Council of theEuropean Union
Brussels, 28 May 2024
(OR. en)9093/24
Interinstitutional File:2022/0155(COD)

LIMITE
JAI 665
ENFOPOL 188
CRIMORG 61
IXIM 118DATAPROTECT 186
CYBER 128
COPEN 199
FREMP 203
TELECOM 160
COMPET 446
MI 427CONSOM 161
DIGIT 119
CODEC 1140

NOTE
From:
To:

Presidency
Law Enforcement Working Party (Police)

No. prev. doc.:

8579/24

Subject:

Proposal for a Regulation of the European Parliament and of the Council
laying down rules to prevent and combat child sexual abuse‒

Presidency compromise texts

With a view to the meeting of the Law Enforcement Working Party (Police) on 4 June 2024,
delegations will find in the Annex Presidency compromise texts on the above proposal.
Changes to the Commission proposal are marked in bold and strikethrough.
New changes to the Commission proposal in comparison to document 8579/24 are marked in bold
underline and strikethrough underline.

9093/24
JAI.1

GR/ml

1

LIMITEEN

ANNEX
Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
laying down rules to prevent and combat child sexual abuse(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114
thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Having regard to the opinion of the European Economic and Social Committee1,
Having regard to the opinion of the Committee of the Regions2,
Having regard to the opinion of the European Data Protection Board and the European Data
Protection Supervisor3,
Acting in accordance with the ordinary legislative procedure,
Whereas:(1)

Information society services have become very important for communication, expression,
gathering of information and many other aspects of present-day life, including for children
but also for perpetrators of child sexual abuse offences. Such offences, which are subject tominimum rules set at Union level, are very serious criminal offences that need to beprevented and combated effectively in order to protect children’s rights and well-being, as isrequired under the Charter of Fundamental Rights of the European Union (‘Charter’), and toprotect society at large. Users of such services offered in the Union should be able to trustthat the services concerned can be used safely, especially by children.

1

OJ C , , p. .
OJ C , , p. .
OJ C , , p. .

239093/24
ANNEX

JAI.1

GR/ml

2

LIMITEEN

(2)Given the central importance of relevant information society services, those aims can only
be achieved by ensuring that providers offering such services in the Union behave
responsibly and take reasonable measures to minimise the risk of their services being
misused for the purpose of child sexual abuse, those providers often being the only ones in aposition to prevent and combat such abuse. The measures taken should be targeted, carefullybalanced and proportionate, so as to avoid any undue negative consequences for those who
use the services for lawful purposes, in particular for the exercise of their fundamental rights
protected under Union law, that is, those enshrined in the Charter and recognised as generalprinciples of Union law, and so as to avoid imposing any excessive burdens on the providersof the services.

(3)

Member States are increasingly introducing, or are considering introducing, national laws toprevent and combat online child sexual abuse, in particular by imposing requirements onproviders of relevant information society services. In the light of the inherently cross-bordernature of the internet and the service provision concerned, those national laws, which
diverge, have a direct negative effect on the internal market. To increase legal certainty,
eliminate the resulting obstacles to the provision of the services and ensure a level playing
field in the internal market, the necessary harmonised requirements should be laid down atUnion level.

(4)

Therefore, this Regulation should contribute to the proper functioning of the internal market
by setting out clear, uniform and balanced rules to prevent and combat child sexual abuse ina manner that is effective and that respects the fundamental rights of all parties concerned. In
view of the fast-changing nature of the services concerned and the technologies used toprovide them, those rules should be laid down in technology-neutral and future-proof
manner, so as not to hamper innovation.

(5)

In order to achieve the objectives of this Regulation, it should cover providers of services
that have the potential to be misused for the purpose of online child sexual abuse. As they
are increasingly misused for that purpose, those services should include publicly available
interpersonal communications services, such as messaging services and web-based e-mailservices, in so far as those services as are publicly available. As services which enable directinterpersonal and interactive exchange of information merely as a minor ancillary featurethat is intrinsically linked to another service, such as chat and similar functions as part ofgaming, image-sharing and video-hosting are equally at risk of misuse, they should also becovered by this Regulation. However, given the inherent differences between the various
relevant information society services covered by this Regulation and the related varying
risks that those services are misused for the purpose of online child sexual abuse and varying
ability of the providers concerned to prevent and combat such abuse, the obligations
imposed on the providers of those services should be differentiated in an appropriatemanner.

9093/24
ANNEX

JAI.1

GR/ml

3

LIMITEEN

(6)Online child sexual abuse frequently involves the misuse of information society services
offered in the Union by providers established in third countries. In order to ensure theeffectiveness of the rules laid down in this Regulation and a level playing field within theinternal market, those rules should apply to all providers, irrespective of their place of
establishment or residence, that offer services in the Union, as evidenced by a substantial
connection to the Union.

(7)

This Regulation should be without prejudice to the rules resulting from other Union acts, inparticular Directive 2011/93 of the European Parliament and of the Council4, Directive
2000/31/EC of the European Parliament and of the Council5 and Regulation (EU) 2022/2065…/… of the European Parliament and of the Council6 [on a Single Market For Digital
Services (Digital Services Act) and amending Directive 2000/31/EC], Directive 2010/13/EUof the European Parliament and of the Council 7, Regulation (EU) 2016/679 of the European
Parliament and of the Council8, and Directive 2002/58/EC of the European Parliament andof the Council9.

4

Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011
on combating the sexual abuse and sexual exploitation of children and child pornography,
and replacing Council Framework Decision 2004/68/JHA (OJ L 335, 17.12.2011, p. 1).
Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on
certain legal aspects of information society services, in particular electronic commerce, in
the Internal Market ('Directive on electronic commerce') (OJ L 178, 17.7.2000, p. 1).
Regulation (EU) 2022/2065 …/… of the European Parliament and of the Council on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC (OJ L ….).
Directive 2010/13/EU of the European Parliament and of the Council of 10 March 2010 on
the coordination of certain provisions laid down by law, regulation or administrative actionin Member States concerning the provision of audiovisual media service (OJ L 95,
15.4.2010, p. 1).
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on thefree movement of such data, and repealing Directive 95/46/EC (OJ L 119, 4.5.2016, p. 1).
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002
concerning the processing of personal data and the protection of privacy in the electronic
communications sector (‘Directive on privacy and electronic communications’) (OJ L 201,
31.7.2002, p. 37).

5

6

7

8

9

9093/24
ANNEX

JAI.1

GR/ml

4

LIMITEEN

(8)This Regulation should be considered lex specialis in relation to the generally applicable
framework set out in Regulation (EU) 2022/2065 …/… of the European Parliament and of
the Council10 [on a Single Market For Digital Services (Digital Services Act) and amending
Directive 2000/31/EC] laying down harmonised rules on the provision of certain
information society services in the internal market. The rules set out in Regulation (EU)2022/2065 …/… of the European Parliament and of the Council11 [on a Single Market For
Digital Services (Digital Services Act) and amending Directive 2000/31/EC] apply inrespect of issues that are not or not fully addressed by this Regulation.

(9)

Article 15(1) of Directive 2002/58/EC allows Member States to adopt legislative measures
to restrict the scope of the rights and obligations provided for in certain specific provisionsof that Directive relating to the confidentiality of communications when such restriction
constitutes a necessary, appropriate and proportionate measure within a democratic society,inter alia, to prevent, investigate, detect and prosecute criminal offences, provided certain
conditions are met, including compliance with the Charter. Applying the requirements ofthat provision by analogy, this Regulation should limit the exercise of the rights andobligations provided for in Articles 5(1), (3) and 6(1) of Directive 2002/58/EC, insofar as
strictly necessary to execute detection orders issued in accordance with this Regulation witha view to prevent and combat online child sexual abuse.

(10)

In the interest of clarity and consistency, the definitions provided for in this Regulation
should, where possible and appropriate, be based on and aligned with the relevant
definitions contained in other acts of Union law, such as Regulation (EU) 2022/2065 …/…
of the European Parliament and of the Council12 [on a Single Market For Digital Services(Digital Services Act) and amending Directive 2000/31/EC].

10

Regulation (EU) …/…2022/ 2065 of the European Parliament and of the Council on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC (OJ L ….).
Regulation (EU) …/… 2022/2065 of the European Parliament and of the Council on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC (OJ L ….).
Regulation (EU) …/… of the European Parliament and of the Council on a Single Market
For Digital Services (Digital Services Act) and amending Directive 2000/31/EC (OJ L ….).

11

129093/24
ANNEX

JAI.1

GR/ml

5

LIMITEEN(11)A substantial connection to the Union should be considered to exist where the relevant
information society services has an establishment in the Union or, in its absence, on thebasis of the existence of a significant number of users in one or more Member States, or thetargeting of activities towards one or more Member States. The targeting of activities
towards one or more Member States should be determined on the basis of all relevant
circumstances, including factors such as the use of a language or a currency generally usedin that Member State, or the possibility of ordering products or services, or using a national
top level domain. The targeting of activities towards a Member State could also be derived
from the availability of a software application in the relevant national software application
store, from the provision of local advertising or advertising in the language used in that
Member State, or from the handling of customer relations such as by providing customer
service in the language generally used in that Member State. A substantial connection
should also be assumed where a service provider directs its activities to one or more
Member State as set out in Article 17(1), point (c), of Regulation (EU) 1215/2012 of theEuropean Parliament and of the Council13. Mere technical accessibility of a website from theUnion should not, alone, be considered as establishing a substantial connection to the Union.

(12)

For reasons of consistency and technological neutrality, the term ‘child sexual abusematerial’ should for the purpose of this Regulation be defined as referring to any type ofmaterial constituting child pornography or pornographic performance within the meaning of
Directive 2011/93/EU, which is capable of being disseminated through the use of hosting orinterpersonal communication services. At present, such material typically consists of images
or videos, without it however being excluded that it takes other forms, especially in view of
future technological developments.

(12a) In the light of the more limited risk of their use for the purpose of child sexual abuse
and the need to preserve confidential information, including classified information,
information covered by professional secrecy and trade secrets, electronic
communications services that are not publicly available, such as those used for national
security purposes, should be excluded from the scope of this Regulation. Accordingly,
this Regulation should not apply to interpersonal communications services that are notavailable to the general public and the use of which is instead restricted to persons
involved in the activities of a particular company, organisation, body or authority14.

13

14

Regulation (EU) No 1215/2012 of the European Parliament and of the Council of 12
December 2012 on jurisdiction and the recognition and enforcement of judgments in civil
and commercial matters (OJ L 351, 20.12.2012, p. 1).
Refers to Art. 1(2a) and (2b).

9093/24
ANNEX

JAI.1

GR/ml

6

LIMITEEN(13)The term ‘online child sexual abuse’ should cover not only the dissemination of material
previously detected and confirmed as constituting child sexual abuse material (‘known’material), but also of material not previously detected that is likely to constitute child sexual
abuse material but that has not yet been confirmed as such (‘new’ material), as well asactivities constituting the solicitation of children (‘grooming’). That is needed in order toaddress not only past abuse, the re-victimisation and violation of the victims’ rights it
entails, such as those to privacy and protection of personal data, but to also address recent,ongoing and imminent abuse, so as to prevent it as much as possible, to effectively protect
children and to increase the likelihood of rescuing victims and stopping perpetrators.

(14)

With a view to minimising the risk that their services are misused for the dissemination of
known or new child sexual abuse material or the solicitation of children, providers of
hosting services and providers of publicly available interpersonal communications services
should assess such risk for each of the services that they offer in the Union. To guide theirrisk assessment, a non-exhaustive list of elements to be taken into account should be
provided. To allow for a full consideration of the specific characteristics of the services they
offer, providers should be allowed to take account of additional elements where relevant. As
risks evolve over time, in function of developments such as those related to technology andthe manners in which the services in question are offered and used, it is appropriate toensure that the risk assessment is updated regularly and when needed for particular reasons.

(15)

Some of those providers of relevant information society services in scope of this Regulation
may also be subject to an obligation to conduct a risk assessment under Regulation (EU)2022/2065 …/… of the European Parliament and of the Council15 [on a Single Market For
Digital Services (Digital Services Act) and amending Directive 2000/31/EC] with respect toinformation that they store and disseminate to the public. For the purposes of the present
Regulation, those providers may draw on such a risk assessment and complement it with amore specific assessment of the risks of use of their services for the purpose of online childsexual abuse, as required by this Regulation.

15

Regulation (EU) …/… 2022/2065 of the European Parliament and of the Council on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC (OJ L ….).

9093/24
ANNEX

JAI.1

GR/ml

7

LIMITEEN

(16)In order to prevent and combat online child sexual abuse effectively, providers of hosting
services and providers of publicly available interpersonal communications services shouldtake reasonable measures to mitigate the risk of their services being misused for such abuse,as identified through the risk assessment. Providers subject to an obligation to adopt
mitigation measures pursuant to Regulation (EU) 2022/2065 …/… of the European
Parliament and of the Council16 [on a Single Market For Digital Services (Digital ServicesAct) and amending Directive 2000/31/EC] may consider to which extent mitigation
measures adopted to comply with that obligation, which may include targeted measures toprotect the rights of the child, including age verification and parental control tools, may also
serve to address the risk identified in the specific risk assessment pursuant to thisRegulation, and to which extent further targeted mitigation measures may be required tocomply with this Regulation.

(16a) Age verification and age assessment measures taken under this Regulation shouldpreserve privacy, respecting the principles relating to the processing of personal data,
notably the principles of lawfulness, purpose limitation and data minimisation,
including by being in compliance with Regulation (EU) 2016/679. Those measures
should take as a primary consideration the best interest of the child, including theprotection of their personal data, be proportionate, transparent, effective and accurate.
The obligation to ensure data protection by design and default is of particularimportance to protect the personal data of children while ensuring a safe online
environment for children. The age verification and age assessment measures should
also be non-discriminatory and accessible17.
(17)

To allow for innovation and ensure proportionality and technological neutrality, no
exhaustive list of the compulsory mitigation measures should be established. Instead,providers should be left a degree of flexibility to design and implement measures tailored to
the risk identified and the characteristics of the services they provide and the manners inwhich those services are used. In particular, providers are free to design and implement, in
accordance with Union law, measures based on their existing practices to detect online childsexual abuse in their services and indicate as part of the risk reporting their willingness andpreparedness to eventually being issued a detection order under this Regulation, if deemednecessary by the competent national authority.

16

Regulation (EU) …/… 2022/2065 of the European Parliament and of the Council on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC (OJ L ….).
Refers to Art. 4(3).

179093/24
ANNEX

JAI.1

GR/ml

8

LIMITEEN

(18)In order to ensure that the objectives of this Regulation are achieved, that flexibility should
be subject to the need to comply with Union law and, in particular, the requirements of thisRegulation on mitigation measures. Therefore, providers of hosting services and providersof publicly available interpersonal communications services should, when designing andimplementing the mitigation measures, give importance not only to ensuring theireffectiveness, but also to avoiding any undue negative consequences for other affectedparties, notably for the exercise of users’ fundamental rights. In order to ensure
proportionality, when determining which mitigation measures should reasonably be taken ina given situation, account should also be taken of the financial and technological capabilities
and the size of the provider concerned. When selecting appropriate mitigation measures,providers should at least duly consider the possible measures listed in this Regulation, as
well as, where appropriate, other measures such as those based on industry best practices,
including as established through self-regulatory cooperation, and those contained in
guidelines from the Commission. When no risk has been detected after a diligently
conducted or updated risk assessment, providers should not be required to take any
mitigation measures.

(18a) In the interest of ensuring effective oversight and compliance, and given theimportance of ensuring that all possible risk mitigation measures have been taken inaccordance with this Regulation prior to the issuance of any detection order, theCoordinating Authorities should be granted specific powers to require providers of
hosting services or providers of interpersonal communications services to adjust theirrisk assessment or mitigation measures so as to ensure compliance with the relevant
requirements of this Regulation. Those specific powers should leave the Coordinating
Authorities’ general investigatory and enforcement powers under this Regulation
unaffected. Therefore, imposing such a requirement regarding the further risk
assessment or mitigation measures could be combined, where appropriate, with otherinvestigatory or enforcement measures, such as imposing a periodic penalty payment
to ensure compliance with that requirement or imposing a fine for failure to comply
with this Regulation18.

18

Refers to Art. 5a.

9093/24
ANNEX

JAI.1

GR/ml

9

LIMITEEN

(18b) With a view to make risk mitigation measures and detection orders more targeted, theservices or parts or components thereof should be categorised according to their risks
based on objective criteria and a methodology established in this Regulation that may
be updated, if required due to technological developments, by a delegated act of theCommission. Following the risk assessment and the mitigation measures put in placeby the providers, their reports to the Coordinating Authority of establishment should
include a self-assessment facilitating the categorisation of services by the Coordinating
Authority of establishment. The risk categorisation, decided by the Coordinating
Authority of establishment, taking into account the risk assessment and the risk
mitigation measures already undertaken by the providers and the self-assessment by
the providers, would have as objective to determine the risk level of services or partsand components thereof. The EU Centre could support the Coordinating Authority of
establishment by providing an assessment of the effectiveness of the mitigation
measures, technical expertise on the technologies put in place as part of the mitigation
measures or by testing the services. Based on this categorisation decision, theCoordinating Authority of establishment can impose additional risk mitigation
measures on the providers classified in the medium and high-risk categories.
Supposing significant risks still prevail after the implementation of the additional risk
mitigation measures, the Coordinating Authority may consider making a request to acompetent judicial authority to issue a detection order as a measure of last resort toservices or parts or components thereof that are classified as high risk. Providers may
flag voluntarily to the Coordinating Authority of establishment whether there isevidence suspicion of their services being used for child sexual abuse that might
require the issuing of detection orders.

9093/24
ANNEX

JAI.1

GR/ml

10

LIMITEEN

(18cb) In order to increase transparency, providers of hosting services and providers ofinterpersonal communications services should be provided with the possibility to
inform their users in an easily recognisable and officially authorised manner as
regards their compliance with relevant parts of this Regulation. They should therefore
be authorised, upon their request, to display a sign of compliance reduced risk when
the Coordinating Authority considers that they have carried out the risk assessment
and have taken all reasonable and necessary risk mitigation measures in accordancewith this Regulation, and that there is no need to initiate the process for the issuance ofa detection order. These providers should make clear to users that the sign ofcompliance reduced risk should not be understood as indicating that the risk of online
child sexual abuse is completely eliminated. Coordinating Authorities may require
these providers to conduct more frequent risk assessments or to take other measures,
including by providing additional information, where necessary for it to be able toverify that the conditions for the authorisation to display the sign of compliancereduced risk continue to be met. In any case, the Coordinating Authority that issued
the authorisation for a service provider to display such a sign of compliance reduced
risk should reassess at least every 6 months whether the conditions for thisauthorisation are still met19.
(19)

In the light of their role as intermediaries facilitating access to software applications that
may be misused for online child sexual abuse, providers of software application storesshould be made subject to obligations to take certain reasonable measures to assess andmitigate that risk. The providers should make that assessment in a diligent manner, making
efforts that are reasonable under the given circumstances, having regard inter alia to thenature and extent of that risk as well as their financial and technological capabilities andsize, and cooperating with the providers of the services offered through the software
application where possible.

(20)

With a view to ensuring effective prevention and fight against online child sexual abuse,
when after mitigating measures are have been deemed insufficient to limit the risk ofmisuse of a certain service for the purpose of online child sexual abuse, the Coordinating
Authorities designated by Member States under this Regulation should be empowered torequest the issuance of detection orders. In order to avoid any undue interference with
fundamental rights and to ensure proportionality, that power should be subject to a carefullybalanced set of limits and safeguards. For instance, considering that child sexual abusematerial tends to be disseminated through hosting services and publicly available
interpersonal communications services, and that solicitation of children mostly takes placein publicly available interpersonal communications services, it should only be possible toaddress detection orders to providers of such services.

19

Refers to Art. 5b.

9093/24
ANNEX

JAI.1

GR/ml

11

LIMITEEN

(21)Furthermore, as parts of those limits and safeguards, detection orders should only be issued
after a diligent and objective assessment leading to the finding of a significant risk of thespecific service concerned being misused for a given type of online child sexual abusecovered by this Regulation. One of the elements to be taken into account in this regard is thelikelihood that the service is used to an appreciable extent, that is, beyond isolated andrelatively rare instances, for such abuse. The criteria should vary so as to account of thedifferent characteristics of the various types of online child sexual abuse at stake and of thedifferent characteristics of the services used to engage in such abuse, as well as the relateddifferent degree of intrusiveness of the measures to be taken to execute the detection order.
For those reasons, additional limits should be set in respect of detection orders
concerning the solicitation of children, such as the exclusion of calls, that is,connections established by means of a publicly available interpersonal communications
service allowing two-way voice communications, including such communications
between a group of more than two, yet a finite number, of persons, whereby the
persons initiating or participating in the communication determine its recipient(s).
Other interpersonal communications services, including those involving voicecommunications through recorded and transmitted voice communications, should
however remain covered and thus be potentially subject to such detection orders.

(22)

However, the finding of such a significant risk should in itself be insufficient to justify theissuance of a detection order, given that in such a case the order might lead todisproportionate negative consequences for the rights and legitimate interests of otheraffected parties, in particular for the exercise of users’ fundamental rights. Therefore, it
should be ensured that detection orders can be issued only after the Coordinating Authorities
and the competent judicial authority or independent administrative authority having
objectively and diligently assessed, identified and weighted, on a case-by-case basis, notonly the likelihood and seriousness of the potential consequences of the service being
misused for the type of online child sexual abuse at issue, but also the likelihood andseriousness of any potential negative consequences for other parties affected. With a view to
avoiding the imposition of excessive burdens, the assessment should also take account of thefinancial and technological capabilities and size of the provider concerned.

(22a) With a view to establishing that there are objective indications about the existence of asignificant risk that might require the issuing of a detection order, the Coordinating
Authority of establishment should provide the competent judicial authority withevidence information that the service or parts or components of the service have beenused for online child sexual abuse and that the risk mitigation measures have not been
sufficient to mitigate that significant risk.

9093/24
ANNEX

JAI.1

GR/ml

12

LIMITEEN

(23)In addition, to avoid undue interference with fundamental rights and ensure proportionality,
when it is established that those requirements have been met and a detection order is to beissued, it should still be ensured that the detection order is targeted and specified so as toensure that any such negative consequences for affected parties do not go beyond what isstrictly necessary to effectively address the significant risk identified. This should concern,in particular, a limitation to an identifiable part or component of the service where possible
without prejudice to the effectiveness of the measure, such as specific types of channels of apublicly available interpersonal communications service, or to specific users or specificgroups or types of users, to the extent that they can be taken in isolation for the purpose of
detection, as well as the specification of the safeguards additional to the ones alreadyexpressly specified in this Regulation, such as independent auditing, the provision of
additional information or access to data, or reinforced human oversight and review, and thefurther limitation of the duration of application of the detection order that the Coordinating
Authority deems necessary. To avoid unreasonable or disproportionate outcomes, suchrequirements should be set after an objective and diligent assessment conducted on a caseby-case basis.

(23a) To further avoid undue interference with fundamental rights and ensure
proportionality, detection orders should cover only images and the visual components
of videos and URLs, while the detection of audio communication and text should be
excluded. Despite that limitation of detection to images and the visual components ofvideos, the solicitation of children could still be identified to some extent through thedetection of visual material exchanged. The reporting by providers of hosting services
and providers of publicly available interpersonal communications services on potential
online new child sexual abuse material and attempts to solicitate children on theirservices should be limited to that material either notified to them by a user or detected
repeatedly on their services users who have been repeatedly detected as sharing
potential new child sexual abuse material or attempting to solicitate children. The firstdetection of potential new child sexual abuse material and the first and the second
detection of attempts to solicitate children on their services should be stored by theproviders as a hit in the user’s account and preserved during for at least twelve months
or, if the detection has been issued for a duration of more than twelve months, for theduration of a detection order. The stored hits should be deleted thereafter once thedetection order has expired. As an additional safeguard, the reporting to the EU
Centre of potential new child sexual abuse material detected in the service of aprovider, should be done in a pseudonymized way, so that the personal data cannot be
attributed to a specific data subject. Only after human verification by the EU Centre,
the providers should share the report with the EU Centre including the personal data
attributable to a data subject.
(23ba) In order to ensure that users are appropriately informed and that affected users can
exercise their right of redress, providers of hosting services or of interpersonalcommunications services that received a detection order issued under this Regulation
should be required to provide certain specific information in connection to themeasures taken pursuant to those orders. That requirement should not preclude thoseservice providers from providing additional information on a voluntary basis.
However, no such required or voluntary provision of information should reduce theeffectiveness of the measures in question. In addition, that requirement should be
without prejudice to any other obligations to provide information pursuant to otheracts of Union law, in particular Regulation (EU) 2016/679.
9093/24
ANNEX

JAI.1

GR/ml

13

LIMITEEN(24)The competent judicial authority or the competent independent administrative authority, as
applicable in accordance with the detailed procedural rules set by the relevant Member State,should be in a position to take a well-informed decision on requests for the issuance or for
authorising the issuing by the Coordinationg Authority of establishment of detections
orders. That is of particular importance to ensure the necessary fair balance of thefundamental rights at stake and a consistent approach, especially in connection to detection
orders concerning the solicitation of children. Therefore, a procedure should be provided forthat allows the providers concerned, the EU Centre on Child Sexual Abuse established bythis Regulation (‘EU Centre’) and, where so provided in this Regulation, the competent dataprotection authority designated under Regulation (EU) 2016/679 to provide their views on
the measures in question. In this regard, the national data protection authorities should,
where appropriate, cooperate with other competent national authorities, in particular
those referred to in Article 15a(3) of Directive 2002/58/EC and in Article 5 of Directive(EU) 2018/1972. They should do so as soon as possible, having regard to the important
public policy objective at stake and the need to act without undue delay to protect children.
In particular, data protections authorities should do their utmost to avoid extending the time
period set out in Regulation (EU) 2016/679 for providing their opinions in response to aprior consultation. Furthermore, they should normally be able to provide their opinion wellwithin that time period in situations where the European Data Protection Board has alreadyissued guidelines regarding the technologies that a provider envisages deploying andoperating to execute a detection order addressed to it under this Regulation.

