REPORT on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament

6.12.2018 - (COM(2018)0636 – C8‑0413/2018 – 2018/0336(COD)) - ***I

Committee on Constitutional Affairs
Rapporteur: Mercedes Bresso, Rainer Wieland

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament

(COM(2018)0636 – C8‑0413/2018 – 2018/0336(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

–  having regard to the Commission proposal to Parliament and the Council (COM(2018)0636),

–  having regard to Article 294(2) and Article 224 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C8‑0413/2018),

–  having regard to the Treaty establishing the European Atomic Energy Community, and in particular Article 106a thereof,

–  having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

–    after consulting the European Economic and Social Committee,

–  after consulting the Committee of the Regions,

–  having regard to Rule 59 of its Rules of Procedure,

–  having regard to the report of the Committee on Constitutional Affairs and also the opinion of the Committee on Civil Liberties, Justice and Home Affairs (A8-0435/2018),

1.  Adopts its position at first reading hereinafter set out;

2.  Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3.  Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Amendment  1 Proposal for a regulation Recital 5 a (new)
Text proposed by the Commission	Amendment
	(5a)  When the Authority imposes a sanction on the European political party or foundation pursuant to the verification procedure, it shall take due account of the ne bis in idem principle, to avoid that the same infringement is sanctioned twice, on the national level following the decision of the supervisory authority, and on the European level following the verification procedure.
Amendment    2 Proposal for a regulation Recital 6
Text proposed by the Commission	Amendment
(6)  Since the new procedure is triggered by a decision of a competent data protection supervisory authority, it should be possible for the European political party or European political foundation concerned to request that the sanction be reviewed if the decision of the supervisory authority is repealed or a remedy against that decision is successful.	(6)  Since the new procedure is triggered by a decision of a competent data protection supervisory authority, it should be possible for the European political party or European political foundation concerned to be heard before that decision is delivered and to request that the sanction be reviewed if the decision of the supervisory authority is repealed or a remedy against that decision is successful.
Amendment    3 Proposal for a regulation Article 1 – paragraph 1 – point 3 Regulation (EU, Euratom) No 1141/2014 Article 10a – paragraph 1
Text proposed by the Commission Amendment If the Authority becomes aware of a decision of a supervisory authority within the meaning of point 21 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council17 finding that a natural or legal person has infringed applicable rules on the protection of personal data and if it follows from that decision, or where there are otherwise reasonable grounds to believe, that the infringement is linked to political activities by a European political party or a European political foundation in the context of elections to the European Parliament, the Authority shall refer this matter to the committee of independent eminent persons established by Article 11. The committee shall give an opinion as to whether the European political party or the European political foundation concerned has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of that infringement. The Authority shall request the opinion without undue delay and no later than 1 month after the decision of the supervisory authority. The committee shall deliver its opinion within a short, reasonable deadline set by the Authority. 1.  A European political party or a European political foundation shall not influence or attempt to influence the outcome of elections to the European Parliament by taking advantage of an infringement, by a natural or legal person, of the applicable rules on the protection of personal data. This paragraph shall only apply if a supervisory authority of a Member State, within the meaning of point 21 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council17, has established, by an enforceable decision, that an infringement of the applicable rules on data protection has occurred.   2.  When the Authority becomes aware of a conduct covered by the first paragraph, and is notified the enforceable decision of the supervisory authority referred to in that first paragraph, it shall refer this matter to the committee of independent eminent persons established by Article 11 without undue delay and no later than 3 months after that notification. The committee shall give an opinion, within a short, reasonable deadline set by the Authority, as to whether or not the European political party or European political foundation concerned has violated paragraph 1.   Having regard to the committee's opinion, the Authority shall decide, pursuant to Article 27(2)(a), whether to impose financial sanctions on the European political party or European political foundation concerned. The decision of the Authority shall be duly reasoned, in particular with regard to the committee’s opinion, and shall be published expeditiously. _________________ _________________ 17 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), (OJ L 119, 4.5. 2016, p. 1). 17 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), (OJ L 119, 4.5. 2016, p. 1).
Amendment    4 Proposal for a regulation Article 1 – paragraph 1 – point 6 – point a Regulation (EU, Euratom) No 1141/2014 Article 27 – paragraph 2 – point a – point vii
Text proposed by the Commission Amendment (vii)  where, in accordance with Article 10a, the committee issues an opinion finding that a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on the protection of personal data.; (vii)  where a European political party or European political foundation has violated Article 10a(1).”;
Amendment    5 Proposal for a regulation Article 1 – paragraph 1 – point 6 – point b Regulation (EU, Euratom) No 1141/2014 Article 27 – paragraph 7
Text proposed by the Commission Amendment 7.  Where a decision of the supervisory authority as referred to in Article 10a has been repealed or where a remedy against such decision has been successful, the Authority shall review any sanction imposed pursuant to point (a)(vii) of paragraph 2 at the request of the European political party or European political foundation concerned. 7.  Where a decision of the national supervisory authority as referred to in Article 10a has been definitively repealed or where a remedy against such decision has been successful and is final, the Authority shall review any sanction imposed pursuant to point (a)(vii) of paragraph 2 at the request of the European political party or European political foundation concerned.

