Council of theEuropean Union
Brussels, 21 April 2023
(OR. en)7842/23
Interinstitutional File:2022/0155(COD)

LIMITE
JAI 365
ENFOPOL 129
CRIMORG 33
IXIM 62DATAPROTECT 82
CYBER 68
COPEN 85
FREMP 89
TELECOM 84
COMPET 271
MI 246CONSOM 107
DIGIT 54
CODEC 484

NOTE
From:
To:

Presidency
Law Enforcement Working Party (Police)

No. prev. doc.:

9068/22, 12354/22, 14008/22, 14143/22; 6276/23; 7038/23; 7595/23

Subject:

Proposal for a Regulation of the European Parliament and of the Council
laying down rules to prevent and combat child sexual abusePresidency compromise texts

With a view to the Law Enforcement Working Party (Police) meeting on 27 and 28 April 2023,
delegations will find in the Annex Presidency compromise texts on the above proposal.
Changes to the Commission proposal are marked in bold and strikethrough.
New changes to the Commission proposal in comparison to documents 7595/23 are marked in bold
underline and strikethrough underline.

7842/23
JAI.1

FL/ml

1

LIMITEEN

ANNEX

Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
laying down rules to prevent and combat child sexual abuse(Text with EEA relevance)
CHAPTER I
GENERAL PROVISIONS
Article 1
Subject matter and scope
1.

This Regulation lays down uniform rules to prevent and address the misuse of relevant
information society services for online child sexual abuse in the internal market.
It establishes, in particular:(a)obligations on providers of relevant information society services to minimise the riskthat their services are misused for online child sexual abuse;(b)

obligations on providers of hosting services and providers of interpersonalcommunication services to detect and report online child sexual abuse;(c)obligations on providers of hosting services to remove or disable access to childsexual abuse material on their services;(d)obligations on providers of internet access services to prevent users from accessing
access child sexual abuse material;(da) obligations on providers of online search engines to delist websites indicating
specific items of child sexual abuse;(e)7842/23
ANNEX

rules on the implementation and enforcement of this Regulation, including as regards
the designation and functioning of the competent authorities of the Member States,
the EU Centre on Child Sexual Abuse established in Article 40 (‘EU Centre’) andcooperation and transparency.

JAI.1

FL/ml

2

LIMITEEN2.

This Regulation shall apply to providers of relevant information society services offeringsuch services in the Union, irrespective of their place of main establishment.

3.

This Regulation shall not affect the rules laid down by the following legal acts:(a)Directive 2011/93/EU on combating the sexual abuse and sexual exploitation ofchildren and child pornography, and replacing Council Framework Decision
2004/68/JHA;(b)

Directive 2000/31/EC and Regulation (EU) …/… [on a Single Market For Digital
Services (Digital Services Act) and amending Directive 2000/31/EC];(ba) Regulation (EU) 2022/… of … on contestable and fair markets in the digital
sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (DigitalMarkets Act);(c)

Directive 2010/13/EU;(d)Regulation (EU) 2016/679, Directive 2016/680, Regulation (EU) 2018/1725, and,subject to paragraph 4 of this Article, Directive 2002/58/EC;(e)Regulation (EU) 2021/784 of the European Parliament and of the Council of 29
April 2021 on addressing the dissemination of terrorist content online.

3a.

This Regulation shall not have the effect of modifying the obligation to respect therights, freedoms and principles referred to in Article 6 TEU and shall apply without
prejudice to fundamental principles relating to the right for respect to private life andfamily life and to freedom of expression and information.1

4.

This Regulation limits the exercise of the rights and obligations provided for in 5(1) and(3) and Article 6(1) of Directive 2002/58/EC insofar as necessary for the execution of thedetection orders issued in accordance with Section 2 of Chapter 1 II of this Regulation.

1

Wording copied from Art. 1(4) of TCO Regulation with an additional reference to the right toprivate life.

7842/23
ANNEX

JAI.1

FL/ml

3

LIMITEEN

Article 2
Definitions
For the purpose of this Regulation, the following definitions apply:(a)‘hosting service’ means an information society service as defined in Article 2, point (f),third indent, of Regulation (EU) …/… [on a Single Market For Digital Services (Digital
Services Act) and amending Directive 2000/31/EC];(b)‘number-independent interpersonal communications service’ means a publicly available
service as defined in Article 2, point 7 5, of Directive (EU) 2018/1972, including services
which enable direct interpersonal and interactive exchange of information merely as aminor ancillary feature that is intrinsically linked to another service; 2(c)‘software application’ means a digital product or service as defined in Article 2, point 13,
of Regulation (EU) …/… [on contestable and fair markets in the digital sector (DigitalMarkets Act)];(d)‘software application store’ means a service as defined in Article 2, point 12, of Regulation(EU) …/… [on contestable and fair markets in the digital sector (Digital Markets Act)] ;(e)‘internet access service’ means a service as defined in Article 2(2), point 2, of Regulation(EU) 2015/2120 of the European Parliament and of the Council3;(f)‘relevant information society services’ means all of the following services:(i)a hosting service;(ii)

an interpersonal communications service;(iii) a software applications store;(iv) an internet access service;
(v)

2

3

online search engines.

PCY comment: See Article 2(1) of the Temporary Regulation (EU) 2021/1232. Many
opinions have been expressed that the scope should not include regular telecom providers but
be limited to the number-independent service providers. The draft opinion of the IMCO
Committee in the EP is also going in this direction and provides elaborate additions to recital
5.
Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November
2015 laying down measures concerning open internet access and amending Directive
2002/22/EC on universal service and users’ rights relating to electronic communications
networks and services and Regulation (EU) No 531/2012 on roaming on public mobile
communications networks within the Union (OJ L 310, 26.11.2015, p. 1–18).

7842/23
ANNEX

JAI.1

FL/ml

4

LIMITEEN(g)‘to offer services in the Union’ means to offer services in the Union as defined in Article 2,
point (d), of Regulation (EU) …/… [on a Single Market For Digital Services (Digital
Services Act) and amending Directive 2000/31/EC];(h)‘user’ means any natural or legal person who uses a relevant information society service;(i)‘child’ means any natural person below the age of 18 years;4(j)‘child user’ means a natural person who uses a relevant information society service andwho is a natural person below the age of 17 years;5(k)‘micro, small or medium-sized enterprise’ means an enterprise as defined in Commission
Recommendation 2003/361 concerning the definition of micro, small and medium-sizedenterprises6;(l)‘child sexual abuse material’ means: material constituting child pornography or
pornographic performance as defined in Article 2, points (c) and (e), respectively, ofDirective 2011/93/EU;(m)‘known child sexual abuse material’ means potential child sexual abuse material detectedusing the indicators contained in the database of indicators referred to in Article 44(1),point (a);(n)‘new child sexual abuse material’ means potential child sexual abuse material detectedusing the indicators contained in the database of indicators referred to in Article 44(1),point (b);(o)‘solicitation of children’ means the solicitation of children for sexual purposes as referred
to in Article 6 of Directive 2011/93/EU;(p)‘online child sexual abuse’ means the online dissemination of child sexual abuse material
and the solicitation of children;

4

5

6

PCY comment: The term child appears 511 times in the whole proposal including in the
explanatory statements. The PCY is of the view that the term child can be used where it does
not lead to problematic incompatibilities between the exercise of powers by Member States,
for instance when it comes to the notice mechanism being developed under Article 12.
PCY comment: It seems superfluous to define child user since child is already defined inpoint (i) (in document 14143/22 the age was set at 18). Furthermore, the term child user
appears in Articles 3(2)(e)(ii) and (iii), 4(3), 6(1)(b) and (c) and 7(7), i.e on six occasions. As
those Articles and paragraphs are discussed, alternative wording should be developed.
Commission Recommendation of 6 May 2003 concerning the definition of micro, small andmedium-sized enterprises (OJ L 124, 20.5.2003, p. 36–41).

7842/23
ANNEX

JAI.1

FL/ml

5

LIMITEEN(q)‘child sexual abuse offences’ means offences as defined in Articles 3 to 7 of Directive
2011/93/EU;(r)‘recommender system’ means the system as defined in Article 2, point (o), of Regulation(EU) …/… [on a Single Market For Digital Services (Digital Services Act) and amending
Directive 2000/31/EC];(s)‘content data’ means data as defined in Article 2, point 10, of Regulation (EU) … [onEuropean Production and Preservation Orders for electronic evidence in criminal matters(…/… e-evidence Regulation)];(t)‘content moderation’ means the activities as defined in Article 2, point (p), of Regulation(EU) …/… [on a Single Market For Digital Services (Digital Services Act) and amending
Directive 2000/31/EC];(u)‘Coordinating Authority of establishment’ means the Coordinating Authority for childsexual abuse issues designated in accordance with Article 25 by the Member State where
the provider of information society services has its main establishment or, whereapplicable, where its legal representative resides or is established;(v)‘terms and conditions’ means terms and conditions as defined in Article 2, point (q), ofRegulation (EU) …/… [on a Single Market For Digital Services (Digital Services Act) andamending Directive 2000/31/EC];(w)‘main establishment’ means the head office or registered office of the provider of relevant
information society services within which the principal financial functions and operational
control are exercised;(x)‘online search engine’ means an intermediary service as defined in Article 3, point (j),of Regulation (EU) …/… [on a Single Market For Digital Services (Digital ServicesAct) and amending Directive 2000/31/EC].

7842/23
ANNEX

JAI.1

FL/ml

6

LIMITEENCHAPTER IIOBLIGATIONS OF PROVIDERS OF RELEVANT INFORMATION SOCIETY SERVICESTO PREVENT AND COMBAT ONLINE CHILD SEXUAL ABUSE
Section 1
Risk assessment and mitigation obligations
Article 3
Risk assessment[…][No new compromise texts in this Article]
Article 4
Risk mitigation[…][No new compromise texts in this Article]
Article 5
Risk reporting[…][No new compromise texts in this Article]
Article 6
Obligations for software application stores[…][No new compromise texts in this Article]

7842/23
ANNEX

JAI.1

FL/ml

7

LIMITEENSection 2
Detection obligations
Article 7
Issuance of detection orders
1.

The Coordinating Authority of establishment shall have the power to request the competentjudicial authority of the Member State that designated it or another independentadministrative authority of that Member State to issue a detection order requiring aprovider of hosting services or a provider of interpersonal communications services under
the jurisdiction of that Member State to take the measures specified in Article 10 to detect
online child sexual abuse on a specific service.

2.

The Coordinating Authority of establishment shall, before requesting the issuance of adetection order, carry out the investigations and assessments necessary to determine
whether the conditions of paragraph 4 have been met.
To that end, it may, where appropriate, require the provider to submit the necessary
information, additional to the report and the further information referred to in Article 5(1)and (3), respectively, within a reasonable time period set by that Coordinating Authority,
or request the EU Centre, another public authority or relevant experts or entities to provide
the necessary additional information.

3.

Where the Coordinating Authority of establishment takes the preliminary view that theconditions of paragraph 4 have been met, it shall:(a)establish a draft request for the issuance of a detection order, specifying the mainelements of the content of the detection order it intends to request and the reasons forrequesting it;(b)submit the draft request to the provider and the EU Centre;(c)afford the provider an opportunity to comment on the draft request, within areasonable time period set by that Coordinating Authority;(d)invite the EU Centre to provide its opinion on the draft request, within a time periodof four weeks from the date of receiving the draft request.

Where, having regard to the comments of the provider and the opinion of the EU Centre,that Coordinating Authority continues to be of the view that the conditions of paragraph 4
have met, it shall re-submit the draft request, adjusted where appropriate, to the provider.
In that case, the provider shall do all of the following, within a reasonable time period set
by that Coordinating Authority:7842/23
ANNEX

JAI.1

FL/ml

8

LIMITEEN(a)draft an implementation plan setting out the measures it envisages taking to executethe intended detection order, including detailed information regarding the envisaged
technologies and safeguards;(b)

where the draft implementation plan concerns an intended detection order concerning
the solicitation of children other than the renewal of a previously issued detection
order without any substantive changes, conduct a data protection impact assessment
and a prior consultation procedure as referred to in Articles 35 and 36 of Regulation(EU) 2016/679, respectively, in relation to the measures set out in theimplementation plan;(c)where point (b) applies, or where the conditions of Articles 35 and 36 of Regulation(EU) 2016/679 are met, adjust the draft implementation plan, where necessary inview of the outcome of the data protection impact assessment and in order to take
into account the opinion of the data protection authority provided in response to theprior consultation;(d)submit to that Coordinating Authority the implementation plan, where applicableattaching the opinion of the competent data protection authority and specifying how
the implementation plan has been adjusted in view of the outcome of the dataprotection impact assessment and of that opinion.

Where, having regard to the implementation plan of the provider and the opinion of thedata protection authority, that Coordinating Authority continues to be of the view that theconditions of paragraph 4 have met, it shall submit the request for the issuance of thedetection, adjusted where appropriate, to the competent judicial authority or independentadministrative authority. It shall attach the implementation plan of the provider and theopinions of the EU Centre and the data protection authority to that request.
4.

The Coordinating Authority of establishment shall request the issuance of the detection
order, and the competent judicial authority or independent administrative authority shallissue the detection order where it considers that the following conditions are met:(a)there is evidence of a significant risk of the service being used for the purpose of
online child sexual abuse, within the meaning of paragraphs 5, 6 and 7, as applicable;(b)the reasons for issuing the detection order outweigh negative consequences for therights and legitimate interests of all parties affected, having regard in particular to theneed to ensure a fair balance between the fundamental rights of those parties.

When assessing whether the conditions of the first subparagraph have been met, accountshall be taken of all relevant facts and circumstances of the case at hand, in particular:(a)7842/23
ANNEX

the risk assessment conducted or updated and any mitigation measures taken by theprovider pursuant to Articles 3 and 4, including any mitigation measures introduced,
reviewed, discontinued or expanded pursuant to Article 5(4) where applicable;

JAI.1

FL/ml

9

LIMITEEN

(b)any additional information obtained pursuant to paragraph 2 or any other relevant
information available to it, in particular regarding the use, design and operation of
the service, regarding the provider’s financial and technological capabilities and size
and regarding the potential consequences of the measures to be taken to execute thedetection order for all other parties affected;(c)the views and the implementation plan of the provider submitted in accordance withparagraph 3;(d)the opinions of the EU Centre and of the data protection authority submitted inaccordance with paragraph 3.

As regards the second subparagraph, point (d), where that Coordinating Authority
substantially deviates from the opinion of the EU Centre, it shall inform the EU Centre andthe Commission thereof, specifying the points at which it deviated and the main reasonsfor the deviation.
5.

6.

7842/23
ANNEX

As regards detection orders concerning the dissemination of known child sexual abusematerial, the significant risk referred to in paragraph 4, first subparagraph, point (a), shallbe deemed to exist where the following conditions are met:(a)

it is likely, despite any mitigation measures that the provider may have taken or will
take, that the service is used, to an appreciable extent for the dissemination of known
child sexual abuse material;(b)

there is evidence of the service, or of a comparable service if the service has not yet
been offered in the Union at the date of the request for the issuance of the detection
order, having been used in the past 12 months and to an appreciable extent for the
dissemination of known child sexual abuse material.

As regards detection orders concerning the dissemination of new child sexual abusematerial, the significant risk referred to in paragraph 4, first subparagraph, point (a), shallbe deemed to exist where the following conditions are met:(a)

it is likely that, despite any mitigation measures that the provider may have taken or
will take, the service is used, to an appreciable extent, for the dissemination of newchild sexual abuse material;(b)

there is evidence of the service, or of a comparable service if the service has not yet
been offered in the Union at the date of the request for the issuance of the detection
order, having been used in the past 12 months and to an appreciable extent, for the
dissemination of new child sexual abuse material;(c)for services other than those enabling the live transmission of pornographic
performances as defined in Article 2, point (e), of Directive 2011/93/EU:

JAI.1

FL/ml

10

LIMITE

EN

7.

(1)

a detection order concerning the dissemination of known child sexual abusematerial has been issued in respect of the service;(2)

the provider submitted a significant number of reports concerning known childsexual abuse material, detected through the measures taken to execute thedetection order referred to in point (1), pursuant to Article 12.

As regards detection orders concerning the solicitation of children, the significant riskreferred to in paragraph 4, first subparagraph, point (a), shall be deemed to exist where thefollowing conditions are met:(a)the provider qualifies as a provider of interpersonal communication services;(b)

it is likely that, despite any mitigation measures that the provider may have taken or
will take, the service is used, to an appreciable extent, for the solicitation of children;(c)there is evidence of the service, or of a comparable service if the service has not yet
been offered in the Union at the date of the request for the issuance of the detection
order, having been used in the past 12 months and to an appreciable extent, for thesolicitation of children.

The detection orders concerning the solicitation of children shall apply only tointerpersonal communications where one of the users is a child user7.
8.

The Coordinating Authority of establishment when requesting the issuance of detection
orders, and the competent judicial or independent administrative authority when issuing thedetection order, shall target and specify it in such a manner that the negative consequencesreferred to in paragraph 4, first subparagraph, point (b), remain limited to what is strictly
necessary to effectively address the significant risk referred to in point (a) thereof.
To that aim, they shall take into account all relevant parameters, including the availabilityof sufficiently reliable detection technologies in that they limit to the maximum extent
possible the rate of errors regarding the detection and their suitability and effectiveness forachieving the objectives of this Regulation, as well as the impact of the measures on therights of the users affected, and require the taking of the least intrusive measures, inaccordance with Article 10, from among several equally effective measures.
In particular, they shall ensure that:(a)7

where that risk is limited to an identifiable part or component of a service, therequired measures are only applied in respect of that part or component;

PCY comment: The PCY concludes that both the term ‘child’ and ‘child user’ as defined atpresent will cause difficult issues requiring further work.

7842/23
ANNEX

JAI.1

FL/ml

11

LIMITE

EN

9.

(b)

where necessary, in particular to limit such negative consequences, effective andproportionate safeguards additional to those listed in Article 10(4), (5) and (6) areprovided for;(c)subject to paragraph 9, the period of application remains limited to what is strictly
necessary.

The competent judicial authority or independent administrative authority shall specify inthe detection order the period during which it applies, indicating the start date and the end
date.
The start date shall be set taking into account the time reasonably required for the provider
to take the necessary measures to prepare the execution of the detection order. It shall not
be earlier than three months from the date at which the provider received the detection
order and not be later than 12 months from that date.
The period of application of detection orders concerning the dissemination of known or
new child sexual abuse material shall not exceed 24 months and that of detection orders
concerning the solicitation of children shall not exceed 12 months.
Article 8
Additional rules regarding detection orders

1.

7842/23
ANNEX

The competent judicial authority or independent administrative authority shall issue thedetection orders referred to in Article 7 using the template set out in Annex I. Detection
orders shall include:(a)information regarding the measures to be taken to execute the detection order,
including the indicators to be used and the safeguards to be provided for, including
the reporting requirements set pursuant to Article 9(3) and, where applicable, any
additional safeguards as referred to in Article 7(8);(b)

identification details of the competent judicial authority or the independentadministrative authority issuing the detection order and authentication of thedetection order by that judicial or independent administrative authority;(c)the name of the provider and, where applicable, its legal representative;(d)the specific service in respect of which the detection order is issued and, whereapplicable, the part or component of the service affected as referred to in Article
7(8);

(e)

whether the detection order issued concerns the dissemination of known or new childsexual abuse material or the solicitation of children;(f)the start date and the end date of the detection order;

JAI.1

FL/ml

12

LIMITE

EN

2.

(g)

a sufficiently detailed statement of reasons explaining why the detection order isissued;(h)a reference to this Regulation as the legal basis for the detection order;(i)the date, time stamp and electronic signature of the judicial or independentadministrative authority issuing the detection order;(j)easily understandable information about the redress available to the addressee of thedetection order, including information about redress to a court and about the time
periods applicable to such redress.

The competent judicial authority or independent administrative authority issuing thedetection order shall address it to the main establishment of the provider or, whereapplicable, to its legal representative designated in accordance with Article 24.
The detection order shall be transmitted to the provider’s point of contact referred to in
Article 23(1), to the Coordinating Authority of establishment and to the EU Centre,
through the system established in accordance with Article 39(2).
The detection order shall be drafted transmitted in any of the official languages declaredby the provider pursuant to Article 23(3).
The order may also be transmitted in any of the official languages of the Member
State authority issuing the order, provided that it is accompanied by a translation ofat least the most important elements necessary for the execution of the order into anyof the official languages declared by the provider in accordance with article 23(3).

3.

If the provider cannot execute the detection order because it contains manifest errors ordoes not contain sufficient information for its execution, the provider shall, without undue
delay, request the necessary clarification to the Coordinating Authority of establishment,using the template set out in Annex II.

4.

The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to amend Annexes I and II where necessary to improve the templates in view of
relevant technological developments or practical experiences gained.
Article 9
Redress, information, reporting and modification of detection orders

1.

7842/23
ANNEX

Providers of hosting services and providers of interpersonal communications services thathave received a detection order, as well as users affected by the measures taken to execute
it, shall have a right to effective redress. That right shall include the right to challenge thedetection order before the courts of the Member State of the competent judicial authority or
independent administrative authority that issued the detection order.

JAI.1

FL/ml

13

LIMITEEN

2.

When the detection order becomes final, the competent judicial authority or independentadministrative authority that issued the detection order shall, without undue delay, transmit
a copy thereof to inform the Coordinating Authority of establishment. The Coordinating
Authority of establishment shall then, without undue delay, transmit a copy thereof of thedetection order to all other Coordinating Authorities through the system established inaccordance with Article 39(2).
For the purpose of the first subparagraph, a detection order shall become final upon the
expiry of the time period for appeal where no appeal has been lodged in accordance withnational law or upon confirmation of the detection order following an appeal.

3.

Where the period of application of the detection order exceeds 12 months, or six months in
the case of a detection order concerning the solicitation of children, the Coordinating
Authority of establishment shall require the provider to report to it on the execution of thedetection order at least once, halfway through the period of application.
Those reports shall include a detailed description of the measures taken to execute thedetection order, including the safeguards provided, and information on the functioning inpractice of those measures, in particular on their effectiveness in detecting thedissemination of known or new child sexual abuse material or the solicitation of children,
as applicable, and on the consequences of those measures for the rights and legitimate
interests of all parties affected.

4.

In respect of the detection orders that the competent judicial authority or independentadministrative authority issued at its request, the Coordinating Authority of establishment
shall, where necessary and in any event following reception of the reports referred to inparagraph 3, assess whether any substantial changes to the grounds for issuing thedetection orders occurred and, in particular, whether the conditions of Article 7(4) continue
to be met. In that regard, it shall take account of additional mitigation measures that theprovider may take to address the significant risk identified at the time of the issuance of thedetection order.
That Coordinating Authority shall request to the competent judicial authority or
independent administrative authority that issued the detection order the modification or
revocation of such order, where necessary in the light of the outcome of that assessment.
The provisions of this Section shall apply to such requests, mutatis mutandis.
Article 10
Technologies and safeguards

1.