(25)

Where new services are concerned, that is, services not previously offered in the Union, theevidence available on the potential misuse of the service in the last 12 months is normally
non-existent. Taking this into account, and to ensure the effectiveness of this Regulation, theCoordinating Authority should be able to draw on evidence stemming from comparable
services when assessing whether to request the issuance of a detection order in respect ofsuch a new service. A service should be considered comparable where it provides afunctional equivalent to the service in question, having regard to all relevant facts andcircumstances, in particular its main characteristics and functionalities, the manner in which
it is offered and used, the user base, the applicable terms and conditions and risk mitigation
measures, as well as the overall remaining risk profile.

9093/24
ANNEX

JAI.1

GR/ml

14

LIMITEEN(26)The measures taken by providers of hosting services and providers of publicly available
interpersonal communications services to execute detection orders addressed to them should
remain strictly limited to what is specified in this Regulation and in the detection orders
issued in accordance with this Regulation. In order to ensure the effectiveness of thosemeasures, allow for tailored solutions, remain technologically neutral, and avoid
circumvention of the detection obligations, those measures should be taken regardless of thetechnologies used by the providers concerned in connection to the provision of theirservices. Therefore, this Regulation leaves to the provider concerned the choice of thetechnologies to be operated to comply effectively with detection orders and should not be
understood as incentivising or disincentivising the use of any given technology, provided
that the technologies and accompanying measures meet the requirements of this Regulation.
That includes the use of end-to-end encryption technology, which is an important tool toguarantee the security and confidentiality of the communications of users, including those ofchildren. Having regard to the availability of technologies that can be used to meet therequirements of this Regulation whilst still allowing for end-to-end encryption, nothing
in this Regulation should be interpreted as prohibiting, requiring to disable, or making
end-to-end encryption impossible. Providers should remain free to offer services using
end-to-end encryption and should not be obliged by this Regulation to decrypt data or
create access to end-to-end encrypted data. When executing the detection order, providers
should take all available safeguard measures to ensure that the technologies employed bythem cannot be used by them or their employees for purposes other than compliance withthis Regulation, nor by third parties, and thus to avoid undermining the cybersecurity andthe confidentiality of the communications of users, while ensuring the effective detectionof online child sexual abuse and the fair balance of all the fundamental rights at stake.
To avoid the significant impairment of undermining cybersecurity, providers should
identify, analyse and assess the possible cybersecurity risks derived from theimplementation of the technologies used to execute the detection order and put in place
the necessary mitigation measures to minimise such risks.

(26a) While end-to-end encryption is a necessary means of protecting fundamental rights
and the digital security of governments, industry and society, the European Union
needs to ensure the effective prevention of and fight against serious crime such as childsexual abuse. Providers should therefore not be obliged to prohibit or make impossible
end-to-end encryption. Nonetheless, it is crucial that services employing end-to-end
encryption do not inadvertently become secure zones where child sexual abusematerial can be shared or disseminated without possible consequences. Therefore,child sexual abuse material should remain detectable in all interpersonalcommunications services through the application of vetted technologies, when
uploaded, under the condition that the users give their explicit consent under theprovider’s terms and conditions for a specific functionality being applied to suchdetection in the respective service. Users not giving their consent should still be able touse that part of the service that does not involve the sending of visual content andURLs. This ensures that the detection mechanism can access the data in its
unencrypted form for effective analysis and action, without compromising theprotection provided by end-to-end encryption once the data is transmitted.

9093/24
ANNEX

JAI.1

GR/ml

15

LIMITEEN

(26b) In order to ensure uniform conditions for the implementation of the detection orders,
implementing powers should be conferred on the Commission to approve thetechnologies that can be used to execute the detection orders. Those powers should be
exercised in accordance with Regulation (EU) No 182/2011 of the European Parliamentand of the Council.
(27)

In order to facilitate the providers’ compliance with the detection obligations, the EU Centre
should make available to providers detection technologies that they may choose to use,on afree-of-charge basis, for the sole purpose of executing the detection orders addressed tothem. The European Data Protection Board should be consulted on those technologies andthe ways in which they should be best deployed to ensure compliance with applicable rulesof Union law on the protection of personal data. The advice of the European Data Protection
Board should be taken into account by the EU Centre when compiling the lists of available
technologies and also by the Commission when preparing guidelines regarding theapplication of the detection obligations. The providers may operate the technologies madeavailable by the EU Centre or by others or technologies that they developed themselves, aslong as they meet the requirements of this Regulation.

9093/24
ANNEX

JAI.1

GR/ml

16

LIMITEEN

(28)With a view to constantly assess the performance of the detection technologies and ensurethat they are sufficiently reliable, as well as to identify false positives and avoid to the extent
erroneous reporting to the EU Centre, providers should ensure human oversight and, where
necessary, human intervention, adapted to the type of detection technologies and the type of
online child sexual abuse at issue. Such oversight should include regular assessment of therates of false negatives and positives generated by the technologies, based on an analysis ofanonymised representative data samples. In particular where the detection of the solicitationof children in publicly available interpersonal communications is concerned, service
providers should ensure regular, specific and detailed human oversight and humanverification of conversations identified by the technologies as involving potential solicitationof children.

(29)

Providers of hosting services and providers of publicly available interpersonalcommunications services are uniquely positioned to detect potential online child sexual
abuse involving their services. The information that they may obtain when offering theirservices is often indispensable to effectively investigate and prosecute child sexual abuse
offences. Therefore, they should be required to report on potential online child sexual abuseon their services, whenever they become aware of it, that is, when there are reasonablegrounds to believe that a particular activity may constitute online child sexual abuse. Where
such reasonable grounds exist, doubts about the potential victim’s age should not prevent
those providers from submitting reports. In the interest of effectiveness, it should be
immaterial in which manner they obtain such awareness. Such awareness could, forexample, be obtained through the execution of detection orders, information flagged byusers or organisations acting in the public interest against child sexual abuse, or activities
conducted on the providers’ own initiative. Those providers should report a minimum of
information, as specified in this Regulation, for competent law enforcement authorities to beable to assess whether to initiate an investigation, where relevant, and should ensure that thereports are as complete as possible before submitting them.

(29a) Metadata connected to reported potential online child sexual abuse may be useful forinvestigative purposes and for the purpose to identify a suspect of a child sexual abuse
offence. For the purpose of this Regulation, the term ‘metadata’ should be understoodas data other than content data referring to information about documents, files orcommunications. Metadata may include, depending on the case, information about thetime, IP address and place of, port number and the devices used for, the creation or
exchange of the documents, files or communications at issue and about any
modifications made thereto20.

20

Refers to Art. 13.

9093/24
ANNEX

JAI.1

GR/ml

17

LIMITEEN

(29b) There should be an expedited reporting procedure when the information reported by
the provider reasonably justifies the conclusion that there is likely to be an imminent
threat to the life or safety of a child or when the information indicates ongoing abuse.
The expedited reporting procedure should limit the information required to bereported to the most necessary items of information and include the rest of theinformation required in the standard reporting procedure only if immediately
available. The expedited reporting procedure should also include an expedited
processing by the EU Centre. In addition to the cases that require expedited reporting,the provider should indicate in the report other situations that require urgent action
but not expedited reporting, such as situations where the provider is aware of an
ongoing investigation and the information reported by the provider reasonably
justifies the conclusion that such information could be beneficial to that investigation 21.
(30)

To ensure that online child sexual abuse material is removed as swiftly as possible after its
detection, Coordinating Authorities of establishment the competent authority of each
Member State, or where applicable its judicial authority, should have the power to issue
a removal order addressed to providers of hosting services. As removal or disabling ofaccess may affect the right of users who have provided the material concerned, providers
should inform such users of the reasons for the removal, to enable them to exercise theirright of redress, subject to exceptions needed to avoid interfering with activities for theprevention, detection, investigation and prosecution of child sexual abuse offences.

(31)

The rules of this Regulation should not be understood as affecting the requirements
regarding removal orders or the rules on no general monitoring or active fact-finding
obligations set out in Regulation (EU) 2022/2065 …/… of the European Parliament and of
the Council22 [on a Single Market For Digital Services (Digital Services Act) and amending
Directive 2000/31/EC].

(31a) The rules of this Regulation should not be understood as affecting the relevant national
requirements providing, in accordance with Union law, procedural safeguards
regarding the issuing of removal, blocking or delisting orders, such as the control of
the conformity with the applicable legal requirements of these orders by anindependent authority23.

21
22

23

Refers to Art. 13.
Regulation (EU) …/… 2022/2065 of the European Parliament and of the Council on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC (OJ L ….).
Refers to Art. 14 to 18c.

9093/24
ANNEX

JAI.1

GR/ml

18

LIMITEEN

(31b) In order to allow Member States to organise the process of issuance of removal,
blocking or delisting orders in a manner compatible with their respective constitutional
requirements and to enhance prior judicial control where deemed appropriate, theyshould have the possibility to require their respective competent authorities to request
the competent judicial authority of the Member State concerned to issue some or all of
those three types of orders under this Regulation. That possibility to derogate should
however only concern the question which authority issues the orders. Accordingly,
when a Member State makes use of that possibility, the competent authority concerned
should remain responsible for assessing the need for the order at stake and forcomplying with all of the procedural requirements of this Regulation related to its
preparation and follow-up. In that case, whilst it is for the competent judicial authority
to conduct an additional verification of whether the conditions of this Regulation for
issuing the order in question have been met, those conditions themselves should remain
unaltered and be applied consistently across the Union. In the interest of effectiveness,that possibility should be subject to the Member State concerned taking all reasonablemeasures to ensure that the issuance of the orders by their judicial authorities does notlead to any undue delays. In addition, in the interest of transparency and legal
certainty, it should be ensured that the necessary information regarding the use of thepossibility is publicly available24.
(31c) In the interest of effectiveness, it should be possible for the competent authorities ofMember States to issue, in accordance with this Regulation, removal orders also
against providers of hosting services that have their main establishment, or their legal
representative, in another Member State. Given the particularity of this situation, it isappropriate to provide for a specific procedure applicable to such cross-borderremoval orders, so as to allow, but not require under Union law, the Coordinating
Authority of that Member State to scrutinise them in respect of certain serious or
manifest infringements that may occur in exceptional cases, insofar as the applicationof that specific procedure is required to comply with the constitutional law of therelevant Member State. To that aim, such cross-border removal orders should betransmitted via that Coordinating Authority to the provider of hosting services
concerned. However, if that Coordinating Authority establishes by reasoned decision,
after having carried out a diligent and objective assessment and after having informed
the Coordinating Authority of the Member State whose authority issued the removal
order and taken into account its response insofar as possible, that such an infringement
occurred, the removal order should not be transmitted and should not take legal effect,it then being for the competent authority that issued the cross-border removal order totake the necessary steps to withdraw or annul it upon being notified of the reasoned
decision. All actions required as part of this procedure should be taken as swiftly as
possible and in any event within the set time periods, so as to ensure that any undue
delays are avoided, and as much as possible in sincere cooperation between thecompetent authorities involved25.

24
25

Refers to Art. 14.
Refers to Art. 14a.

9093/24
ANNEX

JAI.1

GR/ml

19

LIMITEEN(32)The obligations of this Regulation do not apply to providers of hosting services that do notoffer their services in the Union. However, such services may still be used to disseminate
child sexual abuse material to or by users in the Union, causing harm to children and society
at large, even if the providers’ activities are not targeted towards Member States and thetotal numbers of users of those services in the Union are limited. For legal and practicalreasons, it may not be reasonably possible to have those providers remove or disable accessto the material, not even through cooperation with the competent authorities of the third
country where they are established. Therefore, in line with existing practices in several
Member States, it should be possible to require providers of internet access services to takereasonable measures to block the access of users in the Union to the material, when lessintrusive measures such as the removal of the material are not reasonably possible or it
is likely that such measures will fail.

(33)

In the interest of consistency, efficiency and effectiveness and to minimise the risk ofcircumvention, such blocking orders should could be based on the list of uniform resource
locators, leading to specific items of verified child sexual abuse, compiled and provided
centrally by the EU Centre on the basis of diligently verified submissions by the relevant
authorities of the Member States. In order to avoid the taking of unjustified ordisproportionate measures, especially those that would unduly affect the fundamental rights
at stake, notably, in addition to the rights of the children, the users’ freedom of expression
and information and the providers’ freedom to conduct a business, appropriate limits andsafeguards should be provided for. In particular, it should be ensured that the burdens
imposed on the providers of internet access services concerned are not unreasonable, that theneed for and proportionality of the blocking orders is diligently assessed also after theirissuance and that both the providers and the users affected have effective means of judicial
as well as non-judicial redress.

(33a) To ensure that online child sexual abuse material is delisted as swiftly as possible afterits detection, the competent authority of each Member State, or where applicable its
judicial authority, should have the power to issue a delisting order addressed toproviders of online search engines. As delisting may affect the right of users who haveprovided the material concerned, providers should inform such users of the reasons forthe delisting, to enable them to exercise their right of redress, subject to exceptions
needed to avoid interfering with activities for the prevention, detection, investigationand prosecution of child sexual abuse offences26.

26

Refers to Art 18a, 18b and 18c, similar to recital 30 for removal orders.

9093/24
ANNEX

JAI.1

GR/ml

20

LIMITEEN

(33b) In the interest of ensuring effective cooperation in the delisting of online child sexual
abuse material, it should be possible for the competent authorities of each Member
State, or where applicable its judicial authority, to issue a delisting order to a providerof an online search engine that does not have its main establishment or legal
representative in the Member State of the authority that issued the removal delistingorder. Given the particularity of this situation, and in the interest of consistency,
provision should be made for a procedure applicable to such cross-border delistingorders that is the same as the procedure for cross-border removal orders27.
(34)

Considering that acquiring, possessing, knowingly obtaining access and transmitting childsexual abuse material constitute criminal offences under Directive 2011/93/EU, it isnecessary to exempt providers of relevant information society services from criminal
liability when they are involved in such activities, insofar as their activities remain strictly
limited to what is needed for the purpose of complying with their obligations under thisRegulation and they act in good faith.

(35)

The dissemination of child sexual abuse material is a criminal offence that affects the rightsof the victims depicted. Victims should therefore have the right to obtain, upon request, fromthe EU Centre yet via the Coordinating Authorities, relevant information if known childsexual abuse material depicting them is reported by providers of hosting services orproviders of publicly available interpersonal communications services in accordance withthis Regulation.

(36)

Given the impact on the rights of victims depicted in such known child sexual abusematerial and the typical ability of providers of hosting services to limit that impact byhelping ensure that the material is no longer available on their services, those providers
should assist victims who request the removal or disabling of access of the material inquestion. That assistance should remain limited to what can reasonably be asked from theprovider concerned under the given circumstances, having regard to factors such as thecontent and scope of the request, the steps needed to locate the items of known child sexual
abuse material concerned and the means available to the provider. The assistance could
consist, for example, of helping to locate the items, carrying out checks and removing or
disabling access to the items. Considering that carrying out the activities needed to obtainsuch removal or disabling of access can be painful or even traumatic as well as complex,
victims should also have the right to be assisted by the EU Centre in this regard, via the
Coordinating Authorities.

(37)

To ensure the efficient management of such victim support functions, victims should beallowed to contact and rely on the Coordinating Authority that is most accessible to them,which should channel all communications between victims and the EU Centre.

27

Refers to Art 18aa, similar to recital 31c for removal orders.

9093/24
ANNEX

JAI.1

GR/ml

21

LIMITEEN

(38)For the purpose of facilitating the exercise of the victims’ right to information and ofassistance and support for removal or disabling of access, victims should be allowed toindicate the relevant item or items of child sexual abuse material in respect of which they are
seeking to obtain information or removal or disabling of access either by means of providing
the image or images or the video or videos themselves, or by means of providing theuniform resource locators leading to the specific item or items of child sexual abusematerial, or by means of any other representation allowing for the unequivocal identificationof the item or items in question.

(39)

To avoid disproportionate interferences with users’ rights to private and family life and toprotection of personal data, the data related to instances of potential online child sexual
abuse should not be preserved by providers of relevant information society services, unlessand for no longer than necessary for one or more of the purposes specified in this Regulationand subject to an appropriate maximum duration. In that regard, the requirements topreserve such data in connection to the execution of detection orders should not be
understood as allowing or requiring the preservation of all users’ data processed forsuch detection purposes in general. They should rather be understood as requiring
only the preservation of content data and other data processed insofar as this is strictly
necessary to use the relevant technologies meeting the requirements of this Regulation,
covering in particular caching-like activities involving the automatic and intermediate
preservation for purely technical reasons and for very short periods of time needed touse the relevant indicators to detect possible child sexual abuse online, as well as toapply the safeguards required under this Regulation in connection to the use of thosetechnologies, covering in particular the application of measures to prevent, detect andremedy misuse, to ensure regular human oversight and to carry out regular reviews.
As those preservation requirements relate only to this Regulation, they should not be
understood as affecting the possibility to store relevant content data and traffic data inaccordance with Directive 2002/58/EC or the application of any legal obligation to preserve
data that applies to providers under other acts of Union law or under national law that is inaccordance with Union law. In order to achieve the specific purposes set out in thisRegulation, To ensure transparency providers of hosting services and providers ofinterpersonal communications services should keep logs with the time and duration of
the processing and, where applicable, the person performing the processing, in
accordance with Regulation (EU) 2016/67928.

28

Refers to Art 22a.

9093/24
ANNEX

JAI.1

GR/ml

22

LIMITEEN(40)In order to facilitate smooth and efficient communications by electronic means, including,where relevant, by acknowledging the receipt of such communications, relating to matters
covered by this Regulation, providers of relevant information society services should be
required to designate a single point of contact and to publish relevant information relating tothat point of contact, including the languages to be used in such communications. In contrast
to the provider’s legal representative, the point of contact should serve operational purposesand should not be required to have a physical location. Suitable conditions should be set inrelation to the languages of communication to be specified, so as to ensure that smoothcommunication is not unreasonably complicated. For providers subject to the obligation toestablish a compliance function and nominate compliance officers in accordance with
Regulation (EU) 2022/2065 …/… of the European Parliament and of the Council29 [on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC], one of these compliance officers may be designated as the point of contact
under this Regulation, in order to facilitate coherent implementation of the obligations
arising from both frameworks.

(41)

In order to allow for effective oversight and, where necessary, enforcement of thisRegulation, providers of relevant information society services that are not established in athird country and that offer services in the Union should have a legal representative in theUnion and inform the public and relevant authorities about how the legal representative canbe contacted. In order to allow for flexible solutions where needed and notwithstanding theirdifferent purposes under this Regulation, it should be possible, if the provider concerned has
made this clear, for its legal representative to also function as its point of contact, provided
the relevant requirements of this Regulation are complied with.

(42)

Where relevant and convenient, subject to the choice of the provider of relevant informationsociety services and the need to meet the applicable legal requirements in this respect, it
should be possible for those providers to designate a single point of contact and a single
legal representative for the purposes of Regulation (EU) 2022/2065 …/… of the European
Parliament and of the Council30 [on a Single Market For Digital Services (Digital ServicesAct) and amending Directive 2000/31/EC] and this Regulation.

(43)

In the interest of the effective application and, where necessary, enforcement of thisRegulation, each Member State should designate at least one existing or newly establishedauthority competent to ensure such application and enforcement in respect of providers of
relevant information society services under the jurisdiction of the designating Member State.

29

Regulation (EU) …/…2022/2065 of the European Parliament and of the Council on a Single
Market For Digital Services (Digital Services Act) and amending Directive 2000/31/EC (OJ
L ….).
Regulation (EU) …/… 2022/2065 of the European Parliament and of the Council on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC (OJ L ….).

30

9093/24
ANNEX

JAI.1

GR/ml

23

LIMITEEN(44)In order to provide clarity and enable effective, efficient and consistent coordination andcooperation both at national and at Union level, where a Member State designates more than
one competent authority to apply and enforce this Regulation, it should designate one leadauthority as the Coordinating Authority, whilst the designated authority should
automatically be considered the Coordinating Authority where a Member State designates
only one authority. For those reasons, the Coordinating Authority should act as the single
contact point with regard to all matters related to the application of this Regulation, without
prejudice to the enforcement powers of other national authorities.

(45)

Considering the EU Centre’s particular expertise and central position in connection to theimplementation of this Regulation, Coordinating competent Aauthorities should be able torequest the assistance of the EU Centre in carrying out certain of their tasks. Such assistanceshould be without prejudice to the respective tasks and powers of the Coordinatingcompetent Aauthorities requesting assistance and of the EU Centre and to the requirements
applicable to the performance of their respective tasks and the exercise of their respective
powers provided in this Regulation.

(45a) For the purposes of this Regulation, Member States should designate competentauthorities. This should not necessarily imply the establishment of a new authority andit should be possible for each Member State to entrust an existing body with thefunctions provided for in this Regulation, and to decide on the number of competentauthorities to be designated. With a view to leaving Member States a degree of
flexibility so as to implement solutions best adapted to their particular circumstances,whilst also ensuring the coordination at domestic level and cooperation at EU levelneeded to ensure the consistent, efficient and effective application of this Regulation,
Member States should be able to designate several competent authorities yet berequired in that case to appoint one of them as the Coordinating Authority for which
certain tasks are exclusively reserved under this Regulation. In particular, theCoordinating Authority should act as the single contact point with regard to allmatters related to the application of this Regulation, without prejudice to theenforcement powers of other national authorities. Therefore, each mention ofcompetent authorities in this Regulation should be interpreted as referring to therelevant competent authorities designated by the Member States, including where
relevant Coordinating Authorities, while each mention of Coordinating Authorities
should be interpreted as referring to Coordinating Authorities only, to the exclusion of
any other competent authorities that the Member States may have designated.
Member States should also be able to provide for the ex post administrative or judicial
review of the orders issued by competent authorities, in accordance with national law,
including when such review is not specifically provided for in this Regulation31.

31

Refers to Art. 25.

9093/24
ANNEX

JAI.1

GR/ml

24

LIMITEEN

(46)Given the importance of their tasks and the potential impact of the use of their powers forthe exercise of fundamental rights of the parties affected, it is essential that Coordinating
Authorities are fully independent. To that aim, the rules and assurances applicable to
Coordinating Authorities should be similar to those applicable to courts and tribunals, inorder to guarantee that they constitute, and can in all respects act as, independentadministrative authorities.

(46a) Member States should be free to designate any suitable national authority, including
administrative, law enforcement or judicial ones as appropriate, as competentauthority for the purpose of this Regulation, provided that all requirements of thisRegulation relating to them are fully respected, including as regards the competentauthorities’ status and the manner in which they perform their tasks, theirinvestigatory and enforcement powers, complaint-handling and cooperation at EU
level. Member States should also be free to designate and the involvement of a judicial
authority or independent administrative authority for the issuance of certain orders inaccordance with this Regulation, as well as the requirements resulting from theCharter, in particular as regards effective judicial redress against the competentauthorities’ decisions, are fully respected32.
(46b) In order to ensure that the competent authorities designated under this Regulation
carry out their tasks under this Regulation in an objective, adequate and responsible
manner, in compliance with the fundamental rights guaranteed under the Charter andwithout any undue interference, certain requirements in this respect should be
provided for. Those requirements should not be interpreted as precluding judicial
review of the activities of competent authorities in accordance with EU law or withnational law33.
(47)

Competent authorities, including Coordinating Authorities The Coordinating Authority,
as well as other competent authorities, play a crucial role in ensuring the effectiveness of therights and obligations laid down in this Regulation and the achievement of its objectives.
Accordingly, it is necessary to ensure that those authorities have not only the necessary
investigatory and enforcement powers, but also the necessary financial, human,
technological and other resources to adequately carry out their tasks under this Regulation.
In particular, given the variety of providers of relevant information society services and theiruse of advanced technology in offering their services, it is essential that the Coordinating
Authority, as well as other competent authorities, are equipped with the necessary number ofstaff, including experts with specialised skills. The resources of Coordinating Authorities
should be determined taking into account the size, complexity and potential societal impactof the providers of relevant information society services under the jurisdiction of thedesignating Member State, as well as the reach of their services across the Union.

