(Ordinary legislative procedure: first reading)

The European Parliament,

–  having regard to the Commission proposal to Parliament and the Council (COM(2017)0008),

–  having regard to Article 294(2) and Article 16(2) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C8‑0008/2017),

–  having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

–  having regard to the contributions submitted by the Czech Chamber of Deputies, the Spanish Parliament and the Portuguese Parliament on the draft legislative act,

–  having regard to the provisional agreement approved by the committee responsible under Rule 69f(4) of its Rules of Procedure and the undertaking given by the Council representative by letter of 7 June 2018 to approve Parliament’s position, in accordance with Article 294(4) of the Treaty on the Functioning of the European Union,

–  having regard to Rule 59 of its Rules of Procedure,

–  having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs and the opinion of the Committee on Legal Affairs (A8-0313/2017),

1.  Adopts its position at first reading hereinafter set out;

2.  Takes note of the statements by the Commission annexed to this resolution;

3.  Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

4.  Instructs its President to forward its position to the Council, the Commission and the national parliaments.

(As an agreement was reached between Parliament and Council, Parliament's position corresponds to the final legislative act, Regulation (EU) 2018/1725.)

STATEMENTS BY THE COMMISSION

The Commission regrets the exclusion of missions referred to in Articles 42(1), 43 and 44 TEU from the scope of the Regulation and notes that, as a result, there will be no data protection rules in place for such missions. The Commission notes that a Council decision, based on Article 39 TEU, could only lay down the data protection rules for processing of personal data by Member States when carrying out activities that fall within the scope of the Common Foreign and Security Policy. Such a Council decision could not include rules that apply to activities carried out by EU institutions, bodies, offices and agencies. In order to remedy the legal lacuna, a possible Council decision therefore would need to be accompanied by an additional, complementary instrument, based on Article 16 TFEU.

The Commission notes that paragraph 3 of Article 9 (former Article 70a of the Council's General Approach) does not create a new obligation on Union institutions and bodies as regards the balance to be struck between personal data protection and public access to documents.