7842/23
ANNEX

Providers of hosting services and providers of interpersonal communication services thathave received a detection order shall execute it by installing and operating technologies todetect the dissemination of known or new child sexual abuse material or the solicitation ofchildren, as applicable, using the corresponding indicators provided by the EU Centre inaccordance with Article 46.

JAI.1

FL/ml

14

LIMITEEN2.

The provider shall be entitled to acquire, install and operate, free of charge, technologies
made available by the EU Centre in accordance with Article 50(1), for the sole purpose of
executing the detection order. The provider shall not be required to use any specifictechnology, including those made available by the EU Centre, as long as the requirements
set out in this Article are met. The use of the technologies made available by the EU Centre
shall not affect the responsibility of the provider to comply with those requirements and forany decisions it may take in connection to or as a result of the use of the technologies.

3.

The technologies shall be:

4.

8

(a)

effective in detecting the dissemination of known or new child sexual abuse materialor the solicitation of children, as applicable;(b)

not be able to extract any other information from the relevant communications than
the information strictly necessary to detect, using the indicators referred to inparagraph 1, patterns pointing to the dissemination of known or new child sexual
abuse material or the solicitation of children, as applicable;(c)in accordance with the state of the art in the industry and the least intrusive in termsof the impact on the users’ rights to private and family life, including theconfidentiality of communication, and to protection of personal data;(d)sufficiently reliable, in that they limit to the maximum extent possible the rate oferrors regarding the detection.

The provider shall:(a)take all the necessary measures to ensure that the technologies and indicators, as wellas the processing of personal data and other data in connection thereto, are used forthe sole purpose of detecting the dissemination of known or new child sexual abusematerial or the solicitation of children, as applicable, insofar as strictly necessary to
execute the detection orders addressed to them;(b)establish effective internal procedures to prevent and, where necessary, detect andremedy any misuse of the technologies, indicators and personal data and other data
referred to in point (a), including unauthorized access to, and unauthorised transfersof, such personal data and other data;(c)ensure regular human oversight as necessary to ensure that the technologies operate
in a sufficiently reliable manner and, where necessary, in particular when potential
errors and potential solicitation of children are detected, human intervention8;

Will be included in a recital.

7842/23
ANNEX

JAI.1

FL/ml

15

LIMITE

EN

5.

(d)

establish and operate an accessible, age-appropriate and user-friendly mechanismthat allows users to submit to it, within a reasonable timeframe, complaints about
alleged infringements of its obligations under this Section, as well as any decisions
that the provider may have taken in relation to the use of the technologies, including
the removal or disabling of access to material provided by users, blocking the users’
accounts or suspending or terminating the provision of the service to the users, andprocess such complaints in an objective, effective and timely manner;(e)

inform the Coordinating Authority, at the latest one month before the start datespecified in the detection order, on the implementation of the envisaged measures set
out in the implementation plan referred to in Article 7(3);(f)

regularly review the functioning of the measures referred to in points (a), (b), (c) and(d) of this paragraph and adjust them where necessary to ensure that the requirements
set out therein are met, as well as document the review process and the outcomes
thereof and include that information in the report referred to in Article 9(3).

The provider shall inform users in a clear, prominent and comprehensible way of thefollowing:(a)the fact that it operates technologies to detect online child sexual abuse to execute thedetection order, the ways in which it operates those technologies and the impact on
the confidentiality of users’ communications;(b)the fact that it is required to report potential online child sexual abuse to the EU
Centre in accordance with Article 12;(c)the users’ right of judicial redress referred to in Article 9(1) and their rights to submit
complaints to the provider through the mechanism referred to in paragraph 4, point(d) and to the Coordinating Authority in accordance with Article 34.

The provider shall not provide information to users that may reduce the effectiveness of themeasures to execute the detection order.
6.

Where a provider detects potential online child sexual abuse through the measures taken to
execute the detection order, it shall inform the users concerned without undue delay, after
Europol or the national law enforcement authority of a Member State that received thereport pursuant to Article 48 has confirmed that the information to the users would notinterfere with activities for the prevention, detection, investigation and prosecution of childsexual abuse offences.
Article 11
Guidelines regarding detection obligations

The Commission, in cooperation with the Coordinating Authorities and the EU Centre and after
having conducted a public consultation, may issue guidelines on the application of Articles 7 to 10,
having due regard in particular to relevant technological developments and the manners in which
the services covered by those provisions are offered and used.

7842/23
ANNEX

JAI.1

FL/ml

16

LIMITEENSection 3
Reporting obligations
Article 12
Reporting obligations
1.

Where a provider of hosting services or a provider of interpersonal communications
services becomes aware in any manner other than through a removal order issued inaccordance with this Regulation of any information indicating that indicate potential
online child sexual abuse on its services, it shall promptly submit a report thereon to the
EU Centre in accordance with Article 13. It shall do so through the system established inaccordance with Article 39(2).

2.

Where the provider submits a report pursuant to paragraph 1, it shall inform the userconcerned, in accordance with the following sub-paragraphs providing information on
the main content of the report, on the manner in which the provider has become aware of
the potential child sexual abuse concerned, on the follow-up given to the report insofar as
such information is available to the provider and on the user’s possibilities of redress,
including on the right to submit complaints to the Coordinating Authority in accordancewith Article 34.
The provider shall inform the user concerned without undue delay, either after having
received a communication from the EU Centre indicating that it considers the report to be
manifestly unfounded as referred to in Article 48(2), or after the expiry of a time period of
six three months from the date of the report without having received a communicationfrom the EU Centre indicating that the information is not to be provided as referred to in
Article 48(6), point (a), whichever occurs first. The time period of six months refered toin this subparagraph shall be extended by up to 6 months where so requested by thecompetent authority referred to in Article 48(6), point a.
Where within the three months’ time period referred to in the second subparagraph theprovider receives such a communication from the EU Centre indicating that the
information is not to be provided, it shall inform the user concerned, without undue delay,
after the expiry of the time period set out in that communication.

3.

7842/23
ANNEX

The provider shall establish and operate an easy to access, accessible, effective, childfriendly age-appropriate and user-friendly mechanism that allows users to notify flag tothe provider information that indicate potential online child sexual abuse on its theservice. Those mechanisms shall allow for the submission of notices by individuals or
entities exclusively by electronic means.

JAI.1

FL/ml

17

LIMITEENThe mechanisms shall be such as to facilitate the submission of sufficiently precise
and adequately substantiated notices. To that end, the providers shall take thenecessary measures, with particular attention to the needs of the child, to enable andto facilitate the submission of notices, with a view to receiving:

4.

(a)

the reasons why the user claims that the notice contains online child sexual
abuse;(b)a clear indication of the online location of the alleged online child sexual abuse
and, where necessary, additional information specific to a service that enables
the identification of its online location.

The Commission, in cooperation with Coordinating Authorities and the EU Centre
and after having conducted a public consultation, shall issue guidelines on theapplication of paragraph 3, having due regard in particular to the child's age,maturity, views, needs and concerns.
Article 13
Specific requirements for reporting

1.

Providers of hosting services and providers of interpersonal communications services shallsubmit the report referred to in Article 12 using the template set out in Annex III. The
report shall include:(a)identification details of the provider and, where applicable, its legal representative;(b)

the date, time stamp and electronic signature of the provider;(ba) manner in which the provider became aware of the potential child sexual abuse;7842/23
ANNEX(c)

all content data related to the reported potential online child sexual abuse,including images, videos and text;(d)

all other available data related to the reported potential online child sexual abuse,including unique identifiers of the user and metadata related to media files andcommunications;(e)whether the potential online child sexual abuse concerns the dissemination of knownor new child sexual abuse material or the solicitation of children;(f)information concerning the geographic location related to the potential online childsexual abuse, such as the Internet Protocol address of upload, with associated date
and time stamp, and port number;(g)

information concerning the identity of any user involved in the potential online childsexual abuse;

JAI.1

FL/ml

18

LIMITEEN(h)whether the provider has also reported, or will also report, the information thatindicate potential online child sexual abuse to a third-country public authority orother entity competent to receive such reports of a third country and if so, whichauthority or entity;(i)where the information that indicate potential online child sexual abuse concerns thedissemination of known or new child sexual abuse material, whether the provider has
removed or disabled access to the material;(j)whether the provider considers that the report involves an imminent threat tothe life or safety of a child or requires urgent action; 9(k)a reference to this Regulation as the legal basis for reporting.

10

2.

The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to amend Annex III to improve the template where necessary in view of relevant
technological developments or practical experiences gained.

9

In the template of Annex III, section 2, point 1, we could add the reason for the urgency.
COM text proposal: “(j) whether the report is made in accordance with paragraph 2”.
COM explanations: The reasons for urgent action are the imminent threat to the life or safetyof the child.

10

COM text proposal:“2. By deviation from the paragraph 1, where the information referred to in Article 12(1)reasonably justifies the conclusion that there is likely to be an imminent threat to the lifeor safety of a child, the report referred to in paragraph 1 of this Article shall include:(a) in any event, the information referred to in points (a), (b), (f), (j) and (k) of paragraph
1 of this Article;(b) the information referred to in the other points of paragraph 1 of this Article, only
insofar as that information is immediately available and the inclusion thereof in thereport does not delay the submission of the report.
Where the report referred to in the first subparagaph does not contain all informationreferred to in paragraph 1 of this Article in accordance with point (b) of the firstsubaparagraph, the provider of hosting services or of interpersonal communications
services concerned shall be promptly submit an additional report containing all that
information, updated or completed where relevant. That additional report shall include areference to the initial report submitted in accordance with the first subparagaph and shallindicate which information has been updated or completed.”

7842/23
ANNEX

JAI.1

FL/ml

19

LIMITEEN

Article 13a11
Emergency reporting
1.

In the case of an imminent threat to the life or safety of a child, the providers of
hosting services and providers of interpersonal communications services shallpromptly and directly, in addition to paragraph 1(j) of Article 13, inform authorities
competent to for the investigation and prosecution of criminal offences in theMember States concerned12. Where the provider cannot identify with reasonablecertainty the Member State concerned, it shall inform the law enforcement
authorities of the Member State in which it is established or where its legal
representative resides or is established and inform Europol13.

2.

For the purpose of paragraph 1, the Member State concerned shall be theMember State in which the offence is suspected to have taken place, to be taking placeor to be likely to take place, or the Member State where the suspected offenderresides or is located, or the Member State where the victim of the suspected offence
resides or is located.
Section 4
Removal obligations
Article 14
Removal orders

1.

The Coordinating Authority of establishment shall have the power to request the competentjudicial authority of the Member State that designated it or another independentadministrative authority of that Member State to issue a removal order requiring a providerof hosting services under the jurisdiction of the Member State that designated that
Coordinating Authority to remove or disable access in all Member States of one or more
specific items of material that, after a diligent assessment, the Coordinating Authority or
the courts or other independent administrative authorities referred to in Article 36(1)identified as constituting child sexual abuse material.

1.

The competent authority shall have the power to issue a removal order, in accordancewith relevant national requirements, requiring a provider of hosting services toremove or disable access in all Member States of one or more specific items ofmaterial that, after a diligent assessment, the Coordinating Authority or the courts orother independent administrative authorities referred to in Article 36(1) is identified as
constituting child sexual abuse material.

11

COM comment: as mentioned in the last LEWP, it would be best to not create a parallel
procedure and delete this Article, and instead reinforce the existing procedure if needed tofurther speed-up the process in cases of emergency (e.g. reduced reporting requirements – see
new Art. 12(2), and simplified filtering requirements at the EU Centre – see new paragraph).
Wording copied from Art. 14(5) of the TCO Regulation.
Wording copied from Art. 18(2) of the DSA.

12
13

7842/23
ANNEX

JAI.1

FL/ml

20

LIMITE

EN

14

2.

The provider shall execute the removal order as soon as possible and in any event within
24 1 hours of receipt thereof. The provider shall take the necessary measures to ensurethat it is capable to reinstate the material or access thereto in accordance with Article
15(1a).

3.

The competent judicial authority or the independent administrative authority shall issue a
A removal order shall be issued using the template set out in Annex IV. Removal orders
shall include:

14

(a)

identification details of the competent judicial or independent administrative
authority issuing the removal order and authentication of the removal order by that
authority;(b)

the name of the provider and, where applicable, of its legal representative;(c)the specific service in respect of for which the removal order is issued;(d)a sufficiently detailed statement of reasons explaining why the removal order isissued and in particular why the material constitutes child sexual abuse material;

COM proposal: “By deviation from the first subparagraph, and without causing undue delaysin the process of issuance of those orders, Member States may decide that such orders canonly be issued by a judicial authority at the request of the competent authority. Where a
Member State makes use of this possibility, it shall inform the Commission thereof and keep
it up-to-date. The Commission shall make the information received publicly available andkeep it up-to-date.”
COM suggestion to accompany by a recital: “In order to allow Member States to organise theprocess of issuance of removal, blocking or delisting orders in a manner compatible with theirrespective constitutional requirements and to enhance prior judicial control where deemed
appropriate, they should have the possibility to require their respective competent authorities
to request the competent judicial authority of the Member State concerned to issue some or allof those three types of orders under this Regulation. That possibility to derogate should
however only concern the question which authority issues the orders. Accordingly, when aMember State makes use of that possibility, the competent authority concerned should remain
responsible for assessing the need for the order at stake and for complying with all of theprocedural requirements of this Regulation related to its preparation and follow-up. In thatcase, whilst it is for the competent judicial authority to conduct an additional verification ofwhether the conditions of this Regulation for issuing the order in question have been met,
those conditions themselves should remain unaltered and be applied consistently across theUnion. In the interest of effectiveness, that possibility should be subject to the Member State
concerned taking all reasonable measures to ensure that the issuance of the orders by their
judicial authorities does not lead to any undue delays. In addition, in the interest oftransparency and legal certainty, it should be ensured that the necessary information regarding
the use of the possibility is publicly available.”

7842/23
ANNEX

JAI.1

FL/ml

21

LIMITEEN

(da) where applicable, a statement of reasons explaining why the order is issued to aservice provider that does not have its main establishment or legal
representative in the Member State of the issuing authority according to theprocedure provided for in Article 14a;(e)an exact uniform resource locator and, where necessary, additional clear information
for the identification of enabling the provider to identify and locate the childsexual abuse material;(f)where applicable, the information about non-disclosure during a specified time
period, in accordance with Article 15(4), point (c);(fa) reporting requirements pursuant to point 7;

4.

(g)

a reference to this Regulation as the legal basis for the removal order;(h)the date, time stamp and electronic signature of the judicial or independentadministrative competent authority issuing the removal order;(i)easily understandable information about the redress available to the addressee of theremoval order, including information about redress to a court and about the time
periods applicable to such redress.

The judicial authority or the independent administrative authority issuing the removal
order shall address it to the main establishment of the provider or, where applicable, to its
legal representative designated in accordance with Article 24.
It shall transmit The removal order shall be transmitted to the the provider’s point ofcontact referred to in Article 23(1) by electronic means capable of producing a written
record under conditions that allow to establish the authentication of the sender, including
the accuracy of the date and the time of sending and receipt of the order, to the
Coordinating Authority of establishment and to the EU Centre, through the systemestablished in accordance with Article 39(2).
It shall draft transmit the removal order in any of the official languages declared by theprovider pursuant to Article 23(3).
The order may also be transmitted in any of the official languages of the Member
State issuing the order, provided that it is accompanied by a translation of at least themost important elements necessary for the execution of the order into any of theofficial languages declared by the provider in accordance with article 23(3).

5.

If the provider cannot execute the removal order on grounds of force majeure or de facto
impossibility not attributable to it, including for objectively justifiable technical or
operational reasons, it shall, without undue delay, inform the authority issuing the orderof establishment of those grounds, using the template set out in Annex V.
The time period set out in paragraph 21 shall start to run as soon as the reasons referred toin the first subparagraph have ceased to exist.

7842/23
ANNEX

JAI.1

FL/ml

22

LIMITEEN

6.

If the provider cannot execute the removal order because it contains manifest errors or does
not contain sufficient information for its execution, it shall, without undue delay, request
the necessary clarification to from the authority issuing the order of establishment, using
the template set out in Annex V.
The time period set out in paragraph 21 shall start to run as soon as the provider hasreceived the necessary clarification.

7.

The provider shall, without undue delay and using the template set out in Annex VI,
inform the issuing authority, Coordinating Authority of establishment and the EU Centreof the measures taken to execute the removal order, indicating, in particular, whether theprovider removed the child sexual abuse material or disabled access thereto in all Member
States and the date and time thereof.

8.

The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to amend Annexes IV, V and VI where necessary to improve the templates in viewof relevant technological developments or practical experiences gained.
Article 14a
Procedure for cross-border removal orders

1.

Subject to Article 14, where the hosting service provider does not have its mainestablishment or legal representative in the Member State of the authority that issued
the removal order, that authority shall, simultaneously to issuing the order to thehosting service provider, transmit a copy of the removal order to the Coordinating
Authority of the Member State where the hosting service provider has its mainestablishment or where its legal representative resides or is established. If thereceiving Coordinating Authority is not the competent authority, it shall transmit theorder to the competent authority for the purpose of the procedure of this Article.

2.

Where a hosting service provider receives a removal order as referred to in this
Article, it shall take the measures provided for in Article 14 and take the necessary
measures to be able to reinstate the content or access thereto, in accordance withparagraph 6 of this Article.

3.

The Coordinating Authority or the competent authority of the Member State where
the hosting service provider has its main establishment or where its legal
representative resides or is established may, on its own initiative, within 72 hours ofreceiving the copy of the removal order in accordance with paragraph 1, scrutinise
the removal order to determine whether it seriously or manifestly infringes thisRegulation or the fundamental rights and freedoms guaranteed by the Charter.
Where it finds an infringement, it shall, within the same period, adopt a reasoned
decision to that effect.

7842/23
ANNEX

JAI.1

FL/ml

23

LIMITEEN4.

The Coordinating Authority or the competent authority shall, before adopting adecision pursuant to the second subparagraph of paragraph 3, inform the competentauthority that issued the removal order of its intention to adopt the decision and of its
reasons for doing so.

5.

Where the Coordinating Authority or the competent authority adopts a reasoned
decision in accordance with paragraph 3 of this Article, it shall, without delay,transmit that decision, if necessary through the Coordinating Authority, to theauthority that issued the removal order, the hosting service provider and the EU
Centre.
Where the decision finds an infringement pursuant to paragraph 3 of this Article, theremoval order shall cease to have legal effects.

6.

Upon receiving a decision finding an infringement communicated in accordance withparagraph 5, the hosting service provider concerned shall without undue delayreinstate the content or access thereto, without prejudice to the possibility to enforce
its terms and conditions in accordance with Union and national law.
Article 15
Redress and provision of information

1.

Providers of hosting services that have received a removal order issued in accordance with
Article 14, as well as the users who provided the material, shall have the right to aneffective redress. That right shall include the right to challenge such a removal order before
the courts of the Member State of the competent judicial authority or independentadministrative authority that issued the removal order.

1a.

If the order is repealed as a result of a redress procedure, the provider shall without
undue delay reinstate the material or access thereto, without prejudice to thepossibility to enforce its terms and conditions in accordance with Union and national
law15.

2.

When the removal order becomes final, the competent judicial authority or independentadministrative authority that issued the removal order shall, without undue delay, transmit
a copy thereof and copies of the information it has received pursuant to Article 14 (5)to (7) to the Coordinating Authority of establishment. The Coordinating Authority of
establishment shall then, without undue delay, transmit a copy copies thereof to all other
Coordinating Authorities and the EU Centre through the system established inaccordance with Article 39(2).
For the purpose of the first subparagraph, a removal order shall become final upon the
expiry of the time period for appeal where no appeal has been lodged in accordance withnational law or upon confirmation of the removal order following an appeal.

15

Wording copied from Art. 4(7) of the TCO Regulation.

7842/23
ANNEX

JAI.1

FL/ml

24

LIMITEEN

3.

Where a provider removes or disables access to child sexual abuse material pursuant to aremoval order issued in accordance with Article 14, it shall without undue delay, informthe user who provided the material of the following:(a)the fact that it removed the material or disabled access thereto;(b)

the reasons for the removal or disabling, providing a copy of the removal order upon
the user’s request;(c)the user’s right to judicial redress referred to in paragraph 1 and the user’s right tosubmit complaints to the Coordinating Authority in accordance with Article 34.

3a.

The provider shall establish and operate an accessible, age-appropriate and userfriendly mechanism that allows users to submit to it complaints about alleged
infringements of its obligations under this Section. It shall process such complaints inan objective, effective and timely manner.

4.

The issuing authority Coordinating Authority of establishment may decide request, whenrequesting the judicial authority or independent administrative authority issuing theremoval order, and after having consulted if necessary with relevant public authorities,
that the provider is not to disclose any information regarding the removal of or disabling ofaccess to the child sexual abuse material, where and to the extent necessary to avoid
interfering with activities for the prevention, detection, investigation and prosecution ofchild sexual abuse or related criminal offences.
In such a case:(a)the judicial authority or independent administrative authority issuing the removal
order shall inform the provider of its decision specifying the applicable time
period that shall be set the time period not longer than necessary and not exceeding
twelve six weeks, during which the provider is not to disclose such information;(b)

the obligations set out in paragraph 3 shall not apply during that time period;(c)that judicial authority or independent administrative authority shall inform theprovider of its decision, specifying the applicable time period.

The issuing That judicial authority or independent administrative authority may decide toextend the time period referred to in the second subparagraph, point (a), by a further time
period of maximum six weeks, where and to the extent the non-disclosure continues to benecessary. In that case, the issuing that judicial authority or independent administrative
authority shall inform the provider of its decision, specifying the applicable time period.
Article 14(3) shall apply to that decision.

7842/23
ANNEX

JAI.1

FL/ml

25

LIMITEENSection 5
Blocking obligations
Article 16
Blocking orders
1.

The competent authority Coordinating Authority of establishment shall have the power torequest the competent judicial authority of the Member State that designated it or an
independent administrative authority of that Member State to issue a blocking order, in
accordance with relevant national requirements, requiring a provider of internet accessservices under the jurisdiction of that Member State to take reasonable measures to prevent
users from accessing known child sexual abuse material indicated by all uniform resource
locators on the list of uniform resource locators included in the database of indicators, inaccordance with Article 44(2), point (b) and provided by the EU Centre.16

1a.

The provider shall execute the blocking order as soon as possible and in any event
within a reasonable time period set by the issuing authority one week of receipt
thereof. The provider shall take the necessary measures to ensure that it is capable ofreinstating access in accordance with Article 18(1a).

2.