32

Refers to Art. 26.
Refers to Art. 26.

339093/24
ANNEX

JAI.1

GR/ml

25

LIMITEEN

(48)Given the need to ensure the effectiveness of the obligations imposed, Coordinatingcompetent authorities should be granted enforcement powers to address infringements ofthis Regulation. These powers should include the power to temporarily restrict access ofusers of the service concerned by the infringement or, only where that is not technicallyfeasible, to the online interface of the provider on which the infringement takes place. In
light of the high level of interference with the rights of the service providers that such a
power entails, the latter should only be exercised when certain conditions are met. Thoseconditions should include the condition that the infringement results in the regular andstructural facilitation of child sexual abuse offences, which should be understood as
referring to a situation in which it is apparent from all available evidence that such
facilitation has occurred on a large scale and over an extended period of time.

(49)

In order to verify that the rules of this Regulation, in particular those on mitigation measuresand on the execution of detection orders, removal orders, or blocking orders or delistingorders that it issued, are effectively complied in practice, each Coordinating authority
competent authoritiesy should be able to carry out searches, using the relevant indicators
provided by the EU Centre, to detect the dissemination of known or new child sexual abusematerial through publicly available material in the hosting services of the providers
concerned.

(50)

With a view to ensuring that providers of hosting services are aware of the misuse made of
their services and to afford them an opportunity to take expeditious action to remove or
disable access on a voluntary basis, Coordinating Authorities of establishment should be
able to notify those providers of the presence of known child sexual abuse material on theirservices and requesting removal or disabling of access thereof, for the providers’ voluntary
consideration. Such notifying activities should be clearly distinguished from the
Coordinating Authorities’ powers under this Regulation to request the issuance of removal
orders, which impose on the provider concerned a binding legal obligation to remove or
disable access to the material in question within a set time period.
Nothing in this Regulation precludes competent authorities designated therein tosubmit notices to providers of hosting services on the basis of notice and action
mechanisms pursuant to Article 16 of Regulation (EU) 2022/2065 (Digital Services Act)to notify them of the presence of one or more specific items of known child sexual
abuse material, nor to request the status of trusted flagger under the conditions
established under Article 22 of that Regulation.

(51)

In order to provide clarity and ensure effective enforcement of this Regulation, a provider of
relevant information society services should be under the jurisdiction of the Member State
where its main establishment is located, that is, where the provider has its head office orregistered office within which the principal financial functions and operational control are
exercised. In respect of providers that do not have an establishment in the Union but thatoffer services in the Union, the Member State where their appointed legal representative
resides or is established should have jurisdiction, considering the function of legal
representatives under this Regulation.

9093/24
ANNEX

JAI.1

GR/ml

26

LIMITEEN

(52)To ensure effective enforcement and the safeguarding of users’ rights under this Regulation,
it is appropriate to facilitate the lodging of complaints about alleged non-compliance withobligations of providers of relevant information society services under this Regulation. Thisshould be done by allowing users to lodge such complaints with the Coordinating Authority
in the territory of the Member State where the users reside or are established, irrespective of
which Member State has jurisdiction in respect of the provider concerned. For the purposeof lodging of complaints, users can decide to rely on organisations acting in the public
interest against child sexual abuse. However, in order not to endanger the aim ofestablishing a clear and effective system of oversight and to avoid the risk of inconsistentdecisions, it should remain solely for the Coordinating Authority of establishment tosubsequently exercise any of its investigatory or enforcement powers regarding the conduct
complained of, as appropriate, without prejudice to the competence of other supervisory
authorities within their mandate.

(52a) Without prejudice to the rights of users to turn to a representative in accordance with
the Directive (EU) 2020/1828 or to any other type of representation under national law,users should also have the right to mandate a legal person or a public body to exercise
their rights provided for in this Regulation34.
(53)

Member States should ensure that for infringements of the obligations laid down in thisRegulation there are penalties that are effective, proportionate and dissuasive, taking into
account elements such as the nature, gravity, recurrence and duration of the infringement, inview of the public interest pursued, the scope and kind of activities carried out, as well as the
economic capacity of the provider of relevant information society services concerned.

(54)

The rules of this Regulation on supervision and enforcement should not be understood asaffecting the powers and competences of the data protection authorities under Regulation(EU) 2016/679.

34

Refers to Art 34b. Partially copied from Recital 149 DSA.

9093/24
ANNEX

JAI.1

GR/ml

27

LIMITEEN

(55)It is essential for the proper functioning of the system of mandatory detection and blockingof online child sexual abuse set up by this Regulation that the EU Centre receives, via the
Coordinating competent authorities, material identified as constituting child sexual abusematerial or transcripts extracts of conversations identified as constituting the solicitation ofchildren, such as may have been found for example during criminal investigations, so thatthat material or conversations can serve as an accurate and reliable basis for the EU Centre
to generate indicators of such abuses. In order to achieve that result, the identification should
be made after a diligent assessment, conducted in the context of a procedure that guarantees
a fair and objective outcome, subject to adequate oversight by judicial authorities either
by the Coordinating Authorities themselves or by a court or another independentadministrative authority than the Coordinating Authority. Whilst the swift assessment,
identification and submission of such material is important also in other contexts, it is
crucial in connection to new child sexual abuse material and the solicitation of children
reported under this Regulation, considering that this material can lead to the identification of
ongoing or imminent abuse and the rescuing of victims. Therefore, specific time limits
should be set in connection to such reporting.

(56)

With a view to ensuring that the indicators generated by the EU Centre for the purpose of
detection are as complete as possible, the submission of relevant material and transcripts
extracts of conversations should be done proactively by the Coordinating competentauthorities. However, the EU Centre should also be allowed to bring certain material orconversations to the attention of the Coordinating competent authorities for those purposes.

(56a) Member States should set up expedited procedures for the diligent assessment ofsuspected child sexual abuse, so as to allow for the swift submission to the EU Centre of
the specific items of material, extracts of conversations and uniform resource locatorsconcerned upon the reliable establishment of the illegality. With a view to facilitatingand expediting such assessment, it should be possible for Member States to providethat competent authorities carry out the assessment of illegality of the content, under
the oversight of the competent judicial authorities [or independent administrative
authorities]35.

35Refers to Art. 36.

9093/24
ANNEX

JAI.1

GR/ml

28

LIMITEEN

(57)

Certain providers of relevant information society services offer their services in several oreven all Member States, whilst under this Regulation only a single Member State has
jurisdiction in respect of a given provider. It is therefore imperative that the Coordinating
Authority designated by the Member State having jurisdiction takes account of the interestsof all users in the Union when performing its tasks and using its powers, without making any
distinction depending on elements such as the users’ location or nationality, and that
Coordinating Authorities cooperate with each other in an effective and efficient manner. To
facilitate such cooperation, the necessary mechanisms and information-sharing systems
should be provided for. That cooperation shall be without prejudice to the possibility for
Member States to provide for regular exchanges of views with other public authorities where
relevant for the performance of the tasks of those other authorities and of the Coordinating
Authority.

(57a) “Joint investigations” under Article 38 should be interpreted as formal inquiries by
Coordinating Authorities concerning the compliance of the provider of relevant
information society services with the obligations arising from this Regulation. Insofar
as the penalties for infringements of those obligations provided for by the Member
State concerned pursuant to this Regulation are not criminal in nature, “joint
investigations” under Article 38 should not be interpreted as criminal investigations,which are usually conducted by law enforcement authorities under national law.36(58)

In particular, in order to facilitate the cooperation needed for the proper functioning of themechanisms set up by this Regulation, the EU Centre should establish and maintain thenecessary information-sharing systems. When establishing and maintaining such systems,
the EU Centre should cooperate with the European Union Agency for Law Enforcement
Cooperation (‘Europol’) and national authorities to build on existing systems and bestpractices, where relevant.

(59)

To support the implementation of this Regulation and contribute to the achievement of its
objectives, the EU Centre should serve as a central facilitator, carrying out a range of
specific tasks. The performance of those tasks requires strong guarantees of independence,in particular from law enforcement authorities, as well as a governance structure ensuring
the effective, efficient and coherent performance of its different tasks, and legal personality
to be able to interact effectively with all relevant stakeholders. Therefore, it should beestablished as a decentralised Union agency.

36

Refers to Art. 38.

9093/24
ANNEX

JAI.1

GR/ml

29

LIMITEEN

(60)In the interest of legal certainty and effectiveness, the tasks of the EU Centre should belisted in a clear and comprehensive manner. With a view to ensuring the proper
implementation of this Regulation, those tasks should relate in particular to the facilitationof the detection, reporting and blocking obligations imposed on providers of hosting
services, providers of publicly available interpersonal communications services andproviders of internet access services. However, for that same reason, the EU Centre should
also be charged with certain other tasks, notably those relating to the implementation of therisk assessment and mitigation obligations of providers of relevant information society
services, the removal of or disabling of access to child sexual abuse material by providers of
hosting services, the provision of assistance to Coordinating competent authorities, as wellas the generation and sharing of knowledge and expertise related to online child sexual
abuse, including on prevention. The EU Centre could should, in accordance with its
tasks under this Regulation, also assess where possible the initiatives related topreventing and combating online child sexual abuse to determine whether they can beconsidered as best practices, using standardised assessment tools where possible, andmake available these best practices, including through a dedicated database, to support
the knowledge hub function of the EU Centre and prevent duplication of efforts andinitiatives, promoting efficiency and collaboration among stakeholders.

(61)

The EU Centre should provide reliable information on which activities can reasonably beconsidered to constitute online child sexual abuse, so as to enable the detection and blocking
thereof in accordance with this Regulation. Given the nature of child sexual abuse material,that reliable information needs to be provided without sharing the material itself. Therefore,
the EU Centre should generate accurate and reliable indicators, based on identified childsexual abuse material and solicitation of children submitted to it by Coordinating competentauthorities in accordance with the relevant provisions of this Regulation. These indicators
should allow technologies to detect the dissemination of either the same material (known
material) or of different child sexual abuse material (new material), or the solicitation ofchildren, as applicable.

(62)

For the system established by this Regulation to function properly, the EU Centre should becharged with creating databases for each of those three types of online child sexual abuse,
and with maintaining and operating those databases. For accountability purposes and toallow for corrections where needed, it should keep records of the submissions and theprocess used for the generation of the indicators.

(63)

For the purpose of ensuring the traceability of the reporting process and of any follow-up
activity undertaken based on reporting, as well as of allowing for the provision of feedback
on reporting to providers of hosting services and providers of publicly available
interpersonal communications services, generating statistics concerning reports and thereliable and swift management and processing of reports, the EU Centre should create a
dedicated database of such reports. To be able to fulfil the above purposes, that databaseshould also contain relevant information relating to those reports, such as the indicators
representing the material and ancillary tags, which can indicate, for example, the fact that areported image or video is part of a series of images and videos depicting the same victim or
victims.

9093/24
ANNEX

JAI.1

GR/ml

30

LIMITEEN

(64)Given the sensitivity of the data concerned and with a view to avoiding any errors andpossible misuse, it is necessary to lay down strict rules on the access to those databases ofindicators and databases of reports, on the data contained therein and on their security. In
particular, the data concerned should not be stored for longer than is strictly necessary. For
the above reasons, access to the database of indicators should be given only to the parties
and for the purposes specified in this Regulation, subject to the controls by the EU Centre,
and be limited in time and in scope to what is strictly necessary for those purposes.

(64a) Considering its role as central knowledge hub on matters related to theimplementation of this Regulation at EU level, the EU Centre should, in accordancewith this Regulation, leverage all means at its disposal to support facilitate the work ofEuropol and competent law enforcement authorities, for example by ensuring that
information received by law enforcement authorities is relevant, complete and as easy
as possible to access and consult. In particular, the EU Centre should give Europol andthe competent law enforcement authorities of the Member States access to the databaseof indicators when necessary for the purpose of their tasks of investigating suspectedchild sexual abuse offences37.
(65)

In order to avoid erroneous reporting of online child sexual abuse under this Regulation andto allow law enforcement authorities to focus on their core investigatory tasks, reports
should pass through the EU Centre. The EU Centre should assess those reports in order to
identify those that are manifestly unfounded, that is, where it is immediately evident,
without any substantive legal or factual analysis, that the reported activities do not constituteonline child sexual abuse. Where the report is manifestly unfounded, the EU Centre should
provide feedback to the reporting provider of hosting services or provider of publicly
available interpersonal communications services in order to allow for improvements in thetechnologies and processes used and for other appropriate steps, such as reinstating material
wrongly removed. As every report could be an important means to investigate and prosecutethe child sexual abuse offences concerned and to rescue the victim of the abuse, reports
should be processed as quickly as possible.

(66)

With a view to contributing to the effective application of this Regulation and the protectionof victims’ rights, the EU Centre should be able, upon request, to support victims and toassist competent authorities Competent Authorities by conducting searches of hosting
services for the dissemination of known child sexual abuse material that is publicly
accessible, using the corresponding indicators. Where it identifies such material after having
conducted such a search, the EU Centre should also be able to request the provider of thehosting service concerned to remove or disable access to the item or items in question, giventhat the provider may not be aware of their presence and may be willing to do so on a
voluntary basis.

37

Refers to Art. 46.

9093/24
ANNEX

JAI.1

GR/ml

31

LIMITEEN

(67)Given its central position resulting from the performance of its primary tasks under thisRegulation and the information and expertise it can gather in connection thereto, the EU
Centre should also contribute to the achievement of the objectives of this Regulation byserving as a hub for knowledge, expertise and research on matters related to the prevention
and combating of online child sexual abuse. In this connection, the EU Centre should
cooperate with relevant stakeholders from both within and outside the Union and allow
Member States to benefit from the knowledge and expertise gathered, including bestpractices and lessons learned.

(68)

Processing and storing certain personal data is necessary for the performance of the EU
Centre’s tasks under this Regulation. In order to ensure that such personal data is adequately
protected, the EU Centre should only process and store personal data if strictly necessary forthe purposes detailed in this Regulation. It should do so in a secure manner and limit storage
to what is strictly necessary for the performance of the relevant tasks.

(69)

In order to allow for the effective and efficient performance of its tasks, the EU Centre
should closely cooperate with the competent authorities including the Coordinating
Authorities, the Europol and relevant partner organisations, such as the US National Centre
for Missing and Exploited Children, the European Crime Prevention Network(‘EUCPN’) or the International Association of Internet Hotlines (‘INHOPE’) network of
hotlines for reporting child sexual abuse material, within the limits sets by this Regulationand other legal instruments regulating their respective activities. To facilitate suchcooperation, the necessary arrangements should be made, including the designation ofcontact officers by Coordinating Authorities and the conclusion of memoranda ofunderstanding with Europol and, where appropriate, with one or more of the relevant partnerorganisations.

(70)

Longstanding Union support for both INHOPE and its member hotlines recognises that
hotlines are in the frontline in the fight against online child sexual abuse. The EU Centre
should leverage the network of hotlines and encourage that they work together effectively
with the Coordinating competent authorities, providers of relevant information society
services and law enforcement authorities of the Member States. The hotlines’ expertise andexperience is an invaluable source of information on the early identification of common
threats and solutions, as well as on regional and national differences across the Union.

(71)

Considering Europol’s mandate and its experience in identifying competent national
authorities in unclear situation and its database of criminal intelligence which can contributeto identifying links to investigations in other Member States, the EU Centre should
cooperate closely with it, especially in order to ensure the swift identification of competent
national law enforcement authorities in cases where that is not clear or where more than one
Member State may be affected.

9093/24
ANNEX

JAI.1

GR/ml

32

LIMITEEN

(71a) Europol and the EU Centre should cooperate closely when performing their respective,
distinct tasks and responsibilities in accordance with this Regulation and Regulation(EU) 2016/794.38 This Regulation should not be understood as altering in any way
Regulation (EU) 2016/794 and Europol’s tasks and responsibilities under that
Regulation. For example, in relation to the processing of reports from service
providers, the EU Centre should, subject to the filtering provided for in thisRegulation, forward those reports to Europol and to the competent national law
enforcement authority or authorities, together with the additional relevant
information, including for victim identification purposes, as prescribed by thisRegulation, whereas Europol could continue to assist national law enforcement incriminal investigations concerning such reports in accordance with its mandate. Also,in relation to the storage of reports, the EU Centre should perform the tasks specified
in this Regulation, in particular create maintain and operate a database for those
purposes, whereas Europol could, in accordance with its mandate, continue to expand
with the reports received from the EU Centre its own databases of criminal intelligenceshared with national authorities, notably for criminal investigation purposes.
(72)

Considering the need for the EU Centre to cooperate intensively with Europol, the EU
Centre’s headquarters should be [located alongside Europol’s, which is located in The
Hague, the Netherlands]. The highly sensitive nature of the reports shared with Europol by
the EU Centre and the technical requirements, such as on secure data connections, bothbenefit from a shared location between the EU Centre and Europol. It would also allow the
EU Centre, while being an independent entity, to rely on the support services of Europol,
notably those regarding human resources management, information technology (IT),including cybersecurity, the building and communications. Sharing such support services ismore cost-efficient and ensure a more professional service than duplicating them by creatingthem anew.

(73)

To ensure its proper functioning, the necessary rules should be laid down regarding the EU
Centre’s organisation. In the interest of consistency, those rules should be in line with theCommon Approach of the European Parliament, the Council and the Commission on
decentralised agencies.

(74)

In view of the need for technical expertise in order to perform its tasks, in particular the taskof providing a list of technologies that can be used for detection, the EU Centre should havea Technology Committee composed of experts with advisory function. The Technology
Committee may, in particular, provide expertise to support the work of the EU Centre,
within the scope of its mandate, with respect to matters related to detection of online childsexual abuse, to support the EU Centre in contributing to a high level of technical standards
and safeguards in detection technology.

38

Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016
on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing
and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA,
2009/936/JHA and 2009/968/JHA.

9093/24
ANNEX

JAI.1

GR/ml

33

LIMITEEN

(74a) In view of the need for assistance to victims’ expertise in order to perform its tasks, theEU Centre should have a Victims Board, composed of adult victims of child sexual
abuse and persons with relevant expertise, with an advisory function. The Victims
Board may, in particular, provide expertise to support the work of the EU Centre,
within the scope of its mandate, with respect to matters related to the tasks ofproviding information to victims, and assistance and support for removal, via the
Coordinating Authorities39.
(75)

In the interest of transparency and accountability and to enable evaluation and, where
necessary, adjustments, providers of hosting services, providers of publicly available
interpersonal communications services and providers of internet access services,
Coordinating Authorities and the EU Centre should be required to collect, record andanalyse information, based on anonymised gathering of non-personal data and to publish
annual reports on their activities under this Regulation. The Coordinating Authorities should
cooperate with Europol and with law enforcement authorities and other relevant national
authorities of the Member State that designated the Coordinating Authority in question ingathering that information.

(76)

In the interest of good governance and drawing on the statistics and information gathered
and transparency reporting mechanisms provided for in this Regulation, the Commission
should carry out an evaluation of this Regulation within five years of the date of its entry
into force, and every five years thereafter.

(77)

The evaluation should be based on the criteria of efficiency, necessity, effectiveness,
proportionality, relevance, coherence and Union added value. It should assess thefunctioning of the different operational and technical measures provided for by thisRegulation, including the effectiveness of measures to enhance the detection, reporting andremoval of online child sexual abuse, the effectiveness of safeguard mechanisms as well as
the impacts on potentially affected fundamental rights, the freedom to conduct a business,the right to private life and the protection of personal data. The Commission should also
assess the impact on potentially affected interests of third parties.

39

Refers to Art. 66a.

9093/24
ANNEX

JAI.1

GR/ml

34

LIMITEEN

(78)Regulation (EU) 2021/1232 of the European Parliament and of the Council40 provides for a
temporary solution in respect of the use of technologies by certain providers of publicly
available interpersonal communications services for the purpose of combating online childsexual abuse, pending the preparation and adoption of a long-term legal framework. This
Regulation provides that long-term legal framework. It is important that child sexual
abuse online can be effectively and lawfully combated without interruptions and that
there is a smooth transition between the temporary regime created by Regulation (EU)2021/1232 and the long-term regime created by this Regulation. Therefore, thenecessary amendment should be made to Regulation (EU) 2021/1232 and it should be
repealed with effect from the moment at which all relevant provisions of thisRegulation have started to apply Regulation (EU) 2021/1232 should therefore be
repealed41.

(78a) The rules of this Regulation should apply as soon as possible. However, account should
be taken of the need for all parties involved, and in particular the EU Centre, to takethe necessary preparatory measures. Therefore, the relevant provisions of thisRegulation should only start to apply after certain appropriate time periods. During
this transition period, general rules that refer to several measures, some of which havenot entered into application yet, should be understood as not being applicable to themeasures that have not entered into application yet. Thus, for example, during that
period, it should be possible to issue a blocking order in accordance with thisRegulation, subject to the order in such a case having to be executed without making
use of the database of indicators provided by the EU Centre, which would still be
under preparation during such transition period.42(79)

In order to achieve the objectives of this Regulation, the power to adopt acts in accordancewith Article 290 of the Treaty should be delegated to the Commission to amend the Annexes
to this Regulation and to supplement it by laying down detailed rules concerning the settingup, content and access to the databases operated by the EU Centre, concerning the form,
precise content and other details of the reports and the reporting process, concerning thedetermination and charging of the costs incurred by the EU Centre to support providers in
the risk assessment, as well as concerning technical requirements for the information sharing
systems supporting communications between Coordinating Authorities, the Commission, theEU Centre, other relevant Union agencies and providers of relevant information society
services.

40

Regulation (EU) 2021/1232 of the European Parliament and of the Council of 14 July 2021
on a temporary derogation from certain provisions of Directive 2002/58/EC as regards theuse of technologies by providers of number-independent interpersonal communications
services for the processing of personal and other data for the purpose of combating online
child sexual abuse (OJ L 274, 30.7.2021, p. 41).
Refers to Art. 88.
Refers to Art. 89.

41429093/24
ANNEX

JAI.1

GR/ml

35

LIMITEEN

(80)

It is important that the Commission carry out appropriate consultations during its
preparatory work for delegated acts, including via open public consultation and at expert
level, and that those consultations be conducted in accordance with the principles laid downin the Inter-institutional Agreement of 13 April 2016 on Better Law Making43. In particular,
to ensure equal participation in the preparation of delegated acts, the European Parliament
and the Council receive all documents at the same time as Member States' experts, and theirexperts systematically have access to meetings of the Commission expert groups dealing
with the preparation of delegated acts.

(81)

In order to ensure uniform conditions for the implementation of the information-sharing
system, implementing powers should be conferred on the Commission. Those powers should
be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliamentand of the Council44.

(82)

In order to allow all affected parties sufficient time to take the necessary measures to comply
with this Regulation, provision should be made for an appropriate time period between thedate of its entry into force and that of its application.

(83)

Since the objectives of this Regulation, namely contributing to the proper functioning of theinternal market by setting out clear, uniform and balanced rules to prevent and combat childsexual abuse in a manner that is effective and that respects the fundamental rights, cannot be
sufficiently achieved by the Member States but can rather, by reason of its scale and effects,
be better achieved at Union level, the Union may adopt measures, in accordance with theprinciple of subsidiarity as set out in Article 5 of the Treaty on European Union. In
accordance with the principle of proportionality, as set out in that Article, this Regulation
does not go beyond what is necessary in order to achieve that objective.

(84)

The European Data Protection Supervisor and the European Data Protection Board wereconsulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 of the European
Parliament and of the Council45 and delivered their opinion on 28 July 2022 […].

43

Inter-institutional Agreement of 13 April 2016 on Better Law Making (OJ L 123, 12.5.2016,p. 1).
Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16
February 2011 laying down the rules and general principles concerning mechanisms forcontrol by the Member States of the Commission's exercise of implementing powers (OJ L
55, 28.2.2011, p. 13).
Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October
2018 on the protection of natural persons with regard to the processing of personal data by
the Union institutions, bodies, offices and agencies and on the free movement of such data,
and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295,
21.11.2018, p. 39).

44459093/24
ANNEX

JAI.1

GR/ml

36

LIMITEENHAVE ADOPTED THIS REGULATION:

CHAPTER I
GENERAL PROVISIONS
Article 1
Subject matter and scope
1.

This Regulation lays down uniform rules to prevent and combat address in a targeted,carefully balanced and proportionate manner the misuse of relevant information society
services for online child sexual abuse in the internal market.
It establishes, in particular:(a)obligations on providers of relevant information society services to minimise the riskthat their services are misused for online child sexual abuse;(b)

obligations on providers of hosting services and providers of interpersonalcommunications services to detect and report online child sexual abuse;(c)obligations on providers of hosting services to remove or disable access to childsexual abuse material on their services;(d)obligations on providers of internet access services to prevent users from accessing
access child sexual abuse material;(da) obligations on providers of online search engines to delist websites indicating
specific items of child sexual abuse;(e)rules on the implementation and enforcement of this Regulation, including as regards
the designation and functioning of the competent authorities of the Member States,
the EU Centre on Child Sexual Abuse established in Article 40 (‘EU Centre’) andcooperation and transparency.

