules for Union institutions, bodies, offices and agencies with the data protection rules adopted for the public sector in the Member States. Whenever the provisions of this Regulation are based on the same concept as the provisions of Regulation (EU) 2016/679, those two provisions should under the case law of the Court of Justice of the European Union1a, be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of Regulation (EU) 2016/679.
	_________________
	1a Judgment of the Court of Justice of 9 March 2010, Commission v Germany, C-518/07, ECLI:EU:C:2010:125, paragraphs 26 and 28.
Amendment    4 Proposal for a regulation Recital 10
Text proposed by the Commission	Amendment
(10)  Where the founding act of a Union agency carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of the Treaty lays down a standalone data protection regime for the processing of operational personal data such regimes should be unaffected by this Regulation. However, the Commission should, in accordance with Article 62 of Directive (EU) 2016/680, by 6 May 2019 review Union acts which regulate processing by the competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and, where appropriate, make the necessary proposals to amend those acts to ensure a consistent approach to the protection of personal data in the area of judicial cooperation in criminal matters and police cooperation.	(10)  Where the founding act of a Union agency carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of the Treaty lays down a standalone data protection regime for the processing of operational personal data such regimes should be unaffected by this Regulation, as long as they are consistent with the provisions of Regulation (EU) 2016/679. However, the Commission should, in accordance with Article 62 of Directive (EU) 2016/680, by 6 May 2019 review Union acts which regulate processing by the competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and, where appropriate, make the necessary proposals to amend those acts to ensure a consistent approach to the protection of personal data in the area of judicial cooperation in criminal matters and police cooperation.
Justification
Any data protection regime needs to be coherent with the General Data Protection Regulation.
Amendment    5 Proposal for a regulation Recital 14
Text proposed by the Commission	Amendment
(14)  Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.	(14)  Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. At the same time, the data subject should have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Amendment    6 Proposal for a regulation Recital 18
Text proposed by the Commission	Amendment
(18)  The Union law including the internal rules referred to in this Regulation should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union and the European Court of Human Rights.	(18)  The Union law should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union and the European Court of Human Rights.
Amendment    7 Proposal for a regulation Recital 23
Text proposed by the Commission	Amendment
(23)  Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races. The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. In addition to the specific requirements for processing of sensitive data, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.	(23)  Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Such personal data should not be processed unless processing is allowed in specific cases as set out in this Regulation. Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races. The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. In addition to the specific requirements for processing of sensitive data, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.
Amendment    8 Proposal for a regulation Recital 23 a (new)
Text proposed by the Commission	Amendment
	(23a)  Special categories of personal data which merit higher protection should be processed for health-related purposes only where necessary to achieve those purposes for the benefit of natural persons and society as a whole, in particular in the context of the management of health or social care services and systems. Therefore, this Regulation should provide for harmonised conditions for the processing of special categories of personal data concerning health, in respect of specific needs, in particular where the processing of such data is carried out for certain health-related purposes by persons subject to a legal obligation of professional secrecy. Union law should provide for specific and suitable measures so as to protect the fundamental rights and the personal data of natural persons.
Amendment    9 Proposal for a regulation Recital 24
Text proposed by the Commission	Amendment
(24)  The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subject to suitable and specific measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council15, namely all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not result in personal data being processed for other purposes by third parties.	(24)  The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subject to proportionate, suitable and specific measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council15, namely all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not lead to any further processing for other purposes.
_________________	_________________
15 Regulation (EC) No 1338/2008 of the European Parliament and of the Council of 16 December 2008 on Community statistics on public health and health and safety at work (OJ L 354, 31.12.2008, p. 70).	15 Regulation (EC) No 1338/2008 of the European Parliament and of the Council of 16 December 2008 on Community statistics on public health and health and safety at work (OJ L 354, 31.12.2008, p. 70).
Justification
Health data is specifically sensitive and the processing of such sensitive data needs specific restrictions to the absolute necessary. Such data may in particular not end up in the possession of third parties who would further process it.
Amendment    10 Proposal for a regulation Recital 37 – paragraph 1
Text proposed by the Commission	Amendment
Legal acts adopted on the basis of the Treaties or internal rules of Union institutions and bodies may impose restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, confidentiality of electronic communications as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, as far as necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.	Legal acts adopted on the basis of the Treaties may impose restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, confidentiality of electronic communications as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, as far as necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.