The Coordinating Authority of establishment shall, before requesting the issuance of a
blocking order, carry out all investigations and assessments necessary to determine
whether the conditions of paragraph 4 have been met.
To that end, it shall, where appropriate:

16

(a)

verify that, in respect of all or a representative sample of the uniform resource
locators on the list referred to in paragraph 1, the conditions of Article 36(1), point(b), are met, including by carrying out checks to verify in cooperation with the EU
Centre that the list is complete, accurate and up-to-date;(b)require the provider to submit, within a reasonable time period set by that
Coordinating Authority, the necessary information, in particular regarding theaccessing or attempting to access by users of the child sexual abuse materialindicated by the uniform resource locators, regarding the provider’s policy to address
the risk of dissemination of the child sexual abuse material and regarding theprovider’s financial and technological capabilities and size;

COM proposal: “By deviation from the first subparagraph, and without causing undue delaysin the process of issuance of those orders, Member States may decide that such orders canonly be issued by a judicial authority at the request of the competent authority. Where a
Member State makes use of this possibility, it shall inform the Commission thereof and keep
it up-to-date. The Commission shall make the information received publicly available andkeep it up-to-date.”

7842/23
ANNEX

JAI.1

FL/ml

26

LIMITEEN(c)request the EU Centre to provide the necessary information, in particularexplanations and assurances regarding the accuracy of the uniform resource locators
in indicating child sexual abuse material, regarding the quantity and nature of thatmaterial and regarding the verifications by the EU Centre and the audits referred toin Article 36(2) and Article 46(7), respectively;(d)request any other relevant public authority or relevant experts or entities to provide
the necessary information.

3.

The Coordinating Authority of establishment shall, before requesting the issuance of theblocking order, inform the provider of its intention to request the issuance of the blocking
order, specifying the main elements of the content of the intended blocking order and thereasons to request the blocking order. It shall afford the provider an opportunity tocomment on that information, within a reasonable time period set by that Coordinating
authority.

4.

The Coordinating Authority of establishment shall request the issuance of the blocking
order, and the competent judicial authority or independent authority shall issue the A
blocking order shall be issued, where it considers that the following conditions are met:(a)other equally effective and less intrusive measures17 than blocking cannot betaken to prevent access to child sexual abuse material or it is likely that suchmeasure will fail; there is evidence of the service having been used during the past
12 months, to an appreciable extent, for accessing or attempting to access childsexual abuse material indicated by the uniform resource locators;(b)

the blocking order is necessary to prevent the dissemination of the child sexual abusematerial to users in the Union, having regard in particular to the quantity and natureof the material, to the need to protect the rights of the victims and the existence andimplementation by the provider of a policy to address the risk of such dissemination;(c)the uniform resource locators indicate, in a sufficiently reliable manner, child sexual
abuse material;(d)the reasons for issuing the blocking order outweigh negative consequences for therights and legitimate interests of all parties affected, having regard in particular to theneed to ensure a fair balance between the fundamental rights of those parties,
including the exercise of the users’ freedom of expression and information and theprovider’s freedom to conduct a business.

When assessing whether the conditions of the first subparagraph have been met, accountshall be taken of all relevant facts and circumstances of the case at hand, including any
information obtained pursuant to paragraph 2 and the views of the provider submitted inaccordance with paragraph 3.

17

PCY comment: an example of “less intrusive measures” can for instance be a removal orderthat cannot be executed.

7842/23
ANNEX

JAI.1

FL/ml

27

LIMITE

EN

5.

6.

The Coordinating Authority of establishment when requesting the issuance of blocking
orders, and the competent judicial or independent administrative authority when issuing the
A blocking order, shall:(a)where necessary, specify effective and proportionate limits and safeguards
necessary to ensure that a blocking order is targeted and that any negative
consequences referred to in paragraph 4, point (d), remain limited to what is strictly
necessary;(b)subject to paragraph 6, ensure that the period of application remains limited to whatis strictly necessary.

The issuing Coordinating authority shall specify in the blocking order the period during
which it applies, indicating the start date and the end date.
The period of application of blocking orders shall not exceed five years.

7.

In respect of the blocking orders that the competent judicial authority or independentadministrative authority issued at its request, tThe Coordinating Authority or the issuingauthority shall, where necessary and at least once every year, assess whether any
substantial changes to the grounds for issuing the blocking orders have occurred and, inparticular, whether the conditions of paragraph 4 continue to be met.
The Coordinating Authority shall request to the competent judicial authority or
independent administrative authority that issued the blocking order the modification or
revocation of such order, wWhere necessary in the light of the outcome of that assessment
or to take account of justified requests or other relevant information, including
information obtained through the reports referred to in Article 18 17(5a) and (6),respectively an order shall be modified or repealed by the issuing authority, where
relevant at the request of the Coordinating Authority. The provisions of this Section
shall apply to such requests, mutatis mutandis.
Article 17
Additional rules regarding blocking orders

1.

7842/23ANNEX

The Coordinating Authority of establishment shall issue the A blocking orders referred toin Article 16 shall be issued using the template set out in Annex VII. Blocking orders shall
include:

JAI.1

FL/ml

28

LIMITEEN(a)the reference to the list of uniform resource locators, provided by the EU Centre, andthe safeguards to be provided for, including the limits and safeguards specified
pursuant to Article 16(5) and, where applicable, the reporting requirements set
pursuant to Article 18(6)18;(b)

identification details of the competent judicial authority or the independentadministrative authority issuing the blocking order and authentication of the blocking
order by that authority;(c)the name of the provider and, where applicable, its legal representative;(d)clear information enabling the provider to identify and locate the child sexual
abuse material; the specific service in respect of which the detection order is issued;(e)the start date and the end date of the blocking order;(ea) the limits referred to in Article 16(5);(f)

a sufficiently detailed statement of reasons explaining why the blocking order isissued;(fa) reporting requirements pursuant to paragraph 5a;(g)a reference to this Regulation as the legal basis for the blocking order;(h)the date, time stamp and electronic signature of the judicial authority or the
independent administrative authority issuing the blocking order;(i)easily understandable information about the redress available to the addressee of theblocking order, including information about redress to a court and about the time
periods applicable to such redress.

2.

The competent judicial authority or independent administrative authority issuing theblocking order shall address it to the main establishment of the provider or, whereapplicable, to its legal representative designated in accordance with Article 24.

18

PCY comment: the proposal means that a blocking order can only be issued if the subjectmatter of the blocking is on the list provided for by the EU Centre. This list is compiled
according to Article 36(1)(b) that stipulates additional requirements, including that theblocked online location must be displayed from a third country. Do Member States thinkthat there should be such a requirement? Or should it be sufficient that Member States
share their blocking orders with the EU Centre and other Member States once they
become final?

7842/23
ANNEX

JAI.1

FL/ml

29

LIMITEEN3.

The blocking order shall be transmitted to the provider’s point of contact referred to in
Article 23(1) by electronic means capable of producing a written record underconditions that allow to establish the authentication of the sender, including theaccuracy of the date and the time of sending and receipt of the order, to the
Coordinating Authority of establishment and to the EU Centre, through the systemestablished in accordance with Article 39(2).

4.

The blocking order shall be drafted transmitted in any of the official languages declaredby the provider pursuant to Article 23(3).
The order may also be transmitted in any of the official languages of the Member
State issuing the order, provided that it is accompanied by a translation of at least themost important elements necessary for the execution of the order into any of theofficial languages declared by the provider in accordance with article 23(3).

4a.

If the provider cannot execute the blocking order on grounds of force majeure or defacto impossibility not attributable to it, including for objectively justifiable technicalor operational reasons, it shall, without undue delay, inform the authority issuing theorder of those grounds, using the template set out in Annex yy.

5.

If the provider cannot execute the blocking order because it contains manifest errors ordoes not contain sufficient information for its execution, the provider shall, without undue
delay, request the necessary clarification to from the authority issuing the order
Coordinating Authority of establishment using the template set out in Annex VIII.

5a.

The provider shall, without undue delay and using the template set out in Annex xx,
inform the issuing authority of the measures taken to execute the blocking order,
indicating, in particular, whether the provider has prevented access to child sexual
abuse material.
The authority issuing the order may require the provider to report to it at regularintervals on the measures taken and their functioning to execute a blocking order,
including the effective and proportionate limitations and safeguards provided for.
Upon request of the issuing authority, the provider shall also provide, without undue
delay, such reports or any other information relating to the execution of the blocking
order needed for the purpose of the assessment referred to in Article 16(7).

6.

7842/23ANNEX

The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to amend Annexes VII, yy, and VIII and xx where necessary to improve thetemplates in view of relevant technological developments or practical experiences gained.

JAI.1

FL/ml

30

LIMITEEN

Article 18
Redress and provision of information , information and reporting of blocking orders
1.

Providers of internet access services that have received a blocking order, as well as andusers who provided or were prevented from accessing a specific item of blocked materialindicated by the uniform resource locators in execution of such orders, shall have a right toeffective redress. That right shall include the right to challenge the blocking order before
the courts of the Member State of the competent judicial authority or independentadministrative authority that issued the blocking order.

1a.

If the order is repealed as a result of a redress procedure, the provider shall without
undue delay reinstate access to the material, without prejudice to the possibility to
enforce its terms and conditions in accordance with Union and national law.

2.

When the blocking order becomes final, the competent judicial authority or independentadministrative authority that issued the blocking order shall, without undue delay, transmit
a copy thereof and copies of information it has received pursuant to Article 17 (4a) to(5a) the Coordinating Authority of establishment. The Coordinating Authority of
establishment shall then, without undue delay, transmit a copy copies thereof to all other
Coordinating Authorities and the EU Centre through the system established inaccordance with Article 39(2).
For the purpose of the first subparagraph, a blocking order shall become final upon the
expiry of the time period for appeal where no appeal has been lodged in accordance withnational law or upon confirmation of the removal order following an appeal.

3.

The provider shall establish and operate an accessible, age-appropriate and user-friendly
mechanism that allows users to submit to it, within a reasonable timeframe, complaints
about alleged infringements of its obligations under this Section. It shall process suchcomplaints in an objective, effective and timely manner.

4.

Where a provider prevents users from accessing child sexual abuse material the uniform
resource locators pursuant to a blocking order issued in accordance with Article 17, it shalltake reasonable measures to inform the those users of the following:7842/23
ANNEX(a)the fact that it does so pursuant to a blocking order;(b)

the reasons for doing so, providing, upon request, a copy of the blocking order;(c)

the users’ right of users who provided the blocked material to judicial redress
referred to in paragraph 1, their rights of users to submit complaints to the provider
through the mechanism referred to in paragraph 3 and to the Coordinating Authority
in accordance with Article 34, as well as their right to submit the requests referred toin paragraph 5.

JAI.1

FL/ml

31

LIMITEEN5.

The provider and the users referred to in paragraph 1 shall be entitled to request the
Coordinating Authority that requested the issuance of the blocking order to assess whether
users are wrongly prevented from accessing a specific item of material indicated by
uniform resource locators pursuant to the blocking order. The provider shall also beentitled to request modification or revocation of the blocking order, where it considers it
necessary due to substantial changes to the grounds for issuing the blocking orders that
occurred after the issuance thereof, in particular substantial changes preventing theprovider from taking the required reasonable measures to execute the blocking order.
The Coordinating Authority shall, without undue delay, diligently assess such requests andinform the provider or the user submitting the request of the outcome thereof. Where it
considers the request to be justified, it shall request modification or revocation of theblocking order in accordance with Article 16(7) and inform the EU Centre.

6.

Where the period of application of the blocking order exceeds 24 months, the Coordinating
Authority of establishment shall require the provider to report to it on the measures taken
to execute the blocking order, including the safeguards provided for, at least once, halfway
through the period of application.
Section 5a
Delisting obligations
Article 18a
Delisting orders

1.

The competent authority shall have the power to issue an order, in accordance with
relevant national requirements, requiring a provider of online search engines under
the jurisdiction of that Member State to take reasonable measures to delist an online
location where child sexual abuse material can be found from appearing in search
results. 19

2.

The provider shall execute the delisting order without undue delay and in any event
within a reasonable time period set by the issuing authority one week of receipt of theorder. The provider shall take the necessary measures to ensure that it is capable ofreinstating the delisted online location to appear in search results in accordance with
Article 18c(2).

19

COM proposal: “By deviation from the first subparagraph, and without causing undue delaysin the process of issuance of those orders, Member States may decide that such orders canonly be issued by a judicial authority at the request of the competent authority. Where a
Member State makes use of this possibility, it shall inform the Commission thereof and keep
it up-to-date. The Commission shall make the information received publicly available andkeep it up-to-date.”

7842/23
ANNEX

JAI.1

FL/ml

32

LIMITE

EN

3.

4.

A delisting order shall be issued where the following conditions are met:(a)the delisting is necessary to prevent the dissemination of the child sexual abusematerial in the Union, having regard in particular to the need to protect therights of the victims;(b)search results correspond, in a sufficiently reliable manner, to online locations
where child sexual abuse material can be found.

The issuing authority shall specify in the delisting order the period during which it
applies, indicating the start date and the end date.
The period of application of delisting orders shall not exceed five years.

5.

The Coordinating Authority or the issuing authority shall, where necessary and at
least once every year, assess whether any substantial changes to the grounds for
issuing the delisting orders have occurred and whether the conditions of paragraph 4
continue to be met.
Where necessary in the light of the outcome of that assessment or information of thereports referred to in Article 18b(6) an order may be modified or repealed by theissuing authority, where relevant at the request of the Coordinating Authority.
Article 18b
Additional rules regarding delisting orders

1.

7842/23
ANNEX

A delisting order shall be issued using the template set out in annex zz. Delistingorders shall include:(a)identification details of the authority issuing the delisting order andauthentication of the order by that authority;(b)

the name of the provider and, where applicable, its legal representative;(c)clear information enabling the provider to identify and locate the child sexual
abuse material;(d)the start and end date of the delisting;(e)a sufficiently detailed statement of reasons explaining why the delisting order isissued;(f)reporting requirements pursuant to point 6;(g)a reference to this Regulation as the legal basis for delisting;

JAI.1

FL/ml

33

LIMITE

EN

2.

(h)

the date, time stamp and electronic signature of the authority issuing thedelisting order;(i)easily understandable information about the redress available, including
information about redress to a court and about the time periods applicable tosuch redress.

The authority issuing the delisting order shall address it to the main establishment of
the provider or, where applicable, to its legal representative designated in accordancewith Article 24.
The delisting order shall be transmitted to the provider’s point of contact referred toin Article 23(1) by electronic means capable of producing a written record underconditions that allow to establish the authentication of the sender, including theaccuracy of the date and the time of sending and receipt of the order to the
Coordinating Authority of establishment and to the EU Centre, through the systemestablished in accordance with Article 39(2).

3.

The delisting order shall be transmitted in any of the offical languages declared by
the provider pursuant to Article 23(3).
The order may also be transmitted in any of the official languages of the Member
State issuing the order, provided that it is accompanied by a translation of at least themost important elements necessary for the execution of the order into any of theoffical languages declared by the provider in accordance with Article 23(3).

4.

If the provider cannot execute the delisting order on grounds of force majeure or defacto impossibility not attributable to it, including for objectively justifiable technicalor operational reasons, it shall, without undue delay, inform the authority issuing theorder of those grounds, using the template set out in Annex qq.

5.

If the provider cannot execute the delisting order because it contains manifest errors
or does not contain sufficient information for its execution, the provider shall, without
undue delay, request the necessary clarification from the authority issuing the order,using the template set out in Annex pp.

6.

The provider shall, without undue delay and using the template set out in Annex ww,
inform the issuing authority of the measures taken to execute the delisting order,
indicating, in particular, whether the provider has prevented search results for the
online location with child sexual abuse material to appear.
The authority issuing the order may require the provider to report to it regularly on
the measures taken to execute a delisting order.

7.

7842/23ANNEX

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 in order to amend Annexes zz, qq and pp where necessary to improve thetemplates in view of relevant technological developments or practical experiences
gained.

JAI.1

FL/ml

34

LIMITEEN

Article 18c
Redress and provision of information
1.

Providers of online search engines that have received a delisting order and users thatprovided the material to a delisted online location shall have a right to effective
redress. That right shall include the right to challenge the delisting order before thecourts of the Member State of the authority that issued the delisting order.

2.

If the order is repealed as a result of a redress procedure, the provider shall without
undue delay reinstate the delisted online location to appear in search results, without
prejudice to the possibility to enforce its terms and conditions in accordance with
Union and national law.

3.

When the delisting order becomes final, the issuing authority shall, without undue
delay, transmit a copy thereof and information it has received pursuant to Article 18b(4) to (6) to the Coordinating Authority of establishment. The Coordinating Authorityof establishment shall then, without undue delay, transmit a copies thereof to all other
Coordinating Authorities and the EU Centre through the system established inaccordance with Article 39(2).
For the purpose of the first subparagraph, a delisting order shall become final upon
the expiry of the time period for appeal where no appeal has been lodged inaccordance with national law or upon confirmation of the delisting order following anappeal.

3a.

The provider shall establish and operate an accessible, age-appropriate and userfriendly mechanism that allows users to submit to it complaints about alleged
infringements of its obligations under this Section. It shall process such complaints inan objective, effective and timely manner.

4.

Where a provider prevents users from obtaining search results for child sexual abusematerial corresponding to an online location pursuant to a delisting order, it shalltake reasonable measures to inform users that provided the material to a delisted
online location and those users of the following:7842/23
ANNEX(a)the fact that it does so pursuant to a delisting order;(b)

the right of users that provided the material to a delisted online location to
judicial redress referred to in paragraph 1 and users’ right to submit
complaints to the Coordinating Authority in accordance with Article 34.

JAI.1

FL/ml

35

LIMITEENSection 6
Additional provisions
Article 19
Liability of providers
Providers of relevant information society services shall not be liable for child sexual abuse offences
if solely because they carry out, in good faith, the necessary activities to comply with therequirements of this Regulation, in particular activities aimed at assessing and mitigating risk,
detecting, identifying, reporting, removing, disabling of access to, blocking or delisting fromsearch results reporting online child sexual abuse in accordance with those requirements.
Article 20
Victims’ right to information
1.

Persons residing in the Union shall have the right to receive, upon their request, from the
Coordinating Authority designated by in the Member State where they reside, information
regarding any instances where the dissemination of known child sexual abuse material
depicting them is reported to the EU Centre pursuant to Article 12. Persons withdisabilities shall have the right to ask and receive such an information in a manner
accessible to them.
That Coordinating Authority shall transmit the request to the EU Centre through thesystem established in accordance with Article 39(2) and shall communicate the resultsreceived from the EU Centre to the person making the request.

2.

3.

7842/23
ANNEX

The request referred to in paragraph 1 shall indicate:(a)the relevant item or items of known child sexual abuse material;(b)where applicable, the individual or entity that is to receive the information on behalfof the person making the request;(c)sufficient elements to demonstrate the identity of the person making the request.

The information referred to in paragraph 1 shall include:(a)the identification of the provider that submitted the report;(b)

the date of the report;(c)whether the EU Centre forwarded the report in accordance with Article 48(3) and, if
so, to which authorities;(d)whether the provider reported having removed or disabled access to the material, in
accordance with Article 13(1), point (i).

JAI.1

FL/ml

36

LIMITEEN

Article 21
Victims’ right of assistance and support for removal
1.

Providers of hosting services shall provide reasonable assistance, on request, to persons
residing in the Union that seek to have one or more specific items of known child sexual
abuse material depicting them removed or to have access thereto disabled by the provider.

2.

Persons residing in the Union shall have the right to receive support, upon their request,from the Coordinating Authority designated by in the Member State where they person
resides, to request assistance, support from the EU Centre when they seek to have aprovider of hosting services remove or disable access to one or more specific items ofknown child sexual abuse material depicting them. Persons with disabilities shall have theright to ask and receive any information relating to such support in a manner accessible tothem.20
That Coordinating Authority shall transmit the request to the EU Centre through thesystem established in accordance with Article 39(2) and shall communicate the resultsreceived from the EU Centre to the person making the request.

3.

The requests referred to in paragraphs 1 and 2 shall indicate the relevant item or items ofchild sexual abuse material.

4.

The EU Centre’s support referred to in paragraph 2 shall include, as applicable:

20

(a)

support in connection to requesting the provider’s assistance referred to in paragraph1;(b)verifying whether the provider removed or disabled access to that item or those
items, including by conducting the searches referred to in Article 49(1);(c)

notifying the item or items of known child sexual abuse material depicting the person
to the provider and requesting removal or disabling of access, in accordance with
Article 49(2);(d)

where necessary, informing the Coordinating Authority of establishment of thepresence of that item or those items on the service, with a view to the issuance of aremoval order pursuant to Article 14.

PCY comment: it has been suggested to include a deadline by which to inform the victim.

7842/23
ANNEX

JAI.1

FL/ml

37

LIMITEEN

Article 2221
Preservation of information
1.

21

Providers of hosting services and providers of interpersonal communications services shallpreserve the necessary content data and other data processed in connection to the measurestaken to comply with this Regulation and the personal data generated through suchprocessing, when the following measures have been taken or for the purposes ofcomplaints or redress procedures complaints only for one or more of the following
purposes, as applicable:(a)executing a detection order issued pursuant to Article 7, or a removal order issued
pursuant to Article 14 [or a blocking order pursuant to Article 16 or a delistingorder pursuant to Article 18a ];(b)reporting information that indicate potential online child sexual abuse to the EU
Centre pursuant to Article 12;

COM proposal:
1) The proposed deletion of detection order here was conditional to the inclusion of a newparagraph explaining the need to preserve information related to detection orders, as follows:“insofar as strictly necessary for using the technologies referred to in Article 10, involving inparticular the automatic, intermediate and temporary preservation of such data for the use of
the indicators provided by the EU Centre, as well as for applying the safeguards referred to in
Article 10, when executing a detection order issued pursuant to Article 7;”2) Recital 39 could be amended as follows: “(39) To avoid disproportionate interferences withusers’ rights to private and family life and to protection of personal data, the data related to
instances of potential online child sexual abuse should not be preserved by providers of
relevant information society services, unless and for no longer than necessary for one or moreof the purposes specified in this Regulation and subject to an appropriate maximum duration.
In that regard, the requirements to preserve such data in connection to the execution of
detection orders should not be understood as allowing or requiring the preservation of
all users’ data processed for such detection purposes in general. They should rather be
understood as requiring only the preservation of content data and other data processed
insofar as this is strictly necessary to use the relevant technologies meeting therequirements of this Regulation, covering in particular caching-like activities involving
the automatic and intermediate preservation for purely technical reasons and for very
short periods of time needed to use the relevant indicators to detect possible child sexual
abuse online, as well as to apply the safeguards required under this Regulation inconnection to the use of those technologies, covering in particular the application of
measures to prevent, detect and remedy misuse, to ensure regular human oversight andto carry out regular reviews. As those preservation requirements relate only to thisRegulation, they should not be understood as affecting the possibility to store relevant content
data and traffic data in accordance with Directive 2002/58/EC or the application of any legal
obligation to preserve data that applies to providers under other acts of Union law or undernational law that is in accordance with Union law.”7842/23
ANNEX

JAI.1

FL/ml

38

LIMITEEN(c)blocking the account of, or suspending or terminating the provision of the service to,the user concerned;(d)handling users’ complaints to the provider or to the Coordinating Authority, or the
exercise of users’ right to administrative or judicial redress, in respect of alleged
infringements of this Regulation;.