2.

This Regulation shall apply to providers of relevant information society services offeringsuch services in the Union, irrespective of their place of main establishment.

2a.

This Regulation shall not apply to professional government accounts using services orparts of the services used by the State for national security purposes, maintaining law
and order or military purposes.

2b.

The Regulation shall not apply to confidential information, including classified
information, information covered by professional secrecy and trade secrets andinformation and communication systems processing such information.

9093/24
ANNEX

JAI.1

GR/ml

37

LIMITEEN

3.

This Regulation shall not affect the rules laid down by the following legal acts:(a)Directive 2011/93/EU on combating the sexual abuse and sexual exploitation ofchildren and child pornography, and replacing Council Framework Decision
2004/68/JHA;(b)

Directive 2000/31/EC and Regulation (EU) 2022/2065 of the European Parliamentand of the Council of 19 October 2022 on a Single Market For Digital Services
and amending Directive 2000/31/EC (Digital Services Act)…/… of the European
Parliament and of the Council46 [on a Single Market For Digital Services (Digital
Services Act) and amending Directive 2000/31/EC];(ba) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14
September 2022 on contestable and fair markets in the digital sector andamending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act);(c)

Directive 2010/13/EU;(d)Regulation (EU) 2016/679, Directive 2016/680, Regulation (EU) 2018/1725, and,subject to paragraph 4 of this Article, Directive 2002/58/EC;(e)Regulation (EU) 2021/784 of the European Parliament and of the Council of
29 April 2021 on addressing the dissemination of terrorist content online.

3a.

This Regulation shall not have the effect of modifying the obligation to respect therights, freedoms and principles referred to in Article 6 TEU and shall apply without
prejudice to fundamental principles relating to the right for respect to private life andfamily life and to freedom of expression and information.47

4.

This Regulation limits the exercise of the rights and obligations provided for in 5(1) and(3) and Article 6(1) of Directive 2002/58/EC to the extent strictly insofar as necessary forthe execution of the detection orders issued in accordance with Section 2 of Chapter 1 II ofthis Regulation.

4a.

This Regulation shall not lead to any general obligation to monitor the information
which providers of hosting services transmit or store, nor to actively seek facts orcircumstances indicating illegal activity.

46

47

Regulation (EU) …/… 2022/2065 of the European Parliament and of the Council on aSingle Market For Digital Services (Digital Services Act) and amending Directive
2000/31/EC (OJ L ….).
Wording copied from Art. 1(4) of TCO Regulation with an additional reference to the rightto private life.

9093/24
ANNEX

JAI.1

GR/ml

38

LIMITEEN

5.

Without prejudice to Article 10a, this Regulation shall not prohibit or make impossible
end-to-end encryption, implemented by the relevant information society services or by
the users. This Regulation shall not create any obligation that would require a providerof hosting services or a provider of interpersonal communications services to decrypt
data or create access to end-to-end encrypted data, or that would prevent the provisionof providers from offering end-to-end encrypted services. prohibit, make impossible,
weaken, circumvent or otherwise undermine cybersecurity measures, in particular
encryption, including end-to-end encryption, implemented by the relevant informationsociety services or by the users. This Regulation shall not create any obligation to
decrypt data.
Article 2
Definitions

For the purpose of this Regulation, the following definitions apply:(a)‘hosting service’ means an information society service as defined in Article 23(g), point(iii) point (f), third indent, of Regulation (EU) 2022/2065 …/… [on a Single Market For
Digital Services (Digital Services Act) and amending Directive 2000/31/EC];(b)‘interpersonal communications service’ means a publicly available service as defined in
Article 2, point 5, of Directive (EU) 2018/1972, including services which enable directinterpersonal and interactive exchange of information merely as a minor ancillary featurethat is intrinsically linked to another service;(c)‘software application’ means a digital product or service as defined in Article 2, point 15
13, of Regulation (EU) 2022/1925 …/… [on contestable and fair markets in the digital
sector (Digital Markets Act)];(d)‘software application store’ means a service as defined in Article 2, point 14 12, ofRegulation (EU) 2022/1925 …/… [on contestable and fair markets in the digital sector(Digital Markets Act)];(e)‘internet access service’ means a service as defined in Article 2(2), point 2, of Regulation(EU) 2015/2120 of the European Parliament and of the Council48;

48

Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November
2015 laying down measures concerning open internet access and amending Directive
2002/22/EC on universal service and users’ rights relating to electronic communications
networks and services and Regulation (EU) No 531/2012 on roaming on public mobile
communications networks within the Union (OJ L 310, 26.11.2015, p. 1–18).

9093/24
ANNEX

JAI.1

GR/ml

39

LIMITEEN(f)‘relevant information society services’ means all of the following services:(i)a hosting service;(ii)

an interpersonal communications service;(iii) a software applications store;(iv) an internet access service;(v)

online search engines.

(g)‘to offer services in the Union’ means to offer services in the Union as defined in Article 3
2, point (d), of Regulation (EU) 2022/2065 …/… [on a Single Market For Digital Services(Digital Services Act) and amending Directive 2000/31/EC];(h)‘user’ means any natural or legal person who uses a relevant information society service;(i)‘child’ means any natural person below the age of 18 years;(j)‘child user’ means a natural person who uses a relevant information society service andwho is a natural person below the age of 17 years;49(k)‘micro, small or medium-sized enterprise’ means an enterprise as defined in Commission
Recommendation 2003/361 concerning the definition of micro, small and medium-sizedenterprises50;(l)‘child sexual abuse material’ means: material constituting child pornography or
pornographic performance as defined in Article 2, points (c) and (e), respectively, ofDirective 2011/93/EU;(m)‘known child sexual abuse material’ means potential child sexual abuse material detectedusing the indicators contained in the database of indicators referred to in Article 44(1),point (a);(n)‘new child sexual abuse material’ means potential child sexual abuse material using theindicators contained in the database of indicators referred to in Article 44(1), point (b);(o)‘solicitation of children’ means the solicitation of children for sexual purposes as referred
to in Article 6 of Directive 2011/93/EU;

49

50

PCY comment: The PCY concludes that differences in national law for instance, the age
used for defining solicitation make it necessary to find common ground in order to avoid
disparities in the application of the Regulation.
Commission Recommendation of 6 May 2003 concerning the definition of micro, small andmedium-sized enterprises (OJ L 124, 20.5.2003, p. 36–41).

9093/24
ANNEX

JAI.1

GR/ml

40

LIMITEEN(p)‘online child sexual abuse’ means the online dissemination of child sexual abuse material
and the solicitation of children;(q)‘child sexual abuse offences’ means offences as defined in Articles 3 to 7 of Directive
2011/93/EU;(r)‘recommender system’ means the system as defined in Article 3, point (s) 2, point (o), ofRegulation (EU) 2022/2065 …/… [on a Single Market For Digital Services (Digital
Services Act) and amending Directive 2000/31/EC];(s)‘content data’ means data as defined in Article 2, point 10, of Regulation (EU) … [onEuropean Production and Preservation Orders for electronic evidence in criminal matters(…/… e-evidence Regulation)];(t)‘content moderation’ means the activities as defined in Article 3, point (t) 2, point (p), ofRegulation (EU) 2022/2065 …/… [on a Single Market For Digital Services (Digital
Services Act) and amending Directive 2000/31/EC];(ta)‘Competent authority of establishment’ means the competent authority designated inaccordance with Article 25 by the Member State where the provider of informationsociety services has its main establishment or, where applicable, where its legal
representative resides or is established;(u)‘Coordinating Authority of establishment’ means the competent authority designated as
the Coordinating Authority for child sexual abuse issues designated in accordance with
Article 25 by the Member State where the provider of information society services has its
main establishment or, where applicable, where its legal representative resides or isestablished;(v)‘terms and conditions’ means terms and conditions as defined in Article 3, point (u) 2,
point (q), of Regulation (EU) 2022/2065 …/… [on a Single Market For Digital Services(Digital Services Act) and amending Directive 2000/31/EC];(w)‘main establishment’ means the head office or registered office of the provider of relevant
information society services within which the principal financial functions and operational
control are exercised;(x)‘online search engine’ means an intermediary service as defined in Article 3, point (j),of Regulation (EU) 2022/2065 …/… [on a Single Market For Digital Services (Digital
Services Act) and amending Directive 2000/31/EC].

(y)‘real-time audio communication’ means voice communication that allow the persons
concerned to interact with each other with negligible delays;‘call’ means a connection as defined in Article 2, point 31 of Directive (EU) 2018/1972.

9093/24
ANNEX

JAI.1

GR/ml

41

LIMITEENCHAPTER IIOBLIGATIONS OF PROVIDERS OF RELEVANT INFORMATION SOCIETY SERVICESTO PREVENT AND COMBAT ONLINE CHILD SEXUAL ABUSE
Section 1
Risk assessment and mitigation obligations
Article 3
Risk assessment
1.

Providers of hosting services and providers of interpersonal communications services shalldiligently identify, analyse and assess, for each such service that they offer, the risk of useof the service for the purpose of online child sexual abuse.

2.

When carrying out a risk assessment, the provider shall take into account, in particular:(a)any previously identified instances of use of its services for the purpose of online
child sexual abuse;(b)

the existence and implementation by the provider of a policy and the availability offunctionalities to address the risk referred to in paragraph 1, including through thefollowing:–prohibitions and restrictions laid down in the terms and conditions;–

measures taken to enforce such prohibitions and restrictions;–functionalities enabling age verification;–functionalities enabling parental control or parental consent mechanisms;–

functionalities enabling users to flag notify online child sexual abuse to theprovider through tools that are easily accessible and age-appropriate;–measures taken to ensure a robust and swift process to handle notified
potential child sexual abuse;–(c)functionalities enabling the providers the compilation and generation of
relevant statistical information for assessment purposes.

the manner in which users use the service and the impact thereof on that risk;(ca) age appropriate measures taken by the provider to promote users’ media digital
literacy and safe use of the service;9093/24
ANNEX

JAI.1

GR/ml

42

LIMITEEN(d)the manner in which the provider designed and operates the service, including thebusiness model, governance and relevant systems and processes, and the impact
thereof on that risk;(da) the availability of functionalities enabling users to share images or videos withother users, in particular through private communications, and offunctionalities enabling the providers to assess how easily, quickly, and widely
such material may be disseminated further by means of the service;(e)with respect to the risk of solicitation of children:(i)the extent to which the service is used or is likely to be used by children;(ii)

where the service is used by children, the different age groups of the childusers and the risk of solicitation of children in relation to those age groups;(iii) the availability of functionalities creating or reinforcing the risk of solicitationof children, including the following functionalities:

3.

–

enabling users to search for other users and, in particular, for adult users
to search for child users;–

enabling users to establish contact with other users directly, in particularthrough private communications.

–enabling users to share images or videos with other users, in particularthrough private communications.

The provider may request the EU Centre to perform an analysis of representative,
anonymized data samples to identify potential online child sexual abuse, to support the risk
assessment.
The costs incurred by the EU Centre for the performance of such an analysis shall be borneby the requesting provider. However, the EU Centre shall bear those costs where theprovider is a micro, small or medium-sized enterprise, provided the request is reasonably
necessary to support the risk assessment. The EU Centre shall make available
information to providers to determine those costs.
The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to supplement this Regulation with the necessary detailed rules on thedetermination and charging of those costs, the information to be provided and theapplication of the exemption for micro, small and medium-sized enterprises.

9093/24
ANNEX

JAI.1

GR/ml

43

LIMITEEN4.

The provider shall carry out the first risk assessment by [Date of application of thisRegulation + 3 months] or, where the provider did not offer the service in the Union by[Date of application of this Regulation], by three months from the date at which theprovider started offering the service in the Union.
Subsequently, the provider shall update the risk assessment where necessary and,depending on the risk category determined in accordance with Article 5(2), at least
once every three years for low-risk services, at least once every two years for mediumrisk services and at least once every year for high-risk services from the date at which it
last carried out or updated the risk assessment. However:(a)

for a high-risk service which is subject to a detection order issued in accordancewith Article 7, the provider shall update the risk assessment at the latest two fourmonths before the expiry of the period of application of the detection order;(b)

the Coordinating Authority of establishment may require the provider to update therisk assessment at a reasonable earlier date than the date referred to in the second
subparagraph, where there is evidence, including from Coordinating Authoritiesof other Member States or from providers offering low-risk or medium-risk
services, indicating a possible substantial change in the risk that the service is used
for the purpose of online child sexual abuse.

4a.

The risk assessment shall gather information on the limitation of the risk to an
identifiable part or component of the service where possible, such as specific types ofchannels of an interpersonal communications service, or to specific users or specificgroups or types of users where possible, to the extent that such part, component,
specific users or specific groups or types of users can be assessed in isolation for the
purpose of mitigating the risk of online child sexual abuse.

5.

The risk assessment shall include an assessment of any potential remaining risk that, after
taking the mitigation measures pursuant to Article 4, the service is used for the purpose of
online child sexual abuse.

6.

The Commission, in cooperation with Coordinating Authorities and the EU Centre andafter having conducted a public consultation, may issue guidelines on the application ofparagraphs 1 to 5, having due regard in particular to relevant technological developments
and to the manners in which the services covered by those provisions are offered and used.

9093/24
ANNEX

JAI.1

GR/ml

44

LIMITEEN

Article 4
Risk mitigation
1.

If providers of hosting services and providers of interpersonal communications services
have identified a risk of the service being used for the purpose of online child sexual
abuse pursuant to Article 3, they shall take all reasonable mitigation measures, tailoredto the that risk identified pursuant to Article 3, to minimise that risk. The risk mitigation
measures shall be limited to an identifiable part or component of the service, or to
specific users or specific groups or types of users, where possible, without prejudice tothe effectiveness of the measure.
Such measures shall at least include some or all of the following:9093/24
ANNEX(a)adapting, through appropriate technical and operational measures and staffing, theprovider’s content moderation or recommender systems, its decision-making
processes, the operation or functionalities of the service, or the content or
enforcement of its terms and conditions;(b)reinforcing the provider’s internal processes or the internal supervision of thefunctioning of the service;(c)

initiating or adjusting cooperation, in accordance with competition law, with otherproviders of hosting services or providers of interpersonal communications services,public authorities, civil society organisations or, where applicable, entities awarded
the status of trusted flaggers in accordance with Article 22 19 of Regulation (EU)2022/2065 …/… [on a Single Market For Digital Services (Digital Services Act) andamending Directive 2000/31/EC];(d)initiating or adjusting functionalities that enable users to notify online childsexual abuse to the provider through tools that are easily accessible and ageappropriate;(e)initiating or adjusting functionalities that enable users to control what
information about them is shared to other users and how other users may
contact them, and introducing default suitable privacy settings for users who
are minors;

JAI.1

GR/ml

45

LIMITE

EN

2.

(f)

initiating or adjusting functionalities that provide information to users about
notification systems mechanisms and direct users to helplines and trusted
organisations, where users detect material or conversations contact indicating
potential online child sexual abusewhere suspicious contacts are detected;(g)

initiating or adjusting functionalities that allow the providers to collectstatistical data to better assess the risks and the effectiveness of the mitigation
measures. This data shall not include any personal data.

The mitigation measures shall be:(a)effective in mitigating the identified risk;(b)targeted and proportionate in relation to that risk, taking into account, in particular,
the seriousness of the risk as well as the provider’s financial and technologicalcapabilities and the number of users;(c)applied in a diligent and non-discriminatory manner, having due regard, in all
circumstances, to the potential consequences of the mitigation measures for the
exercise of fundamental rights of all parties affected;(d)introduced, implemented, reviewed, modified, discontinued or expanded, as
appropriate, each time the risk assessment is conducted or updated pursuant to
Article 3(4), within three months from the date referred to therein.

3.

Providers of interpersonal communications services that have identified, pursuant to therisk assessment conducted or updated in accordance with Article 3, a risk of use of theirservices for the purpose of the solicitation of children, shall take, the necessary age
verification and age assessment measures to reliably identify child users on their services,
enabling them to take the mitigation measures.

3a.

Any Those age verification and age assessment measures shall be privacy preserving,
respecting the principles relating to the processing of personal data, notably theprinciples of lawfulness, purpose limitation and data minimisation, proportionate,transparent, effective, accurate, non-discriminatory, accessible and take as a primaryconsideration the best interest of the child into account not involve any profiling or
biometric identification of users.

3a.

Providers of hosting services and providers of interpersonal communications services
The provider may request the EU Centre to assist in identifying and assessing
technical aspects of analysing suitable specific mitigation measures selected by theprovider in application of referred to in paragraphs 1, 2 and 3.
The costs incurred by the EU Centre for providing such assistance the performanceof such an analysis shall be borne by the requesting provider. However, the EU
Centre shall bear those costs where the provider is a micro, small or medium-sizedenterprise, provided the request is reasonably necessary to support the risk
assessment the identification and assessment of risk mitigation measures. The EU
Centre shall make available information to determine those costs.

9093/24
ANNEX

JAI.1

GR/ml

46

LIMITEENThe assistance provided by the EU Centre shall not affect the responsibility of theprovider to comply with the requirements applicable to the mitigation measures andfor any decisions it may take in connection to or as a result of the application of thosemeasures.
The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 in order to supplement this Regulation with the necessary detailed rules on
the determination and charging of those costs, the information to be provided and theapplication of the exemption for micro, small and medium-sized enterprises.
4.

Providers of hosting services and providers of interpersonal communications services shallclearly describe in their terms and conditions the mitigation measures that they have taken.
That description shall not include information that may reduce the effectiveness of the
mitigation measures.

5.

The Commission, in cooperation with Coordinating Authorities and the EU Centre andafter having conducted a public consultation, may issue guidelines on the application ofparagraphs 1, 2, 3 and 4, having due regard in particular to relevant technologicaldevelopments and in the manners in which the services covered by those provisions areoffered and used.
Article 5
Risk reporting and categorisation

1.

Providers of hosting services and providers of interpersonal communications services shalltransmit, by three months from the date referred to in Article 3(4), to the Coordinating
Authority of establishment a report specifying including the following:(a)the premise for the risk assessment pursuant to Article 3(2), the process and theresults of the risk assessment conducted or updated pursuant to Article 3, including
the assessment of any potential remaining risk referred to in Article 3(5);(b)

any mitigation measures taken pursuant to Article 4 and, where applicable, Article
5a, and the results thereof including the effectiveness of these measures and how
they comply with the requirements of Article 4(2), and in case of age assessment
and verification measures, how they comply with the requirements of Article 4(3);(ba) any other mitigation measures implemented before carrying out the risk
assessment and, when available, complementary informations about theeffectiveness of these measures;(bb) the effectiveness of these measures and how they comply with the requirementsof Article 4 (2);9093/24
ANNEX

JAI.1

GR/ml

47

LIMITEEN(c)where potential remaining risk as referred to in Article 3(5) is identified, anyavailable information relevant for identifying as precisely as possible the parts
or components of the service, or the specific users or groups or types of users, inrespect of which the potential remaining risk arises and the planned further
measures to mitigate this risk.

(ca) a self-assessment against the criteria established for the categorisation of risksof the service or the parts or components of the service, following the templateestablished in accordance with Article 5(2a)laid down in ANNEX XIV;(d)whether the provider intends to requests to the Coordinating Authority of
establishment the authorisation to display the sign of compliance reduced risk
as referred to in accordance with in Article 5b.

(d)any other relevant measures taken to mitigate the risk and the results thereof.

When made available, tThis report should shall include available statisticalinformation to support and illustrate the development and effectiveness of mitigation
measures.
Providers of hosting services and providers of interpersonal communications services
may notify in this report whether there is evidence of the service or parts orcomponents of the service being used for the purpose of online child abuse that might
require the issuing of a detection order in accordance with Article 7(4).
2.

Within three months after receiving the report, the Coordinating Authority of establishment
shall assess it and determine, on that basis and taking into account any other relevant
information available to it, whether the risk assessment has been properly diligently
carried out or updated and the mitigation measures have been taken in accordance with therequirements of Articles 3 and 4 and evaluate the level of the remaining risk.
Based on the evaluation of the level of the remaining risk and taking into account the
self-assessment carried out by the providers of hosting services and providers ofinterpersonal communications against the criteria established for the categorisationof risks, the Coordinating Authority of establishment shall determine the risk
category allocated to the service or the parts or components of the service, following
the methodology and criteria established in accordance with Article 5(2a) outlined in
ANNEX XV.
The service or the parts or components of the service shall be classified into thefollowing categories:

9093/24
ANNEX(a)High risk(b)Medium risk(c)

Low risk

JAI.1

GR/ml

48

LIMITEENThe decision of the Coordinating Authority of establishment determining the risk
category, including the date by when the provider is required to update the risk
assessment, shall be communicated to the providers concerned, recorded by the
Coordinating Authority of establishment and notified to the EU Centre.
The Coordinating Authority of establishment may request the EU Centre to assist in
evaluating the mitigation measures taken by the provider, as well as evaluating thelevel of the remaining risk and in determining the risk category allocated to theservice or the parts or components of the service.
If the provider has submitted the request referred to in point (d) of paragraph 1, theCoordinating Authority shall decide on the issuance of the authorisation to display
the sign of compliance reduced risk in accordance to Article 5b.
2a.

51

The risk categorisation shall be based on the report submitted by the providers to the
Coordinating Authority of establishment in line with Article 5, in particular the risk
assessment by the providers, the mitigation measures undertaken by them and theirself-assessment, and any other relevant information available to the Coordinating
Authority of establishment or the EU Centre. The methodology and the criteria forthe risk categorisation shall enable an objective, transparent and comprehensibleclassification of the risks of services related to child sexual abuse based on the scoringof risk indicators be based on the following key principles as outlined below51:(a)

The methodology for the risk categorisation shall enable an objective,
transparent and comprehensible classification of the risks of services related tochild sexual abuse based on the scoring of risk indicators.

(b)

The risk categorisation shall be based on the report submitted by the providers
to the Coordinating Authority of establishment in line with Article 5, inparticular the risk assessment by the providers, the mitigation measures
undertaken by them and their self-assessment, and any other relevant
information available to the Coordinating Authority of establishment or the EU
Centre.

(a)

The template for the self-assessment of providers shall be issued in different
versions taking into account the size and the type of the services offered by theproviders as indicated in ANNEX XIV.

(b)

The scoring shall be based on the following criteria: the size, type and corearchitecture of the service, the policies and safety by design functionalities inplace to address the identified risks and a mapping of user tendencies.

(c)

The risk criteria shall be broken down in risk indicators as outlined in the list ofrisk indicators included in ANNEX XIV.

PCY comment: The Presidency has noted reluctance from some delegations to pursue theconcept of risk categorisation with the objective to target the issuing of detection orders tohigh-risk services, while some delegations insisted to keep the provisions in place. This
paragraph is subject to further discussions.

9093/24
ANNEX

JAI.1

GR/ml

49

LIMITEEN

(d)The risk indicators shall be weighted in a transparent and understandable
manner according to their impact on the risks of a service related to child sexual
abuse based on the methodology and criteria as laid down in ANNEX XIV.

(e)

The result of the scoring shall be quantitative and comparable, and provide fora classification into high-risk, medium-risk and low-risk services.52 A service
exceeding 60% of the risk indicators shall be classified as high-risk service. A
service exceeding 25% but not exceeding 60% of the risk indicators shall beconsidered as medium-risk service. A service not exceeding 25% of the risk
indicators shall be considered as low-risk service.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 to detail and amend ANNEX XIV laying down ANNEX XV, if required inparticular due to technological developments, in order to revise the methodology andcriteria for the risk categorisation in line with the key principles outlined in thisparagraph 2a, and to establish and amend the template for the self-assessment by
providers amend ANNEX XIV reflecting the amendments made to ANNEX XV.
3.

Where necessary for that assessment, that Coordinating Authority may require further
information from the provider, within a reasonable time period set by that Coordinating
Authority. That time period shall not be longer than two weeks.
The time period referred to in the first subparagraph paragraph 2 of this Article shall besuspended until that additional information is provided.

4.

Without prejudice to Articles 7 and 27 to 29, where the requirements of Articles 3 and 4
have not been met, that Coordinating Authority shall require the provider to re-conduct or
update the risk assessment or to introduce, implement, review, discontinue or expand, asapplicable, the mitigation measures, within a reasonable time period set by that
Coordinating Authority. That time period shall not be longer than one month. The
provisions of this Article shall also apply to risk assessments re-conducted or updated
pursuant to this paragraph.

4a.

If the Coordination Authority of establishement, after carrying out the assessments
referred to in paragraphs 1 to 4, determines that the risk assessment has beensatisfactorily carried out and that no further mitigation measures can be introduced,
implemented, reviewed, discontinued or expanded, that Coordinating Authority shallauthorise within one week the providers to display a distinctive and universal signattesting to the optimised safety aspects of the assessed service, in accordance toarticle 6a.