Amendment    11 Proposal for a regulation Recital 37 – paragraph 2
Text proposed by the Commission	Amendment
Where a restriction is not provided for in legal acts adopted on the basis of the Treaties or their internal rules, Union institutions and bodies may in a specific case impose an ad hoc restriction concerning specific principles and the rights of data subject if such a restriction respects the essence of the fundamental rights and freedoms and, in relation to a specific processing operation, is necessary and proportionate in a democratic society to safeguard one or more of the objectives mentioned in paragraph 1. The restriction should be notified to the data protection officer. All restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.	deleted
Amendment    12 Proposal for a regulation Recital 42
Text proposed by the Commission	Amendment
(42)  In order to demonstrate compliance with this Regulation, controllers should maintain records of processing activities under their responsibility and processors should maintain records of categories of processing activities under their responsibility. Union institutions and bodies should be obliged to cooperate with the European Data Protection Supervisor and make their records, on request, available to it, so that they might serve for monitoring those processing operations. Union institutions and bodies should be able to establish a central register of records of their processing activities. For reasons of transparency, they should also be able to make such a register public.	(42)  In order to demonstrate compliance with this Regulation, controllers should maintain records of processing activities under their responsibility and processors should maintain records of categories of processing activities under their responsibility. Union institutions and bodies should be obliged to cooperate with the European Data Protection Supervisor and make their records, on request, available to it, so that they might serve for monitoring those processing operations. Union institutions and bodies should be able to establish a central register of records of their processing activities. For reasons of transparency, they should make such a register public. Data subjects should have the possibility to consult that register through the data protection officer of the controller.
Amendment    13 Proposal for a regulation Recital 46
Text proposed by the Commission	Amendment
(46)  The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions. The communication should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the European Data Protection Supervisor, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities.	(46)  The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions. The communication should be confidential and should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the European Data Protection Supervisor, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities.
Amendment    14 Proposal for a regulation Recital 52
Text proposed by the Commission	Amendment
(52)  When personal data are transferred from the Union institutions and bodies to controllers, processors or other recipients in third countries or to international organisations, the level of protection of natural persons ensured in the Union by this Regulation should not be undermined, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. In any event, transfers to third countries and international organisations may only be carried out in full compliance with this Regulation. A transfer could take place only if, subject to the other provisions of this Regulation, the conditions laid down in the provisions of this Regulation relating to the transfer of personal data to third countries or international organisations are complied with by the controller or processor.	(52)  When personal data are transferred from the Union institutions and bodies to controllers, processors or other recipients in third countries or to international organisations, the level of protection of natural persons ensured in the Union by this Regulation should be guaranteed, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. In any event, transfers to third countries and international organisations may only be carried out in full compliance with this Regulation, with Regulation (EU) 2016/679 and with the fundamental rights and freedoms enshrined in the Charter. A transfer could take place only if, subject to the other provisions of this Regulation, the conditions laid down in the provisions of this Regulation relating to the transfer of personal data to third countries or international organisations are complied with by the controller or processor.
Amendment    15 Proposal for a regulation Recital 54
Text proposed by the Commission	Amendment
(54)  In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject. Such appropriate safeguards can consist of making use of standard data protection clauses adopted by the Commission, standard data protection clauses adopted by the European Data Protection Supervisor or contractual clauses authorised by the European Data Protection Supervisor. Where the processor is not a Union Institution or body those appropriate safeguards can also consist of binding corporate rules, codes of conduct and certification mechanisms used for international transfers under Regulation (EU) 2016/679. Those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default. Transfers may also be carried out by Union institutions and bodies to public authorities or bodies in third countries or to international organisations with corresponding duties or functions, including on the basis of provisions to be inserted into administrative arrangements, such as a memorandum of understanding, providing for enforceable and effective rights for data subjects. Authorisation by the European Data Protection Supervisor should be obtained when the safeguards are provided for in administrative arrangements that are not legally binding.	deleted
Amendment    16 Proposal for a regulation Article 1 – paragraph 1
Text proposed by the Commission	Amendment
1.  This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and rules relating to the free movement of personal data between themselves or to recipients established in the Union and subject to Regulation (EU) 2016/67918 or the provisions of national law adopted pursuant to Directive (EU) 2016/68019.	1.  This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and rules relating to the free movement of personal data between themselves or to recipients established in the Union.
_________________
18 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, p. 1–88.
19 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131.
Amendment    17 Proposal for a regulation Article 1 – paragraph 2