(e)
1a.

Upon a request responding to requests issued by a competent law enforcement
authorityies and judicial authorities [in accordance with the applicable law], providers
shall with a view to provideing them requesting authority with the necessary information
for the prevention, detection, investigation or prosecution of child sexual abuse offences,or the handling of complaints or admininstrative or judicial redress proceedings,
insofar as the content data and other data have been preserved for one of the purposes inparagraphs 1(a) to (d). relate to a report that the provider has submitted to the EU Centre
pursuant to Article 12.
As regards the first subparagraph, point (a), the provider may also preserve the information
for the purpose of improving the effectiveness and accuracy of the technologies to detect
online child sexual abuse for the execution of a detection order issued to it in accordancewith Article 7. However, it shall not store any personal data for that purpose.

2.

Providers shall preserve the information referred to in paragraph 1 for no longer thannecessary for the applicable purpose and, in any event, no longer than 12 months from thedate of the measures taken that led to the obligation to preserve the content data andother data processed reporting or of the removal or disabling of access, whichever occurs
first.
Providers They shall, upon request from the competent national authority or court,
preserve the information for a further specified period, set by that the requesting authority
or court where and to the extent necessary for ongoing administrative or judicial redress
proceedings, as referred to in paragraph 1, point (d).

3.

Providers shall ensure that the information referred to in paragraph 1 is preserved in asecure manner and that the preservation is subject to appropriate technical andorganisational safeguards. Those safeguards shall ensure, in particular, that the information
can be accessed and processed only for the purpose for which it is preserved, that a highlevel of security is achieved and that the information is deleted upon the expiry of theapplicable time periods for preservation. Providers shall regularly review those safeguards
and adjust them where necessary.

4.

When a detection order pursuant to Article 7, a removal order issued pursuant to
Article 14 [, a blocking order pursuant to Article 16 or a delisting order pursuant to
Article 18a] is repealed, the obligation to preserve the content data and other dataaccording to paragraph 1 is discontinued.

7842/23
ANNEX

JAI.1

FL/ml

39

LIMITEEN

Article 23
Points of contact
1.

Providers of relevant information society services shall establish a single point of contact
allowing for direct communication, by electronic means, with the Coordinating
Authorities, other competent authorities of the Member States, the Commission and the EU
Centre, for the application of this Regulation.

2.

The providers shall communicate to the EU Centre and make public the informationnecessary to easily identify and communicate with their single points of contact, including
their names, addresses, the electronic mail addresses and telephone numbers.

3.

The providers shall specify in the information referred to in paragraph 2 the official
language or languages of the Union, which can be used to communicate with their pointsof contact.
The specified languages shall include at least one of the official languages of the Member
State in which the provider has its main establishment or, where applicable, where its legal
representative resides or is established.
Article 24
Legal representative

1.

Providers of relevant information society services which do not have their mainestablishment in the Union shall designate, in writing, a natural or legal person as its legal
representative in the Union for the purposes of this Regulation.

2.

The legal representative shall reside or be established in one of the Member States where
the provider offers its services.

3.

The provider shall mandate its legal representatives to be addressed in addition to or
instead of the provider by the Coordinating Authorities, other competent authorities of theMember States and the Commission on all issues necessary for the receipt of, compliancewith and enforcement of orders and decisions issued in relation to this Regulation,
including detection orders, removal orders and, blocking orders and delisting orders.

4.

The provider shall provide its legal representative with the necessary powers and resources
to cooperate with the Coordinating Authorities, other competent authorities of the Member
States and the Commission and to comply with the orders and decisions referred to inparagraph 3.

5.

The designated legal representative may be held liable for non-compliance with obligationsof the provider under this Regulation, without prejudice to the liability and legal actions
that could be initiated against the provider.

7842/23
ANNEX

JAI.1

FL/ml

40

LIMITEEN6.

The provider shall notify the name, address, the electronic mail address and telephone
number of its legal representative designated pursuant to paragraph 1 to the Coordinating
Authority in the Member State where that legal representative resides or is established, andto the EU Centre. The provider or the legal representative They shall ensure that that
information is up to date and publicly available.

7.

The designation of a legal representative within the Union pursuant to paragraph 1 shallnot amount to an establishment in the Union.

7842/23
ANNEX

JAI.1

FL/ml

41

LIMITEENCHAPTER III
SUPERVISION, ENFORCEMENT AND COOPERATION
Section 1
Coordinating Authorities of the Member States for child sexual abuse issues
Article 2522
Coordinating Authorities for child sexual abuse issues and other competent authorities
1.

Member States shall, by [Date - two eighteen months from the date of entry into force of
this Regulation], designate one or more competent authorities as responsible for theapplication, and supervision and enforcement of this Regulation (‘competent authorities’).

2.

Where a Member State designates more than one competent authority, it shallappoint one of those competent authorities as Coordinating Authority. Where it
designates only one competent authority, that competent authority shall be theCoordinating Authority.

2.

Member States shall, by the date referred to in paragraph 1, designate one of the competentauthorities as their Coordinating Authority for child sexual abuse issues (‘Coordinating
Authority’).
The Coordinating Authority shall be responsible for all matters related to the applicationand enforcement of this Regulation in the Member State concerned, unless that Member
State has assigned certain specific tasks or sectors to other competent authorities.
The Coordinating Authority shall in any event be responsible for ensuring coordination at
national level in respect of those all matters relating to the application, supervision andenforcement of this Regulation and for contributing to the effective efficient andconsistent application, supervision and enforcement of this Regulation throughout theUnion.

22

PCY comment: the new logic could be explained in a recital, as follows:“With a view to leaving Member States a degree of flexibility so as to implement solutions
best adapted to their particular circumstances, whilst also ensuring the coordination atdomestic level and cooperation at EU level needed to ensure the consistent, efficient andeffective application of this Regulation, Member States should be able to designate several
competent authorities yet be required in that case to appoint one of them as the Coordinating
for which certain tasks are exclusively reserved under this Regulation. Therefore, eachmention of competent authorities in this Regulation should be interpreted as referring to therelevant competent authorities designated by the Member States, including where relevant
Coordinating Authorities, while each mention of Coordinating Authorities should beinterpreted as referring to Coordinating Authorities only, to the exclusion of any othercompetent authorities that the Member States may have designated.”

7842/23
ANNEX

JAI.1

FL/ml

42

LIMITEEN

3.

Where a Member State designates more than one competent authority in addition to the
Coordinating Authority, it shall ensure that the respective tasks of those authorities and of
the Coordinating Authority including those of the Coordinating Authority, are clearly
defined and that they cooperate closely and effectively when performing their tasks. The
Member State concerned shall communicate the name of the other competent authorities aswell as their respective tasks to the EU Centre and the Commission.

4.

Within one week after the designation of the competent authorities, including theCoordinating Authorities and other competent authorities pursuant to paragraph 1, Member
States shall make publicly available, and communicate to the Commission and the EU
Centre, the names of their Coordinating Authority and other compentent thoseauthorities as well as their respective tasks or sectors. They shall keep that information
updated.

5.

Each Member States shall ensure that a contact point is designated or establish a contact
point within its the Coordinating Authority’s office to handle requests for clarification,
feedback and other communications in relation to all matters related to the application andenforcement of this Regulation in that Member State. Member States shall make theinformation on the contact point publicly available and communicate it to the EU Centre.
They shall keep that information updated.

6.

Within two weeks after the designation of the Coordinating Authorities pursuant toparagraph 2, the EU Centre shall set up an online register listing the Coordinating
Authorities and their contact points. The EU Centre shall regularly publish any
modification thereto.

7.

Competent authorities Coordinating Authorities may, where necessary for the
performance of their tasks under this Regulation, request through the Coordinating
Authority, the assistance of the EU Centre in carrying out those tasks, in particular, by
requesting the EU Centre to:(a)provide certain information or technical expertise on matters covered by thisRegulation;(b)

assist in assessing, in accordance with Article 5(2), the risk assessment conducted or
updated or the mitigation measures taken by a provider of hosting or interpersonalcommunication services under the jurisdiction of the Member State that designatedthe requesting competent authority Coordinating Authority;(c)provide opinion on verify the possible need for a competent authority to request
competent national authorities to issue the issuance of a detection order, a removal
order, or a blocking order in respect of a service under the jurisdiction of the Member
State that designated that Coordinating Authority;[(d) provide opinion on verify the effectiveness of a detection order or a removal orderissued upon the request of the requesting Coordinating Authority;. ]23

23

PCY comment: to be revised pending further discussions on detection orders.

7842/23
ANNEX

JAI.1

FL/ml

43

LIMITEEN8.

The EU Centre shall provide such assistance free of charge and in accordance with its tasks
and obligations under this Regulation and insofar as its resources and priorities allow. 24

9.

The requirements applicable to Coordinating Authorities set out in Articles 26, 27, 28, 29
and 30 shall also apply to any other competent authorities that the Member States designate
pursuant to paragraph 1.
Article 26
Requirements for Coordinating competent Authorities

1

Member States shall ensure that the competent authorities Coordinating Authorities thatthey have designated carry out perform their tasks under this Regulation in an objective,
impartial, transparent and timely and non-discriminatory manner, while fully respecting
the fundamental rights of all parties affected25. Member States shall ensure that their
Coordinating Authorities those authorities have adequate technical, financial and humanresources to carry out their tasks.
Those authorities The Coordinating Authorities shall not seek or take instructions
from any other body in relation to carrying out their tasks under this Regulation26.

2.

24
25
26

When carrying out their tasks and exercising their powers in accordance with thisRegulation, the Coordinating Authorities shall act with complete independence. To that
aim, Member States shall ensure, in particular, that they:(a)are legally and functionally independent from any other public authority;(b)have a status enabling them to act objectively and impartially when carrying out theirtasks under this Regulation;

PCY comment: moved to Art 43(5)(b) on the EU Centre.
PCY comment: wording copied from Art. 13(2) of the TCO Regulation.
PCY comment:
1) A recital could specify that competent authorities can be any body or entity fulfilling atleast the independence requirements enshrined in Article 26(1) of the proposal, except forjudicial authorities, as follows: “Member States should be free to designate any body or entity
fulfilling at least the independence requirements established in Article 26(1) as competentauthority for the purpose of this Regulation, with the exception of national judicial
authorities.”2) To address some delegations’ concerns that competent authorities would be getting“instructions” from judicial authorities, a recital could be added, as follows: “In order toensure that the competent authorities designated under this Regulation carry out their tasks
under this Regulation in an objective, adequate and responsible manner, in compliance withthe fundamental rights guaranteed under the Charter and without any undue interference,certain requirements in this respect should be provided for. Those requirements should not beinterpreted as precluding judicial review of the activities of competent authorities inaccordance with EU law or with national law in accordance with EU law.”7842/23
ANNEX

JAI.1

FL/ml

44

LIMITEEN(c)are free from any external influence, whether direct or indirect;(d)neither seek nor take instructions from any other public authority or any private
party;(e)are not charged with tasks relating to the prevention or combating of child sexual
abuse, other than their tasks under this Regulation.

2 3.

Paragraph 2 1 shall not prevent supervision of the Coordinating competent aAuthorities inaccordance with national constitutional law, to the extent that such supervision does notaffect their independence as required under this Regulation.

3 4.

The Coordinating Authorities and other competent authorities shall ensure that theirrelevant members of staff have the required qualifications, experience, integrity andtechnical skills to perform carry out the application, supervision and enforcement
under this Regulation duties.

5.

The management and other staff of the Coordinating Authorities shall, in accordance with
Union or national law, be subject to a duty of professional secrecy both during and after
their term of office, with regard to any confidential information which has come to theirknowledge in the course of the performance of their tasks. Member States shall ensure thatthe management and other staff are subject to rules guaranteeing that they can carry out
their tasks in an objective, impartial and independent manner, in particular as regards their
appointment, dismissal, remuneration and career prospects.
Section 2
Powers of competent authorities the Coordinating Authorities of Member States
Article 2727
Investigatory and enforcement powers

1.

Where needed in order to for carrying out their tasks under this Regulation, competentauthorities Coordinating Authorities or other competent authorities shall have thefollowing powers of investigation, in respect of conduct by providers of relevant
information society services falling within the competence under the jurisdiction of thetheir Member State that designated them:27

PCY comment: copied word for word from Art. 51 of the DSA as a baseline for further
discussions. Differences include that (i) both the Coordinating and competent authorities areincluded; (ii) this text speaks about “user”, not “the recipient of a service” and (iii) in point 3b
below the wording “or the infringement results in the regular and structural facilitation ofchild sexual abuse offences” has been maintained. The restruturing of Articles 27 to 30 toensure alignement with DSA has lead to the fact that some cross-references need to becorrected. This will be done once the text is stable. For the delegations’ ease, a clean
version of Articles 27-30 is in annex.

7842/23
ANNEX

JAI.1

FL/ml

45

LIMITE

EN

2.

(a)

the power to require those providers, as well as any other persons acting for purposes
related to their trade, business, craft or profession that may reasonably be aware of
information relating to a suspected infringement of this Regulation, to provide suchinformation without undue delay within a reasonable time period;(b)

the power to carry out, or to request a judicial authority to order, on-site
inspections of any premises that those providers or the other those persons referred
to in point (a) use for purposes related to their trade, business, craft or profession, orto request other public authorities to do so, in order to examine, seize, take or obtaincopies of information relating to a suspected infringement of this Regulation in any
form, irrespective of the storage medium;(c)the power to ask any member of staff or representative of those providers or the other
those persons to give explanations in respect of any information relating to asuspected infringement of this Regulation and to record the answers by any
technical means;(d)the power to request information, including to assess whether the measures taken to
execute a detection order, removal order, or blocking order or delisting ordercomply with the requirements of this Regulation.

Member States may grant additional investigative powers to the Coordinating Authorities.
Article 28
Enforcement powers

2. 1.

7842/23
ANNEX

Where needed for carrying out their tasks under this Regulation, competent authorities
Coordinating Authorities or other competent authorities shall have the following
enforcement powers, in respect of providers of relevant information society services
falling within the competence under the jurisdiction of the their Member State thatdesignated them:(a)the power to accept the commitments offered by those providers in relation to theircompliance with this Regulation and to make those commitments binding;(b)

the power to order the cessation of infringements of this Regulation and, whereappropriate, to impose remedies proportionate to the infringement and necessary tobring the infringement effectively to an end or to request a judicial authority intheir Member States to do so;(c)the power to impose fines, or request a judicial authority in their Member State to doso, in accordance with Article 35 for failure to comply with infringements of thisRegulation, including non-compliance with any of the investigative orders issued
pursuant to paragraph 1 of this Article 27 and to point (b) of this paragraph;

JAI.1

FL/ml

46

LIMITEEN(d)the power to impose a periodic penalty payment, or to request a judicial authority
to do so, in accordance with Article 35 to ensure that an infringement of thisRegulation is terminated in compliance with an order issued pursuant to point (b) of
this subparagraph or for failure to comply with any of the orders issued pursuant toparagraph 1 of this Article. 27 and to point (b) of this paragraph;(e)the power to adopt interim measures or to request the competent national judicial
authority to do so, to avoid the risk of serious harm.

2.

Member States may grant additional enforcement powers to the Coordinating Authorities.

3.

As regards the first subparagraph 1, points (c) and (d), competent authorities
Coordinating Authorities or other competent authorities shall also have the enforcement
powers set out in those points also in respect of the other persons referred to in paragraph
1 Article 27, for failure to comply with any of the orders issued to them pursuant to thatparagraph Article. 4. They shall only exercise those enforcement powers after having
provided those other persons in good time with all relevant information relating to suchorders, including the applicable time period, the fines or periodic payments that may be
imposed for failure to comply and redress the possibilities for redress.
Article 29
Additional enforcement powers

3. 1.

2.

Where needed for carrying out their tasks under this Regulation, competent authorities
Coordinating Authorities or other competent authorities shall have the additional
enforcement powers referred to in paragraph 2, in respect of providers of relevant
information society services falling within the competence under the jurisdiction of their
Member State, where that designated them, provided that:(a)all other powers pursuant to this Articles 27 and 28 to bring about the cessation of an
infringement of this Regulation have been exhausted;(b)and the infringement has not been remedied or is continuing and is persists;(c)

the infringement causes causing serious harm which cannot be avoided through theexercise of other powers available under Union or national law, also have the power
to take the following measures:

Coordinating Authorities shall have the additional enforcement powers to take thefollowing measures:(a)7842/23
ANNEX

to require the management body of the providers, without undue delay, to examine
the situation, within a reasonable time period and to:

JAI.1

FL/ml

47

LIMITEEN(i)adopt and submit an action plan setting out the necessary measures to terminate
the infringement;(ii)

ensure that the provider takes those measures; and(iii) report on the measures taken;(b)where the Coordinating Authority competent authorities or other competentauthorities consider that a provider of relevant information society services has
not sufficiently complied with the requirements of point (a), that the
infringement has not been remedied or is continuing and is causing serious
harm, and that that infringement entails a criminal offence involving a threat tothe life or safety of persons or the infringement results in the regular andstructural facilitation of child sexual abuse offences, to request that the competentjudicial authority or other independent administrative authority of its the Member
State that designated the Coordinating Authority to order the temporary restriction ofaccess of users of the service concerned by the infringement or, only where that is
not technically feasible, to the online interface of the provider on which the
infringement takes place. , where the Coordinating Authority considers that:(i)the provider has not sufficiently complied with the requirements of point (a);(ii)

the infringement persists and causes serious harm;(iii) the infringement results in the regular and structural facilitation of child sexual
abuse offences.
3.

The Coordinating Authority or other competent authorities shall, prior to submitting therequest referred to in this paragraph 2, point (b), invite interested parties to submit written
observations within a period that shall not be less than two weeks, describing themeasures that it intends to request and identifying the intended addressee oraddressees thereof. The provider, the intended addressee or addressees and any otherthird party demonstrating a legitimate interest shall be entitled to participate in theproceedings before the competent judicial authority or other independentadministrative authority.
on its intention to submit that request within a reasonable time period set by that
Coordinating Authority. That time period shall not be less than two weeks.
The invitation to submit written observations shall:(a)describe the measures that it intends to request;(b)

identify the intended addressee or addressees thereof.

The provider, the intended addressee or addressees and any other third party demonstratinga legitimate interest shall be entitled to participate in the proceedings regarding the request.

7842/23
ANNEX

JAI.1

FL/ml

48

LIMITEEN

4.

Any measure ordered upon the request referred to in paragraph 2, point (b), shall be
proportionate to the nature, gravity, recurrence and duration of the infringement, without
unduly restricting access to lawful information by users of the service concerned.
The temporary restriction of access shall be apply for a period of four weeks, subject to thepossibility for the competent judicial authority or other independent administrative
authority of the Member State, in its order, to allow the Coordinating Authority or othercompetent authorities, including the Coordinating Authorities, to extend that period
for further periods of the same lengths, subject to a maximum number of extensions set bya that judicial authority or other independent administrative authority.
The Coordinating Authority or other competent authorities, including the Coordinating
Authorities, referred to in the previous subparagraph shall only extend the period
where it considers, having regard to the rights and legitimate interests of all parties affectedby the that restriction and all relevant facts and circumstances, including any informationthat the provider, the addressee or addressees and any other third party that demonstrated alegitimate interest may provide to it, it considers that both of the following conditions
have been met:(a)the provider has failed to take the necessary measures to terminate the infringement;(b)

the temporary restriction does not unduly restrict access to lawful information byusers of the service, having regard to the number of users affected and whether any
adequate and readily accessible alternatives exist.

Where the Coordinating Authority or other competent authority, including theCoordinating Authority, considers that the conditions set out in the fourthsubparagraph, points (a) and (b) those two conditions have been met but it cannot
further extend the period pursuant to the fourth second subparagraph, it shall submit a new
request to the competent judicial authority or other independent administrative
authority, as referred to in the first subparagraph 2, point (b).
Article 30
Common provisions on investigatory and enforcement powers
4. 1.

7842/23
ANNEX

The measures taken by the Coordinating Authorities or other competent authorities inthe exercise of their investigatory and enforcement powers listed in paragraphs 1, 2 and3 referred to in Articles 27, 28 and 29 shall be effective, dissuasive and proportionate,having regard, in particular, to the nature, gravity, recurrence and duration of theinfringement of this Regulation or suspected infringement to which those measures relate,
as well as the economic, technical and operational capacity of the provider of relevant
information society services concerned, where relevant applicable.

JAI.1

FL/ml

49

LIMITEEN5. 2.

Member States shall lay down specific rules and procedures for the exercise of thepowers pursuant to paragraphs 1, 2 and 3 and shall ensure that any exercise of thosethe investigatory and enforcement powers referred to in Articles 27, 28 and 29 is subject toadequate safeguards laid down in the applicable national law in compliance with theCharter and with the general principles of Union law to respect the fundamental rights
of all parties affected. In particular, those measures shall only be taken in accordance withthe right to respect for private life and the rights of defence, including the rights to be heard
and of access to the file, and subject to the right to an effective judicial remedy of allparties affected parties.
Article 31
Searches to verify compliance

The competent authorities Coordinating Authorities or other competent authorities shall havethe power to carry out searches on publicly accessible material on hosting services to detect thedissemination of known or new child sexual abuse material, using the indicators contained in the
databases referred to in Article 44(1), points (a) and (b), where necessary to verify whether theproviders of hosting services under the jurisdiction of the Member State that designated the
Coordinating Authorities comply with their obligations under this Regulation.
Article 32
Notification of known child sexual abuse material
Coordinating Authorities shall have the power to notify providers of hosting services under thejurisdiction of the Member State that designated them of the presence on their service of one ormore specific items of known child sexual abuse material and to request them to remove or disable
access to that item or those items, for the providers’ voluntary consideration.
The request shall clearly set out the identification details of the Coordinating Authority making therequest and information on its contact point referred to in Article 25(5), the necessary information
for the identification of the item or items of known child sexual abuse material concerned, as wellas the reasons for the request. The request shall also clearly state that it is for the provider’svoluntary consideration. 28

28

PCY comment: It is the view of the PCY that this power can be explained and described in arecital that builds on recital 40 of the TCO Regulation and Article 16 DSA. The recital below
clarifies that competent authorities can make use of notice and action mechanisms and be
appointed as trusted flaggers: “Nothing in this Regulation precludes competent authorities
designated therein to submit notices to providers of hosting services on the basis ofnotice and action mechanisms pursuant to Article 16 of Regulation (EU) 2022/2065(Digital Services Act) to notify them of the presence of one or more specific items ofknown child sexual abuse material, nor to request the status of trusted flagger under theconditions established under Article 22 of that Regulation.”