OPINION of the Committee on Civil Liberties, Justice and Home Affairs (5.12.2018)

for the Committee on Constitutional Affairs

on the proposal for a regulation of the European Parliament and of the Council on the protection of personal data in the context of elections to the European Parliament
(COM(2018)0636 – C8‑0413/2018 – 2018/0336(COD))

Rapporteur for opinion: Sophia in 't Veld

AMENDMENTS

The Committee on Civil Liberties, Justice and Home Affairs calls on the Committee on Constitutional Affairs, as the committee responsible, to take into account the following amendments:

Amendment    1 Proposal for a regulation Recital 4
Text proposed by the Commission	Amendment
(4)  To that end, a verification procedure should be established whereby the Authority must, in certain circumstances, ask the committee of independent eminent persons to assess whether a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on protection of personal data. Where the committee finds that to be the case, the Authority should impose sanctions in line with the effective, proportionate and dissuasive sanctioning system established by the Regulation (EU, Euratom) No 1141/2014.	(4)  To that end, a verification procedure should be established whereby the Authority must, following a final decision by the national supervisory authority or European Data Protection Supervisor, ask the committee of independent eminent persons to assess whether a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on protection of personal data. Where the committee finds that to be the case, the Authority should impose sanctions in line with the effective, proportionate and dissuasive sanctioning system established by the Regulation (EU, Euratom) No 1141/2014. These sanctions should pursue the objective of guaranteeing free and fair elections to the European Parliament, while possible sanctions imposed by the data protection authorities should pursue the objective of protecting natural persons with regard to the processing of personal data.
Amendment    2 Proposal for a regulation Recital 5 a (new)
Text proposed by the Commission	Amendment
	(5 a)  When the Authority imposes a sanction on the European political party or foundation pursuant to the verification procedure, it shall take due account of the ne bis in idem principle, to avoid that the same infringement is sanctioned twice, on the national level following the decision of the supervisory authority, and on the European level following the verification procedure.
Justification
If the Authority imposes a sanction on the European political party/foundation pursuant to the verification procedure, the sanction could be considered a bis in idem: the decision by the supervisory authority, and the sanction imposed by the Authority. This would be contrary to Article 50 of the Charter and Article 4 of Protocol No. 7 to the European Convention on Human Rights.
Amendment    3 Proposal for a regulation Article 1 – paragraph 1 – point 3 Regulation (EU, Euratom) 1141/2014 Article 10a –paragraph 1
Text proposed by the Commission Amendment If the Authority becomes aware of a decision of a supervisory authority within the meaning of point 21 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council17 finding that a natural or legal person has infringed applicable rules on the protection of personal data and if it follows from that decision, or where there are otherwise reasonable grounds to believe, that the infringement is linked to political activities by a European political party or a European political foundation in the context of elections to the European Parliament, the Authority shall refer this matter to the committee of independent eminent persons established by Article 11. The committee shall give an opinion as to whether the European political party or the European political foundation concerned has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of that infringement. The Authority shall request the opinion without undue delay and no later than 1 month after the decision of the supervisory authority. The committee shall deliver its opinion within a short, reasonable deadline set by the Authority. If the Authority becomes aware of a final decision of a supervisory authority within the meaning of point 21 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council adopted pursuant to Article 58(2) of Regulation (EU) 2016/679 or of a final decision of the European Data Protection Supervisor established in accordance with Article 52 of Regulation (EU) 2018/172517a of the European Parliament and of the Council adopted pursuant to Article 58(2) of Regulation 2018/1725 finding that a natural or legal person has infringed applicable rules on the protection of personal data and if it follows from that final decision or where there are factual grounds indicating that the infringement is linked to political activities by or was committed on behalf of, under instructions from, or with the support of a European political party or a European political foundation in the context of elections to the European Parliament, the Authority shall refer this matter to the committee of independent eminent persons established by Article 11. The committee shall give an opinion as to whether the European political party or the European political foundation concerned has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by infringing the applicable rules on the protection of personal data, or by authorising, instructing or supporting an entity that has infringed the applicable rules, by taking advantage of that infringement. The Authority shall request the opinion without undue delay and no later than 1 month after the decision of the supervisory authority. The committee shall deliver its opinion within a short, reasonable deadline set by the Authority. __________________ __________________ 17 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), (OJ L 119, 4.5. 2016, p. 1). 17 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), (OJ L 119, 4.5. 2016, p. 1).   17a Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, (OJ L 295, 21.11.2018, p. 39)