Text proposed by the Commission	Amendment
2.  This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.	2.  This Regulation protects fundamental rights and freedoms of natural persons enshrined in the Charter and in particular their right to the protection of personal data.
Amendment    18 Proposal for a regulation Article 2 – paragraph 2 a (new)
Text proposed by the Commission	Amendment
	2a.  This Regulation shall also apply to Union agencies carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of Part Three TFEU, including where the founding acts of those Union agencies lay down a standalone data protection regime for the processing of operational personal data. The provisions of this Regulation shall take precedence over the conflicting provisions in the founding acts of those Union agencies.
Amendment    19 Proposal for a regulation Article 4 – paragraph 1 – point d
Text proposed by the Commission	Amendment
(d)  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified without delay (‘accuracy’);	(d)  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data which are inaccurate or incomplete, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
Amendment    20 Proposal for a regulation Article 8 – title
Text proposed by the Commission	Amendment
Conditions applicable to children's consent in relation to information society services	Conditions applicable to child's consent in relation to information society services
Justification
This term is used also in the GDPR, Article 8, and should be used here consistently.
Amendment    21 Proposal for a regulation Article 8 – paragraph 1
Text proposed by the Commission Amendment (1)  Where point (d) of Article 5(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 13 years old. Where the child is below the age of 13 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. (1)  Where point (d) of Article 5(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
Amendment    22 Proposal for a regulation Article 9 – title
Text proposed by the Commission	Amendment
Transmissions of personal data to recipients, other than Union institutions and bodies, established in the Union and subject to Regulation (EU) 2016/679 or Directive (EU) 2016/680	Transmissions of personal data to recipients, other than Union institutions and bodies, established in the Union
Amendment    23 Proposal for a regulation Article 9 – paragraph 1 – point b
Text proposed by the Commission	Amendment
(b)  that it is necessary to have the data transmitted, it is proportionate to the purposes of the transmission and if there is no reason to assume that the data subject's rights and freedoms and legitimate interests might be prejudiced.	(b)  that it is strictly necessary to have the data transmitted having regard to the recipient's objectives, and that there is not any reason to assume that the data subject's rights and freedoms and legitimate interests might be prejudiced by the requested data transfer or the reasonably expected further use of that personal data by the recipient.
Amendment    24 Proposal for a regulation Article 11 – paragraph 1
Text proposed by the Commission	Amendment
Processing of personal data relating to criminal convictions and offences or related security measures pursuant to Article 5(1) may be carried out only if authorised by Union law, which may include internal rules, providing the appropriate specific safeguards for the rights and freedoms of data subjects.	Processing of personal data relating to criminal convictions and offences or related security measures pursuant to Article 5(1) may be carried out only if authorised by Union law providing the appropriate specific safeguards for the rights and freedoms of data subjects.
Amendment    25 Proposal for a regulation Article 16 – paragraph 5 – point b
Text proposed by the Commission	Amendment
(b)  the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing;	(b)  the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interest, including making the information publicly available;
Amendment    26 Proposal for a regulation Article 25 – paragraph 1 – introductory part
Text proposed by the Commission	Amendment
1.  Legal acts adopted on the basis of the Treaties or, in matters relating to the operation of the Union institutions and bodies, internal rules laid down by the latter may restrict the application of Articles 14 to 22, 34 and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:	1.  Legal acts adopted on the basis of the Treaties may restrict the application of Articles 14 to 22, 34 and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
Justification
The amendment seeks to align the provisions of this Regulation with the provisions of GDPR, following the EDPS opinion.
Amendment    27 Proposal for a regulation Article 25 – paragraph 1 – point d
Text proposed by the Commission Amendment (d)   the internal security of Union institutions and bodies, including of their electronic communication networks; (d)   the internal security of Union institutions and bodies, including of their IT and electronic communication networks;
Amendment    28 Proposal for a regulation Article 25 – paragraph 1 a (new)
Text proposed by the Commission	Amendment
	1a.  In particular, any legal act referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to :
	(a)   the purposes of the processing or categories of processing;
	(b)   the categories of personal data;
	(c)   the scope of the restriction introduced;
	(d)   the safeguards to prevent abuse or unlawful access or transfer;
	(e)   the specification of the controller or categories of controllers;
	(f)   the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
	(g)   the risks to the rights and freedoms of data subjects; and
	(h)   the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.
Amendment    29 Proposal for a regulation Article 25 – paragraph 2
Text proposed by the Commission	Amendment
2.  Where a restriction is not provided for by a legal act adopted on the basis of the Treaties or by an internal rule in accordance with paragraph 1, the Union institutions and bodies may restrict the application of Articles 14 to 22, 34 and 38, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, if such a restriction respects the essence of the fundamental rights and freedoms, in relation to a specific processing operation, and is a necessary and proportionate measure in a democratic society to safeguard one or more of the objectives referred to in paragraph 1. The restriction shall be notified to the competent data protection officer.	deleted
Amendment    30 Proposal for a regulation Article 25 – paragraph 3
Text proposed by the Commission	Amendment