7842/23
ANNEX

JAI.1

FL/ml

50

LIMITEENSection 3
Other provisions on enforcement
Article 33
Jurisdiction
1.

The Member State in which the main establishment of the provider of relevant informationsociety services is located shall have jurisdiction for the purposes of this Regulation.

2.

A provider of relevant information society services which does not have an establishment
in the Union shall be deemed to be under the jurisdiction of the Member State where its
legal representative resides or is established.
Where a provider failed to appoint a legal representative in accordance with Article 24, all
Member States shall have jurisdiction. Where a Member State decides to exercise
jurisdiction under this subparagraph, it shall inform all other Member States and ensurethat the principle of ne bis in idem is respected.
Article 3429
Right of users of the service to lodge a complaint

1.

Users and any body, organisation or association mandated to exercise the rights
conferred by this Regulation on their behalf shall have the right to lodge a complaint
against providers of relevant information society services alleging an infringement of
this Regulation affecting them against providers of relevant information society services
with the Coordinating Authority designated by in the Member State where the user islocated resides or is established.

2.

Coordinating Authorities shall provide child-friendly mechanisms to submit a complaint
under this Article and adopt a child-sensitive approach when handling complaints
submitted by children, taking due account of the child's age, maturity, views, needs andconcerns.

3.

The Coordinating Authority receiving the complaint shall assess the complaint and, whereappropriate, transmit it to the Coordinating Authority of establishment, accompanied,
where appropriate, by its reasoning an opinion.
Where the complaint falls under the responsibility of another competent authority in its
Member State, that designated the Coordinating Authority receiving the complaint, that
Coordinating Authority shall transmit it to that other competent authority.

29

PCY comment: copied word for word from Art. 53 of the DSA.

7842/23
ANNEX

JAI.1

FL/ml

51

LIMITEEN

4.

During these proceedings, both parties shall have the right to be heard and receive
appropriate information about the status of the complaint, in accordance withnational law.
Article 34b30
Representation

1.

Without prejudice to Directive (EU) 2020/1828 or to any other type of representation
under national law, users of relevant information society services shall at least havethe right to mandate a body, organisation or association to exercise the rights
conferred by this Regulation on their behalf, provided the body, organisation or
association meets all of the following conditions:

2.

(a)

it operates on a non-profit basis;(b)

it has been properly constituted in accordance with the law of a Member State;(c)

its statutory objectives include a legitimate interest in ensuring that thisRegulation is complied with.

Providers of relevant information society services shall take the necessary technicaland organisational measures to ensure that complaints submitted by bodies,organisations or associations referred to in paragraph 1 of this Article on behalf ofrecipients of the service through the mechanisms referred to in Article xx areprocessed and decided upon with priority and without undue delay.
Article 3531
Penalties32

1.

Member States shall lay down the rules on penalties applicable to infringements of theobligations pursuant to Chapters II and V of this Regulation by providers of relevant
information society services within their competence under their jurisdiction and shalltake all the necessary measures to ensure that they are implemented in accordance with
Article 27.
The pPenalties shall be effective, proportionate and dissuasive. Member States shall, by[Date of application of this Regulation], notify the Commission of those rules and of thosemeasures and shall notify it, without delay, of any subsequent amendments affecting them.

30
31
32

PCY comment: copied word for word from Art. 86 of the DSA. To be discussed in relation to
Articles 18(3) and 34.
PCY comment: copied word for word from Art. 52 of the DSA (except paragraph 4 that istaken from the TCO Regulation).
PCY comment: this should be understood as administrative sanctions, not criminal sanctions,i.e. penalties (TCO and DSA use the wording “penalties” when these are in factadministrative sanctions). A recital should be included to clarify this issue.

7842/23
ANNEX

JAI.1

FL/ml

52

LIMITE

EN

2.

Member States shall ensure that the maximum amount of fines that may be penalties
imposed for an a failure to comply with an obligation laid down in Chapters II and V
infringement of this Regulation shall be not exceed 6 % of the annual worldwide income
or global turnover of the providers concerned in the preceding financial business year of
the provider. 3. Member States shall ensure that the maximum amount of the fine that
may be imposed Penalties for the supply of incorrect, incomplete or misleading
information, failure to reply or rectify incorrect, incomplete or misleading information or
and failure to submit to an on-site inspection shall be not exceed 1% of the annual income
or worldwide global turnover of the preceding business year of the provider or the otherperson concerned in the preceeding financial year referred to in Article 27.

34.

Member States shall ensure that the maximum amount of a periodic penalty payment shallbe not exceed 5 % of the average daily worldwide global turnover or income of theprovider or the other person referred to in Article 27 in the preceding financial year per
day, calculated from the date specified in the decision concerned.

45.

Member States shall ensure that the competent authorities, when deciding whether toimpose a penalty and when determining the type and level of penalty, account is taken of
all relevant circumstances, including:7842/23
ANNEX(a)the nature, gravity and duration of the infringement;(b)whether the infringement was intentional or negligent;(c)any previous infringements by the provider or the other person;(d)the financial strength of the provider or the other person;(e)the level of cooperation of the provider with the competent authorities or the otherperson;(f)

the nature and size of the provider or the other person, in particular whether it is a
micro, small or medium-sized enterprise;(g)

the degree of fault of the provider or other person, taking into account the technicaland organisational measures taken by the provider it to comply with this Regulation.

JAI.1

FL/ml

53

LIMITEENSection 4
Cooperation
Article 36 33
Identification and submission of online child sexual abuse
1.

Coordinating Authorities shall submit to the EU Centre, without without undue delay andthrough the system established in accordance with Article 39(2):(a)

specific items of material and transcripts of conversations that competentauthorities Coordinating Authorities or that the competent judicial authorities orother independent administrative authorities of a Member State have identified, aftera diligent assessment, as constituting child sexual abuse material or the solicitation ofchildren, as applicable, for the EU Centre to generate indicators in accordance with
Article 44(3);(b)

exact uniform resource locators indicating the electronic location of theinformation specific items of material that competent authorities Coordinating
Authorities or that competent judicial authorities or other independent administrative
authorities of a Member State have identified, after a diligent assessment, as
constituting child sexual abuse material, hosted by providers of hosting services notoffering services in the Union, that cannot be removed due to those providers’ refusal
to remove or disable access thereto and to the lack of cooperation by the competentauthorities of the third country having jurisdiction, for the EU Centre to compile thelist of uniform resource locators in accordance with Article 44(3).

Member States shall take the necessary measures to ensure that the Coordinating
Authorities that they designated receive, without undue delay, the material identified as
child sexual abuse material, the transcripts of conversations identified as the solicitation ofchildren, and the uniform resource locators, identified by a competent authority acompetent judicial authority or other independent administrative authority than the
Coordinating Authority, for submission to the EU Centre in accordance with the firstsubparagraph.

33

PCY comment: the LEWP should continue working on this Article and return to it once moreclarity is reached on the detection and blocking orders. Meanwhile the Commission has
provided a proposal for a new recital to make clear that law enforcement can be involved in
the process to determine the illegality of the content, under judicial supervision, as follows:“Member States should set up expedited procedures for the diligent assessment ofsuspected child sexual abuse, so as to allow for the swift submission to the EU Centre of
the specific items of material, transcripts of conversations and uniform resource locatorsconcerned upon the reliable establishment of the illegality. With a view to facilitatingand expediting such assessment, competent authorities may assist the competent judicial
authorities or independent administrative authorities responsible for such anassessment.”

7842/23
ANNEX

JAI.1

FL/ml

54

LIMITEEN

2.

Upon the request of the EU Centre where necessary to ensure that the data contained in the
databases referred to in Article 44(1) are complete, accurate and up-to-date, Coordinating
Authorities shall verify or provide clarifications or additional information as to whether theconditions of paragraph 1, points (a) and (b) have been and, where relevant, continue to be
met, in respect of a given submission to the EU Centre in accordance with that paragraph.

3.

Member States shall ensure that, where their law enforcement authorities receive a reportof the dissemination of new child sexual abuse material or of the solicitation of children
forwarded to them by the EU Centre in accordance with Article 48(3), a diligent
assessment is conducted in accordance with paragraph 1 and, if the material orconversation is identified as constituting child sexual abuse material or as the solicitationof children, the Coordinating Authority submits the material to the EU Centre, in
accordance with that paragraph, within one month from the date of reception of the reportor, where the assessment is particularly complex, two months from that date.

4.

They shall also ensure that, where the diligent assessment indicates that the material does
not constitute child sexual abuse material or the solicitation of children, the Coordinating
Authority is informed of that outcome and subsequently informs the EU Centre thereof,
within the time periods specified in the first subparagraph.
Article 3734
Cross-border cooperation among Coordinating Authorities

1.

Where a Coordinating Authority that is not the Coordinating Authority of establishment
has reasons to suspect that a provider of relevant information society services infringed thisRegulation in a manner negatively affecting the users of the service in the Member
State of that Coordinating Authority, it may shall request the Coordinating Authority of
establishment to assess the matter and to take the necessary investigatory and enforcement
measures to ensure compliance with this Regulation.
Where the Commission has reasons to suspect that a provider of relevant informationsociety services infringed this Regulation in a manner involving at least three Member
States, it may recommend that the Coordinating Authority of establishment assess thematter and take the necessary investigatory and enforcement measures to ensurecompliance with this Regulation.

34

PCY comment: copied word for word from Art. 58 of the DSA.

7842/23
ANNEX

JAI.1

FL/ml

55

LIMITEEN2.

The A request or recommendation pursuant referred to in paragraph 1 shall be duly
reasoned and at least indicate:(a)the point of contact of the provider as set out in Article 23;(b)a description of the relevant facts, the provisions of this Regulation concerned andthe reasons why the Coordinating Authority that sent the request, or the Commission
suspects, that the provider infringed this Regulation including the description of thenegative effects of the alleged infringement;(c)any other information that the Coordinating Authority that sent the request, or theCommission, considers relevant, including, where appropriate, information gatheredon its own initiative and or suggestions for specific investigatory or enforcement
measures to be taken, including interim measures.

3.

The Coordinating Authority of establishment shall take utmost account of the requests
pursuant to paragraph 1 of this Article assess the suspected infringement, taking into
utmost account the request or recommendation referred to in paragraph 1. Where it
considers that it has insufficient information to asses the suspected infringement or to act
upon the request or recommendation and has reasons to consider that the Coordinating
Authority that sent the request, or the Commission, could provide additional information, it
may request such information. The time period laid down in paragraph 4 shall besuspended until that additional information is provided.

4.

The Coordinating Authority of establishment shall, without undue delay and in any event
not later than two months following receipt of the request or recommendation pursuant
referred to in paragraph 1, communicate to the Coordinating Authority that sent therequest, or the Commission, the outcome of its assessment of the suspected infringement,or that of any other competent authority pursuant to national law where relevant, and,
where applicable, an explanation of the investigatory or enforcement measures taken or
envisaged in relation thereto to ensure compliance with this Regulation.

7842/23
ANNEX

JAI.1

FL/ml

56

LIMITEEN

Article 3835
Joint investigations
1.

Coordinating Authorities may participate in joint investigations, which may be coordinatedwith the support of the EU Centre, of matters covered by this Regulation, concerning
providers of relevant information society services that offer their services in several
Member States.
Such joint investigations are without prejudice to the tasks and powers of the participating
Coordinating Authorities and the requirements applicable to the performance of those tasks
and exercise of those powers provided for in this Regulation.

2.

The participating Coordinating Authorities shall make the results of the joint investigations
available to other Coordinating Authorities, the Commission and the EU Centre, throughthe system established in accordance with Article 39(2), for the fulfilment of theirrespective tasks under this Regulation.
Article 38a36
Mutual assistance1.

The Coordinating Authorities, the competent authorities of the Member States and the
EU Centre Digital Services Coordinators and the Commission shall cooperate closely
and provide each other with mutual assistance in order to apply this Regulation in aconsistent and efficient manner. Mutual assistance shall include, in particular,
exchange of information in accordance with this Article and the duty of the Digital
Services Coordinator of establishment Coordinating Authority to inform all
Coordinating Authorities Digital Services Coordinators of destination, the Board andthe Commission about the opening of an investigation and the intention to take a final
decision, including its assessment, in respect of a specific provider of a relevant
information society intermediary service.

35

PCY comment: The PCY notes that the elements of the Article can be found in Article 58 of
the DSA. The PCY observes that a number of delegations have requested clarifications about
what is meant with joint investigations, a concept that is close also to law enforcement andjudicial cooperation. This could be clarified in a recital, as follows: “Joint investigations”
under Article 38 should be interpreted as formal inquiries by Coordinating Authorities
concerning the compliance of the provider of relevant information society services withthe obligations arising from this Regulation. Insofar as the penalties for infringements of
those obligations provided for by the Member State concerned pursuant to thisRegulation are not criminal in nature, “joint investigations” under Article 38 should not
be interpreted as criminal investigations, which are usually conducted by law
enforcement authorities under national law.”36

Copied from Article 57 of the DSA (changes vis-à-vis the DSA in italics).

7842/23
ANNEX

JAI.1

FL/ml

57

LIMITEEN2.

For the purpose of an investigation, a Coordinating Authority the Digital Services
Coordinator of establishment may request a Coordinating Authority in another Member
State other Digital Services Coordinators to provide specific information in theirpossession as regards a specific provider of relevant information society intermediaryservices or to exercise their investigative powers referred to in Article 27 51(1) withregard to specific information located in their Member State. Where appropriate, theCoordinating Authority Digital Services Coordinator receiving the request may involveother competent authorities or other public authorities of the Member State inquestion.

3.

The Coordinating Authority Digital Services Coordinator receiving the request
pursuant to paragraph 2 shall comply with such request and inform the requesting
Coordinating Authority Digital Services Coordinator of establishment about the action
taken, without undue delay and no later than two months after its receipt, unless:(a)the scope or the subject matter of the request is not sufficiently specified,justified or proportionate in view of the investigative purposes; or(b)neither the requested Coordinating Authority Digital Service Coordinator norother competent authority or other public authority of that Member State is inpossession of the requested information nor can have access to it; or(c)the request cannot be complied with without infringing Union or national law.

The Digital Services Coordinator Coordinating Authority receiving the request shalljustify its refusal by submitting a reasoned reply, within the period set out in the firstsubparagraph.
Article 39
General cCooperation, coordination and information-sharing system
1.

Competent authorities Coordinating Authorities shall sincerely cooperate with eachother, other competent authorities of the Member States that designated the Coordinating
Authority, the Commission, the EU Centre and other relevant Union agencies, including
Europol, to facilitate the performance of their respective tasks under this Regulation and toensure its effective, efficient and consistent application and enforcement, without
prejudice to the possibilitty for Member States to provide for cooperation
mechanisms and regular exchanges of views between the competent authorities where
relevant for the performance of their respective tasks in accordance with thisRegulation.

1a.

The authorities and agencies referred to in paragraph 1 may, including with thesupport from the EU Centre, coordinate their work under this Regulation with a view
to avoiding interference with criminal investigations in different Member States andto avoiding duplication of efforts.

7842/23
ANNEX

JAI.1

FL/ml

58

LIMITEEN2.

The EU Centre shall establish and maintain one or more reliable and secure information
sharing systems supporting communications between Coordinating Authorities, theCommission, the EU Centre, other relevant Union agencies and providers of relevant
information society services.

3.

The Coordinating Authorities, the Commission, the EU Centre, other relevant Union
agencies and providers of relevant information society services shall use the informationsharing systems referred to in paragraph 2 for all relevant communications pursuant to thisRegulation.

4.

The Commission shall adopt implementing acts laying down the practical and operationalarrangements for the functioning of the information-sharing systems referred to inparagraph 2 and their interoperability with other relevant systems. Those implementing
acts shall be adopted in accordance with the advisory procedure referred to in Article 87.

7842/23
ANNEX

JAI.1

FL/ml

59

LIMITEENCHAPTER IV
EU CENTRE TO PREVENT AND COMBAT CHILD SEXUAL ABUSE
Section 1
Principles
Article 40
Establishment and scope of action of the EU Centre
1.

A European Union Agency to prevent and combat child sexual abuse, the EU Centre on
Child Sexual Abuse, is established.

2.

The EU Centre shall contribute to the achievement of the objective of this Regulation by
supporting and facilitating the implementation of its provisions concerning the detection,
reporting, removal or disabling of access to, and blocking of online child sexual abuse andgather and share information and expertise and facilitate cooperation between relevantpublic and private parties in connection to the prevention and combating of child sexual
abuse, in particular online.
Article 41
Legal status

1.

The EU Centre shall be a body of the Union with legal personality.

2.

In each of the Member States the EU Centre shall enjoy the most extensive legal capacity
accorded to legal persons under their laws. It may, in particular, acquire and dispose of
movable and immovable property and be party to legal proceedings.

3.

The EU Centre shall be represented by its Executive Director.
Article 42
Seat

The seat of the EU Centre shall be The Hague, The Netherlands.

7842/23
ANNEX

JAI.1

FL/ml

60

LIMITEENSection 2
Tasks
Article 43
Tasks of the EU Centre
The EU Centre shall:
(1)

(2)

(3)

(4)

facilitate the risk assessment process referred to in Section 1 of Chapter II, by:(a)supporting the Commission in the preparation of the guidelines referred to in Article
3(8), Article 4(5), Article 6(4) and Article 11, including by collecting and providing
relevant information, expertise and best practices, taking into account advice fromthe Technology Committee referred to in Article 66;(b)upon request from a provider of relevant information services, providing an analysisof anonymised data samples for the purpose referred to in Article 3(3);facilitate the detection process referred to in Section 2 of Chapter II, by:(a)providing the opinions on intended detection orders referred to in Article 7(3), firstsubparagraph, point (d);(b)

maintaining and operating the databases of indicators referred to in Article 44;(c)giving providers of hosting services and providers of interpersonal communications
services that received a detection order access to the relevant databases of indicatorsin accordance with Article 46;(d)making technologies available to providers for the execution of detection orders
issued to them, in accordance with Article 50(1);facilitate the reporting process referred to in Section 3 of Chapter II, by:(a)maintaining and operating the database of reports referred to in Article 45;(b)assessing, processing and, where necessary, forwarding the reports and providing
feedback thereon in accordance with Article 48;

facilitate the removal process referred to in Section 4 of Chapter II and the other processes
referred to in Section 5, 5a and 6 of that Chapter, by:(a)7842/23
ANNEX

receiving the removal orders transmitted to it pursuant to Article 14(4) in order tofulfil the verification function referred to in Article 49(1);

JAI.1

FL/ml

61

LIMITEEN

(aa) receiving decisions on a cross-border removal order transmitted to it pursuant
to Article 14a(5);(ab) receiving copies of final removal orders and thereto connected informationtransmitted to it pursuant to Article 15(2);(b)

cooperating with and responding to requests of Coordinating Authorities inconnection to intended blocking orders as referred to in Article 16(2);(c)

receiving and processing the blocking orders transmitted to it pursuant to Article
17(3);(ca) receiving copies of final blocking orders and thereto connected informationtransmitted to it pursuant to Article 18(2);(cb) receiving the delisting orders transmitted to it pursuant to Article 18b(2);(cc) receiving copies of final delisting orders and thereto connected informationtransmitted to it pursuant to Article 18c(3);(5)

7842/23
ANNEX(d)providing information and support to victims in accordance with Articles 20 and 21;(e)maintaining up-to-date records of contact points and legal representatives ofproviders of relevant information society services as provided in accordance with
Article 23(2) and Article 24(6);support the competent authorities, including the Coordinating Authorities, and theCommission in the performance of their tasks under this Regulation and facilitate
cooperation, coordination and communication in connection to matters covered by thisRegulation, by:(a)creating and maintaining an online register listing the Coordinating Authorities andtheir contact points referred to in Article 25(6);(b)

providing assistance to the Coordinating Authorities free of charge and inaccordance with its tasks and obligations under this Regulation as provided forin Article 25(7);(c)

assisting the Commission, upon its request, in connection to its tasks under thecooperation mechanism referred to in Article 37;(d)creating, maintaining and operating the information-sharing system referred to in
Article 39;

JAI.1

FL/ml

62

LIMITE

EN

(6)

(e)

assisting the Commission in the preparation of the delegated and implementing acts
and the guidelines that the Commission adopts under this Regulation;(f)providing information to Coordinating Authorities, upon their request or on its own
initiative, relevant for the performance of their tasks under this Regulation, including
by informing the Coordinating Authority of establishment of potential infringements
identified in the performance of the EU Centre’s other tasks;

facilitate the generation and sharing of knowledge with other Union institutions, bodies,
offices and agencies, competent authorities including Coordinating Authorities, or otherrelevant authorities of the Member States to contribute to the achievement of the objectiveof this Regulation, by:(a)collecting, recording, analysing and providing information, providing analysis basedon anonymised and non-personal data gathering, and providing expertise on mattersregarding the prevention and combating of online child sexual abuse, in accordancewith Article 51;(b)

supporting the development and dissemination of research and expertise on thosematters and on assistance to victims, including by serving as a hub of expertise tosupport evidence-based policy;(c)drawing up the annual reports referred to in Article 84.
Article 44
Databases of indicators

1.

2.

The EU Centre shall create, maintain and operate databases of the following three types ofindicators of online child sexual abuse:(a)indicators to detect the dissemination of child sexual abuse material previously
detected and identified as constituting child sexual abuse material in accordance with
Article 36(1);(b)

indicators to detect the dissemination of child sexual abuse material not previously
detected and identified as constituting child sexual abuse material in accordance with
Article 36(1);(c)

indicators to detect the solicitation of children.

The databases of indicators shall solely contain:(a)7842/23
ANNEX

relevant indicators, consisting of digital identifiers to be used to detect thedissemination of known or new child sexual abuse material or the solicitation ofchildren, as applicable, on hosting services and interpersonal communications
services, generated by the EU Centre in accordance with paragraph 3;

JAI.1

FL/ml

63

LIMITE

EN

3.

(b)

as regards paragraph 1, point (a), the relevant indicators shall include a list of
uniform resource locators compiled by the EU Centre in accordance with paragraph3;(c)the necessary additional information to facilitate the use of the indicators inaccordance with this Regulation, including identifiers allowing for a distinction
between images, videos and, where relevant, other types of material for the detectionof the dissemination of known and new child sexual abuse material and language
identifiers for the detection of solicitation of children.

The EU Centre shall generate the indicators referred to in paragraph 2, point (a), solely on
the basis of the child sexual abuse material and the solicitation of children identified assuch by the Coordinating Authorities competent authorities of the Member States,
submitted to it by the Coordinating Authorities pursuant to Article 36(1), point (a).
The EU Centre shall compile the list of uniform resource locators referred to in paragraph
2, point (b), solely on the basis of the uniform resource locators submitted to it pursuant to
Article 36(1), point (b).

4.

The EU Centre shall keep records of the submissions and of the process applied to generate
the indicators and compile the list referred to in the first and second subparagraphs. It shallkeep those records for as long as the indicators, including the uniform resource locators, towhich they correspond are contained in the databases of indicators referred to in paragraph1.
Article 45
Database of reports

1.