Justification
If only final decisions can trigger the verification procedures, the principles of legal certainty and respect of the rights to a fair trial and due process are better guaranteed.By including Regulation [2018/xxxx (45/2001)], also EDPS decisions on infringements of data protection rules by EU institutions (including MEPs and staff) can trigger the procedure.Only decisions adopted by DPAs or EDPS based on their corrective powers can lead to this procedure, not investigative or advisory decisions.
Amendment    4 Proposal for a regulation Article 1 – paragraph 1 – point 4 Regulation 1141/2014 Article 11 – paragraph 3 –subparagraph 1 – second sentence
Text proposed by the Commission Amendment When requested by the Authority, the committee shall give an opinion on whether a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on the protection of personal data. In both cases the committee may request any relevant document and evidence from the Authority, the European Parliament, the European political party or European political foundation concerned, other political parties, political foundations or other stakeholders, and it may request to hear their representatives. In the case of opinions on whether a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on the protection of personal data, the supervisory authorities referred to in the Article 10(a) shall cooperate with the committee in accordance with applicable law. When requested by the Authority, the committee shall give an opinion on whether a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on the protection of personal data, or by authorising, instructing or supporting an entity that has infringed the applicable rules. In both cases the committee may request any relevant document and evidence from the Authority, the European Parliament, the European political party or European political foundation concerned, other political parties, political foundations or other stakeholders, and it may request to hear their representatives. In the case of opinions on whether a European political party or a European political foundation has influenced or attempted to influence the outcome of elections to the European Parliament by infringing the applicable rules on the protection of personal data, or by authorising, instructing or supporting an entity that has infringed the applicable rules, the supervisory authorities referred to in the Article 10(a) shall cooperate with the committee in accordance with applicable law and in compliance with the duty of professional secrecy as laid down in Article 54(2) of Regulation (EU) 2016/679 and in Article 56 of Regulation (EU) 2018/1725.
Justification
The GDPR and new Regulation (EU) 2018/1725 provide that the members and staff of supervisory authorities are bound by professional secrecy. If they will share any confidential information with this committee of eminent persons, this cooperation should respect the duty of professional secrecy.
Amendment    5 Proposal for a regulation Article 1 – paragraph 1 – point 6 – point a Regulation (EU, Euratom) 1141/2014 Article 27 – paragraph 2 – point a – point vii
Text proposed by the Commission Amendment (vii)  where, in accordance with Article 10a, the committee issues an opinion finding that a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on the protection of personal data.; (vii)  where, in accordance with Article 10a, the committee issues an opinion finding that a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on the protection of personal data. In this case, due account shall be taken of the ne bis in idem principle;
Justification
If the Authority imposes a sanction on the European political party/foundation pursuant to the verification procedure, the sanction could be considered a bis in idem: the decision by the supervisory authority, and the sanction imposed by the Authority. This would be contrary to Article 50 of the Charter and Article 4 of Protocol No. 7 to the European Convention on Human Rights.
Amendment    6 Proposal for a regulation Article 1 – paragraph 1 – point 6 a (new) Regulation (EU, Euratom) 1141/2014 Article 27a – paragraph 1 – point b a (new)
Text proposed by the Commission Amendment   (6 a)  in Article 27a, the following point is added:   (ba)  in the situation referred to in point (a) (vii) of Article 27, where the natural person has been found to be also responsible for the facts and conducts in question pursuant to the procedure established in Article 10a.
Justification
For the sake of consistency, this point needs to be added to Article 27a (Responsibility of natural persons).