52

PCY comment: A service exceeding 60% of the risk indicators could be classified as highrisk service, a service exceeding 25% but not exceeding 60% of the risk indicators as
medium-risk service, and a service not exceeding 25% of the risk indicators as low-risk
service.

9093/24
ANNEX

JAI.1

GR/ml

50

LIMITEEN

4 5.

Providers shall, when transmitting the report to the Coordinating Authority of
establishment in accordance with paragraph 1, transmit the report also to the EU Centre.

5.6.

Providers shall, upon request, transmit the report to the providers of software application
stores, insofar as necessary for the assessment referred to in Article 6(2). Where necessary,
they may remove confidential information from the reports.
Article 5a
Adjusted or additional risk assessment or risk mitigation measures

1.

Without prejudice to Articles 27 to 29, where on the basis of its assessment referred toin Article 5(2), the Coordinating Authority of establishment determines that aprovider offering a service or parts or components of a service classified as high risk
or medium risk has not met the requirements of Articles 3 and or 4 have not beenmet, it shall require the provider of hosting services or the provider of interpersonalcommunications services to carry out one or several of the following actions, withrespect to those parts or components classified as high risk or medium risk, as
appropriate:(a)to re-conduct or update the risk assessment in accordance with Article 3,
including where appropriate by modifying the methodology used to conduct therisk assessment, and report thereon in accordance with Article 5;(b)

to implement, review, modify, discontinue or expand some or all of the risk
mitigation measures taken in accordance with Article 4;(c)to introduce additional risk mitigation measures in accordance with Article 4.

The Coordinating Authority of establishment may request the EU Centre for an
opinion on technical aspects of the possible actions that it intends to require pursuant
to the first subparagraph.
2.

The A provider that is required to perform the actions specified in points (b) or (c) of
paragraph 1 shall re-conduct or update the risk assessment in accordance with
Article 3 so as to take account of those actions, and report thereon in accordance with
Article 5. In the report on the re-conducted or updated risk assessment the provider
shall also specify and explain inform the Coordinating Authority of the actions
performed steps taken to ensure compliance with the measures required pursuant toparagraph 1, within a time period set by the Coordinating Authority. That time
period shall be reasonable, taking into account the complexity of the required actions
measures.

3.

The Coordinating Authority of establishment shall, by deviation from the time
periods specified in Articles 3(4) and 5(1), set a reasonable time period for the
performance of the actions pursuant to paragraph 1 and for the reporting pursuant
to paragraph 2. That time period shall be reasonable, taking into account thecomplexity of the required actions.

9093/24
ANNEX

JAI.1

GR/ml

51

LIMITEEN4.

The Coordinating Authority of establishment may recommend to a provider offeringa service or parts or components of a service classified as low risk to carry out one orseveral of the actions listed in paragraph 1, with respect to those parts or components
classified as low risk, as appropriate.
Article 5b53
Sign of reduced risk compliance

1.

Where both of the following conditions have been met, the Coordinating Authority of
establishment shall authorise a provider of hosting services or a provider ofinterpersonal telecommunications services, upon its reasoned and voluntary request,
as referred to in point (d) of Article 5(1), to publicly display a distinctive sign ofcompliance reduced risk as a clear visual representation to users indicating that theservice concerned meets those conditions:(a)the Coordinating Authority considers that the provider has satisfactorily
carried out the risk assessment in accordance with Article 3 and has taken all
reasonable and necessary risk mitigation measures in accordance with Article 4,
including where applicable pursuant to Article 5a;(b)

the Coordinating Authority considers that there is no need to initiate theprocess for the issuance of a detection order in accordance with Article 7,
having regard in particular to the nature and extent of any remaining riskreferred to in Article 5(2) and the conditions set out in Article 7(4).

2.

The sign shall only be displayed with upon receiving the authorisation referred to inparagraph 1. It The provider shall not be displayed the sign where the authorisation
has been suspended or withdrawn in accordance with paragraph 4, in which case theprovider shall stop displaying it within 24 hours.

3.

Providers authorised in accordance with paragraph 1 shall, for as long as theauthorisation is not withdrawn or suspended, do both of the following:

53

(a)

prominently display the sign on the service concerned;(b)

include, in a clear and easily understandable manner, the necessary
explanations regarding the sign in their terms and conditions, including about
the conditions met to be authorised to display the sign and the fact that theauthorisation does not mean that the risk of online child sexual abuse iscompletely eliminated.

PCY comment: drafting suggestions building on the text proposed by one delegation, taking
into account the comments provided by other delegations during the LEWP meeting of
13 June, notably to ensure that this label is not seen as a complete lack of risk and that itcomes with additional oversight requirements.

9093/24
ANNEX

JAI.1

GR/ml

52

LIMITEEN4.

The Coordinating Authority that issued an authorisation in accordance withparagraph 1 shall regularly, and at least every six months, review whether theconditions set out in that paragraph continue to be met, taking due account of the risk
reporting in accordance with Article 5 and all other relevant information. Where
necessary to that aim, it may require the provider concerned to do one or both of thefollowing:a)conduct or update a risk assessment, take the necessary risk mitigation
measures and report thereon in accordance with Articles 3, 4 and 5 respectively;b)

provide any other relevant information.

The Coordinating Authority shall immediately suspend the authorisation where it hasreasonable doubts about the provider’s continued compliance with the conditions ofparagraph 1. During the suspension, the Coordinating Authority it shall review suchcompliance, including by requiring the provision of information pursuant to the firstsubparagraph where appropriate and giving the provider an opportunity to commenton its findings and its intended next steps within a reasonable time period whereappropriate. It shall conclude the review, without undue delay and taking into
account any comments received within the time period set, either by terminating thesuspension or by withdrawing the authorisation.
The Coordinating Authority shall withdraw the authorisation where it considers thatthe provider no longer meets the conditions of paragraph 1, after having informed theprovider of its intention to withdraw the authorisation and the reasons for that
intention and having given the provider an opportunity to comment thereon within areasonable time period. It shall also withdraw the authorisation upon request of theprovider.
5.

Coordinating Authorities shall immediately inform the provider concerned and the
EU Centre about each authorisation granted, suspended or withdrawn in accordancewith paragraphs 1 and 4. The EU Centre shall maintain a publicly available registryof that information.

6.

The issuance of an authorisation in accordance with paragraph 1 shall not affect the
Coordinating Authority’s possibility to initiate the process for the issuance of adetection order in accordance with Article 7.

7.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 in order to supplement this Regulation with the necessary detailed rules onrequests for authorisation to display the sign, on the issuance, suspension andwithdrawal of the authorisation, on the design of the sign, on the display of the signand the provision of information to users relating thereto, on the regular review ofcontinued compliance with the conditions and on the registry of information.

9093/24
ANNEX

JAI.1

GR/ml

53

LIMITEEN

Article 6
Obligations for software application stores
1.

Providers of software application stores shall:(a)make reasonable efforts to assess, where possible together with the providers ofsoftware applications, whether each service offered through the software applications
that they intermediate presents a risk of being used for the purpose of the solicitationof children;(b)take reasonable measures to prevent child users from accessing the software
applications in relation to which they have identified a significant risk of use of theservice concerned for the purpose of the solicitation of children;(c)take the necessary age verification and age assessment measures to reliably identify
child users on their services, enabling them to take the measures referred to in point(b). Those age verification and age assessment measures shall be privacy
preserving, proportionate, transparent, effective, accurate, non-discriminatory,
accessible and take as a primary consideration the best interest of the child.

2.

In assessing the risk referred to in paragraph 1, the provider shall take into account all theavailable information, including the results of the risk assessment conducted or updated
pursuant to Article 3.

3.

Providers of software application stores shall make publicly available information
describing the process and criteria used to assess the risk and describing the measuresreferred to in paragraph 1. That description shall not include information that may reduce
the effectiveness of the assessment of those measures.

4.

The Commission, in cooperation with Coordinating Authorities and the EU Centre andafter having conducted a public consultation, may issue guidelines on the application ofparagraphs 1, 2 and 3, having due regard in particular to relevant technologicaldevelopments and to the manners in which the services covered by those provisions areoffered and used.

9093/24
ANNEX

JAI.1

GR/ml

54

LIMITEEN

Article 6aLabelling of optimised Safety Aspects for Services:1.

Upon authorisation from the Coordinating Authority of establishment, in accordancewith Article 5(4a), the service provided that has undergone satisfactory risk
assessments and implemented effective safety measures shall publicly display a
distinctive and universal sign that ensures transparency and inspires confidence forusers (‘label’).

2.

This distinctive sign shall:(a)be designed and published by the EU Centre, ensuring its recognition anduniformity across all certified services;(b)

serve as a clear visual representation to users, indicating that the service has
undergone rigorous risk assessments and has implemented efficient risk
mitigation measures with the aim of persistently improving the safety of service
users regarding child sexual abuse;(c)be displayed, where applicable, by the service providers prominently on theconcerned service;3.

The Coordinating Authorities shall inform the EU Centre about the labelling
authorisations given upon successful certification process.

4.

The EU Centre shall maintain a publicly accessible registry of certified services,
including information on the certified service providers, the date of certification, theexact scope of certification.

5.

The Coordinating Authority may reassess the previous certification and, whenappropriate, withdraw the authorisation referred to in paragraph 1 of this Article.

6.

The Commission, in cooperation with Coordinating Authorities and the EU Centre
and after having conducted a public consultation, may issue guidelines on theapplication of paragraphs 1 to 4, having due regard in particular to relevant
technological developments and in the manners in which the services covered by those
provisions are offered and used.

9093/24
ANNEX

JAI.1

GR/ml

55

LIMITEENSection 2
Detection obligations
Article 7
Issuance of detection orders
1.

The Coordinating Authority of establishment shall have the power to request the competentjudicial authority of the Member State that designated it or an independent administrative
authority of that Member State to issue a detection order requiring a provider of hosting
services or a provider of interpersonal communications services that are classified as highrisk in accordance with Article 5(2) or parts or components of the services classified
as high risks that fall under the jurisdiction of that Member State to take the measures
specified in Article 10 for the sole purpose of to detecting the dissemination of online
child sexual abuse material on a specific service or parts or components of the service,classified as high risk in accordance with Article 5(2), for a limited period of time as
specified in paragraph 9. Member States may decide that detection orders can beissued by the Coordinating Authority of establishment subject to prior authorisation
by a judicial authority or an independent administrative authority.

2.

The Coordinating Authority of establishment shall, before requesting the issuance of or
the authorisation for issuing a detection order, carry out the investigations andassessments necessary to determine whether the conditions of paragraph 4 have been met.
To that end, it may, where appropriate, require the provider to submit the necessary
information, additional to the report and the further information referred to in Article 5(1)and (3), and Article 5a(2), respectively, within a reasonable time period set by that
Coordinating Authority, or request the EU Centre, another public authority or relevant
experts or entities to provide the necessary additional information. It may also request theassistance of the EU Centre to conduct simulation tests in accordance with Article 47aon the service in question to verify whether there are objective indications, as
referred to in point (a) of paragraphs 5, or 6 or 7, as applicable.

3.

9093/24
ANNEX

Where the Coordinating Authority of establishment takes the preliminary view that theconditions of paragraph 4 have been met, it shall:(a)establish a draft request for the issuance of a detection order, specifying the mainelements of the content of the detection order it intends to request and the reasons
including the necessity for requesting it;(b)submit the draft request to the provider and the EU Centre;(c)afford the provider an opportunity to comment on the draft request, within areasonable time period set by that Coordinating Authority;(d)invite the EU Centre to provide its opinion on the draft request, within a time periodof four weeks from the date of receiving the draft request.

JAI.1

GR/ml

56

LIMITEEN

Where, having regard to the comments of the provider and the opinion of the EU Centre,that Coordinating Authority continues to be of the view that the conditions of paragraph 4
have met, it shall re-submit the draft request, adjusted where appropriate, to the provider.
In that case, the provider shall do all of the following, within a reasonable time period set
by that Coordinating Authority:(a)draft an implementation plan setting out the measures it envisages taking to executethe intended detection order, including detailed information regarding the envisaged
technologies and safeguards;(b)

where the draft implementation plan concerns an intended detection order concerning
the solicitation of children other than the renewal of a previously issued detection
order without any substantive changes, conduct a data protection impact assessment
and a prior consultation procedure as referred to in Articles 35 and 36 of Regulation(EU) 2016/679, respectively, in relation to the measures set out in theimplementation plan;(c)where point (b) applies, or where the conditions of Articles 35 and 36 of Regulation(EU) 2016/679 are met, adjust the draft implementation plan, where necessary inview of the outcome of the data protection impact assessment and in order to take
into account the opinion of the data protection authority provided in response to theprior consultation;(d)submit to that Coordinating Authority the implementation plan, where applicableattaching the opinion of the competent data protection authority and specifying how
the implementation plan has been adjusted in view of the outcome of the dataprotection impact assessment and of that opinion.

Where, having regard to the implementation plan of the provider and the received opinionsof the data protection authority and the EU Centre, where applicable, that Coordinating
Authority continues to be of the view that the conditions of paragraph 4 have met, it shallsubmit the request for the issuance or for the authorisation of the issuance of thedetection order, adjusted where appropriate, to the competent judicial authority or
independent administrative authority. It shall attach the implementation plan of theprovider and the opinions of the EU Centre and the data protection authority to that request
and, when appropriate, the reasons for diverging from the opinions received.

9093/24
ANNEX

JAI.1

GR/ml

57

LIMITEEN4.

The Coordinating Authority of establishment shall request the issuance of or theauthorisation for issuing the detection order substantiated by its motivated reasoning
and relevant justifications, and the competent judicial authority or independentadministrative authority may shall issue or authorise the issuing by the Coordinating
Authority of establishment of the detection order where it considers that the following
conditions are met:(a)there is evidence of a significant and present or foreseeable risk of the high-risk
service or parts or components of the service being used for the purpose of online
child sexual abuse, within the meaning of paragraphs 5, and 6 and 7, as applicable;(b)the reasons for issuing the detection order outweigh negative consequences for therights and legitimate interests of all parties affected, having regard in particular to theneed to ensure a fair balance between the fundamental rights of those parties.

When assessing whether the conditions of the first subparagraph have been met, accountshall be taken of all relevant facts and circumstances of the case at hand, in particular:(a)the risk assessment conducted or updated and any mitigation measures taken by theprovider pursuant to Articles 3 and 4, including any mitigation measures introduced,
reviewed, discontinued or expanded pursuant to Article 5a 5(4) where applicable;(b)

any additional information obtained pursuant to paragraph 2 or any other relevant
information available to it, in particular regarding the use, design and operation of
the service, regarding the provider’s financial and technological capabilities and size
and regarding the potential consequences of the measures to be taken to execute thedetection order for all other parties affected;(c)the views and the implementation plan of the provider submitted in accordance withparagraph 3;(ca) the necessity and proportionality in terms of the period of application, that theleast intrusiveness of the technologies, approved by implementing act in linewith Article 10(2), are used, the impact on fundamental rights, and thepossibility to limit the scope to parts or components of a service and othersafeguards provided for in accordance with paragraph 8;(d)the opinions of the EU Centre and of the data protection authority submitted inaccordance with paragraph 3.

As regards the second subparagraph, point (d), where that Coordinating Authority
substantially deviates from the opinions received of the EU Centre, it shall inform the EU
Centre and the Commission thereof, specifying the points at which it deviated and the main
reasons for the deviation.

9093/24
ANNEX

JAI.1

GR/ml

58

LIMITE

EN

5.

6.

9093/24
ANNEX

As regards detection orders concerning the dissemination of known child sexual abusematerial, the significant risk referred to in paragraph 4, first subparagraph, point (a), shallbe deemed to exist where the following conditions are met:(a)

it is likely, there are objective indications that, despite any mitigation measuresthat the provider may have taken or will take, that there is a genuine and present
or foreseeable risk, that the service or parts or components of the high-risk
service is or will be used, to an appreciable extent for the dissemination of known
child sexual abuse material;(b)

there is evidence of the service, or of a comparable service if the service has not yet
been offered in the Union at the date of the request for the issuance of the detection
order, having been used in the past 12 months and to an appreciable extent for the
dissemination of known child sexual abuse material.

As regards detection orders concerning the dissemination of new child sexual abusematerial, the significant risk referred to in paragraph 4, first subparagraph, point (a), shallbe deemed to exist where the following conditions are met:(a)

it is likely, there are objective indications that, despite any mitigation measuresthat the provider may have has taken or will take, that there is a genuine andpresent or foreseeable risk that the service or parts or components of the highrisk service is or will be used, to an appreciable extent for the dissemination of newchild sexual abuse material;(b)

there is evidence of the service, or of a comparable service if the service has not yet
been offered in the Union at the date of the request for the issuance of the detection
order, having been used in the past 12 months and to an appreciable extent, for the
dissemination of new child sexual abuse material;(c)for services other than those enabling the live transmission of pornographic
performances as defined in Article 2, point (e), of Directive 2011/93/EU:(1)

a detection order concerning the dissemination of known child sexual abusematerial has been issued in respect of the service;(2)

the provider submitted a significant number of reports concerning known childsexual abuse material, detected through the measures taken to execute thedetection order referred to in point (1), pursuant to Article 12.

JAI.1

GR/ml

59

LIMITEEN

6a. 54

Providers of hosting services and providers of interpersonal communications services
shall carry out the detection orders concerning the dissemination of new child sexual
abuse material in a way that the material is reported in accordance with Articles 12
and 13 under the conditions outlined in sub-paragraphs 2 to 4.
The detection of potential new child sexual abuse material shall result in a hit to be
flagged in the affected service, without the provider getting knowledge of, or control
over, that information. Providers shall preserve the information about the existenceof the hit for at least twelve months or the duration of the respective detection order,whatever is longer.
Once potential new child sexual abuse material has been flagged in a service twice oronce a user has notified the provider about potential new child sexual abuse material
within a service, the provider shall report that material to the EU Centre in such amanner that the personal data cannot be attributed to a specific data subject without
the use of additional information, provided that such additional information is kept
separate and is subject to technical and organisational measures to ensure that thepersonal data are not attributed to an identified or identifiable natural person.
Where the EU Centre considers, after human verification, that a report on potential
new child sexual abuse material submitted by a provider is not manifestly
unfounded, it shall require the provider to re-submit the report without thelimitations outlined in sub-paragraph 3.

7.

54

As regards detection orders concerning the solicitation of children, the significant riskreferred to in paragraph 4, first subparagraph, point (a), shall be deemed to exist where thefollowing conditions are met:(a)the provider qualifies as a provider of interpersonal communications services
excluding such services consisting of real-time audio communications;(b)

it is likely, there are objective indications that, despite any mitigation measuresthat the provider may have has taken or will take, that there is a genuine andpresent or foreseeable risk that the high-risk service or parts or components ofthe service is or will be used, to an appreciable extent for the solicitation ofchildren;

PCY comment: The Presidency has noted reluctance from some delegations to pursue theconcept of delayed reporting for new CSAM with the objective to limit the number ofpotential false positives, while some delegations insisted to keep the provisions in place.
This paragraph is subject to further discussions.

9093/24
ANNEX

JAI.1

GR/ml

60

LIMITEEN(c)there is evidence of the service, or of a comparable service if the service has not yet
been offered in the Union at the date of the request for the issuance of the detection
order, having been used in the past 12 months and to an appreciable extent, for thesolicitation of children.

The detection orders concerning the solicitation of children shall apply only tointerpersonal communications where at least one of the users is a child user and shall not
apply to calls.
8.

The Coordinating Authority of establishment when requesting the issuance of or theauthorisation to issue detection orders, and the competent judicial or independentadministrative authority when issuing or authorising the issuing by the Coordinating
Authority of establishment of the detection order, shall target and specify it in such amanner that the negative consequences referred to in paragraph 4, first subparagraph, point(b), remain limited to what is strictly necessary to effectively address the significant riskreferred to in point (a) thereof.
To that aim, they shall take into account all relevant parameters, including the availabilityof sufficiently reliable detection technologies in that they limit to the maximum extent
possible the rate of errors regarding the detection and their suitability and effectiveness forachieving the objectives of this Regulation, as well as the impact of the measures on therights of the users affected, and require the taking of the least intrusive measures, inaccordance with Article 10, from among several equally effective measures.
In particular, they shall ensure that:

9.

(a)

where that risk is limited to an identifiable part or component of a service, therequired measures are only applied in respect of that part or component;(b)where necessary, in particular to limit such negative consequences, effective andproportionate safeguards additional to those listed in Article 10(4), (5) and (6) areprovided for;(c)subject to paragraph 9, the period of application remains limited to what is strictly
necessary.

(d)detection does not apply to accounts used by the State for national security
purposes, maintaining law and order or military purposes.

The competent judicial authority or independent administrative authority shall specify inthe detection order the period during which it applies, indicating the start date and the end
date.
The start date shall be set taking into account the time reasonably required for the provider
to take the necessary measures to prepare the execution of the detection order. It shall not
be earlier than three months from the date at which the provider received the detection
order and not be later than 12 months from that date.
The period of application of the detection orders concerning the dissemination of known or
new child sexual abuse material shall not exceed 24 months and that of detection orders
concerning the solicitation of children shall not exceed 12 months.

9093/24
ANNEX

JAI.1

GR/ml

61

LIMITEEN10.

Providers of hosting services and providers of interpersonal communications services
shall carry out the detection orders in a way that only users detected repeatedly on
the sharing of potential new child sexual abuse material or attempts to solicitatechildren are reported in accordance with Articles 12 and 13 under the conditions
outlined in the sub-paragraphs 2 and 3.
The detection of potential new child sexual abuse material or attempts to solicitatechildren shall result in a hit to be flagged in the users’ accounts of the affected
service.
Providers shall preserve the information about the existance of the hit for theduration of the respective detection order but not report the data until users on whose
accounts hits related to known potential new child sexual abuse material have been
flagged twice, and users on whose accounts hits related to potential new child sexual
abuse material or attempts to solicitation of children have been flagged three times
during the duration of the respective detection order, shall be reported.
A child using the service shall be automatically and immediately informed that
potential new child sexual abuse material or attempts to solicitate children weredetected, without the provider being notified. The child shall be enabled to notify theprovider thereof through tools that are easily accessible and age-appropriate.
Article 8
Additional rules regarding detection orders

1.

The competent judicial authority or independent administrative authority, or the
Coordinating Authority of establishment subject to prior authorisation by a judicial
authority or an independent administrative authority shall issue the detection orders
referred to in Article 7 using the template set out in Annex I. Detection orders shall
include:(a)9093/24
ANNEX

information regarding the measures to be taken to execute the detection order, including
the indicators to be used and the safeguards to be provided for, including the reporting
requirements set pursuant to Article 9(3) and, where applicable, any additionalsafeguards as referred to in Article 7(8);(b)

identification details of the competent judicial authority or the independentadministrative authority issuing the detection order and authentication of thedetection order by that judicial or independent administrative authority;(c)the name of the provider and, where applicable, its legal representative;(d)the specific service in respect of which the detection order is issued and, whereapplicable, the part or component of the service affected as referred to in Article
7(8);

(e)

whether the detection order issued concerns the dissemination of known or new childsexual abuse material or the solicitation of children;(f)the start date and the end date of the detection order;

JAI.1

GR/ml

62

LIMITEEN(g)a sufficiently detailed statement of reasons explaining why the detection order isissued;(h)a reference to this Regulation as the legal basis for the detection order;(i)the date, time stamp and electronic signature of the judicial or independentadministrative authority issuing the detection order;(j)easily understandable information about the redress available to the addressee of thedetection order, including information about redress to a court and about the time
periods applicable to such redress.

1a.

If a detection order is issued by an independent administrative authority or by the
Coordinating Authority of establishment with the prior authorisation by anindependent administrative authority, that independent administrative authority
must have a status enabling it to act objectively and impartially when carrying out its
duties and must, for that purpose, be free from any external influence.

2.

The competent judicial authority or independent administrative authority issuing thedetection order shall address it to the main establishment of the provider or, whereapplicable, to its legal representative designated in accordance with Article 24.
The detection order shall be transmitted to the provider’s point of contact referred to in
Article 23(1), to the Coordinating Authority of establishment and to the EU Centre,
through the system established in accordance with Article 39(2).
The detection order shall be drafted transmitted in any of the official languages declaredby the provider pursuant to Article 23(3).
The detection order may also be transmitted in any of the official languages of theMember State authority issuing the order, provided that it is accompanied by atranslation of at least the most important elements necessary for the execution of theorder into any of the official languages declared by the provider in accordance witharticle 23(3).

3.

If the provider cannot execute the detection order because it contains manifest errors ordoes not contain sufficient information for its execution, the provider shall, without undue
delay, inform request the necessary clarification to the Coordinating Authority of
establishment, using the template set out in Annex II. That Coordinating Authority shallassess the matter and request the competent judicial authority or independentadministrative authority that issued or authorised the issuing of the detection orderthe modification or revocation of such order, where necessary in the light of theoutcome of that assessment.
The competent judicial authority or independent administrative authority that issued
the detection order shall inform the provider of the outcome of and the reasonsleading to that assessment.