The EU Centre shall create, maintain and operate a database for the reports submitted to itby providers of hosting services and providers of interpersonal communications services inaccordance with Article 12(1) and assessed and processed in accordance with Article 48.

2.

The database of reports shall contain the following information:

7842/23
ANNEX(a)the report;(b)where the EU Centre considered the report manifestly unfounded, the reasons and thedate and time of informing the provider in accordance with Article 48(2);(c)

where the EU Centre forwarded the report in accordance with Article 48(3), the date
and time of such forwarding and the name of the competent law enforcement
authority or authorities to which it forwarded the report or, where applicable,
information on the reasons for forwarding the report solely to Europol for further
analysis;

JAI.1

FL/ml

64

LIMITEEN(d)where applicable, information on the requests for and provision of additional
information referred to in Article 48(5);(e)

where available, information indicating that the provider that submitted a reportconcerning the dissemination of known or new child sexual abuse material removed
or disabled access to the material;(f)where applicable, information on the EU Centre’s request to the Coordinating
Authority competent authority of establishment to issue a removal order pursuant to
Article 14 in relation to the item or items of child sexual abuse material to which thereport relates;(g)

relevant indicators and ancillary tags associated with the reported potential childsexual abuse material.
Article 46
Access, accuracy and security

1.

Subject to paragraphs 2 and 3, solely EU Centre staff and auditors duly authorised by the
Executive Director shall have access to and be entitled to process the data contained in the
databases referred to in Articles 44 and 45.

2.

The EU Centre shall give providers of hosting services, providers of interpersonalcommunications services, and providers of internet access services and providers of
online search engines access to the databases of indicators referred to in Article 44, where
and to the extent necessary for them to execute the detection or blocking orders that theyreceived in accordance with Articles 7 or 16. It shall take measures to ensure that suchaccess remains limited to what is strictly necessary for the period of application of thedetection or blocking orders concerned and that such access does not in any way endanger
the proper operation of those databases and the accuracy and security of the data contained
therein.

3.

The EU Centre shall give Coordinating Authorities competent authorities access to the
databases of indicators referred to in Article 44 where and to the extent necessary for the
performance of their tasks under this Regulation.

4.

The EU Centre shall give Europol and the competent law enforcement authorities of theMember States access to the databases of indicators referred to in Article 44 where and to
the extent necessary for the performance of their tasks of investigating suspected childsexual abuse offences.

5.

The EU Centre shall give Europol access to the databases of reports referred to in Article
45, where and to the extent necessary for the performance of its tasks of assisting
investigations of suspected child sexual abuse offences

7842/23
ANNEX

JAI.1

FL/ml

65

LIMITEEN6.

The EU Centre shall provide the access referred to in paragraphs 2, 3, 4 and 5 only upon
the reception of a request, specifying the purpose of the request, the modalities of therequested access, and the degree of access needed to achieve that purpose. The requests forthe access referred to in paragraph 2 shall also include a reference to the detection order orthe blocking order, as applicable.
The EU Centre shall diligently assess those requests and only grant access where it
considers that the requested access is necessary for and proportionate to the specified
purpose.

7.

The EU Centre shall regularly verify that the data contained in the databases referred to in
Articles 44 and 45 is, in all respects, complete, accurate and up-to-date and continues to benecessary for the purposes of reporting, detection and blocking in accordance with thisRegulation, as well as facilitating and monitoring of accurate detection technologies andprocesses. In particular, as regards the uniform resource locators contained in the databasereferred to Article 44(1), point (a), the EU Centre shall, where necessary in cooperation
with the Coordination Authorities, regularly verify that the conditions of Article 36(1),point (b), continue to be met. Those verifications shall include audits, where appropriate.
Where necessary in view of those verifications, it shall immediately complement, adjust or
delete the data.

8.

The EU Centre shall ensure that the data contained in the databases referred to in Articles
44 and 45 is stored in a secure manner and that the storage is subject to appropriatetechnical and organisational safeguards. Those safeguards shall ensure, in particular, thatthe data can be accessed and processed only by duly authorised persons for the purpose forwhich the person is authorised and that a high level of security is achieved. The EU Centre
shall regularly review those safeguards and adjust them where necessary.
Article 47
Delegated acts relating to the databases

The Commission shall be empowered to adopt delegated acts in accordance with Article 86 in orderto supplement this Regulation with the necessary detailed rules concerning:(a)the types, precise content, set-up and operation of the databases of indicators referred to in
Article 44(1), including the indicators and the necessary additional information to becontained therein referred to in Article 44(2);(b)

the processing of the submissions by Coordinating Authorities, the generation of theindicators, the compilation of the list of uniform resource locators and the record-keeping,referred to in Article 44(3);(c)

the precise content, set-up and operation of the database of reports referred to in Article
45(1);(d)access to the databases referred to in Articles 44 and 45, including the modalities of theaccess referred to in Article 46(1) to (5), the content, processing and assessment of therequests referred to in Article 46(6), procedural matters related to such requests and thenecessary measures referred to in Article 46(6);7842/23
ANNEX

JAI.1

FL/ml

66

LIMITEEN(e)the regular verifications and audits to ensure that the data contained in those databases iscomplete, accurate and up-to-date referred to in Article 46(7) and the security of thestorage of the data, including the technical and organisational safeguards and regularreview referred to in Article 46(8).
Article 48
Reporting

1.

The EU Centre shall expeditiously assess and process reports submitted by providers of
hosting services and providers of interpersonal communications services in accordancewith Article 12 to determine whether the reports are manifestly unfounded or are to be
forwarded.

2.

Where the EU Centre considers that the report is manifestly unfounded, it shall inform theprovider that submitted the report, specifying the reasons why it considers the report to be
unfounded.

3.

Where the EU Centre considers that a report is not manifestly unfounded, it shall forward
the report, together with any additional relevant information available to it, to Europol andto the competent law enforcement authority or authorities of the Member State likely tohave jurisdiction to investigate or prosecute the potential child sexual abuse to which thereport relates.
Where that competent law enforcement authority or those competent law enforcement
authorities cannot be determined with sufficient certainty, the EU Centre shall forward thereport, together with any additional relevant information available to it, to Europol, forfurther analysis and subsequent referral by Europol to the competent law enforcement
authority or authorities.
37

37

COM proposal: Aim is to make even more clear the expedite processing in the EU Centre forthese urgent reports. It keeps the review (expedited) to serve as a safeguard against possible
misuse by the providers (to avoid having to complete the reports, which would not be helpful
for law enforcement, and it would “pollute” the system and harm the situations that do require
real urgent action). Text as follows: “The EU Centre shall perform the assessment andprocessing referred to in paragraphs 1, 2 and 3 of this Article as a matter of priority in respectof reports submitted in accordance with Article 13(2), first subparagraph. In particular, where
the EU Centre considers that such a report is not manifestly unfounded and that there is likely
to be an imminent threat to the life or safety of a child, it shall immediately forward the reportin accordance with paragraph 3, marking it as requiring urgent action. Where the EU Centre
considers, in respect of a report submitted in accordance with Article 13(2), firstsubparagraph, that there is not likely to be an imminent threat to the life of a child, it shallindicate that when forwarding the report in accordance with paragraph 3 and it shall also
inform the provider that submitted the report and the competent authority, specifying in allcases the reasons why it considers that there is not likely to be an imminent threat to the life ofa child.”

7842/23
ANNEX

JAI.1

FL/ml

67

LIMITEEN

4.

Where a provider that submitted the report has indicated that the report requires urgent
action, the EU Centre shall assess and process that report as a matter of priority and, where
it forwards the report in accordance with paragraph 3 and it considers that the reportrequires urgent action, shall ensure that the forwarded report is marked as such.

5.

Where the report does not contain all the information required in Article 13, the EU Centre
may request the provider that submitted the report to provide the missing information.

6.

Where so requested by a competent law enforcement authority of a Member State in order
to avoid interfering with activities for the prevention, detection, investigation andprosecution of child sexual abuse offences, the EU Centre shall:(a)communicate to the provider that submitted the report that it is not to inform the userconcerned, specifying the time period during which the provider is not to do so;(b)where the provider that submitted the report is a provider of hosting services and thereport concerns the potential dissemination of child sexual abuse material,
communicate to the provider that it is not to remove or disable access to the material,
specifying the time period during which the provider is not to do so.

7.

The time periods referred to in the first subparagraph, points (a) and (b), shall be thosespecified in the competent law enforcement authority’s request to the EU Centre, provided
that they remain limited to what is necessary to avoid interference with the relevant
activities and does not exceed 18 months.

8.

The EU Centre shall verify whether a provider of hosting services that submitted a reportconcerning the potential dissemination of child sexual abuse material removed or disabled
access to the material, insofar as the material is publicly accessible. Where it considers thatthe provider did not remove or disable access to the material expeditiously, the EU Centre
shall inform the Coordinating Authority of establishment thereof.
Article 49
Searches and notification

1.

7842/23ANNEX

The EU Centre shall have the power to conduct searches on hosting services for the
dissemination of publicly accessible child sexual abuse material, using the relevant
indicators from the database of indicators referred to in Article 44(1), points (a) and (b), in
the following situations:(a)where so requested to support a victim by verifying whether the provider of hosting
services removed or disabled access to one or more specific items of known childsexual abuse material depicting the victim, in accordance with Article 21(4), point
(c);

(b)

where so requested to assist a Coordinating Authority competent authority byverifying the possible need for the issuance of a detection order or a removal order inrespect of a specific service or the effectiveness of a detection order or a removal
order that the Coordinating Authority issued, in accordance with Article 25(7), points(c) and (d), respectively;

JAI.1

FL/ml

68

LIMITE

EN

(c)

2.

where so requested to assist a Coordinating Authority, by verifying theeffectiveness of a detection order that the competent judicial authorities or otherindependent administrative authorities issued, in accordance with Article 25(7),point (d).

The EU Centre shall have the power to notify, after having conducted the searches referred
to in paragraph 1, providers of hosting services of the presence of one or more specificitems of known child sexual abuse material on their services and request them to remove or
disable access to that item or those items, for the providers’ voluntary consideration.
The request shall clearly set out the identification details of the EU Centre and a contact
point, the necessary information for the identification of the item or items, as well as thereasons for the request. The request shall also clearly state that it is for the provider’svoluntary consideration.

3.

Where so requested by a competent law enforcement authority of a Member State in order
to avoid interfering with activities for the prevention, detection, investigation andprosecution of child sexual abuse offences, the EU Centre shall not submit a notice, for as
long as necessary to avoid such interference but no longer than 18 months.
Article 50
Technologies, information and expertise1.

The EU Centre shall make available technologies that providers of hosting services andproviders of interpersonal communications services may acquire, install and operate, freeof charge, where relevant subject to reasonable licensing conditions, to execute detection
orders in accordance with Article 10(1).
To that aim, the EU Centre shall compile lists of such technologies, having regard to therequirements of this Regulation and in particular those of Article 10(2).
Before including specific technologies on those lists, the EU Centre shall request theopinion of its Technology Committee and of the European Data Protection Board. The
Technology Committee and the European Data Protection Board shall deliver theirrespective opinions within eight weeks. That period may be extended by a further six
weeks where necessary, taking into account the complexity of the subject matter. The
Technology Committee and the European Data Protection Board shall inform the EU
Centre of any such extension within one month of receipt of the request for consultation,
together with the reasons for the delay.

2.

The EU Centre shall collect, record, analyse and make available relevant, objective,
reliable and comparable information on matters related to the prevention and combating ofchild sexual abuse, in particular:(a)7842/23
ANNEX

information obtained in the performance of its tasks under this Regulation
concerning detection, reporting, removal or disabling of access to, and blocking of
online child sexual abuse;

JAI.1

FL/ml

69

LIMITEEN(b)information resulting from the research, surveys and studies referred to in paragraph3;(c)

information resulting from research or other activities conducted by Member States’
authorities, other Union institutions, bodies, offices and agencies, the competentauthorities of third countries, international organisations, research centres and civilsociety organisations.

3.

Where necessary for the performance of its tasks under this Regulation, the EU Centre
shall carry out, participate in or encourage research, surveys and studies, either on its own
initiative or, where appropriate and compatible with its priorities and its annual work
programme, at the request of the European Parliament, the Council or the Commission.

4.

The EU Centre shall provide the information referred to in paragraph 2 and the information
resulting from the research, surveys and studies referred to in paragraph 3, including its
analysis thereof, and its opinions on matters related to the prevention and combating of
online child sexual abuse to other Union institutions, bodies, offices and agencies,
Coordinating Authorities, other competent authorities and other public authorities of theMember States, either on its own initiative or at request of the relevant authority. Where
appropriate, the EU Centre shall make such information publicly available.

5.

The EU Centre shall develop a communication strategy and promote dialogue with civilsociety organisations and providers of hosting or interpersonal communication services toraise public awareness of online child sexual abuse and measures to prevent and combat
such abuse.
Section 3
Processing of information
Article 51
Processing activities and data protection

1.

In so far as is necessary for the performance of its tasks under this Regulation, the EU
Centre may process personal data.

2.

The EU Centre shall process personal data as strictly necessary for the purposes of:7842/23
ANNEX(a)providing the opinions on intended detection orders referred to in Article 7(3);(b)

cooperating with and responding to requests of Coordinating Authorities inconnection to intended blocking orders as referred to in Article 16(2);(c)

receiving and processing blocking orders transmitted to it pursuant to Article 17(3);

JAI.1

FL/ml

70

LIMITEEN(d)cooperating with Coordinating Authorities in accordance with Articles 20 and 21 on
tasks related to victims’ rights to information and assistance;(e)maintaining up-to-date records of contact points and legal representatives ofproviders of relevant information society services as provided in accordance with
Article 23(2) and Article 24(6);(f)

creating and maintaining an online register listing the Coordinating Authorities andtheir contact points referred to in Article 25(6);(g)

providing assistance to Coordinating Authorities in accordance with Article 25(7);(h)

assisting the Commission, upon its request, in connection to its tasks under thecooperation mechanism referred to in Article 37;(i)create, maintain and operate the databases of indicators referred to in Article 44;(j)create, maintain and operate the database of reports referred to in Article 45;(k)providing and monitoring access to the databases of indicators and of reports inaccordance with Article 46;(l)performing data quality control measures in accordance with Article 46(7);(m) assessing and processing reports of potential online child sexual abuse in accordancewith Article 48;(n)cooperating with Europol and partner organisations in accordance with Articles 53
and 54, including on tasks related to the identification of victims;(o)generating statistics in accordance with Article 83.

3.

The EU Centre shall store the personal data referred to in paragraph 2 only where and for
as long as strictly necessary for the applicable purposes listed in paragraph 2.

4.

It shall ensure that the personal data is stored in a secure manner and that the storage issubject to appropriate technical and organisational safeguards. Those safeguards shallensure, in particular, that the personal data can be accessed and processed only for the
purpose for which it is stored, that a high level of security is achieved and that the personal
data is deleted when no longer strictly necessary for the applicable purposes. It shallregularly review those safeguards and adjust them where necessary.

7842/23
ANNEX

JAI.1

FL/ml

71

LIMITEENSection 4
Cooperation
Article 52
Contact officers
1.

Each Coordinating Authority shall designate at least one contact officer, who shall be themain contact point for the EU Centre in the Member State concerned. The contact officers
may be seconded to the EU Centre. Where several contact officers are designated, theCoordinating Authority shall designate one of them as the main contact officer.

2.

Contact officers shall assist in the exchange of information between the EU Centre and the
Coordinating Authorities that designated them. Where the EU Centre receives reports
submitted in accordance with Article 12 concerning the potential dissemination of newchild sexual abuse material or the potential solicitation of children, the contact officers
designated by the competent Member State shall facilitate the process to determine theillegality of the material or conversation, in accordance with Article 36(1).

3.

The Management Board shall determine the rights and obligations of contact officers in
relation to the EU Centre. Contact officers shall enjoy the privileges and immunities
necessary for the performance of their tasks.

4.

Where contact officers are seconded to the EU Centre, the EU Centre shall cover the costsof providing them with the necessary premises within the building and adequate support
for contact officers to perform their duties. All other costs that arise in connection with thedesignation of contact officers and the performance of their tasks shall be borne by the
Coordinating Authority that designated them.
Article 53
Cooperation with Europol

1.

Where necessary for the performance of its tasks under this Regulation, within theirrespective mandates, the EU Centre shall cooperate with Europol.

2.

Europol and the EU Centre shall provide each other with the fullest possible access torelevant information and information systems, where necessary for the performance of
their respective tasks and in accordance with the acts of Union law regulating such access.
Without prejudice to the responsibilities of the Executive Director, the EU Centre shall
maximise efficiency by sharing administrative functions with Europol, including functions
relating to personnel management, information technology (IT) and budget
implementation.

3.

7842/23
ANNEX

The terms of cooperation and working arrangements shall be laid down in a memorandumof understanding.

JAI.1

FL/ml

72

LIMITEEN

Article 54
Cooperation with partner organisations
1.

Where necessary for the performance of its tasks under this Regulation, the EU Centre may
cooperate with organisations and networks with information and expertise on mattersrelated to the prevention and combating of online child sexual abuse, including civilsociety organisations and semi-public organisations.

2.

The EU Centre may conclude memoranda of understanding with organisations referred toin paragraph 1, laying down the terms of cooperation.
Section 5
Organisation
Article 55
Administrative and management structure

The administrative and management structure of the EU Centre shall comprise:(a)a Management Board, which shall exercise the functions set out in Article 57;(b)an Executive Board which shall perform the tasks set out in Article 62;(c)an Executive Director of the EU Centre, who shall exercise the responsibilities set
out in Article 64;(d)a Technology Committee as an advisory group, which shall exercise the tasks set out
in Article 66.
Part 1: Management Board
Article 56
Composition of the Management Board

1.

The Management Board shall be composed of one representative from each Member Stateand two representatives of the Commission, all as members with voting rights.

2.

The Management Board shall also include one independent expert observer designated by
the European Parliament, without the right to vote.
Europol may designate a representative to attend the meetings of the Management Board
as an observer on matters involving Europol, at the request of the Chairperson of theManagement Board.

7842/23
ANNEX

JAI.1

FL/ml

73

LIMITEEN

3.

Each member of the Management Board shall have an alternate. The alternate shallrepresent the member in his/her absence.

4.

Members of the Management Board and their alternates shall be appointed in the light of
their knowledge in the field of combating child sexual abuse, taking into account relevant
managerial, administrative and budgetary skills. Member States shall appoint a
representative of their Coordinating Authority, within four months of [date of entry into
force of this Regulation]. All parties represented in the Management Board shall makeefforts to limit turnover of their representatives, in order to ensure continuity of its work.
All parties shall aim to achieve a balanced representation between men and women on theManagement Board.

5.

The term of office for members and their alternates shall be four years. That term may berenewed.
Article 57
Functions of the Management Board

1.

7842/23
ANNEX

The Management Board shall:(a)give the general orientations for the EU Centre's activities;(b)contribute to facilitate the effective cooperation with and between the Coordinating
Authorities;(c)adopt rules for the prevention and management of conflicts of interest in respect ofits members, as well as for the members of the Technological Committee and of any
other advisory group it may establish and publish annually on its website thedeclaration of interests of the members of the Management Board;(d)adopt the assessment of performance of the Executive Board referred to in Article
61(2);(e)adopt and make public its Rules of Procedure;(f)appoint the members of the Technology Committee, and of any other advisory groupit may establish;(g)

adopt the opinions on intended detection orders referred to in Article 7(4), on thebasis of a draft opinion provided by the Executive Director;(h)adopt and regularly update the communication and dissemination plans referred to in
Article 77(3) based on an analysis of needs.

JAI.1

FL/ml

74

LIMITEEN

Article 58
Chairperson of the Management Board
1.

The Management Board shall elect a Chairperson and a Deputy Chairperson from amongits members. The Chairperson and the Deputy Chairperson shall be elected by a majorityof two thirds of the members of the Management Board.
The Deputy Chairperson shall automatically replace the Chairperson if he/she is prevented
from attending to his/her duties.

2.

The term of office of the Chairperson and the deputy Chairperson shall be four years. Theirterm of office may be renewed once. If, however, their membership of the Management
Board ends at any time during their term of office, their term of office shall automatically
expire on that date.
Article 59
Meetings of the Management Board

1.

The Chairperson shall convene the meetings of the Management Board.

2.

The Executive Director shall take part in the deliberations, without the right to vote.

3.

The Management Board shall hold at least two ordinary meetings a year. In addition, it
shall meet on the initiative of its Chairperson, at the request of the Commission, or at therequest of at least one-third of its members.

4.

The Management Board may invite any person whose opinion may be of interest to attend
its meetings as an observer.

5.

The members of the Management Board and their alternates may, subject to its rules ofprocedure, be assisted at the meetings by advisers or experts.

6.

The EU Centre shall provide the secretariat for the Management Board.
Article 60
Voting rules of the Management Board

1.

Unless provided otherwise in this Regulation, the Management Board shall take decisions
by absolute majority of its members.

2.

Each member shall have one vote. In the absence of a member, his/her alternate shall beentitled to exercise his/her right to vote.

3.

The Executive Director shall not take part in the voting.

4.

The Management Board's rules of procedure shall establish more detailed voting
arrangements, in particular the circumstances in which a member may act on behalf ofanother member.

7842/23
ANNEX

JAI.1

FL/ml

75

LIMITEENPart 2: Executive Board
Article 61
Composition and appointment of the Executive Board
1.

The Executive Board shall be composed of the Chairperson and the Deputy Chairperson of
the Management Board, two other members appointed by the Management Board fromamong its members with the right to vote and two representatives of the Commission to theManagement Board. The Chairperson of the Management Board shall also be the
Chairperson of the Executive Board.
The Executive Director shall participate in meetings of the Executive Board without theright to vote.

2.

The term of office of members of the Executive Board shall be four years. In the course of
the 12 months preceding the end of the four-year term of office of the Chairperson and fivemembers of the Executive Board, the Management Board or a smaller committee selectedamong Management Board members including a Commission representative shall carryout an assessment of performance of the Executive Board. The assessment shall take into
account an evaluation of the Executive Board members’ performance and the EU Centre’s
future tasks and challenges. Based on the assessment, the Management Board may extend
their term of office once.
Article 62
Tasks of the Executive Board

1.

The Executive Board shall be responsible for the overall planning and the execution of thetasks conferred on the EU Centre pursuant to Article 43. The Executive Board shall adopt
all the decisions of the EU Centre with the exception of the decisions that shall be taken by
the Management Board in accordance with Article 57.

2.