3.  Where personal data are processed for scientific or historical research purposes or statistical purposes, Union law, which may include internal rules, may provide for derogations from the rights referred to in Articles 17, 18, 20 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.	3.  Where personal data are processed for scientific or historical research purposes or statistical purposes, Union law may provide for derogations from the rights referred to in Articles 17, 18, 20 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
Amendment    31 Proposal for a regulation Article 25 – paragraph 4
Text proposed by the Commission	Amendment
4.  Where personal data are processed for archiving purposes in the public interest, Union law, which may include internal rules, may provide for derogations from the rights referred to in Articles 17, 18, 20, 21, 22 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.	4.  Where personal data are processed for archiving purposes in the public interest, Union law may provide for derogations from the rights referred to in Articles 17, 18, 20, 21, 22 and 23 subject to the conditions and safeguards referred to in Article 13 in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
Amendment    32 Proposal for a regulation Article 25 – paragraph 5
Text proposed by the Commission	Amendment
5.  Internal rules referred to in paragraphs 1, 3 and 4 shall be sufficiently clear and precise and subject to appropriate publication.	deleted
Amendment    33 Proposal for a regulation Article 25 – paragraph 6
Text proposed by the Commission	Amendment
6.  If a restriction is imposed pursuant to paragraphs 1 or 2, the data subject shall be informed, in accordance with Union law, of the principal reasons on which the application of the restriction is based and of his or her right to lodge a complaint with the European Data Protection Supervisor.	6.  If a restriction is imposed pursuant to paragraph 1, the data subject shall be informed, in accordance with Union law, of the principal reasons on which the application of the restriction is based and of his or her right to lodge a complaint with the European Data Protection Supervisor.
Amendment    34 Proposal for a regulation Article 25 – paragraph 7
Text proposed by the Commission	Amendment
7.  If a restriction imposed pursuant to paragraphs 1 or 2 is relied upon to deny access to the data subject, the European Data Protection Supervisor shall, when investigating the complaint, only inform him or her of whether the data have been processed correctly and, if not, whether any necessary corrections have been made.	7.  If a restriction imposed pursuant to paragraph 1 is relied upon to deny access to the data subject, the European Data Protection Supervisor shall, when investigating the complaint, only inform him or her of whether the data have been processed correctly and, if not, whether any necessary corrections have been made.
Amendment    35 Proposal for a regulation Article 25 – paragraph 8
Text proposed by the Commission	Amendment
8.  Provision of the information referred to in paragraphs 6 and 7 and in Article 46(2) may be deferred, omitted or denied if it would cancel the effect of the restriction imposed pursuant to paragraph 1 or 2.	8.  Provision of the information referred to in paragraphs 6 and 7 and in Article 46(2) may be deferred, omitted or denied if it would cancel the effect of the restriction imposed pursuant to paragraph 1.
Amendment    36 Proposal for a regulation Article 31 – paragraph 5
Text proposed by the Commission	Amendment
(5)  Union institutions and bodies may decide to keep their records of processing activities in a central register. In this case, they may also decide to make the register publicly accessible.	(5)  Union institutions and bodies shall keep their records of processing activities in a central register. For reasons of transparency, they should also make such a register public so that the individual concerned can consult it without prejudice to the rights of other concerned parties.
Amendment    37 Proposal for a regulation Article 31 – paragraph 5 a (new)
Text proposed by the Commission	Amendment
	5a.  Data subjects shall be able to consult the central register referred to in paragraph 5 through the data protection officer of the controller.
Amendment    38 Proposal for a regulation Article 34 – paragraph 1
Text proposed by the Commission	Amendment
Union institutions and bodies shall ensure the confidentiality of electronic communications, in particular by securing their electronic communication networks.	Union institutions and bodies shall ensure the confidentiality of electronic communications in accordance with Regulation (EU) 2017/XXXX.
Justification
The specific legislative proposal concerning the confidentiality of electronic communication will be the Regulation based on Commission proposal COM(2017)0010 and should thus be referred to.
Amendment    39 Proposal for a regulation Article 36
Text proposed by the Commission	Amendment
Article 36	deleted
Directories of users
1.   Personal data contained in directories of users and access to such directories shall be limited to what is strictly necessary for the specific purposes of the directory.
2.   Union institutions and bodies shall take all the necessary measures to prevent personal data contained in those directories, regardless of whether they are accessible to the public or not, from being used for direct marketing purposes.
Amendment    40 Proposal for a regulation Article 42 – paragraph 2
Text proposed by the Commission	Amendment
2.  Where an act referred to in paragraph 1 is of particular importance for the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission may also consult the European Data Protection Board. In such cases the European Data Protection Supervisor and the European Data Protection Board shall coordinate their work with a view to issue a joint opinion.	2.  Where an act referred to in paragraph 1 is of particular importance for the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission shall also consult the European Data Protection Board. In such cases the European Data Protection Supervisor and the European Data Protection Board shall coordinate their work with a view to issue a joint opinion.
Amendment    41 Proposal for a regulation Article 44 – paragraph 4
Text proposed by the Commission	Amendment
4.  The data protection officer may be a staff member of the Union institution or body, or fulfil the tasks on the basis of a service contract.	4.  The data protection officer shall be a staff member of the Union institution, body, office or agency.
Justification
The outsourcing of a data protection officer seems not suitable for a Union institution.
Amendment    42 Proposal for a regulation Article 46 – paragraph 1 – point b a (new)