4.

9093/24
ANNEX

The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to amend Annexes I and II where necessary to improve the templates in view of
relevant technological developments or practical experiences gained.

JAI.1

GR/ml

63

LIMITEEN

Article 9
Redress, information, reporting and modification of detection orders
1.

Providers of hosting services and providers of interpersonal communications services thathave received a detection order, as well as users affected by the measures taken to execute
it, shall have a right to effective redress. That right shall include the right to challenge thedetection order before the courts of the Member State of the competent judicial authority or
independent administrative authority that issued the detection order.

2.

When the detection order becomes final, the competent judicial authority or independentadministrative authority that issued or authorised the issuing of the detection order shall,
without undue delay, transmit a copy thereof to inform the Coordinating Authority of
establishment. The Coordinating Authority of establishment shall then, without undue
delay, transmit a copy thereof of the detection order to all other Coordinating Authorities
through the system established in accordance with Article 39(2).
For the purpose of the first subparagraph, a detection order shall become final upon the
expiry of the time period for appeal where no appeal has been lodged in accordance withnational law or upon confirmation of the detection order following an appeal.

3.

Where the period of application of the detection order exceeds 12 months, or six months in
the case of a detection order concerning the solicitation of children, the Coordinating
Authority of establishment shall require the provider to report to it the necessary
information on the execution of the detection order at least once, halfway through theperiod of application.
Those reports shall include a detailed description of the measures taken to execute thedetection order, including the safeguards provided, and information on the functioning inpractice of those measures, in particular on their effectiveness in detecting thedissemination of known or new child sexual abuse material or the solicitation of children,
as applicable, and on the consequences of those measures for the rights and legitimate
interests of all parties affected.

4.

In respect of the detection orders that the competent judicial authority or independentadministrative authority issued at its request, The Coordinating Authority of establishment
shall, where necessary and in any event following reception of the reports referred to inparagraph 3, assess whether any substantial changes to the grounds for issuing thedetection orders occurred and, in particular, whether the conditions of Article 7(4) continue
to be met. In that regard, it shall take account of additional mitigation measures that theprovider may take to address the significant risk identified at the time of the issuance of thedetection order.
That Coordinating Authority shall request to the competent judicial authority or
independent administrative authority that issued or authorised the issuing of the detection
order the modification or revocation of such order, where necessary in the light of theoutcome of that assessment. The provisions of this Section shall apply to such requests,
mutatis mutandis.

9093/24
ANNEX

JAI.1

GR/ml

64

LIMITEEN

Article 10
Technologies and safeguards
1.

Providers of hosting services and providers of interpersonal communications services thathave received a detection order shall execute it by installing and operating technologies
approved by the Commission to detect the dissemination of known or new child sexual
abuse material or the solicitation of children, as applicable, using the corresponding
indicators provided by the EU Centre in accordance with Article 46.

2.

The Commission shall adopt implementing acts to approve the technologies referred
to in paragraph 1, after consulting the EU Centre, using the criteria set out inparagraph 3. Those implementing acts shall be adopted in accordance with theadvisory examination procedure referred to in Article 87.
The provider shall be entitled to acquire, install and operate, free of charge, technologies
made available by the EU Centre in accordance with Article 50(1), for the sole purpose of
executing the detection order.
The provider shall not be required to use any specific technology, including those madeavailable by the EU Centre, as long as the requirements set out in this Article are met. The
use of the technologies referred to in paragraph 1 approved by the Commission madeavailable by the EU Centre shall not affect the responsibility of the provider to comply
with those the requirements set out in this Article and for any decisions it may take inconnection to or as a result of the use of the technologies.

3.

The technologies shall be:(a)be effective and suitable and not easily circumvented in detecting thedissemination of known or new child sexual abuse material or the solicitation ofchildren, as applicable;(aa) not introduce cybersecurity risks for which it is not possible to take any effective
measures to mitigate such risk;9093/24
ANNEX(b)

not be able to deduce the substance of the content of the communications nor to
extract any other information from the relevant communications than the information
strictly necessary to detect, using the indicators referred to in paragraph 1, patterns
pointing to the dissemination of known or new child sexual abuse material or thesolicitation of children, as applicable;(c)be in accordance with the state of the art in the industry and the least intrusive interms of the impact on the users’ rights to private and family life, including theconfidentiality of communication, and to protection of personal data;(d)be sufficiently reliable and accurate, in that they limit to the maximum extent
possible the rate of errors regarding the detection and, where such errors occur,
enable the correction of errors without undue delay. .

JAI.1

GR/ml

65

LIMITEEN4.

The provider shall:(a)take all the necessary measures to ensure that the technologies and indicators, as wellas the processing of personal data and other data in connection thereto, are used forthe sole purpose of detecting the dissemination of known or new child sexual abusematerial or the solicitation of children, as applicable, insofar as strictly necessary to
execute the detection orders addressed to them. In particular, the provider shall:(i)diligently identify, analyse and assess the cybersecurity risks that could be
introduced by the technologies used for the execution of the detection
orders;(ii)

take all reasonable mitigation measures, tailored to the possible
cyberscurity risk identified, to minimise that risk;(iii) support a functional and security audit by the EU Centre at the sourcecode level for scrutiny.
(aa) limit the functionalities of the service to prevent the transmission of visualcontent and URLs absent the user consent pursuant to paragraph 5(aa);9093/24
ANNEX(b)establish effective internal procedures to prevent and, where necessary, detect andremedy any misuse, including misuses caused by breaching cybersecurity
measures, of the technologies, indicators and personal data and other data referred toin point (a), and unauthorized access to, and unauthorised transfers of, such personal
data and other data;(c)ensure regular human oversight as necessary to ensure that the technologies operate
in a sufficiently reliable manner and, where necessary, in particular whenpotential errors and potential solicitation of children are detected, humanintervention;(d)establish and operate an accessible, age-appropriate and user-friendly mechanismthat allows users to submit to it, within a reasonable timeframe, complaints about
alleged infringements of its obligations under this Section, as well as any decisions
that the provider may have taken in relation to the use of the technologies, including
the removal or disabling of access to material provided by users, blocking the users’
accounts or suspending or terminating the provision of the service to the users, andprocess such complaints in an objective, effective and timely manner;(e)

inform the Coordinating Authority, at the latest one month before the start datespecified in the detection order, on the implementation of the envisaged measures set
out in the implementation plan referred to in Article 7(3);(f)

regularly review the functioning of the measures referred to in points (a), (aa), (b),(c) and (d) of this paragraph and adjust them where necessary to ensure that therequirements set out therein are met, as well as document the review process and theoutcomes thereof and include that information in the report referred to in Article
9(3).

JAI.1

GR/ml

66

LIMITEEN5.

The provider shall inform request the consent of users after informing them in theterms and conditions of use in a clear, prominent and comprehensible way of thefollowing:(a)the fact that, upon receiving a detection order, the provider it operates automatedtechnologies (automated profiling) to detect online child sexual abuse material to
execute the detection order, the ways in which it operates those technologies,
meaningful information about the logic involved, and the impact on theconfidentiality of users’ communications;(aa) the fact that, upon receiving a detection order in interpersonal communications
services, it is required to limit the functionalities of the service to prevent thetransmission of visual content and URLs absent the user consent;(b)

the fact that the provider it is required to report potential online child sexual abuseto the EU Centre in accordance with Article 12;(c)the users’ right of judicial redress referred to in Article 9(1) and their rights to submit
complaints to the provider through the mechanism referred to in paragraph 4, point(d) and to the Coordinating Authority in accordance with Article 34.

(d)the users’ rights as data subjects under Regulation (EU) 2016/679.

The provider shall not provide information to users that may reduce the effectiveness of themeasures to execute the detection order.
6.

Where a provider detects potential online child sexual abuse through the measures taken to
execute the detection order, it shall inform the users concerned without undue delay, after
Europol or the national law enforcement authority of a Member State that received thereport pursuant to Article 48 has confirmed that the information to the users would notinterfere with activities for the prevention, detection, investigation and prosecution of childsexual abuse offences.
Article 10a
Technologies for upload moderation

In order to implement this Regulation, providers of interpersonal communications services
shall install and operate technologies to detect, prior to transmission, the dissemination of
known child sexual abuse material or of new child sexual abuse material.
Article 11
Guidelines regarding detection obligations
The Commission, in cooperation with the Coordinating Authorities and the EU Centre and after
having conducted a public consultation, may issue guidelines on the application of Articles 7 to 10,
having due regard in particular to relevant technological developments and the manners in which
the services covered by those provisions are offered and used.

9093/24
ANNEX

JAI.1

GR/ml

67

LIMITEENSection 3
Reporting obligations
Article 12
Reporting obligations
1.

Without prejudice to Article 7(6a), where a provider of hosting services or a provider ofinterpersonal communications services becomes aware in any manner other than through aremoval order issued in accordance with this Regulation of any information indicating thatindicate potential online child sexual abuse on its services, it shall promptly submit areport thereon to the EU Centre in accordance with Article 13. It shall do so through thesystem established in accordance with Article 39(2).

2.

Where the provider submits a report pursuant to paragraph 1, it shall inform the users
concerned, in accordance with the following sub-paragraphs providing information on
the main content of the report, on the manner in which the provider has become aware of
the potential child sexual abuse concerned, on the follow-up given to the report insofar as
such information is available to the provider and on the user’s possibilities of redress,
including on the right to submit complaints to the Coordinating Authority in accordancewith Article 34.
The provider shall inform the users concerned without undue delay, either after having
received a communication from the EU Centre indicating that it considers the report to be
manifestly unfounded as referred to in Article 48(2), or after the expiry of a time period of
six three months from the date of the report without having received a communicationfrom the EU Centre indicating that the information is not to be provided as referred to in
Article 48(6), point (a), whichever occurs first. The time period of six months refered toin this subparagraph shall be extended by up to 6 months where so requested by thecompetent authority referred to in Article 48(6), point a.
Where within the three months’ time period referred to in the second subparagraph theprovider receives such a communication from the EU Centre indicating that the
information is not to be provided, it shall inform the users concerned, without undue delay,
after the expiry of the time period set out in that communication.

9093/24
ANNEX

JAI.1

GR/ml

68

LIMITEEN3.

The provider shall establish and operate an easy to access, accessible, effective, childfriendly age-appropriate and user-friendly, in particular child-friendly, mechanism thatallows users to notify flag to the provider information that indicate potential online childsexual abuse on its the service. Those mechanisms shall allow for the submission ofnotices by individuals or entities exclusively by electronic means.
The mechanisms shall be such as to facilitate the submission of sufficiently precise
and adequately substantiated notices. To that end, the providers shall take thenecessary measures, with particular attention to the needs of the child, to enable andto facilitate the submission of notices, with a view to receiving:

4.

(a)

the reasons why the user alleges that the material or conversation at issue
constitutes claims that the notice contains online child sexual abuse;(b)

a clear indication of the online location of the alleged online child sexual abuse
and, where necessary, additional information specific to a service that enables
the identification of its online location.

The Commission, in cooperation with Coordinating Authorities and the EU Centre
and after having conducted a public consultation, shall issue guidelines on theapplication of paragraph 3, having due regard in particular to the child's age,maturity, views, needs and concerns.
Article 13
Specific requirements for reporting

1.

Providers of hosting services and providers of interpersonal communications services shallsubmit the report referred to in Article 12 using the template set out in Annex III. The
report shall include:(a)identification details of the provider and, where applicable, its legal representative;(b)

the date, time stamp and electronic signature of the provider;(ba) manner in which the provider became aware of the potential child sexual
abuse55;

55

PCY comment: the type of source of the report is included in Annex III, Section 2, point 8.

9093/24
ANNEX

JAI.1

GR/ml

69

LIMITEEN1a.

9093/24
ANNEX(c)

all content data related to the reported potential online child sexual abuse,including images, videos and text;(d)

all other available data related to the reported potential online child sexual abuse,including unique identifiers of the user and metadata related to media files andcommunications;(e)whether the potential online child sexual abuse concerns the dissemination of knownor new child sexual abuse material or the solicitation of children;(f)information concerning the geographic location related to the potential online childsexual abuse, such as the Internet Protocol address of upload, with associated date
and time stamp, including time zone, and port number;(g)

information concerning the identity of any user involved in the potential online childsexual abuse, including unique identifiers of the user;(h)whether the provider has also reported, or will also report, the information thatindicate potential online child sexual abuse to a third-country public authority orother entity competent to receive such reports of a third country and if so, whichauthority or entity;(i)where the information that indicate potential online child sexual abuse concerns thedissemination of known or new child sexual abuse material, whether the provider has
removed or disabled access to the material, and, where relevant, whether it has
been done on a voluntary basis;(j)whether the provider considers that the report requires urgent action;(k)a reference to this Regulation as the legal basis for reporting.

By deviation from paragraph 1, where the information referred to in Article 12(1)reasonably justifies the conclusion that there is likely to be an imminent threat to thelife or safety of a child or when the information indicates ongoing abuse, the reportreferred to in paragraph 1 of this Article shall include:(a)in any event, the information referred to in points (a), (b), (f), (j) and (k) of
paragraph 1 of this Article;(b)

the information referred to in the other points of paragraph 1 of this Article,
only insofar as that information is immediately available and the inclusion
thereof in the report does not delay the submission of the report.

JAI.1

GR/ml

70

LIMITEEN

Where the report referred to in the first subparagaph does not contain all
information referred to in paragraph 1 of this Article in accordance with point (b) of
the first subparagraph, the provider of hosting services or of interpersonalcommunications services concerned shall be promptly submit an additional reportcontaining all that information, updated or completed where relevant. That
additional report shall include a reference to the initial report submitted inaccordance with the first subparagaph and shall indicate which information has been
updated or completed.
2.

The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to amend Annex III to improve the template where necessary in view of relevant
technological developments or practical experiences gained.
Article 13a
Emergency reporting

1.

In the case of an imminent threat to the life or safety of a child, the providers of
hosting services and providers of interpersonal communications services shallpromptly and directly, in addition to paragraph 1(j) of Article 13, inform authorities
competent to for the investigation and prosecution of criminal offences in theMember States concerned56. Where the provider cannot identify with reasonablecertainty the Member State concerned, it shall inform the law enforcement
authorities of the Member State in which it is established or where its legal
representative resides or is established and inform Europol57.

2.

For the purpose of paragraph 1, the Member State concerned shall be theMember State in which the offence is suspected to have taken place, to be taking placeor to be likely to take place, or the Member State where the suspected offenderresides or is located, or the Member State where the victim of the suspected offence
resides or is located.

56
57

Wording copied from Art. 14(5) of the TCO Regulation.
Wording copied from Art. 18(2) of the DSA.

9093/24
ANNEX

JAI.1

GR/ml

71

LIMITEENSection 4
Removal obligations
Article 14
Removal orders
1.

The Coordinating Authority of establishment shall have the power to request the competentjudicial authority of the Member State that designated it or another independentadministrative authority of that Member State to issue a removal order requiring a providerof hosting services under the jurisdiction of the Member State that designated that
Coordinating Authority to remove or disable access in all Member States of one or more
specific items of material that, after a diligent assessment, the Coordinating Authority or
the courts or other independent administrative authorities referred to in Article 36(1)identified as constituting child sexual abuse material. The competent authority of each
Member State of establishment shall have the power to issue a removal order, in
accordance with relevant national requirements,subject to any requirements ofnational law as referred to in paragraph 1a, requiring a provider of hosting services
to remove or disable access in all Member States of one or more specific and publicly
available items of material disseminated to the public that, after a diligent assessment,
the Coordinating Authority or the courts or other independent administrative authorities
referred to in Article 36(1) is identified as constituting child sexual abuse material.

1a.

By deviation from the first subparagraph 1, and without causing undue delays in theprocess of issuance of those orders, Member States may decide that such orders canonly be issued by or with the prior authorisation of a judicial authority, if necessary,at the request of another the competent authority. Where a Member State makes useof this possibility, it shall inform the Commission thereof and maintain thisinformation updated. The Commission shall make the information received publicly
available and maintain this information updated.

2.

The provider shall execute the removal order as soon as possible and in any event within
24 1 hours of receipt thereof. The provider shall take the necessary measures to ensurethat it is capable to reinstate the material or access thereto in accordance with Article
15(1a).

3.

The competent judicial authority or the independent administrative authority shall issue a
A removal order shall be issued using the template set out in Annex IV. Removal orders
shall include:9093/24
ANNEX(a)identification details of the competent judicial or independent administrative
authority issuing the removal order and authentication of the removal order by that
authority;(b)

the name of the provider and, where applicable, of its legal representative;

JAI.1

GR/ml

72

LIMITEEN(c)the specific service in respect of for which the removal order is issued;(d)a sufficiently detailed statement of reasons explaining why the removal order isissued and in particular why the material constitutes child sexual abuse material;(da) where applicable, a statement of reasons explaining why the order is issued to aservice provider that does not have its main establishment or legal
representative in the Member State of the issuing authority according to theprocedure provided for in Article 14a;(e)an exact uniform resource locator and, where necessary, additional clear information
for the identification of enabling the provider to identify and locate the childsexual abuse material;(f)where applicable, the information about non-disclosure during a specified time
period, in accordance with Article 15(4), point (c);(fa) the information necessary for the application, where relevant, of paragraphs 5,
6 and 7 reporting requirements pursuant to point 7;

4.

(g)

a reference to this Regulation as the legal basis for the removal order;(h)the date, time stamp and electronic signature of the judicial or independentadministrative competent authority issuing the removal order;(i)easily understandable information about the redress available to the addressee of theremoval order, including information about redress to a court and about the time
periods applicable to such redress.

The judicial authority or the independent administrative competent authority issuing theremoval order shall address it to the main establishment of the provider or, whereapplicable, to its legal representative designated in accordance with Article 24.
It shall transmit The removal order shall be transmitted, where applicable inaccordance with Article 14a 14(a), to the the provider’s point of contact referred to in
Article 23(1) by electronic means capable of producing a written record under conditions
that allow to establish the authentication of the sender, including the accuracy of the date
and the time of sending and receipt of the order, to the Coordinating Authority of in theMember State whose authority issued the order in which the order was issued of
establishment and to the EU Centre, through the system established in accordance with
Article 39(2).

9093/24
ANNEX

JAI.1

GR/ml

73

LIMITEEN

It The removal order shall draft be transmitted the removal order in any of the official
languages declared by the provider pursuant to Article 23(3).
The order may also be transmitted in any of the official languages of the Member
State issuing the order, provided that it is accompanied by a translation of at least themost important elements necessary for the execution of the order into any of theofficial languages declared by the provider in accordance with article 23(3).
5.

If the provider cannot execute the removal order on grounds of force majeure or de facto
impossibility not attributable to it, including for objectively justifiable technical or
operational reasons, it shall, without undue delay, inform the authority issuing the orderof establishment of those grounds, using the template set out in Annex V.
The time period set out in paragraph 21 shall start to run as soon as the reasons referred toin the first subparagraph have ceased to exist.

6.

If the provider cannot execute the removal order because it contains manifest errors or does
not contain sufficient information for its execution, it shall, without undue delay, request
the necessary clarification to from the authority issuing the order of establishment, using
the template set out in Annex V.
The time period set out in paragraph 21 shall start to run as soon as the provider hasreceived the necessary clarification.

7.

The provider shall, without undue delay and using the template set out in Annex VI,
inform the issuing authority issuing the order, Coordinating Authority of establishment
and the EU Centre of the measures taken to execute the removal order, indicating, inparticular, whether the provider removed the child sexual abuse material or disabled accessthereto in all Member States and the date and time thereof.

8.

The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to amend Annexes IV, V and VI where necessary to improve the templates in viewof relevant technological developments or practical experiences gained.

9093/24
ANNEX

JAI.1

GR/ml

74

LIMITEEN

Article 14a
Procedure Request for cross-border removal orders
1.

Competent authorities of a Member State where the hosting service provider does nothave its main establishment or legal representative shall have the power to request
the issuance of a removal order to the competent authorities of the Member State
where the hosting service provider has its main establishment or where its legal
representative resides or is established. The communication of the request to issue theorder shall take place via the respective Coordinating Authorities.
Subject to Article 14, where the provider of hosting services provider does not haveits main establishment or legal representative in the Member State of the authoritythat issued the removal order, that authority shall, simultaneously, to issuing theorder to the hosting service provider, transmit, if necessary submit through the
Coordinating Authority, a copy of the removal order to the Coordinating Authorityof establishment the that Member State where the provider of hosting services
provider has its main establishment or where its legal representative resides or isestablished If the receiving Coordinating Authority is not the competent authority, it
shall transmit the order to the competent authority for the purpose of the procedureof this Article.
If the legal system of the Member State, where the hosting service provider has its
main establishment or where its legal representative resides or is established, requires
it, the removal order shall be transmitted to the Coordinating Authority of that
Member State. such as in case of a serious constitutional incompatibility, the issuingcompetent authority shall have the power to request the competent authority of theMember State of establishment to issue the removal order. The request to issue theorder shall take place via the respective Coordinating Authorities.
If the competent authority of the Member State where the hosting service provider
has its main establishment or where its legal representative resides or is established,refuses to issue the removal order requested, it should duly justify its decision to therequesting authority, via the respective Coordinating Authorities.
The removal order shall be transmitted in any of the official languages declared by
the provider pursuant to Article 23(3).

9093/24
ANNEX

JAI.1

GR/ml

75

LIMITEEN2.

Where the competent authorities of the Member State where the hosting service has
its main establishment or where its legal representative resides or is establisheddecide to issue the removal order, such an order shall be issued in accordance with
Article 14.
Where a hosting service provider receives a removal order as referred to in this
Article, it shall take the measures provided for in Article 14 and take the necessary
measures to be able to reinstate the content or access thereto, in accordance withparagraph 6 of this Article.
The receiving Coordinating Authority shall, as soon as possible and in any event
within 72 hours of receiving the removal order in accordance with paragraph 1,transmit the removal order to the provider of hosting services, unless it adopts a
decision in accordance with paragraph 3. The removal order shall only have legal
effect upon the transmission thereof to the provider of hosting services.
The Coordinating Authority of the Member State where the provider of hosting
services has its main establishment or where its legal representative resides or isestablished may, within 72 hours of receiving the copy of the removal order inaccordance with paragraph 1, scrutinise the removal order to determine whether it
seriously or manifestly infringes this Regulation or the fundamental rights andfreedoms guaranteed by the Charter.
Where it finds such an infringement, it shall, within the same period, adopt areasoned decision to that effect.

3.

The request to issue a removal order referred to in paragraph 1 shall be transmitted
in any of the official languages of the Member State where the hosting service
provider has its main establishment or where its legal representative resides or isestablished.
The receiving Coordinating Authority competent authority of the Member State
where the hosting service provider has its main establishment or where its legal
representative resides or is established may, on its own initiative, within 72 hours ofreceiving the copy of the removal order in accordance with paragraph 1, scrutinise
the removal order to determine whether it seriously or manifestly infringes thisRegulation or the fundamental rights and freedoms guaranteed by the Charter.
Where it finds such an infringement, it shall, within the same period, adopt areasoned decision to that effect.
Where a hosting service provider receives a removal order as referred to inparagraph 1, it shall take the measures provided for in Article 14 and take thenecessary measures to be able to reinstate the content or access thereto, in accordancewith paragraph 4 of this Article.

9093/24
ANNEX

JAI.1

GR/ml

76

LIMITEEN

4.

Upon receiving a decision finding an infringement communicated in accordance withparagraph 7, the provider of hosting services concerned shall without undue delayreinstate the content or access thereto, without prejudice to the possibility to enforce
its terms and conditions in accordance with Union and national law.

5.

By deviation from Article 14(1) and from paragraphs 1 and 2 of this Article, whererequired by the constitutional law of the Member State where the provider of hosting
services has its main establishment or where its legal representative resides or isestablished, that Member State may decide that removal orders issued by thecompetent authorities of other Member States are to be transmitted through the
Coordinating Authority of that Member State. That Member State shall inform theCommission of its decision and of its reasons for taking the decision. The Commission
shall make publicly available, and keep up-to-date, a list of Member States that took
the decision referred to in this subparagraph.
The receiving Coordinating Authority of establishment shall as soon as possible andin any event within 72 hours of receiving the removal order transmit the removal
order covered by the first subparagraph to the provider of hosting services, unless it
adopts a reasoned decision within these 72 hours that the removal order seriously or
manifestly infringes this Regulation or the fundamental rights and freedoms
guaranteed by the Charter. The removal order shall only have legal effect upon thetransmission thereof to the provider of hosting services.

6. 4.

The receiving Coordinating Authority of establishment competent authority shall,
before adopting a decision pursuant to the second subparagraph of paragraph 2 or
the second subparagraph of paragraph 5 3, inform the Coordinating Authority
competent authority of the Member State whose authority issued the removal orderof its intention to adopt the decision and of its reasons for doing so.

7. 5.