In addition, the Executive Board shall have the following tasks:7842/23
ANNEX(a)adopt, by 30 November of each year, on the basis of a proposal by the Executive
Director, the draft Single Programming Document, and shall transmit it for
information to the European Parliament, the Council and the Commission by 31
January the following year, as well as any other updated version of the document;(b)adopt the draft annual budget of the EU Centre and exercise other functions in
respect of the EU Centre’s budget;(c)assess and adopt a consolidated annual activity report on the EU Centre's activities,
including an overview of the fulfilment of its tasks and send it, by 1 July each year,
to the European Parliament, the Council, the Commission and the Court of Auditorsand make the consolidated annual activity report public;

JAI.1

FL/ml

76

LIMITEEN(d)adopt an anti-fraud strategy, proportionate to fraud risks taking into account the costs
and benefits of the measures to be implemented, an efficiency gains and synergies
strategy, a strategy for cooperation with third countries and/or internationalorganisations, and a strategy for the organisational management and internal control
systems(e)adopt rules for the prevention and management of conflicts of interest in respect ofits members;(f)adopt its rules of procedure;(g)

exercise, with respect to the staff of the EU Centre, the powers conferred by the Staff
Regulations on the Appointing Authority and by the Conditions of Employment of
Other Servants on the EU Centre Empowered to Conclude a Contract of
Employment38 ("the appointing authority powers");(h)adopt appropriate implementing rules for giving effect to the Staff Regulations andthe Conditions of Employment of Other Servants in accordance with Article 110(2)of the Staff Regulations;(i)

appoint the Executive Director and remove him/her from office, in accordance with
Article 65;(j)appoint an Accounting Officer, who may be the Commission's Accounting Officer,
subject to the Staff Regulations and the Conditions of Employment of other servants,
who shall be totally independent in the performance of his/her duties;(k)ensure adequate follow-up to findings and recommendations stemming from theinternal or external audit reports and evaluations, as well as from investigations of
the European Anti-Fraud Office (OLAF);(l)adopt the financial rules applicable to the EU Centre;(m) take all decisions on the establishment of the EU Centre's internal structures and,
where necessary, their modification.

38

(n)

appoint a Data Protection Officer;(o)adopt internal guidelines further specifying the procedures for the processing of
information in accordance with Article 51, after consulting the European Data
Protection Supervisor;(p)authorise the conclusion of memoranda of understanding referred to in Article 53(3)and Article 54(2).

Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying
down the Staff Regulations of Officials and the Conditions of Employment of Other Servantsof the European Communities and instituting special measures temporarily applicable toofficials of the Commission (OJ L 56, 4.3.1968, p. 1)

7842/23
ANNEX

JAI.1

FL/ml

77

LIMITEEN

3.

With respect to the powers mentioned in paragraph 2 point (g) and (h), the Executive
Board shall adopt, in accordance with Article 110(2) of the Staff Regulations, a decision
based on Article 2(1) of the Staff Regulations and Article 6 of the Conditions of
Employment, delegating relevant appointing authority powers to the Executive Director.
The Executive Director shall be authorised to sub-delegate those powers.

4.

In exceptional circumstances, the Executive Board may by way of a decision temporarilysuspend the delegation of the appointing authority powers to the Executive Director andany sub-delegation by the latter and exercise them itself or delegate them to one of its
members or to a staff member other than the Executive Director.

5.

Where necessary because of urgency, the Executive Board may take certain provisional
decisions on behalf of the Management Board, in particular on administrative management
matters, including the suspension of the delegation of the appointing authority powers andbudgetary matters.
Article 63
Voting rules of the Executive Board

1.

The Executive Board shall take decisions by simple majority of its members. Each memberof the Executive Board shall have one vote. The Chairperson shall have a casting vote incase of a tie.

2.

The representatives of the Commission shall have a right to vote whenever matterspertaining to Article 62(2), points (a) to (l) and (p) are discussed and decided upon. For the
purposes of taking the decisions referred to in Article 62(2), points (f) and (g), therepresentatives of the Commission shall have one vote each. The decisions referred to in
Article 62(2), points (b) to (e), (h) to (l) and (p), may only be taken if the representatives of
the Commission casts a positive vote. For the purposes of taking the decisions referred toin Article 62(2), point (a), the consent of the representatives of the Commission shall only
be required on the elements of the decision not related to the annual and multi-annual
working programme of the EU Centre.
The Executive Board's rules of procedure shall establish more detailed voting
arrangements, in particular the circumstances in which a member may act on behalf ofanother member.

7842/23
ANNEX

JAI.1

FL/ml

78

LIMITEENPart 3: Executive Director
Article 64
Responsibilities of the Executive Director
1.

The Executive Director shall manage the EU Centre. The Executive Director shall be
accountable to the Management Board.

2.

The Executive Director shall report to the European Parliament on the performance of
his/her duties when invited to do so. The Council may invite the Executive Director toreport on the performance of his/her duties.

3.

The Executive Director shall be the legal representative of the EU Centre.

4.

The Executive Director shall be responsible for the implementation of the tasks assigned to
the EU Centre by this Regulation. In particular, the Executive Director shall be responsiblefor:7842/23
ANNEX(a)the day-to-day administration of the EU Centre;(b)

preparing decisions to be adopted by the Management Board;(c)implementing decisions adopted by the Management Board;(d)preparing the Single Programming Document and submitting it to the Executive
Board after consulting the Commission;(e)

implementing the Single Programming Document and reporting to the Executive
Board on its implementation;(f)preparing the Consolidated Annual Activity Report (CAAR) on the EU Centre’s
activities and presenting it to the Executive Board for assessment and adoption;(g)

preparing an action plan following-up conclusions of internal or external audit
reports and evaluations, as well as investigations by the European Anti-Fraud Office(OLAF) and by the European Public Prosecutor’s Office (EPPO) and reporting on
progress twice a year to the Commission and regularly to the Management Board andthe Executive Board;(h)protecting the financial interests of the Union by applying preventive measuresagainst fraud, corruption and any other illegal activities, without prejudicing theinvestigative competence of OLAF and EPPO by effective checks and, if
irregularities are detected, by recovering amounts wrongly paid and, whereappropriate, by imposing effective, proportionate and dissuasive administrative,
including financial penalties;

JAI.1

FL/ml

79

LIMITEEN(i)preparing an anti-fraud strategy, an efficiency gains and synergies strategy, a strategy
for cooperation with third countries and/or international organisations and a strategy
for the organisational management and internal control systems for the EU Centre
and presenting them to the Executive Board for approval;(j)preparing draft financial rules applicable to the EU Centre;(k)preparing the EU Centre’s draft statement of estimates of revenue and expenditureand implementing its budget;(l)preparing and implementing an IT security strategy, ensuring appropriate risk
management for all IT infrastructure, systems and services, which are developed or
procured by the EU Centre as well as sufficient IT security funding.

(m) implementing the annual work programme of the EU Centre under the control of the
Executive Board;

5.

(n)

drawing up a draft statement of estimates of the EU Centre’s revenue andexpenditure as part of the EU Centre’s Single Programming Document andimplementing the budget of the EU Centre pursuant to Article 67;(o)preparing a draft report describing all activities of the EU Centre with a section on
financial and administrative matters;(p)fostering recruitment of appropriately skilled and experienced EU Centre staff, while
ensuring gender balance.

Where exceptional circumstances so require, the Executive Director may decide to locate
one or more staff in another Member State for the purpose of carrying out the EU Centre’stasks in an a more efficient, effective and coherent manner. Before deciding to establish a
local office, the Executive Director shall obtain the prior consent of the Commission, theManagement Board and the Member State concerned. The decision shall be based on an
appropriate cost-benefit analysis that demonstrates in particular the added value of suchdecision and specify the scope of the activities to be carried out at the local office in amanner that avoids unnecessary costs and duplication of administrative functions of the EU
Centre. A headquarters agreement with the Member State(s) concerned may be concluded.
Article 65
Executive Director

1.

The Executive Director shall be engaged as a temporary agent of the EU Centre under
Article 2(a) of the Conditions of Employment of Other Servants.

2.

The Executive Director shall be appointed by the Executive Board, from a list of
candidates proposed by the Commission, following an open and transparent selection
procedure.

7842/23
ANNEX

JAI.1

FL/ml

80

LIMITEEN3.

For the purpose of concluding the contract with the Executive Director, the EU Centre
shall be represented by the Chairperson of the Executive Board.

4.

The term of office of the Executive Director shall be five years. Six months before the endof the Executive Director’s term of office, the Commission shall complete an assessmentthat takes into account an evaluation of the Executive Director's performance and the EU
Centre's future tasks and challenges.

5.

The Executive Board, acting on a proposal from the Commission that takes into accountthe assessment referred to in paragraph 3, may extend the term of office of the Executive
Director once, for no more than five years.

6.

An Executive Director whose term of office has been extended may not participate inanother selection procedure for the same post at the end of the overall period.

7.

The Executive Director may be dismissed only upon a decision of the Executive Board
acting on a proposal from the Commission.

8.

The Executive Board shall take decisions on appointment, extension of the term of officeor dismissal of the Executive Director by a majority of two-thirds of its members withvoting rights.
Subsection 5: Technology Committee
Article 66
Establishment and tasks of the Technology Committee

1.

The Technology Committee shall consist of technical experts appointed by theManagement Board in view of their excellence and their independence, following the
publication of a call for expressions of interest in the Official Journal of the European
Union.

2.

Procedures concerning the appointment of the members of the Technology Committee andits operation shall be specified in the rules of procedure of the Management Board andshall be made public.

3.

The members of the Committee shall be independent and shall act in the public interest.
The list of members of the Committee shall be made public and shall be updated by the EU
Centre on its website.

4.

When a member no longer meets the criteria of independence, he or she shall inform theManagement Board. Alternatively, the Management Board may declare, on a proposal ofat least one third of its members or of the Commission, a lack of independence and revoke
the person concerned. The Management Board shall appoint a new member for theremaining term of office in accordance with the procedure for ordinary members.

7842/23
ANNEX

JAI.1

FL/ml

81

LIMITEEN5.

The mandates of members of the Technology Committee shall be four years. Thosemandates shall be renewable once.

6.

The Technology Committee shall(a)contribute to the EU Centre’s opinions referred to in Article 7(3), first subparagraph,point (d);(b)

contribute to the EU Centre’s assistance to the Coordinating Authorities, theManagement Board, the Executive Board and the Executive Director, in respect ofmatters related to the use of technology;(c)provide internally, upon request, expertise on matters related to the use of technology
for the purposes of prevention and detection of child sexual abuse online.
Article 66a
Appointment and tasks of the Victims and Survivors Board

1.

The Victims and Survivors Board shall be comprised of adult victims and survivors ofchild sexual abuse who, following a call for expressions of interest published in the
Official Journal of the European Union, will be appointed by the Management Board on
the basis of their personal experience, expertise and independence.

2.

The procedures governing the appointment of the members of the Victims and Survivors
Board, its functioning and the conditions governing the transmission of information to
the Victims and Survivors Board shall be laid down in the Management Board’s Rules ofProcedure, and shall be published.

3.

The members of the Victims and Survivors Board shall be independent and shall act in
the interest of persons affected by online child sexual abuse. The EU Centre shall publish
on its website and keep up to date the list of the members of the Victims and Survivors
Board.

4.

Members who cease to be independent shall inform the Management Board accordingly.
Otherwise, the Management Board, at the proposal of at least one third of its members orof the Commission, may determine that they lack sufficient independence and revoke
their appointment. The Management Board shall appoint new members to replace themfor the remainder of their predecessors’ term of office, following the same procedure as
the one governing ordinary members.

5.

The term of office of members of the Victims and Survivors Board shall be four years. It
may be renewed once.

6.

The Executive Director and the Management Board may consult the Victims andSurvivors Board in connection with all matters concerning persons affected by online
child sexual abuse.

7842/23
ANNEX

JAI.1

FL/ml

82

LIMITEEN7.

The Victims and Survivors Board has the following tasks:(a)make the concerns of survivors visible;(b)advise the Management Board in matters referred to in Article 57 (1), sentence 2;(c)advise the Executive Director and the Management Board as foreseen inparagraph 6;(d)incorporate their experience and expertise as regards preventing and combating
online child sexual abuse, assisting and supporting survivors(e)contribute own proposals for the work of the competent authorities Coordinating
Authorities;(f)contribute to the European networking of victims and survivors of child sexual
abuse.

Section 6
Establishment and Structure of the Budget
Subsection 1
Single Programming Document
Article 67
Budget establishment and implementation
1.

Each year the Executive Director shall draw up a draft statement of estimates of the EU
Centre’s revenue and expenditure for the following financial year, including anestablishment plan, and shall send it to the Executive Board.

2.

The Executive Board shall, on the basis of the draft statement of estimates, adopt a
provisional draft estimate of the EU Centre’s revenue and expenditure for the following
financial year and shall send it to the Commission by 31 January each year.

3.

The Executive Board shall send the final draft estimate of the EU Centre’s revenue andexpenditure, which shall include a draft establishment plan, to the European Parliament,
the Council and the Commission by 31 March each year.

4.

The Commission shall send the statement of estimates to the European Parliament and theCouncil, together with the draft general budget of the Union.

7842/23
ANNEX

JAI.1

FL/ml

83

LIMITEEN5.

On the basis of the statement of estimates, the Commission shall enter in the draft generalbudget of the Union the estimates that it considers necessary for the establishment plan andthe amount of the contribution to be charged to the general budget, which it shall place
before the European Parliament and the Council in accordance with Articles 313 and 314
of the Treaty on the Functioning of the European Union.

6.

The European Parliament and the Council shall authorise the appropriations for thecontribution from the Union to the EU Centre.

7.

The European Parliament and the Council shall adopt the EU Centre’s establishment plan.

8.

The EU Centre’s budget shall be adopted by the Executive Board. It shall become final
following the final adoption of the general budget of the Union. Where necessary, it shallbe adjusted accordingly.

9.

The Executive Director shall implement the EU Centre’s budget.

10.

Each year the Executive Director shall send to the European Parliament and the Council all
information relevant to the findings of any evaluation procedures.
Article 68
Financial rules

The financial rules applicable to the EU Centre shall be adopted by the Executive Board after
consultation with the Commission. They shall not depart from Delegated Regulation (EU)2019/71539 unless such a departure is specifically required for the operation of the EU Centre andthe Commission has given its prior consent.
Subsection 2
Presentation, implementation and control of the budget
Article 69
Budget1.

Estimates of all revenue and expenditure for the EU Centre shall be prepared each financial
year, which shall correspond to the calendar year, and shall be shown in the EU Centre’s
budget, which shall be balanced in terms of revenue and of expenditure.

2.

Without prejudice to other resources, the EU Centre’s revenue shall comprise acontribution from the Union entered in the general budget of the Union.

39

OJ L 122, 10.5.2019, p. 1.

7842/23
ANNEX

JAI.1

FL/ml

84

LIMITEEN3.

The EU Centre may benefit from Union funding in the form of delegation agreements or
ad hoc grants in accordance with its financial rules referred to in Article 68 and with theprovisions of the relevant instruments supporting the policies of the Union.

4.

The EU Centre’s expenditure shall include staff remuneration, administrative andinfrastructure expenses, and operating costs.

5.

Budgetary commitments for actions relating to large-scale projects extending over morethan one financial year may be broken down into several annual instalments.
Article 70
Presentation of accounts and discharge

1.

The EU Centre’s accounting officer shall send the provisional accounts for the financial
year (year N) to the Commission's accounting officer and to the Court of Auditors by 1
March of the following financial year (year N + 1).

2.

The EU Centre shall send a report on the budgetary and financial management for year N
to the European Parliament, the Council and the Court of Auditors by 31 March of year N
+ 1.

3.

The Commission's accounting officer shall send the EU Centre’s provisional accounts foryear N, consolidated with the Commission's accounts, to the Court of Auditors by 31
March of year N + 1.

4.

The Management Board shall deliver an opinion on the EU Centre’s final accounts for yearN.

5.

The EU Centre’s accounting officer shall, by 1 July of year N + 1, send the final accounts
for year N to the European Parliament, the Council, the Commission, the Court of Auditorsand national parliaments, together with the Management Board's opinion.

6.

The final accounts for year N shall be published in the Official Journal of the European
Union by 15 November of year N + 1.

7.

The Executive Director shall send to the Court of Auditors, by 30 September of year N + 1,
a reply to the observations made in its annual report. He or she shall also send the reply to
the Management Board.

8.

The Executive Director shall submit to the European Parliament, at the latter's request, any
information required for the smooth application of the discharge procedure for year N.

9.

On a recommendation from the Council acting by a qualified majority, the European
Parliament shall, before 15 May of year N + 2, grant a discharge to the Executive Director
in respect of the implementation of the budget for year N.

7842/23
ANNEX

JAI.1

FL/ml

85

LIMITEENSection 7
Staff
Article 71
General provisions
1.

The Staff Regulations and the Conditions of Employment of Other Servants and the rules
adopted by agreement between the institutions of the Union for giving effect thereto shallapply to the EU Centre for all matters not covered by this Regulation.

2.

The Executive Board, in agreement with the Commission, shall adopt the necessary
implementing measures, in accordance with the arrangements provided for in Article 110of the Staff Regulations.

3.

The EU Centre staff, in particular those working in areas related to detection, reporting andremoval of online child sexual abuse, shall have access to appropriate counselling andsupport services.
Article 72
Seconded national experts and other staff

1.

The EU Centre may make use of seconded national experts or other staff not employed byit.

2.

The Executive Board shall adopt rules related to staff from Member States, including thecontact officers referred to in Article 52, to be seconded to the EU Centre and update themas necessary. Those rules shall include, in particular, the financial arrangements related tothose secondments, including insurance and training. Those rules shall take into accountthe fact that the staff is seconded and to be deployed as staff of the EU Centre. They shall
include provisions on the conditions of deployment. Where relevant, the Executive Board
shall aim to ensure consistency with the rules applicable to reimbursement of the mission
expenses of the statutory staff.
Article 73
Privileges and immunities

Protocol No 7 on the Privileges and Immunities of the European Union annexed to the Treaty on the
Functioning of the European Union shall apply to the EU Centre and its staff.
Privileges and immunities of contact officers and members of their families shall be subject to anagreement between the Member State where the seat of the EU Centre is located and the otherMember States. That agreement shall provide for such privileges and immunities as are necessary
for the proper performance of the tasks of contact officers.

7842/23
ANNEX

JAI.1

FL/ml

86

LIMITEEN

Article 74
Obligation of professional secrecy
1.

Members of the Management Board and the Executive Board, and all members of the staffof the EU Centre, including officials seconded by Member States on a temporary basis, andall other persons carrying out tasks for the EU Centre on a contractual basis, shall be
subject to the requirements of professional secrecy pursuant to Article 339 of the Treaty on
the Functioning of the European Union even after their duties have ceased.

2.

The Executive Board shall ensure that individuals who provide any service, directly or
indirectly, permanently or occasionally, relating to the tasks of the EU Centre, including
officials and other persons authorised by the Executive Board or appointed by thecoordinating authorities for that purpose, are subject to requirements of professionalsecrecy equivalent to those in paragraph 1.

3.

The EU Centre shall establish practical arrangements for implementing the confidentiality
rules referred to in paragraphs 1 and 2.

4.

The EU Centre shall apply Commission Decision (EU, Euratom) 2015/44440.
Article 75
Security rules on the protection of classified and sensitive non-classified information

1.

The EU Centre shall adopt its own security rules equivalent to the Commission’s security
rules for protecting European Union Classified Information (EUCI) and sensitive nonclassified information, as set out in Commission Decisions (EU, Euratom) 2015/44341 and(EU, Euratom) 2015/444. The security rules of the EU Centre shall cover, inter alia,
provisions for the exchange, processing and storage of such information. The Executive
Board shall adopt the EU Centre’s security rules following approval by the Commission.

2.

Any administrative arrangement on the exchange of classified information with therelevant authorities of a third country or, in the absence of such arrangement, any
exceptional ad-hoc release of EUCI to those authorities, shall be subject to theCommission’s prior approval.

40
41

Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules forprotecting EU classified information (OJ L 72, 17.3.2015, p. 53).
Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in theCommission (OJ L 72, 17.3.2015, p. 41).

7842/23
ANNEX

JAI.1

FL/ml

87

LIMITEENSection 8
General provisions
Article 76
Language arrangements
The provisions laid down in Regulation No 142 shall apply to the EU Centre. The translation
services required for the functioning of the EU Centre shall be provided by the Translation Centre
for the bodies of the European Union.
Article 77
Transparency and communication
1.

Regulation (EC) No 1049/200143 shall apply to documents held by the EU Centre. The
Management Board shall, within six months of the date of its first meeting, adopt thedetailed rules for applying that Regulation.

2.

The processing of personal data by the EU Centre shall be subject to Regulation (EU)2018/1725. The Management Board shall, within six months of the date of its firstmeeting, establish measures for the application of that Regulation by the EU Centre,
including those concerning the appointment of a Data Protection Officer of the EU Centre.
Those measures shall be established after consultation of the European Data Protection
Supervisor.

3.

The EU Centre may engage in communication activities on its own initiative within its
field of competence. Communication activities shall be carried out in accordance with
relevant communication and dissemination plans adopted by the Management Board.
Article 78
Anti-fraud measures

1.

42
43

44

In order to combat fraud, corruption and other unlawful activities, Regulation (EU,
Euratom) No 883/201344 shall apply.

Regulation No 1 determining the languages to be used by the European Economic
Community (OJ 17, 6.10.1958, p. 385/58).
Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May
2001 regarding public access to European Parliament, Council and Commission documents,
Official Journal L 145 , 31/05/2001 P. 0043 – 0048.
Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11
September 2013 concerning investigations conducted by the European Anti-Fraud Office(OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of theCouncil and Council Regulation (Euratom) No 1074/1999. (OJ L 248, 18.9.2013, p. 1).

7842/23
ANNEX

JAI.1

FL/ml

88

LIMITEEN2.

The EU Centre shall accede to the Interinstitutional Agreement of 25 May 1999 between
the European Parliament, the Council of the European Union and the Commission of theEuropean Communities concerning internal investigations by OLAF within six months
from [date of start of operations as set out in Article 82] and shall adopt the appropriate
provisions applicable to its staff using the template set out in the Annex to that Agreement.

3.

The European Court of Auditors shall have the power of audit, on the basis of documents
and on the spot, over all grant beneficiaries, contractors and subcontractors who havereceived Union funds from the EU Centre.

4.

OLAF may carry out investigations, including on-the-spot checks and inspections with aview to establishing whether there has been fraud, corruption or any other illegal activity
affecting the financial interests of the Union in connection with a grant or a contract
funded by the EU Centre, in accordance with the provisions and procedures laid down inRegulation (EU, Euratom) No 883/2013 and Council Regulation (Euratom, EC) No
2185/9645.

5.

Without prejudice to paragraphs 1, 2, 3, and 4, cooperation agreements with third countries
and international organisations, contracts, grant agreements and grant decisions of the EU
Centre shall contain provisions expressly empowering the European Court of Auditors and
OLAF to conduct such audits and investigations, in accordance with their respective
competences.
Article 79
Liability

1.