Text proposed by the Commission	Amendment
	(ba)  ensure that the fundamental rights and freedoms of data subjects are not adversely affected by processing operations;
Amendment    43 Proposal for a regulation Article 48 – paragraph 1
Text proposed by the Commission	Amendment
1.  A transfer of personal data to a third country or international organisation may take place where the Commission has decided pursuant to Article 45(3) of Regulation (EU) 2016/679 that an adequate level of protection is ensured in the third country, a territory or one or more specified sectors within that third country, or within the international organisation and the personal data are transferred solely to allow tasks covered by the competence of the controller to be carried out.	1.  A transfer of personal data to a third country or international organisation may take place where the Commission has adopted an implementing act pursuant to Article 45(3) of Regulation (EU) 2016/679 which stipulates that an adequate level of protection is ensured in the third country, a territory or one or more specified sectors within that third country, or within the international organisation and the personal data are transferred solely to allow tasks covered by the competence of the controller to be carried out. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or the international organisation. The implementing act shall further indicate its territorial and sectorial application and shall identify the supervisory authority. Chapter V of Regulation (EU) 2016/679 shall apply.
Justification
The rules on transfer of personal data to third countries or third country institutions must be coherent with the relevant rules in the General Data Protection Regulation in order not to create any loopholes or legal inconsistencies. Notably, the review mechanism should be emphasised.
Amendment    44 Proposal for a regulation Article 54 – paragraph 1
Text proposed by the Commission	Amendment
1.  The European Parliament and the Council shall appoint the European Data Protection Supervisor by common accord for a term of five years, on the basis of a list drawn up by the Commission following a public call for candidates. The call for candidates shall enable all interested parties throughout the Union to submit their applications. The list of candidates drawn up by the Commission shall be public. On the basis of the list drawn up by the Commission, the competent committee of the European Parliament may decide to hold a hearing in order to enable it to express a preference.	1.  The European Parliament and the Council shall appoint the European Data Protection Supervisor by common accord for a term of five years, on the basis of a list drawn up jointly by the European Parliament, the Council and the Commission following a public call for candidates. The call for candidates shall enable all interested parties throughout the Union to submit their applications. The list of candidates shall be public and shall consist of at least five candidates. The competent committee of the European Parliament may decide to hold a hearing of the candidates in order to enable it to express a preference.
Amendment    45 Proposal for a regulation Article 54 – paragraph 2
Text proposed by the Commission	Amendment
2.  The list drawn up by the Commission from which the European Data Protection Supervisor shall be chosen shall be made up of persons whose independence is beyond doubt and who are acknowledged as having the experience and skills required to perform the duties of European Data Protection Supervisor, for example because they belong or have belonged to the supervisory authorities established under Article 41 of Regulation (EU) 2016/679.	2.  The list drawn up jointly by the European Parliament, the Council and the Commission from which the European Data Protection Supervisor shall be chosen shall be made up of persons whose independence is beyond doubt and who are acknowledged as having expert knowledge in data protection as well as the experience and skills required to perform the duties of European Data Protection Supervisor, for example because they belong or have belonged to the supervisory authorities established under Article 41 of Regulation (EU) 2016/679.
Amendment    46 Proposal for a regulation Article 63 – paragraph 1 a (new)
Text proposed by the Commission	Amendment
	1a.  In cases where the data subject is a child, Member States shall provide for specific safeguards, in particular with regard to legal aid.
Justification
Children may be more vulnerable than adults and specific safeguard clauses, notably as regards legal aid protection should be foreseen in Member States to guarantee children’s rights.
Amendment    47 Proposal for a regulation Chapter IX a (new)
Text proposed by the Commission	Amendment
	Chapter IXa
	Article 70a
	Review Clause
	1.   No later than 1 June 2021, and every five years thereafter, the Commission shall present to the European Parliament a report on the application of this Regulation, accompanied, if necessary, by appropriate legislative proposals.
	2.   The ex-post evaluation outlined in paragraph 1 shall pay particular attention to the appropriateness of the scope of this Regulation, the consistency with other legislative acts in the field of data protection and assess, in particular, the implementation of Chapter V of this Regulation.
	3.   No later than 1 June 2021, and every five years thereafter, the Commission shall report to the European Parliament on the application of Chapter VIII of this Regulation and the penalties and sanctions applied.
Justification
In the light of better law-making and in particular the effective use of ex-post evaluations to capture the whole legislative cycle, it is of particular interest to follow the transposition, implementation and enforcement of EU law, and more generally, to monitor the impact, operation and effectiveness of its law. A comprehensive review clause, requesting an appropriate evaluation on the application of the Regulation, its scope and the foreseen derogation of powers as well as constituting proportionate reporting obligations serves this purpose.
Amendment    48 Proposal for a regulation Article 72 a (new)
Text proposed by the Commission	Amendment
	Article 72a
	Review of Union legal acts
	By 25 May 2021, the Commission shall review other legal acts adopted on the basis of the Treaties which regulate processing of personal data, in particular by agencies established under Chapters 4 and 5 of Title V of Part Three TFEU, in order to assess the need to align them with this Regulation and to make, where appropriate, the necessary proposals to amend those acts in order to ensure a consistent approach to the protection of personal data within the scope of this Regulation.