Where the receiving Coordinating Authority of establishment competent authority
adopts a reasoned decision in accordance with the second subparagraph of paragraph
2 or the second subparagraph of paragraph 5 3 of this Article, as applicable, it shall,
without delay, transmit that decision, if necessary through the Coordinating
Authority, to the Coordinating Authority authority that of the Member State whose
authority issued the removal order, the provider of the hosting services provider andthe EU Centre.
Where the Coordinating Authority of establishment adopts a reasoned decision inaccordance with the second subparagraph of paragraph 5, it shall, without delay,transmit that decision to the Coordinating Authority of the Member State whose
authority issued the removal order and the EU Centre.
Where the decision finds an infringement pursuant to paragraph 3 of this Article, theremoval order shall cease to have legal effects.

9093/24
ANNEX

JAI.1

GR/ml

77

LIMITEEN

6.

Upon receiving a decision finding an infringement communicated in accordance withparagraph 5, the hosting service provider concerned shall without undue delayreinstate the content or access thereto, without prejudice to the possibility to enforce
its terms and conditions in accordance with Union and national law.
Article 15
Redress and provision of information

1.

Providers of hosting services that have received a removal order issued in accordance with
Article 14, as well as the users who provided the material, shall have the right to aneffective redress. That right shall include the right to challenge such a removal order before
the courts of the Member State of the competent judicial authority or independentadministrative authority that issued the removal order.

1a.

If the order is repealed reversed as a result of a redress procedure, the provider shallwithout undue delay reinstate the material or access thereto, without prejudice to thepossibility to enforce its terms and conditions in accordance with Union and national
law58.

2.

When the removal order becomes final, the competent judicial authority or independentadministrative authority that issued the removal order shall, without undue delay, transmit
a copy thereof and copies of the information it has received pursuant to Article 14(5)to (7) to the Coordinating Authority of the Member State of the authority issuing theremoval order of establishment. Thate Coordinating Authority of establishment shallthen, without undue delay, transmit a copy copies thereof to all other Coordinating
Authorities and the EU Centre through the system established in accordance with Article
39(2).
For the purpose of the first subparagraph, a removal order shall become final upon the
expiry of the time period for appeal where no appeal has been lodged in accordance withnational law or upon confirmation of the removal order following an appeal.

3.

58

Where a provider removes or disables access to child sexual abuse material pursuant to aremoval order issued in accordance with Article 14, it shall without undue delay, informthe user who provided the material of the following:(a)the fact that it removed the material or disabled access thereto;(b)

the reasons for the removal or disabling, providing a copy of the removal order upon
the user’s request;(c)the user’s right to judicial redress referred to in paragraph 1 and the user’s right tosubmit complaints to the Coordinating Authority in accordance with Article 34.

Wording copied from Art. 4(7) of the TCO Regulation.

9093/24
ANNEX

JAI.1

GR/ml

78

LIMITEEN

3a.

The provider shall establish and operate an accessible, age-appropriate and userfriendly mechanism that allows users to submit to it complaints about alleged
infringements of its obligations under this Section. It shall process such complaints inan objective, effective and timely manner.

4.

The issuing authority Coordinating Authority of establishment may decide request, whenrequesting the judicial authority or independent administrative authority issuing theremoval order, and after having consulted if necessary with relevant public authorities,
that the provider is not to disclose any information regarding the removal of or disabling ofaccess to the child sexual abuse material, where and to the extent necessary to avoid
interfering with activities for the prevention, detection, investigation and prosecution ofchild sexual abuse or related criminal offences.
In such a case:(a)the judicial authority or independent administrative authority issuing the removal
order shall inform the provider of its decision specifying the applicable time
period that shall be set the time period not longer than necessary and not exceeding
twelve six weeks, during which the provider is not to disclose such information;(b)

the obligations set out in paragraph 3 shall not apply during that time period;(c)that judicial authority or independent administrative authority shall inform theprovider of its decision, specifying the applicable time period.

The issuing That judicial authority or independent administrative authority issuing theremoval order may decide to extend the time period referred to in the second
subparagraph, point (a), by a further time period of maximum six weeks, where and to theextent the non-disclosure continues to be necessary. In that case, the issuing that judicial
authority or independent administrative authority shall inform the provider of its decision,
specifying the applicable time period. Article 14(3) shall apply to that decision.
4a.

9093/24
ANNEX

Where Article 14a(5) applies, the issuing authority shall inform the provider of its thedecision referred to in paragraph 4 through the Coordinating Authority of
establishment.

JAI.1

GR/ml

79

LIMITEENSection 5
Blocking obligations
Article 16
Blocking orders
1.

The competent authority of establishment Coordinating Authority of establishment shallhave the power to request the competent judicial authority of the Member State thatdesignated it or an independent administrative authority of that Member State to issue a
blocking order, in accordance with relevant national requirements, subject to any
requirements of national law as referred to in paragraph 1a, requiring a provider ofinternet access services under the jurisdiction of that Member State to take reasonablemeasures to prevent users from accessing known child sexual abuse material indicated by
all uniform resource locators on the list of uniform resource locators included in the
database of indicators, in accordance with Article 44(2), point (b) and provided by the EU
Centre. The competent authorities may make use of the list of uniform resource
locators included in the database of indicators, in accordance with Article 44(2), point(b) and provided by the EU Centre.

1a.

By deviation from the first subparagraph 1, and without causing undue delays in theprocess of issuance of those orders, Member States may decide that such orders canonly be issued by or with the prior authorisation of a judicial authority at the requestof another the competent authority. Where a Member State makes use of thispossibility, it shall inform the Commission thereof and maintain this information
updated. The Commission shall make the information received publicly available andmaintain this information updated.

1ba.

The provider shall execute the blocking order as soon as possible and in any event a
reasonable time period set by the issuing authority one week of receipt thereof. The
provider shall take the necessary measures to ensure that it is capable of reinstating
access in accordance with Article 18(1a).

2.

The Coordinating Authority of establishment shall, before requesting the issuance of a
blocking order, carry out all investigations and assessments necessary to determine
whether the conditions of paragraph 4 have been met.
To that end, it shall, where appropriate:(a)9093/24
ANNEX

verify that, in respect of all or a representative sample of the uniform resource
locators on the list referred to in paragraph 1, the conditions of Article 36(1), point(b), are met, including by carrying out checks to verify in cooperation with the EU
Centre that the list is complete, accurate and up-to-date;

JAI.1

GR/ml

80

LIMITEEN(b)require the provider to submit, within a reasonable time period set by that
Coordinating Authority, the necessary information, in particular regarding theaccessing or attempting to access by users of the child sexual abuse materialindicated by the uniform resource locators, regarding the provider’s policy to address
the risk of dissemination of the child sexual abuse material and regarding theprovider’s financial and technological capabilities and size;(c)request the EU Centre to provide the necessary information, in particularexplanations and assurances regarding the accuracy of the uniform resource locators
in indicating child sexual abuse material, regarding the quantity and nature of thatmaterial and regarding the verifications by the EU Centre and the audits referred toin Article 36(2) and Article 46(7), respectively;(d)request any other relevant public authority or relevant experts or entities to provide
the necessary information.

3.

The Coordinating Authority of establishment shall, before requesting the issuance of theblocking order, inform the provider of its intention to request the issuance of the blocking
order, specifying the main elements of the content of the intended blocking order and thereasons to request the blocking order. It shall afford the provider an opportunity tocomment on that information, within a reasonable time period set by that Coordinating
authority.

4.

The Coordinating Authority of establishment shall request the issuance of the blocking
order, and the competent judicial authority or independent authority shall issue the A
blocking order shall be issued, where it considers that the following conditions are met:

59

(a)

other equally effective and less intrusive measures59 than blocking cannot betaken to prevent access to child sexual abuse material or if it is likely that suchmeasure will fail; there is evidence of the service having been used during the past
12 months, to an appreciable extent, for accessing or attempting to access childsexual abuse material indicated by the uniform resource locators;(b)

the blocking order is necessary to prevent the dissemination of the child sexual abusematerial to users in the Union, having regard in particular to the quantity and natureof the material, to the need to protect the rights of the victims and the existence andimplementation by the provider of a policy to address the risk of such dissemination;

PCY comment: examples of “less intrusive measures” can for instance be a failed notice, aremoval order that cannot be executed or a removal order towards a so-called “bulletproof
service provider”. This could be clarified in a recital.

9093/24
ANNEX

JAI.1

GR/ml

81

LIMITEEN(c)the uniform resource locators indicate, in a sufficiently reliable manner, child sexual
abuse material;(d)the reasons for issuing the blocking order outweigh negative consequences for therights and legitimate interests of all parties affected, having regard in particular to theneed to ensure a fair balance between the fundamental rights of those parties,
including the exercise of the users’ freedom of expression and information and theprovider’s freedom to conduct a business.

When assessing whether the conditions of the first subparagraph have been met, accountshall be taken of all relevant facts and circumstances of the case at hand, including any
information obtained pursuant to paragraph 2 and the views of the provider submitted inaccordance with paragraph 3.
5.

6.

The Coordinating Authority of establishment when requesting the issuance of blocking
orders, and the competent judicial or independent administrative authority when issuing the
A blocking order, shall:(a)where necessary, specify effective and proportionate limits and safeguards
necessary to ensure that a blocking order is targeted and that any negative
consequences referred to in paragraph 4, point (d), remain limited to what is strictly
necessary;(b)subject to paragraph 6, ensure that the period of application remains limited to whatis strictly necessary.

The issuing Coordinating authority shall specify in the blocking order the period during
which it applies, indicating the start date and the end date.
The period of application of blocking orders shall not exceed five years.

7.

In respect of the blocking orders that the competent judicial authority or independentadministrative authority issued at its request, tThe Coordinating Authority or the issuingauthority shall, where necessary and at least once every year, assess whether any
substantial changes to the grounds for issuing the blocking orders have occurred and, inparticular, whether the conditions of paragraph 4 continue to be met.
The Coordinating Authority shall request to the competent judicial authority or
independent administrative authority that issued the blocking order the modification or
revocation of such order, wWhere necessary in the light of the outcome of that assessment
or to take account of justified requests or other relevant information, including
information obtained through the reports referred to in Article 18 17(5a) and (6),respectively an order shall be modified or repealed reversed by the issuing authority,
where relevant at the request of the Coordinating Authority. The provisions of thisSection shall apply to such requests, mutatis mutandis.

9093/24
ANNEX

JAI.1

GR/ml

82

LIMITEEN

Article 17
Additional rules regarding blocking orders
1.

The Coordinating Authority of establishment shall issue the A blocking orders referred toin Article 16 shall be issued using the template set out in Annex VII. Blocking orders shall
include:(a)where applicable, the reference to the list of uniform resource locators, provided by
the EU Centre, and the safeguards to be provided for, including the limits andsafeguards specified pursuant to Article 16(5) and, where applicable, the reporting
requirements set pursuant to Article 18(6);(b)

identification details of the competent judicial authority or the independentadministrative authority issuing the blocking order and authentication of the blocking
order by that authority;(c)the name of the provider and, where applicable, its legal representative;(d)clear information enabling the provider to identify and locate the child sexual
abuse material and the specific service in respect of which the detection blocking
order is issued;(e)the start date and the end date of the blocking order;(ea) the limits referred to in Article 16(5);(f)

a sufficiently detailed statement of reasons explaining why the blocking order isissued;(fa) the information necessary for the application, where relevant, of paragraphs 4a,5, and 5a reporting requirements pursuant to paragraph 5a;2.

9093/24
ANNEX(g)a reference to this Regulation as the legal basis for the blocking order;(h)the date, time stamp and electronic signature of the judicial authority or the
independent administrative competent authority issuing the blocking order;(i)easily understandable information about the redress available to the addressee of theblocking order, including information about redress to a court and about the time
periods applicable to such redress.

The competent judicial authority or independent administrative competent authority
issuing the blocking order shall address it to the main establishment of the provider or,
where applicable, to its legal representative designated in accordance with Article 24.

JAI.1

GR/ml

83

LIMITEEN3.

The blocking order shall be transmitted to the provider’s point of contact referred to in
Article 23(1) by electronic means capable of producing a written record underconditions that allow to establish the authentication of the sender, including theaccuracy of the date and the time of sending and receipt of the order, to the
Coordinating Authority in the Member State in which the order was issued of
establishment and to the EU Centre, through the system established in accordance with
Article 39(2).

4.

The blocking order shall be drafted transmitted in any of the official languages declaredby the provider pursuant to Article 23(3).
The order may also be transmitted in any of the official languages of the Member
State issuing the order, provided that it is accompanied by a translation of at least themost important elements necessary for the execution of the order into any of theofficial languages declared by the provider in accordance with article 23(3).60

4a.

If the provider cannot execute the blocking order on grounds of force majeure or defacto impossibility not attributable to it, including for objectively justifiable technicalor operational reasons, it shall, without undue delay, inform the authority issuing theorder of those grounds, using the template set out in Annex VIIIyy.

5.

If the provider cannot execute the blocking order because it contains manifest errors ordoes not contain sufficient information for its execution, the provider shall, without undue
delay, request the necessary clarification to from the authority issuing the order
Coordinating Authority of establishment using the template set out in Annex VIII.

5a.

The provider shall, without undue delay and using the template set out in Annex
IXxx, inform the issuing authority of the measures taken to execute the blocking
order, indicating, in particular, whether the provider has prevented access to childsexual abuse material.
The authority issuing the order may shall require the provider to report to it atregular intervals on the measures taken and their functioning to execute a blocking
order, including the effective and proportionate limitations and safeguards providedfor.
Upon request of the issuing authority, the provider shall also provide, without undue
delay, such reports or any other information relating to the execution of the blocking
order needed for the purpose of the assessment referred to in Article 16(7).

6.

60The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to amend Annexes VII, yy, and VIII and IXxx where necessary to improve thetemplates in view of relevant technological developments or practical experiences gained.

PCY comment: not necessary considering wording of Article 23(3).

9093/24
ANNEX

JAI.1

GR/ml

84

LIMITEEN

Article 18
Redress and provision of information, information and reporting of blocking orders
1.

Providers of internet access services that have received a blocking order, as well as andusers who provided or were prevented from accessing a specific item of blocked materialindicated by the uniform resource locators in execution of such orders, shall have a right toeffective redress. That right shall include the right to challenge the blocking order before
the courts of the Member State of the competent judicial authority or independentadministrative authority that issued the blocking order.

1a.

If the order is repealed reversed as a result of a redress procedure, the provider shallwithout undue delay reinstate access to the material, without prejudice to thepossibility to enforce its terms and conditions in accordance with Union and national
law.

2.

When the blocking order becomes final, the competent judicial authority or independentadministrative authority that issued the blocking order shall, without undue delay, transmit
a copy thereof and copies of information it has received pursuant to Article 17 (4a) to(5a) the Coordinating Authority of establishment. The Coordinating Authority of
establishment shall then, without undue delay, transmit a copy copies thereof to all other
Coordinating Authorities and the EU Centre through the system established inaccordance with Article 39(2).
For the purpose of the first subparagraph, a blocking order shall become final upon the
expiry of the time period for appeal where no appeal has been lodged in accordance withnational law or upon confirmation of the removal order following an appeal.

3.

The provider shall establish and operate an accessible, age-appropriate and user-friendly
mechanism that allows users to submit to it, within a reasonable timeframe, complaints
about alleged infringements of its obligations under this Section. It shall process suchcomplaints in an objective, effective and timely manner.

4.

Where a provider prevents users from accessing the content child sexual abuse material
the uniform resource locators pursuant to a blocking order issued in accordance with
Article 17, it shall take reasonable measures to inform the those users of the following:9093/24
ANNEX(a)the fact that it does so pursuant to a blocking order and the reasons for doing so;(b)

the reasons for doing so, providing, upon request, a copy of the blocking order;(c)

the users’ right of users who provided the blocked material to judicial redress
referred to in paragraph 1, their rights of users to submit complaints to the provider
through the mechanism referred to in paragraph 3 and to the Coordinating Authority
in accordance with Article 34, as well as their right to submit the requests referred toin paragraph 5.

JAI.1

GR/ml

85

LIMITEEN5.

The provider and the users referred to in paragraph 1 shall be entitled to request the
Coordinating Authority that requested the issuance of the blocking order to assess whether
users are wrongly prevented from accessing a specific item of material indicated by
uniform resource locators pursuant to the blocking order. The provider shall also beentitled to request modification or revocation of the blocking order, where it considers it
necessary due to substantial changes to the grounds for issuing the blocking orders that
occurred after the issuance thereof, in particular substantial changes preventing theprovider from taking the required reasonable measures to execute the blocking order.
The Coordinating Authority shall, without undue delay, diligently assess such requests andinform the provider or the user submitting the request of the outcome thereof. Where it
considers the request to be justified, it shall request modification or revocation of theblocking order in accordance with Article 16(7) and inform the EU Centre.

6.

Where the period of application of the blocking order exceeds 24 months, the Coordinating
Authority of establishment shall require the provider to report to it on the measures taken
to execute the blocking order, including the safeguards provided for, at least once, halfway
through the period of application.
Section 5a
Delisting obligations
Article 18a
Delisting orders

1.

The competent authority of establishment of each Member State shall have the power
to issue an delisting order, in accordance with relevant national requirements, subject
to any requirements of national law as referred to in the paragraph 1a, requiring aprovider of an online search engine under the jurisdiction of that Member State totake reasonable measures to delist an online location where child sexual abusematerial can be found from appearing in search results in all Member States. The
competent authorities may make use of the list of uniform resource locators includedin the database of indicators, in accordance with Article 44(2), point (b) and provided
by the EU Centre.

1a.

By deviation from the first subparagraph 1, and without causing undue delays in theprocess of issuance of those orders, Member States may decide that such orders canonly be issued by or with the prior authorisation of a judicial authority at the requestof another the competent authority. Where a Member State makes use of thispossibility, it shall inform the Commission thereof and maintain this information
updated. The Commission shall make the information received publicly available andmaintain this information updated.

9093/24
ANNEX

JAI.1

GR/ml

86

LIMITEEN2.

The provider shall execute the delisting order as soon as possible without undue delay
and in any event within 24 hours of receipt thereof a reasonable time period set by theissuing authority one week of receipt of the order. The provider shall take thenecessary measures to ensure that it is capable of reinstating the delisted online
location to appear in search results in accordance with Article 18c(2).

3.

A delisting order shall be issued where the following conditions are met:

4.

(a)

the delisting is necessary to prevent the dissemination of the child sexual abusematerial in the Union, having regard in particular to the need to protect therights of the victims;(b)

URLs specified in the delisting order search results correspond, in a sufficiently
reliable manner, to online locations where child sexual abuse material can befound.

The issuing authority shall specify in the delisting order the period during which it
applies, indicating the start date and the end date.
The period of application of delisting orders shall not exceed five years.

5.

The Coordinating Authority or the issuing authority shall, where necessary and at
least once every year, assess whether any substantial changes to the grounds for
issuing the delisting orders have occurred and whether the conditions of paragraph 4
continue to be met.
Where necessary in the light of the outcome of that assessment or information of thereports referred to in Article 18b(6) an order may be modified or repealed reversedby the issuing authority, where relevant at the request of the Coordinating Authority.
Article 18aa
Procedure for cross-border delisting orders

1.

Subject to Article 18a, where the provider of an online search engine does not have its
main establishment or legal representative in the Member State of the authority thatissued the delisting order, that authority shall, simultaneously to issuing the order tothe provider of the online search engine, transmit submit through the Coordinating
Authority a copy of the delisting order to the Coordinating Authority of
establishment the that Member State where the online search engine provider has its
main establishment or where its legal representative resides or is established. If thereceiving Coordinating Authority is not the competent authority, it shall transmit theorder to the competent authority for the purpose of the procedure of this Article.
The delisting order shall be transmitted in any of the official languages declared by
the provider pursuant to Article 23(3).

9093/24
ANNEX

JAI.1

GR/ml

87

LIMITEEN2.

The receiving Coordinating Authority shall, as soon as possible and in any event
within 72 hours of receiving the delisting order in accordance with paragraph 1,transmit the removal order to the provider of hosting services, unless it adopts a
decision in accordance with paragraph 3. The removal order shall only have legal
effect upon the transmission thereof to the provider of an online search engine.
The Coordinating Authority of the Member State where the provider of an online
search engine has its main establishment or where its legal representative resides or isestablished may, within 72 hours of receiving the copy of the delisting order inaccordance with paragraph 1, scrutinise the delisting order to determine whether it
seriously or manifestly infringes this Regulation or the fundamental rights andfreedoms guaranteed by the Charter.
Where it finds such an infringement, it shall, within the same period, adopt areasoned decision to that effect.
Where an online search engine provider receives a delisting order as referred to inthis Article, it shall take the measures provided for in Article 18a and take thenecessary measures to ensure that it is capable of reinstating the delisted online
location to appear in search results in accordance with Article 18c(2).

3.

The receiving Coordinating Authority competent authority of the Member State
where the online search engine provider has its main establishment or where its legal
representative resides or is established may, on its own initiative, within 72 hours ofreceiving the copy of the delisting order in accordance with paragraph 1, scrutinise
the delisting order to determine whether it seriously or manifestly infringes thisRegulation or the fundamental rights and freedoms guaranteed by the Charter andwhether it complies with its national constitutional law. Where it finds such an
infringement or a constitutional incompatibility, it shall, within the same period,
adopt a reasoned decision to that effect.
Where a provider of an online search engine receives a delisting order as referred toin paragraph 1, it shall take the measures provided for in Article 18a and take thenecessary measures to be able to reinstate the delisted online location to appear in
search results, in accordance with paragraph 4 of this Article.

4.

9093/24
ANNEX

Upon receiving a decision finding an infringement communicated in accordance withparagraph 7, the provider of an online search engine concerned shall without undue
delay reinstate the delisted online location to appear in search results, without
prejudice to the possibility to enforce its terms and conditions in accordance with
Union and national law.

JAI.1

GR/ml

88

LIMITEEN

5.

By deviation from Article 18a(1) and from paragraphs 1 and 2 of this Article, whererequired by the constitutional law of the Member State where the provider of an
online search engine has its main establishment or where its legal representative
resides or is established, that Member State may decide that delisting orders issued
by the competent authorities of other Member States are to be transmitted throughthe Coordinating Authority of that Member State. That Member State shall informthe Commission of its decision and of its reasons for taking the decision. The
Commission shall make publicly available, and keep up-to-date, a list of Member
States that took the decision referred to in this subparagraph.
The receiving Coordinating Authority of establishment shall as soon as possible andin any event within 72 hours of receiving the delisting order transmit the delistingorder covered by the first subparagraph to the provider of the online search engine,
unless it adopts a reasoned decision within these 72 hours that the delisting orderseriously or manifestly infringes this Regulation or the fundamental rights andfreedoms guaranteed by the Charter. The delisting order shall only have legal effectupon the transmission thereof to the provider of the online search engine.

6. 4.

The receiving Coordinating Authority of establishment competent authority shall,
before adopting a decision pursuant to the second subparagraph of paragraph 2 or
the second subparagraph of paragraph 53, inform the Coordinating Authority
competent authority of the Member State whose authority issued the delisting orderof its intention to adopt the decision and of its reasons for doing so.

7. 5.

Where the receiving Coordinating Authority of establishment competent authority
adopts a reasoned decision in accordance with the second subparagraph of paragraph
2 or the second subparagraph of paragraph 53 of this Article, as applicable, it shall,
without delay, transmit that decision, if necessary through the Coordinating
Authority, to the authority that Coordinating Authority of the Member State whose
authority issued the delisting order, the provider of the online search engine provider
and the EU Centre.
Where the Coordinating Authority of establishment adopts a reasoned decision inaccordance with the second subparagraph of paragraph 5, it shall, without delay,transmit that decision to the Coordinating Authority of the Member State whose
authority issued the delisting order and the EU Centre.
Where the decision finds an infringement or a constitutional incompatibility pursuant
to paragraph 3 of this Article, the delisting order shall cease to have legal effects.

6.

9093/24
ANNEX

Upon receiving a decision finding an infringement or a constitutional incompatibility
communicated in accordance with paragraph 5, the online search engine provider
concerned shall without undue delay reinstate the delisted online location to appear in
search results, without prejudice to the possibility to enforce its terms and conditionsin accordance with Union and national law.

JAI.1

GR/ml

89

LIMITEEN

Article 18b
Additional rules regarding delisting orders
1.

A delisting order shall be issued using the template set out in aAnnex Xzz. Delistingorders shall include:(aa) where applicable, the reference to the list of uniform resource locators, provided
by the EU Centre,

2.

(a)

identification details of the authority issuing the delisting order andauthentication of the order by that authority;(b)

the name of the provider and, where applicable, its legal representative;(c)clear information enabling the provider to identify and locate the child sexual
abuse material and the specific service in respect of which the delisting order isissued;(d)the start and end date of the delisting;(e)a sufficiently detailed statement of reasons explaining why the delisting order isissued;(f)the information necessary for the application, where relevant, of paragraphs 4,5, and 6 reporting requirements pursuant to point 6;(g)a reference to this Regulation as the legal basis for delisting;(h)the date, time stamp and electronic signature of the competent authority issuingthe delisting order;(i)easily understandable information about the redress available, including
information about redress to a court and about the time periods applicable tosuch redress.