The EU Centre's contractual liability shall be governed by the law applicable to thecontract in question.

2.

The Court of Justice of the European Union shall have jurisdiction to give judgment
pursuant to any arbitration clause contained in a contract concluded by the EU Centre.

3.

In the case of non-contractual liability, the EU Centre shall, in accordance with the generalprinciples common to the laws of the Member States, make good any damage caused by its
departments or by its staff in the performance of their duties.

4.

The Court of Justice of the European Union shall have jurisdiction in disputes overcompensation for damages referred to in paragraph 3.

5.

The personal liability of its staff towards the Centre shall be governed by the provisions
laid down in the Staff Regulations or Conditions of Employment applicable to them.

45

Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-the-spotchecks and inspections carried out by the Commission in order to protect the European
Communities' financial interests against fraud and other irregularities. (OJ L 292, 15.11.1996,
p. 2).

7842/23
ANNEX

JAI.1

FL/ml

89

LIMITEEN

Article 80
Administrative inquiries
The activities of the EU Centre shall be subject to the inquiries of the European Ombudsman inaccordance with Article 228 of the Treaty on the Functioning of the European Union.
Article 81
Headquarters Agreement and operating conditions
1.

The necessary arrangements concerning the accommodation to be provided for the EU
Centre in the Member State where the seat of the EU Centre is located and the facilities tobe made available by that Member State, together with the specific rules applicable in that
Member State to the Executive Director, members of the Executive Board, EU Centre staff
and members of their families shall be laid down in a Headquarters Agreement between the
EU Centre and the Member State where the seat of the EU Centre is located, concluded
after obtaining the approval of the Executive Board and no later than [2 years after theentry into force of this Regulation].

2.

The Member State where the seat of the EU Centre is located shall provide the best
possible conditions to ensure the smooth and efficient functioning of the EU Centre,
including multilingual, European-oriented schooling and appropriate transport connections.
Article 82
Start of the EU Centre's activities

1.

7842/23ANNEX

The Commission shall be responsible for the establishment and initial operation of the EU
Centre until the Executive Director has taken up his or her duties following his or her
appointment by the Executive Board in accordance with Article 65(2). For that purpose:(a)the Commission may designate a Commission official to act as interim Executive
Director and exercise the duties assigned to the Executive Director;(b)by derogation from Article 62(2)(g) and until the adoption of a decision as referred toin Article 62(4), the interim Executive Director shall exercise the appointing
authority power;(c)the Commission may offer assistance to the EU Centre, in particular by seconding
Commission officials to carry out the activities of the EU Centre under the
responsibility of the interim Executive Director or the Executive Director;(d)the interim Executive Director may authorise all payments covered by appropriations
entered in the EU Centre's budget after approval by the Executive Board and may
conclude contracts, including staff contracts, following the adoption of the EU
Centre's establishment plan.

JAI.1

FL/ml

90

LIMITEENCHAPTER VDATA COLLECTION AND TRANSPARENCY REPORTING
Article 83
Data collection
1.

Providers of relevant information society services that were subject to orders under
Articles 7, 14, 14a, 16 and 18a Providers of hosting services, providers of interpersonalcommunications services, providers of internet access services shall collect data on thefollowing topics and make that information available to the EU Centre upon request:(a)where the provider has been subject to a detection order issued in accordance with
Article 7:–

the measures taken to comply with the order, including the technologies used
for that purpose and the safeguards provided;–

the error rates of the technologies deployed to detect online child sexual abuse
and measures taken to prevent or remedy any errors;–

in relation to complaints and cases submitted by users in connection to themeasures taken to comply with the order, the number of complaints submitted
directly to the provider, the number of cases brought before a judicial authority,
the basis for those complaints and cases, the decisions taken in respect of thosecomplaints and in those cases, the average time needed for taking thosedecisions and the number of instances where those decisions were subsequently
reversed;(b)

the number of removal orders and cross-border removal orders issued to theprovider in accordance with Articles 14 and 14a the average time needed forremoving or disabling access to the item or items of child sexual abuse material inquestion;(c)the total number of items of child sexual abuse material that the provider removed or
to which it disabled access, broken down by whether the items were removed oraccess thereto was disabled pursuant to a removal order, cross-border removal
order or to a notice submitted by a Competent Authority, the EU Centre or a third
party or at the provider’s own initiative;(d)the number of blocking orders issued to the provider in accordance with Article 16;(da) the number of delisting orders issued to the provider in accordance with Article
18a;7842/23
ANNEX

JAI.1

FL/ml

91

LIMITE

EN

(e)

2.

The Coordinating Authorities competent authorities shall collect data on the following
topics and make that information available to the EU Centre upon request:(a)46

the number of instances in which the provider invoked Article 8(3), Article 14(5) or(6), or Article 17(4a) or (5) or Article 18b(4) or (5), together with the reasons
grounds therefor;the follow-up given to reports of potential online child sexual abuse that the EU
Centre forwarded in accordance with Article 48(3), specifying for each report:–

whether the report led to the launch of a criminal investigation, contributed toan ongoing investigation, led to taking any other action or led to no action;–

where the report led to the launch of a criminal investigation or contributed toan ongoing investigation, the state of play or outcome of the investigation,
including whether the case was closed at pre-trial stage, whether the case led tothe imposition of penalties, whether victims were identified and rescued and if
so their numbers differentiating by gender and age, and whether any suspects
were arrested and any perpetrators were convicted and if so their numbers;–

where the report led to any other action, the type of action, the state of play oroutcome of that action and the reasons for taking it;–

where no action was taken, the reasons for not taking any action;46(b)

the most important and recurrent risks of online child sexual abuse, as reported byproviders of hosting services and providers of interpersonal communications services
in accordance with Article 5 3 or identified through other information available to the
Coordinating Authority;(c)a list of the providers of hosting services and providers of interpersonalcommunications services to which the Coordinating Authority addressed a detection
order in accordance with Article 7;

PCY comment: The PCY concludes that many delegations have objections to this provision,at least as regards the level of detail. The PCY also observes that it would be a major
undertaking to ensure that a report is flagged as it is processed or being an element of aprocess in a way that ensures a feedback loop whenever a measure is taken in connection withthe processing. The PCY would like to hear if delegations see prospects for a simplified
reporting requirement concerning the follow-up of reports or if such reporting shouldbe part of future developments.

7842/23
ANNEX

JAI.1

FL/ml

92

LIMITEEN(d)the number of detection orders issued in accordance with Article 7, broken down by
provider and by type of online child sexual abuse, and the number of instances inwhich the provider invoked Article 8(3);(e)

a list of providers of hosting services to which the Coordinating Authority issued aremoval order or cross-border removal order were issued in accordance with
Articles 14 and 14a;(f)

the number of removal orders issued in accordance with Article 14, broken down by
provider, the time needed to remove or disable access to the item or items of childsexual abuse material concerned, and the number of instances in which the provider
invoked Article 14(5) and (6);(g)

the number of blocking orders issued in accordance with Article 16, broken down by
provider, and the number of instances in which the provider invoked Article 17(4a)or (5);(h)a list of relevant information society services to which the Coordinating
Authority addressed a decision taken pursuant to Articles 27, 28 or 29, the typeof decision taken, and the reasons for taking it;(i)

the instances in which the opinion of the EU Centre pursuant to Article 7(4)(d)substantially deviated from the opinion of the Coordinating Authority, specifying thepoints at which it deviated and the main reasons for the deviation;.

(ga) the number of complaints received in accordance with Article 34 broken downby what the alleged infringement of this Regulation was concerned with andwho submitted the complaint.
3.

47

The EU Centre shall collect data and generate statistics on the detection, reporting,removal of or disabling of access to online child sexual abuse under this Regulation. The
data shall be in particular on the following topics:47(a)the number of indicators in the databases of indicators referred to in Article 44 andthe development of that number as compared to previous years;(b)the number of submissions of child sexual abuse material and solicitation of childrenreferred to in Article 36(1), broken down by Member State that designated thesubmitting Coordinating Authorities, and, in the case of child sexual abuse material,
the number of indicators generated on the basis thereof and the number of uniform
resource locators included in the list of uniform resource locators in accordance with
Article 44(3);PCY comment: It seems to the PCY that several items in paragraph 3 can only be properly
assessed and discussed once increased clarity on the outcome of their respective basis isreached.

7842/23
ANNEX

JAI.1

FL/ml

93

LIMITEEN

4.

7842/23
ANNEX(c)the total number of reports submitted to the EU Centre in accordance with Article 12,
broken down by provider of hosting services and provider of interpersonalcommunications services that submitted the report and by Member State thecompetent authority of which the EU Centre forwarded the reports to in accordancewith Article 48(3);(d)

the online child sexual abuse to which the reports relate, including the number of
items of potential known and new child sexual abuse material and instances ofpotential solicitation of children included in the reports the Member State thecompetent authority of which the EU Centre forwarded the reports to in accordancewith Article 48(3), and type of relevant information society service that the reporting
provider offers;(e)the number of reports that the EU Centre considered manifestly unfounded, as
referred to in Article 48(2);(f)

the number of reports relating to potential new child sexual abuse material andsolicitation of children that were assessed as not constituting child sexual abusematerial of which the EU Centre was informed pursuant to Article 36(3), broken
down by Member State;(g)

the results of the searches in accordance with Article 49(1), including the number ofimages, videos and URLs by Member State where the material is hosted;(h)where the same item of potential child sexual abuse material was reported more thanonce to the EU Centre in accordance with Article 12 or detected more than once
through the searches in accordance with Article 49(1), the number of times that that
item was reported or detected in that manner.

(i)the number of notices and number of providers of hosting services notified by the EU
Centre pursuant to Article 49(2);(j)

number of victims of online child sexual abuse assisted by the EU Centre pursuant to
Article 21(2), and the number of these victims that requested to receive suchassistance in a manner accessible to them due to disabilities.

Providers of relevant information society services that were subject to orders under
Articles 7, 14, 14a, 16 and 18a The providers of hosting services, providers ofinterpersonal communications services and providers of internet access services, theCoordinating Authorities [or other competent authorities] and the EU Centre shallensure that the data referred to in paragraphs 1, 2 and 3, respectively, is stored no longer
than is necessary for the transparency reporting referred to in Article 84. The data storedreferred to in paragraphs 1 to 3 shall not contain any personal data.

JAI.1

FL/ml

94

LIMITEEN

5.

They shall ensure that the data is stored in a secure manner and that the storage is subject
to appropriate technical and organisational safeguards. Those safeguards shall ensure, inparticular, that the data can be accessed and processed only for the purpose for which it isstored, that a high level of security is achieved and that the information is deleted when nolonger necessary for that purpose. They shall regularly review those safeguards and adjust
them where necessary.
Article 84
Transparency reporting1.

Each provider of relevant information society services that were subject to orders under
Articles 7, 14, 14a, 16 and 18a during the relevant year shall draw up an annual reporton its activities under this Regulation. That report shall compile the information referred toin Article 83(1). The providers shall, by 31 January of every year subsequent to the year towhich the report relates, make the report available to the public and communicate it to the
Coordinating Authority of establishment, the Commission and the EU Centre.

2.

Each Coordinating Authority shall draw up an annual report on its activities under thisRegulation. That report shall compile the information referred to in Article 83(2). It shall,by 31 March of every year subsequent to the year to which the report relates, make thereport available to the public and communicate it to the Commission and the EU Centre.

3.

Where a Member State has designated several competent authorities pursuant to Article 25,
it shall ensure that the Coordinating Authority draws up a single report covering theactivities of all competent authorities under this Regulation and that the Coordinating
Authority receives all relevant information and support needed to that effect from the othercompetent authorities concerned.

4.

The EU Centre, working in close cooperation with the Coordinating Authorities, shall draw
up an annual report on its activities under this Regulation. That report shall also compile
and analyse the information contained in the reports referred to in paragraphs 2 and Article
83(3). The EU Centre shall, by 30 June of every year subsequent to the year to which thereport relates, make the report available to the public and communicate it to theCommission.

5.

The annual transparency reports referred to in paragraphs 1, 2 and 3 shall not include any
information that may prejudice ongoing activities for the assistance to victims or theprevention, detection, investigation or prosecution of child sexual abuse offences. They
shall also not contain any personal data.

6.

The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to supplement this Regulation with the necessary templates and detailed rules
concerning the form, precise content and other details of the reports and the reporting
process pursuant to paragraphs 1, 2 and 3.

7842/23
ANNEX

JAI.1

FL/ml

95

LIMITEENCHAPTER VI
FINAL PROVISIONS
Article 85
Evaluation
1.

By [five years after the entry into force of this Regulation], and every five years thereafter,
the Commission shall evaluate this Regulation and submit a report on its application to theEuropean Parliament and the Council.

2.

By [five years after the entry into force of this Regulation], and every five years thereafter,
the Commission shall ensure that an evaluation in accordance with Commission guidelinesof the EU Centre’s performance in relation to its objectives, mandate, tasks andgovernance and location is carried out. The evaluation shall, in particular, address thepossible need to modify the tasks of the EU Centre, and the financial implications of any
such modification.

3.

On the occasion of every second evaluation referred to in paragraph 2, the results achievedby the EU Centre shall be assessed by the Commission, having regard to its objectives andtasks, including an assessment of whether the continuation of the EU Centre is still
justified with regard to those objectives and tasks.

4.

The Commission shall report to the European Parliament and the Council the findings ofthe evaluation referred to in paragraph 3. The findings of the evaluation shall be madepublic.

5.

For the purpose of carrying out the evaluations referred to in paragraphs 1, 2 and 3, theCoordinating Authorities and Member States and the EU Centre shall provide information
to the Commission at its request.

6.

In carrying out the evaluations referred to in paragraphs 1, 2 and 3, the Commission shalltake into account the relevant evidence at its disposal.

7.

Where appropriate, the reports referred to in paragraphs 1 and 4 shall be accompanied bylegislative proposals.

7842/23
ANNEX

JAI.1

FL/ml

96

LIMITEEN

Article 86
Exercise of the delegation
1.

The power to adopt delegated acts is conferred on the Commission subject to theconditions laid down in this Article.

2.

The power to adopt delegated acts referred to in Articles 3, 8, 13, 14, 17, 47 and 84 shall be
conferred on the Commission for an indeterminate period of time from [date of adoption of
the Regulation] 48.

3.

The delegation of power referred to in Articles 3, 8, 13, 14, 17, 47 and 84 may be revokedat any time by the European Parliament or by the Council. A decision to revoke shall put
an end to the delegation of the power specified in that decision. It shall take effect the day
after the publication of the decision in the Official Journal of the European Union or at alater date specified therein. It shall not affect the validity of any delegated acts already inforce.

4.

Before adopting a delegated act, the Commission shall consult experts designated by each
Member State in accordance with the principles laid down in the Inter-institutional
Agreement of 13 April 2016 on Better Law-Making.

5.

As soon as it adopts a delegated act, the Commission shall notify it simultaneously to theEuropean Parliament and to the Council.

6.

A delegated act adopted pursuant to Articles 3, 8, 13, 14, 17, 47 and 84 shall enter into
force only if no objection has been expressed either by the European Parliament or theCouncil within a period of two months of notification of that act to the European
Parliament and the Council or if, before the expiry of that period, the European Parliament
and the Council have both informed the Commission that they will not object. That period
shall be extended by two months at the initiative of the European Parliament or of theCouncil.

48

PCY comment: The PCY has taken note of the comment from some delegations that thedelegation in relation to Article 47 is concerned with subject-matters that may not beappropriate for such delegation due to its principal nature. The PCY suggests that thisparticular issue is discussed in connection with Article 47 and, where needed, in connection
with the other Articles referred to here.

7842/23
ANNEX

JAI.1

FL/ml

97

LIMITEEN

Article 87
Committee procedure1.

For the purposes of the adoption of the implementing acts referred to in Article 39(4), theCommission shall be assisted by a committee. That committee shall be a committee within
the meaning of Regulation (EU) No 182/2011.

2.

Where reference is made to this paragraph, Article 4 of Regulation (EU) No 182/2011 shallapply.
Article 8849
RepealRegulation (EU) 2021/1232 is repealed from [date of application of this Regulation].
Article 89
Entry into force and application
This Regulation shall enter into force on the twentieth day following that of its publication in the
Official Journal of the European Union.
It shall apply from 18 6 months after its entry into force.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels,
For the European Parliament

For the Council

The President

The President

49

PCY comment: Many delegations are in favour of exploring how the Temporary Regulation
could be prolonged and/or how to allow voluntary detection on a permanent basis byincluding the provisions of the Temporary Regulation in this Regulation.

7842/23
ANNEX

JAI.1

FL/ml

98

LIMITEEN

ANNEX
Article 27 [clean version of former Art 27-30]
Investigatory and enforcement powers
1.

2.

7842/23
ANNEX

Where needed in order to carrying out their tasks under this Regulation, competentauthorities shall have the following powers of investigation, in respect of conduct byproviders of relevant information society services falling within the competence of their
Member State:(a)the power to require those providers, as well as any other persons acting for purposes
related to their trade, business, craft or profession that may reasonably be aware of
information relating to a suspected infringement of this Regulation, to provide suchinformation without undue delay;(b)the power to carry out, or to request a judicial authority to order, inspections of any
premises that those providers or those persons use for purposes related to their trade,business, craft or profession, or to request other public authorities to do so, in order
to examine, seize, take or obtain copies of information relating to a suspected
infringement in any form, irrespective of the storage medium;(c)the power to ask any member of staff or representative of those providers or those
persons to give explanations in respect of any information relating to a suspected
infringement and to record the answers by any technical means;(d)the power to request information, including to assess whether the measures taken to
execute a detection order, removal order, blocking order or delisting order comply
with the requirements of this Regulation.

Where needed for carrying out their tasks under this Regulation, competent authorities
shall have the following enforcement powers, in respect of providers of relevant
information society services falling within the competence of their Member State:(a)the power to accept the commitments offered by those providers in relation to theircompliance with this Regulation and to make those commitments binding;(b)

the power to order the cessation of infringements and, where appropriate, to impose
remedies proportionate to the infringement and necessary to bring the infringement
effectively to an end or to request a judicial authority to do so;(c)the power to impose fines, or request a judicial authority in their Member State to doso, in accordance with Article 35 for failure to comply with this Regulation,
including any of the investigative orders issued pursuant to paragraph 1 of this
Article;

JAI.1

FL/ml

99

LIMITEEN(d)the power to impose a periodic penalty payment, or to request a judicial authority to
do so, in accordance with Article 35 to ensure that an infringement is terminated incompliance with an order issued pursuant to point (b) of this subparagraph or for
failure to comply with any of the orders issued pursuant to paragraph 1 of this
Article.

(e)the power to adopt interim measures or to request the competent national judicial
authority to do so, to avoid the risk of serious harm.

As regards the first subparagraph, points (c) and (d), competent authorities shall also havethe enforcement powers set out in those points in respect of the other persons referred to inparagraph 1, for failure to comply with any of the orders issued to them pursuant to thatparagraph. They shall only exercise those enforcement powers after having provided thoseother persons in good time with all relevant information relating to such orders, including
the applicable period, the fines or periodic payments that may be imposed for failure tocomply and the possibilities for redress.
3.

Where needed for carrying out their tasks under this Regulation, competent authorities
shall, in respect of providers of relevant information society services falling within thecompetence of their Member State, where all other powers pursuant to this Article to bringabout the cessation of an infringement have been exhausted and the infringement has notbeen remedied or is continuing and is causing serious harm which cannot be avoided
through the exercise of other powers available under Union or national law, also have thepower to take the following measures:(a)to require the management body of the providers, without undue delay, to examine
the situation, to adopt and submit an action plan setting out the necessary measures toterminate the infringement, to ensure that the provider takes those measures, and toreport on the measures taken;(b)where the competent authorities, including the Coordinating Authorities consider thata provider of relevant information society services has not sufficiently complied withthe requirements of point (a), that the infringement has not been remedied or iscontinuing and is causing serious harm, and that that infringement entails a criminal
offence involving a threat to the life or safety of persons or the infringement resultsin the regular and structural facilitation of child sexual abuse offences, to request thatthe competent judicial authority or other independent administrative authority of its
Member State order the temporary restriction of access of users of the service
concerned by the infringement or, only where that is not technically feasible, to theonline interface of the provider on which the infringement takes place.

The competent authorities, including the Coordinating Authorities, shall, prior to
submitting the request referred to in this paragraph, point (b), invite interested parties tosubmit written observations within a period that shall not be less than two weeks,
describing the measures that it intends to request and identifying the intended addressee oraddressees thereof. The provider, the intended addressee or addressees and any other third
party demonstrating a legitimate interest shall be entitled to participate in the proceedings
before the competent judicial authority or other independent administrative authority.

7842/23
ANNEX

JAI.1

FL/ml

100

LIMITEEN

Any measure ordered shall be proportionate to the nature, gravity, recurrence and durationof the infringement, without unduly restricting access to lawful information by users of theservice concerned.
The restriction of access shall be for a period of four weeks, subject to the possibility forthe competent judicial authority or other independent administrative authority of theMember State, in its order, to allow the competent authorities, including the Coordinating
Authorities, to extend that period for further periods of the same lengths, subject to a
maximum number of extensions set by a that judicial authority or other independentadministrative authority.
The competent authorities, including the Coordinating Authorities, referred to in theprevious subparagraph shall only extend the period where, having regard to the rights andinterests of all parties affected by that restriction and all relevant circumstances, including
any information that the provider, the addressee or addressees and any other third party
that demonstrated a legitimate interest may provide to it, it considers that both of thefollowing conditions have been met:(a)the provider has failed to take the necessary measures to terminate the infringement;(b)

the temporary restriction does not unduly restrict access to lawful information byusers of the service, having regard to the number of users affected and whether any
adequate and readily accessible alternatives exist.

Where the competent authority, including the Coordinating Authority, considers that theconditions set out in the fourth subparagraph, points (a) and (b) have been met but it cannot
further extend the period pursuant to the fourth subparagraph, it shall submit a new request
to the competent judicial authority or other independent administrative authority, as
referred to in the first subparagraph, point (b).
4.

The measures taken by the competent authorities, including the Coordinating Authorities,
in the exercise of their powers listed in paragraphs 1, 2 and 3 shall be effective, dissuasive
and proportionate, having regard, in particular, to the nature, gravity, recurrence andduration of the infringement or suspected infringement to which those measures relate, as
well as the economic, technical and operational capacity of the provider of relevant
information society services concerned, where relevant.

5.

Member States shall lay down specific rules and procedures for the exercise of the powers
pursuant to paragraphs 1, 2 and 3 and shall ensure that any exercise of those powers is
subject to adequate safeguards laid down in the applicable national law in compliance with
the Charter and with the general principles of Union law. In particular, those measures
shall only be taken in accordance with the right to respect for private life and the rights ofdefence, including the rights to be heard and of access to the file, and subject to the right toan effective judicial remedy of all affected parties.

7842/23
ANNEX

JAI.1

FL/ml

101

LIMITE

EN