PROCEDURE – COMMITTEE ASKED FOR OPINION

Title	Protection of personal data in the context of elections to the European Parliament
References	COM(2018)0636 – C8-0413/2018 – 2018/0336(COD)
Committee responsible        Date announced in plenary	AFCO 1.10.2018
Opinion by        Date announced in plenary	LIBE 1.10.2018
Rapporteur        Date appointed	Sophia in ‘t Veld 5.11.2018
Discussed in committee	20.11.2018	3.12.2018
Date adopted	3.12.2018
Result of final vote	+: –: 0:	39 2 1
Members present for the final vote	Heinz K. Becker, Monika Beňová, Malin Björk, Michał Boni, Caterina Chinnici, Cornelia Ernst, Romeo Franz, Kinga Gál, Sylvie Guillaume, Monika Hohlmeier, Filiz Hyusmenova, Sophia in ‘t Veld, Dietmar Köster, Barbara Kudrycka, Cécile Kashetu Kyenge, Juan Fernando López Aguilar, Roberta Metsola, Claude Moraes, József Nagy, Ivari Padar, Judith Sargentini, Birgit Sippel, Branislav Škripek, Sergei Stanishev, Helga Stevens, Traian Ungureanu, Marie-Christine Vergiat, Udo Voigt, Josef Weidenholzer, Kristina Winberg, Auke Zijlstra
Substitutes present for the final vote	Carlos Coelho, Gérard Deprez, Anna Hedh, Sylvia-Yvonne Kaufmann, Emilian Pavel, Morten Helveg Petersen, Christine Revault d’Allonnes Bonnefoy, Barbara Spinelli, Josep-Maria Terricabras
Substitutes under Rule 200(2) present for the final vote	Max Andersson, France Jamet

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

39	+
ALDE	Gérard Deprez, Filiz Hyusmenova, Sophia in 't Veld, Morten Helveg Petersen
ECR	Branislav Škripek, Helga Stevens, Kristina Winberg
GUE/NGL	Malin Björk, Cornelia Ernst, Barbara Spinelli, Marie-Christine Vergiat
NI	Udo Voigt
PPE	Heinz K. Becker, Michał Boni, Carlos Coelho, Kinga Gál, Monika Hohlmeier, Barbara Kudrycka, Roberta Metsola, József Nagy
S&D	Monika Beňová, Caterina Chinnici, Sylvie Guillaume, Anna Hedh, Sylvia-Yvonne Kaufmann, Dietmar Köster, Cécile Kashetu Kyenge, Juan Fernando López Aguilar, Claude Moraes, Ivari Padar, Emilian Pavel, Christine Revault d'Allonnes Bonnefoy, Birgit Sippel, Sergei Stanishev, Josef Weidenholzer
VERTS/ALE	Max Andersson, Romeo Franz, Judith Sargentini, Josep-Maria Terricabras

2	-
ENF	France Jamet, Auke Zijlstra

1	0
PPE	Traian Ungureanu

Key to symbols:

+  :  in favour

-  :  against

0  :  abstention

PROCEDURE – COMMITTEE RESPONSIBLE

Title	Protection of personal data in the context of elections to the European Parliament
References	COM(2018)0636 – C8-0413/2018 – 2018/0336(COD)
Date submitted to Parliament	12.9.2018
Committee responsible        Date announced in plenary	AFCO 1.10.2018
Committees asked for opinions        Date announced in plenary	BUDG 1.10.2018	JURI 1.10.2018	LIBE 1.10.2018
Not delivering opinions        Date of decision	BUDG 9.10.2018	JURI 24.9.2018
Rapporteurs        Date appointed	Mercedes Bresso 24.9.2018	Rainer Wieland 24.9.2018
Discussed in committee	12.11.2018
Date adopted	6.12.2018
Result of final vote	+: –: 0:	21 0 0
Members present for the final vote	Mercedes Bresso, Richard Corbett, Ramón Jáuregui Atondo, Alain Lamassoure, Maite Pagazaurtundúa Ruiz, György Schöpflin, Barbara Spinelli, Kazimierz Michał Ujazdowski
Substitutes present for the final vote	Max Andersson, Charles Goerens, Siôn Simon
Substitutes under Rule 200(2) present for the final vote	Albert Deß, Norbert Erdős, Sven Giegold, Krzysztof Hetman, Monika Hohlmeier, Danuta Jazłowiecka, Seán Kelly, Gabriel Mato, Anne-Marie Mineur, Pavel Poc, Gabriele Preuß
Date tabled	6.12.2018

FINAL VOTE BY ROLL CALL IN COMMITTEE RESPONSIBLE

21	+
ALDE	Charles Goerens, Maite Pagazaurtundúa Ruiz
GUE/NGL	Anne-Marie Mineur, Barbara Spinelli
NI	Kazimierz Michał Ujazdowski
PPE	Albert Deß, Norbert Erdős, Krzysztof Hetman, Monika Hohlmeier, Danuta Jazłowiecka, Seán Kelly, Gabriel Mato, György Schöpflin
S&D	Mercedes Bresso, Richard Corbett, Ramón Jáuregui Atondo, Pavel Poc, Gabriele Preuß, Siôn Simon
VERTS/ALE	Max Andersson, Sven Giegold

0	-

0	0

Key to symbols:

+  :  in favour

-  :  against

0  :  abstention