PROCEDURE – COMMITTEE ASKED FOR OPINION

Title	Protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data
References	COM(2017)0008 – C8-0008/2017 – 2017/0002(COD)
Committee responsible        Date announced in plenary	LIBE 3.4.2017
Opinion by        Date announced in plenary	JURI 3.4.2017
Rapporteur        Date appointed	Angel Dzhambazki 28.2.2017
Discussed in committee	13.7.2017	7.9.2017
Date adopted	2.10.2017
Result of final vote	+: –: 0:	17 0 4
Members present for the final vote	Max Andersson, Joëlle Bergeron, Marie-Christine Boutonnet, Jean-Marie Cavada, Mary Honeyball, Sylvia-Yvonne Kaufmann, Gilles Lebreton, Jiří Maštálka, Emil Radev, Julia Reda, Evelyn Regner, Pavel Svoboda, József Szájer, Axel Voss, Francis Zammit Dimech, Tadeusz Zwiefka
Substitutes present for the final vote	Isabella Adinolfi, Jens Rohde, Virginie Rozière, Tiemo Wölken
Substitutes under Rule 200(2) present for the final vote	Arne Lietz

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

17	+
ALDE EFDD PPE S&D VERTS/ALE	Jean-Marie Cavada, Jens Rohde Joëlle Bergeron Emil Radev, Pavel Svoboda, József Szájer, Axel Voss, Francis Zammit Dimech, Tadeusz Zwiefka Mary Honeyball, Sylvia-Yvonne Kaufmann, Arne Lietz, Evelyn Regner, Virginie Rozière, Tiemo Wölken Max Andersson, Julia Reda

0	-

4	0
EFDD ENF GUE/NGL	Isabella Adinolfi Marie-Christine Boutonnet, Gilles Lebreton Jiri Mastálka

Key to symbols:

+  :  in favour

-  :  against

0  :  abstention

PROCEDURE – COMMITTEE RESPONSIBLE

Title	Protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data
References	COM(2017)0008 – C8-0008/2017 – 2017/0002(COD)
Date submitted to Parliament	12.1.2017
Committee responsible        Date announced in plenary	LIBE 3.4.2017
Committees asked for opinions        Date announced in plenary	BUDG 3.4.2017	JURI 3.4.2017
Not delivering opinions        Date of decision	BUDG 26.1.2017
Rapporteurs        Date appointed	Cornelia Ernst 9.3.2017
Discussed in committee	30.3.2017	21.6.2017	28.9.2017	12.10.2017
Date adopted	12.10.2017
Result of final vote	+: –: 0:	45 7 6
Members present for the final vote	Asim Ahmedov Ademov, Jan Philipp Albrecht, Gerard Batten, Heinz K. Becker, Malin Björk, Michał Boni, Caterina Chinnici, Rachida Dati, Frank Engel, Cornelia Ernst, Laura Ferrara, Raymond Finch, Lorenzo Fontana, Kinga Gál, Ana Gomes, Nathalie Griesbeck, Sylvie Guillaume, Sophia in ‘t Veld, Dietmar Köster, Barbara Kudrycka, Cécile Kashetu Kyenge, Marju Lauristin, Juan Fernando López Aguilar, Monica Macovei, Roberta Metsola, Louis Michel, Claude Moraes, József Nagy, Soraya Post, Judith Sargentini, Birgit Sippel, Branislav Škripek, Csaba Sógor, Traian Ungureanu, Bodil Valero, Marie-Christine Vergiat, Udo Voigt, Kristina Winberg, Tomáš Zdechovský, Auke Zijlstra
Substitutes present for the final vote	Carlos Coelho, Ignazio Corrao, Gérard Deprez, Anna Hedh, Marek Jurek, Sylvia-Yvonne Kaufmann, Ska Keller, Andrejs Mamikins, Barbara Spinelli, Anders Primdahl Vistisen, Axel Voss
Substitutes under Rule 200(2) present for the final vote	Beatriz Becerra Basterrechea, Czesław Hoc, Christelle Lechevalier, Olle Ludvigsson, Maria Noichl, Stanisław Ożóg, José Ignacio Salafranca Sánchez-Neyra
Date tabled	23.10.2017

FINAL VOTE BY ROLL CALL IN COMMITTEE RESPONSIBLE

45	+
ALDE	Beatriz Becerra Basterrechea, Gérard Deprez, Nathalie Griesbeck, Sophia in 't Veld, Louis Michel
EFDD	Ignazio Corrao, Laura Ferrara
GUE/NGL	Malin Björk, Cornelia Ernst, Barbara Spinelli, Marie-Christine Vergiat
PPE	Asim Ahmedov Ademov, Heinz K. Becker, Michał Boni, Carlos Coelho,Rachida Dati, Frank Engel, Kinga Gál, Barbara Kudrycka, Roberta Metsola, József Nagy, José Ignacio Salafranca Sánchez-Neyra, Csaba Sógor, Traian Ungureanu, Axel Voss, Tomáš Zdechovský
S&D	Caterina Chinnici, Ana Gomes, Sylvie Guillaume, Anna Hedh, Sylvia-Yvonne Kaufmann, Cécile Kashetu Kyenge, Dietmar Köster, Marju Lauristin, Olle Ludvigsson, Juan Fernando López Aguilar, Andrejs Mamikins, Claude Moraes, Maria Noichl, Soraya Post, Birgit Sippel
VERTS/ALE	Jan Philipp Albrecht, Ska Keller, Judith Sargentini, Bodil Valero

7	-
ECR	Czesław Hoc, Marek Jurek, Monica Macovei, Stanisław Ożóg, Anders Primdahl Vistisen, Branislav Škripek
ENF	Auke Zijlstra

6	0
EFDD	Gerard Batten, Raymond Finch, Kristina Winberg
ENF	Lorenzo Fontana, Christelle Lechevalier
NI	Udo Voigt

Key to symbols:

+  :  in favour

-  :  against

0  :  abstention