The competent authority issuing the delisting order shall address it to the mainestablishment of the provider or, where applicable, to its legal representative
designated in accordance with Article 24.
The delisting order shall be transmitted to the provider’s point of contact referred toin Article 23(1) by electronic means capable of producing a written record underconditions that allow to establish the authentication of the sender, including theaccuracy of the date and the time of sending and receipt of the order to the
Coordinating Authority in the Member State in which the order was issued of
establishment and to the EU Centre, through the system established in accordancewith Article 39(2).

9093/24
ANNEX

JAI.1

GR/ml

90

LIMITEEN3.

The delisting order shall be transmitted in any of the official languages declared by
the provider pursuant to Article 23(3).
The order may also be transmitted in any of the official languages of the Member
State issuing the order, provided that it is accompanied by a translation of at least themost important elements necessary for the execution of the order into any of theoffical languages declared by the provider in accordance with Article 23(3). 61

4.

If the provider cannot execute the delisting order on grounds of force majeure or defacto impossibility not attributable to it, including for objectively justifiable technicalor operational reasons, it shall, without undue delay, inform the authority issuing theorder of those grounds, using the template set out in Annex XIqq.

5.

If the provider cannot execute the delisting order because it contains manifest errors
or does not contain sufficient information for its execution, the provider shall, without
undue delay, request the necessary clarification from the authority issuing the order,using the template set out in Annex XIpp.

6.

The provider shall, without undue delay and using the template set out in Annex
XIIww, inform the issuing authority of the measures taken to execute the delistingorder, indicating, in particular, whether the provider has prevented search results forthe online location with child sexual abuse material to appear.
The authority issuing the order may require the provider to report to it regularly on
the measures taken to execute a delisting order.

7.

61

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 in order to amend Annexes X, and XI and XII zz, qq and pp where
necessary to improve the templates in view of relevant technological developments orpractical experiences gained.

PCY comment: not necessary considering wording of Article 23(3).

9093/24
ANNEX

JAI.1

GR/ml

91

LIMITEEN

Article 18c
Redress and provision of information
1.

Providers of online search engines that have received a delisting order and users thatprovided the material to a delisted online location shall have a right to effective
redress. That right shall include the right to challenge the delisting order before thecourts of the Member State of the authority that issued the delisting order.

2.

If the order is repealed reversed as a result of a redress procedure, the provider shallwithout undue delay reinstate the delisted online location to appear in search results,
without prejudice to the possibility to enforce its terms and conditions in accordancewith Union and national law.

3.

When the delisting order becomes final, the issuing authority shall, without undue
delay, transmit a copy thereof and information it has received pursuant to Article 18b(4) to (6) to the Coordinating Authority of establishment. The Coordinating Authorityof establishment shall then, without undue delay, transmit a copies thereof to all other
Coordinating Authorities and the EU Centre through the system established inaccordance with Article 39(2).
For the purpose of the first subparagraph, a delisting order shall become final upon
the expiry of the time period for appeal where no appeal has been lodged inaccordance with national law or upon confirmation of the delisting order following anappeal.

3a.

The provider shall establish and operate an accessible, age-appropriate and userfriendly mechanism that allows users to submit to it complaints about alleged
infringements of its obligations under this Section. It shall process such complaints inan objective, effective and timely manner.

4.

Where a provider prevents users from obtaining search results for child sexual abusematerial corresponding to an online location pursuant to a delisting order, it shalltake reasonable measures to inform users that provided the material to a delisted
online location and those users of the following:9093/24
ANNEX(a)the fact that it does so pursuant to a delisting order and the reasons for doing
so;

(b)

the right of users that provided the material to a delisted online location to
judicial redress referred to in paragraph 1 and users’ right to submit
complaints to the Coordinating Authority in accordance with Article 34.

JAI.1

GR/ml

92

LIMITEENSection 6
Additional provisions
Article 19
Liability of providers
Providers of relevant information society services shall not be liable for child sexual abuse offences
if and insofar as solely because they carry out, in good faith, the necessary activities to comply
with the requirements of this Regulation, in particular activities aimed at assessing and mitigatingrisk, detecting, identifying, reporting, removing, disabling of access to, blocking or delisting fromsearch results reporting online child sexual abuse in accordance with those requirements.
Article 20
Victims’ right to information
1.

Persons residing in the Union shall have the right to receive, upon their request, from the
Coordinating Authority designated by in the Member State where they reside, information
regarding any instances where the dissemination of known child sexual abuse material
depicting them is reported to the EU Centre pursuant to Article 12. Persons withdisabilities shall have the right to ask and receive such an information in a manner
accessible to them.
That Coordinating Authority shall transmit the request to the EU Centre through thesystem established in accordance with Article 39(2) and shall communicate the resultsreceived from the EU Centre to the person making the request.

2.

3.

9093/24
ANNEX

The request referred to in paragraph 1 shall indicate:(a)the relevant item or items of known child sexual abuse material;(b)where applicable, the individual or entity that is to receive the information on behalfof the person making the request;(c)sufficient elements to demonstrate the identity of the person making the request.

The information referred to in paragraph 1 shall include:(a)the identification of the provider that submitted the report;(b)

the date of the report;(c)whether the EU Centre forwarded the report in accordance with Article 48(3) and, if
so, to which authorities;(d)whether the provider reported having removed or disabled access to the material, in
accordance with Article 13(1), point (i).

JAI.1

GR/ml

93

LIMITEEN

Article 21
Victims’ right of assistance and support for removal
1.

Providers of hosting services shall provide reasonable assistance, on request, to persons
residing in the Union that seek to have one or more specific items of known child sexual
abuse material depicting them removed or to have access thereto disabled by the provider.

2.

Persons residing in the Union shall have the right to receive support from the EU Centre,
upon their request, to and via from the Coordinating Authority designated by in theMember State where they person resides, to request assistance, support from the EU
Centre when they seek to have a provider of hosting services remove or disable access to
one or more specific items of known child sexual abuse material depicting them. Persons
with disabilities shall have the right to ask and receive any information relating to suchsupport in a manner accessible to them.
That Coordinating Authority shall transmit the request to the EU Centre through thesystem established in accordance with Article 39(2) and shall communicate the resultsreceived from the EU Centre to the person making the request.

3.

The requests referred to in paragraphs 1 and 2 shall indicate the relevant item or items ofchild sexual abuse material.

4.

The EU Centre’s support referred to in paragraph 2 shall include, as applicable:

9093/24
ANNEX(a)support in connection to requesting the provider’s assistance referred to in paragraph1;(b)verifying whether the provider removed or disabled access to that item or those
items, including by conducting the searches referred to in Article 49(1);(c)

notifying the item or items of known child sexual abuse material depicting the person
to the provider and requesting removal or disabling of access, in accordance with
Article 49(2);(d)

where necessary, informing the Coordinating Authority of establishment of thepresence of that item or those items on the service, with a view to the issuance of aremoval order pursuant to Article 14.

JAI.1

GR/ml

94

LIMITEEN

Article 22
Preservation of information
1.

Providers of hosting services and providers of interpersonal communications services shallpreserve the necessary content data and other data processed that is necessary for taking
in connection to the measures taken to comply with this Regulation and the personal data
generated through such processing, when the following measures have been taken or forthe purposes of complaints or redress procedures complaints only for one or more of thefollowing purposes, as applicable:(xa) insofar as strictly necessary for using the technologies referred to in Article 10,
involving in particular the automatic, intermediate and temporary preservationof such data for the use of the indicators provided by the EU Centre, as well as
for applying the safeguards referred to in Article 10, when executing a detection
order issued pursuant to Article 7;

1a.

(a)

executing a detection order issued pursuant to Article 7, or a removal order issued
pursuant to Article 14 [or a blocking order pursuant to Article 16 or a delistingorder pursuant to Article 18a];(b)reporting information that indicate potential online child sexual abuse to the EU
Centre pursuant to Article 12;(c)blocking the account of, or suspending or terminating the provision of the service to,the user concerned;(d)handling users’ complaints to the provider or to the Coordinating Authority, or the
exercise of users’ right to administrative or judicial redress, in respect of alleged
infringements of this Regulation;.

Upon a request responding to requests issued by a competent law enforcement
authorityies and judicial authorities [in accordance with the applicable law], providers
shall with a view to provideing them requesting authority with the necessary information
for the prevention, detection, investigation or prosecution of child sexual abuse offences,or the handling of complaints or admininstrative or judicial redress proceedings,
insofar as the content data and other data have been preserved for one of the purposes inparagraphs 1(a) to (d). relate to a report that the provider has submitted to the EU Centre
pursuant to Article 12.
As regards the first subparagraph, point (a), the provider may also preserve the information
for the purpose of improving the effectiveness and accuracy of the technologies to detect
online child sexual abuse for the execution of a detection order issued to it in accordancewith Article 7. However, it shall not store any personal data for that purpose.

9093/24
ANNEX

JAI.1

GR/ml

95

LIMITE

EN

2.

Providers shall preserve the information referred to in paragraph 1 for no longer thannecessary for the applicable purpose and, in any event, no longer than 12 months from thedate of the measures taken that led to the obligation to preserve the information
content data and other data processed reporting or of the removal or disabling of access,whichever occurs first. They shall subsequently irrevocably delete the information.
Providers They shall, upon request from the competent national authority or court,
preserve the information for a further specified period, set by that the requesting authority
or court where and to the extent necessary for ongoing administrative or judicial redress
proceedings, as referred to in paragraph 1, point (d).

3.

Providers shall ensure that the information referred to in paragraph 1 is preserved in asecure manner and that the preservation is subject to appropriate technical andorganisational safeguards. Those safeguards shall ensure, in particular, that the information
can be accessed and processed only for the purpose for which it is preserved, that a highlevel of security is achieved and that the information is deleted upon the expiry of theapplicable time periods for preservation. Providers shall regularly review those safeguards
and adjust them where necessary.

4.

When a detection order pursuant to Article 7, a removal order issued pursuant to
Article 14 [, a blocking order pursuant to Article 16 or a delisting order pursuant to
Article 18a] is repealed, the obligation to preserve the content data and other dataaccording to paragraph 1 is discontinued.
Article 22a
Keeping of logs

1.

Providers of hosting services and providers of interpersonal communications services
shall record, in respect of any a detailed event information on processing of content
and other data in connection with the execution of detection order pursuant to Article
7, [and other measures of this Regulation]
This event information shall include the time and duration of the processing and,
where applicable, the person performing the processing.

2.

9093/24
ANNEX

The logs shall only be used for the verification of the lawfulness of the processing, forself-monitoring, for ensuring data integrity and data security as well as for the
purposes of criminal or disciplinary proceedings.

JAI.1

GR/ml

96

LIMITEEN

3.

Providers shall keep the information contained in the logs referred to in paragraph 1
for no longer than necessary for the applicable purpose and, in any event, no longer
than five years from the date of the measures taken that led to the obligation topreserve the information recorded in those logs. They shall subsequently irrevocably
delete the information.
They shall, upon request from the competent national authority or court, keep theinformation for a further specified period, set by that the requesting authority or
court, where and to the extent necessary for one of the purposes referred to inparagraph 2.
Article 23
Points of contact

1.

Providers of relevant information society services shall establish a single point of contact
allowing for direct communication, by electronic means, with the Coordinating
Authorities, other competent authorities of the Member States, the Commission and the EU
Centre, for the application of this Regulation.

2.

The providers shall communicate to the EU Centre and make public the informationnecessary to easily identify and communicate with their single points of contact, including
their names, addresses, the electronic mail addresses and telephone numbers.

3.

The providers shall specify in the information referred to in paragraph 2 the official
language or languages of the Union, which can be used to communicate with their pointsof contact.
The specified languages shall include at least one of the official languages of the Member
State in which the provider has its main establishment or, where applicable, where its legal
representative resides or is established.
Article 24
Legal representative

1.

Providers of relevant information society services which do not have their mainestablishment in the Union shall designate, in writing, a natural or legal person as its legal
representative in the Union for the purposes of this Regulation.

2.

The legal representative shall reside or be established in one of the Member States where
the provider offers its services.

9093/24
ANNEX

JAI.1

GR/ml

97

LIMITEEN3.

The provider shall mandate its legal representatives to be addressed in addition to or
instead of the provider by the Coordinating Authorities, other competent authorities of theMember States and the Commission on all issues necessary for the receipt of, compliancewith and enforcement of orders and decisions issued in relation to this Regulation,
including detection orders, removal orders and, blocking orders and delisting orders.

4.

The provider shall provide its legal representative with the necessary powers and resources
to cooperate with the Coordinating Authorities, other competent authorities of the Member
States and the Commission and to comply with the orders and decisions referred to inparagraph 3.

5.

The designated legal representative may be held liable for non-compliance with obligationsof the provider under this Regulation, without prejudice to the liability and legal actions
that could be initiated against the provider.

6.

The provider shall notify the name, address, the electronic mail address and telephone
number of its legal representative designated pursuant to paragraph 1 to the Coordinating
Authority in the Member State where that legal representative resides or is established, andto the EU Centre. The provider or the legal representative They shall ensure that that
information is up to date and publicly available.

7.

The designation of a legal representative within the Union pursuant to paragraph 1 shallnot amount to an establishment in the Union.

9093/24
ANNEX

JAI.1

GR/ml

98

LIMITEENCHAPTER III
SUPERVISION, ENFORCEMENT AND COOPERATION
Section 1
Coordinating Authorities of the Member States for child sexual abuse issues
Article 2562
Coordinating Authorities for child sexual abuse issues and other competent authorities
1.

Member States shall, by [Date - two eighteen months from the date of entry into force of
this Regulation], designate one or more competent authorities as responsible for theapplication, and supervision and enforcement of this Regulation (‘competent authorities’).

1a.

Where a Member State designates more than one competent authority, it shallappoint one of those competent authorities as Coordinating Authority. Where it
designates only one competent authority, that competent authority shall be theCoordinating Authority.

2.

Member States shall, by the date referred to in paragraph 1, designate one of the competentauthorities as their Coordinating Authority for child sexual abuse issues (‘Coordinating
Authority’).
The Coordinating Authority shall be responsible for all matters related to the applicationand enforcement of this Regulation in the Member State concerned, unless that Member
State has assigned certain specific tasks or sectors to other competent authorities.

62

PCY comment: the new logic could be explained in a recital, as follows:“With a view to leaving Member States a degree of flexibility so as to implement solutions
best adapted to their particular circumstances, whilst also ensuring the coordination atdomestic level and cooperation at EU level needed to ensure the consistent, efficient andeffective application of this Regulation, Member States should be able to designate several
competent authorities yet be required in that case to appoint one of them as the Coordinating
for which certain tasks are exclusively reserved under this Regulation. Therefore, eachmention of competent authorities in this Regulation should be interpreted as referring to therelevant competent authorities designated by the Member States, including where relevant
Coordinating Authorities, while each mention of Coordinating Authorities should beinterpreted as referring to Coordinating Authorities only, to the exclusion of any othercompetent authorities that the Member States may have designated. Member States should
also be able to provide for the ex post administrative or judicial review of the orders issuedby competent authorities, in accordance with national law, including when such review is
not specifically provided for in this Regulation.”

9093/24
ANNEX

JAI.1

GR/ml

99

LIMITEENThe Coordinating Authority shall in any event be responsible for ensuring coordination at
national level in respect of those all matters relating to the application, supervision andenforcement of this Regulation and for contributing to the effective efficient andconsistent application, and enforcement of this Regulation throughout the Union.
3.

Where a Member State designates more than one competent authority in addition to the
Coordinating Authority, it shall ensure that the respective tasks of those authorities and of
the Coordinating Authority including those of the Coordinating Authority, are clearly
defined and that they cooperate closely and effectively when performing their tasks. The
Member State concerned shall communicate the name of the other competent authorities aswell as their respective tasks to the EU Centre and the Commission.

4.

Within one week after the designation of the competent authorities, including theCoordinating Authorities and other competent authorities pursuant to paragraph 1, Member
States shall make publicly available, and communicate to the Commission and the EU
Centre, the names of their Coordinating Authority and other compentent thoseauthorities as well as their respective tasks or sectors. They shall keep that information
updated.

5.

Each Member States shall ensure that a contact point is designated or establish a contact
point within their its the Coordinating Authority’s office to handle requests forclarification, feedback and other communications in relation to all matters related to theapplication and enforcement of this Regulation in that Member State. Member States shallmake the information on the contact point publicly available and communicate it to the EU
Centre. They shall keep that information updated.

6.

The EU Centre shall, by [eighteen months and two weeks from the date of entry into
force of this Regulation]Within two weeks after the designation of the Coordinating
Authorities pursuant to paragraph 2, the EU Centre shall set up an online register listing
the competent authorities, including the Coordinating Authorities and their contact
points, designated pursuant to paragraphs 1, 1a, 2 and 5. The EU Centre shall regularly
publish any modification thereto.

7.

Competent authorities Coordinating Authorities may, where necessary for the
performance of their tasks under this Regulation, request through the Coordinating
Authority, the assistance of the EU Centre in carrying out those tasks, in particular, by
requesting the EU Centre to:9093/24
ANNEX(a)provide certain information or technical expertise on matters covered by thisRegulation;(b)

assist in assessing, in accordance with Article 5(2), the risk assessment conducted or
updated or the mitigation measures taken by a provider of hosting or interpersonalcommunications services under the jurisdiction of the Member State that designatedthe requesting competent authority Coordinating Authority;

JAI.1

GR/ml

100

LIMITEEN(c)provide an opinion on verify the possible need for a competent authority torequest competent national authorities to issue the issuance of a detection order, aremoval order, or a blocking order in respect of a service under the jurisdiction of theMember State that designated that Coordinating Authority;[(d) provide an opinion on verify the effectiveness of a detection order or a removal
order issued upon the request of the requesting Coordinating Authority;. ]8.

The EU Centre shall provide such assistance free of charge and in accordance with its tasks
and obligations under this Regulation and insofar as its resources and priorities allow. 63

9.

The requirements applicable to Coordinating Authorities set out in Articles 26, 27, 28, 29
and 30 shall also apply to any other competent authorities that the Member States designate
pursuant to paragraph 1.
Article 26
Requirements for Coordinating competent Aauthorities

1.64

63
64

65

Member States shall ensure that the competent authorities Coordinating Authorities thatthey have designated carry out perform their tasks under this Regulation in an objective,
impartial, transparent and timely and non-discriminatory manner, while fully respecting
the fundamental rights of all parties affected65. Member States shall ensure that their
Coordinating Authorities those authorities have adequate technical, financial and humanresources to carry out their tasks.

PCY comment: moved to Art 43(5)(b) on the EU Centre.
PCY comment: this recital (copied from recital 35 TCO) could be included: “For the
purposes of this Regulation, Member States should designate competent authorities. Thisshould not necessarily imply the establishment of a new authority and it should be possible
to entrust an existing body with the functions provided for in this Regulation. This
Regulation should require the designation of authorities competent for issuing removal
orders, scrutinising removal orders, overseeing specific measures and imposing penalties,
while it should be possible for each Member State to decide in accordance with the relevant
requirements of this Regulation and the Charter, on the number of competent authorities tobe designated and whether they are administrative or law enforcement or judicial. Member
States should ensure that the competent authorities fulfil their tasks in an objective and nondiscriminatory manner and do not seek or take instructions from any other body in relation
to the exercise of the tasks under this Regulation. This should not prevent supervision inaccordance with national constitutional law. Member States should communicate thecompetent authorities designated under this Regulation to the Commission, which should
publish online a register listing the competent authorities. That online register should be
easily accessible to facilitate the swift verification of the authenticity of removal orders by
the hosting service providers.”
PCY comment: wording copied from Art. 13(2) of the TCO Regulation.

9093/24
ANNEX

JAI.1

GR/ml

101

LIMITEEN

Those authorities shall not seek or take instructions from any other body in relation
to carrying out their tasks under this Regulation.
2.

When carrying out their tasks and exercising their powers in accordance with thisRegulation, the Coordinating Authorities shall act with complete independence. To that
aim, Member States shall ensure, in particular, that they:(a)are legally and functionally independent from any other public authority;(b)have a status enabling them to act objectively and impartially when carrying out theirtasks under this Regulation;(c)

are free from any external influence, whether direct or indirect;(d)neither seek nor take instructions from any other public authority or any private
party;(e)are not charged with tasks relating to the prevention or combating of child sexual
abuse, other than their tasks under this Regulation.

2 3.

Paragraph 2 1 shall not prevent supervision of the Coordinating competent aAuthorities inaccordance with national constitutional law, to the extent that such supervision does notaffect their independence as required under this Regulation.

3 4.

The Coordinating Authorities and other competent authorities shall ensure that theirrelevant members of staff have the required qualifications, experience, integrity andtechnical skills to perform carry out the application, supervision and enforcement
under this Regulation duties.

5.

The management and other staff of the Coordinating Authorities shall, in accordance with
Union or national law, be subject to a duty of professional secrecy both during and after
their term of office, with regard to any confidential information which has come to theirknowledge in the course of the performance of their tasks. Member States shall ensure thatthe management and other staff are subject to rules guaranteeing that they can carry out
their tasks in an objective, impartial and independent manner, in particular as regards their
appointment, dismissal, remuneration and career prospects.

9093/24
ANNEX

JAI.1

GR/ml

102

LIMITEENSection 2
Powers of competent authorities the Coordinating Authorities of Member States
Article 2766
Investigatory and enforcement powers
1.

Where needed in order to for carrying out their tasks under this Regulation, competentauthorities Coordinating Authorities or other competent authorities shall have thefollowing powers of investigation, in respect of conduct by providers of relevant
information society services falling within the competence under the jurisdiction of thetheir Member State that designated them:(a)the power to require those providers, as well as any other persons acting for purposes
related to their trade, business, craft or profession that may reasonably be aware of
information relating to a suspected infringement of this Regulation, to provide suchinformation without undue delay within a reasonable time period;(b)

the power to carry out, or to request a judicial authority to order, on-site
inspections of any premises that those providers or the other those persons referred
to in point (a) use for purposes related to their trade, business, craft or profession, orto request other public authorities to do so, in order to examine, seize, take or obtaincopies of information relating to a suspected infringement of this Regulation in any
form, irrespective of the storage medium;(c)the power to ask any member of staff or representative of those providers or the other
those persons to give explanations in respect of any information relating to asuspected infringement of this Regulation and to record the answers by any
technical means;(d)the power to request information, including to assess whether the measures taken to
execute a detection order, removal order, or blocking order or delisting ordercomply with the requirements of this Regulation.

2.

Member States may grant additional investigative powers to the Coordinating Authorities.

66

PCY comment: copied word for word from Art. 51 of the DSA as a baseline for further
discussions. Differences include that (i) both the Coordinating and competent authorities areincluded; (ii) this text speaks about “user”, not “the recipient of a service”; (iii) in point 3b
below the wording “or the infringement results in the regular and structural facilitation ofchild sexual abuse offences” has been maintained; and (iv) keeping the reference to“jusridiction” in the proposal rather than “competence” as in the DSA, given the extensive
references to jurisdiction in the proposal. The restruturing of Articles 27 to 30 to ensurealignement with DSA has lead to the fact that some cross-references need to be corrected.
This will be done once the text is stable.

9093/24
ANNEX

JAI.1

GR/ml

103

LIMITEEN

Article 28
Enforcement powers
2. 1.

Where needed for carrying out their tasks under this Regulation, competent authorities
Coordinating Authorities shall have the following enforcement powers, in respect ofproviders of relevant information society services falling within the competence under
the jurisdiction of the their Member State that designated them:(a)the power to accept the commitments offered by those providers in relation to theircompliance with this Regulation and to make those commitments binding;(b)

the power to order the cessation of infringements of this Regulation and, whereappropriate, to impose remedies proportionate to the infringement and necessary tobring the infringement effectively to an end or to request a judicial authority intheir Member States to do so;(c)the power to impose fines, or request a judicial authority in their Member State to doso, in accordance with Article 35 for failure to comply with infringements of thisRegulation, including non-compliance with any of the investigative orders issued
pursuant to paragraph 1 of this Article 27 and to point (b) of this paragraph;(d)the power to impose a periodic penalty payment, or to request a judicial authority
to do so, in accordance with Article 35 to ensure that an infringement of thisRegulation is terminated in compliance with an order issued pursuant to point (b) of
this subparagraph or for failure to comply with any of the orders issued pursuant toparagraph 1 of this Article. 27 and to point (b) of this paragraph;(e)the power to adopt interim measures or to request the competent national judicial
authority to do so, to avoid the risk of serious harm.

2.

Member States may grant additional enforcement powers to the Coordinating Authorities.

3.

As regards the first subparagraph 1, points (c) and (d), competent authorities
Coordinating Authorities shall also have the enforcement powers set out in those points
also in respect of the other persons referred to in paragraph 1 Article 27, for failure tocomply with any of the orders issued to them pursuant to that paragraph Article. 4. They
shall only exercise those enforcement powers after having provided those other persons ingood time with all relevant information relating to such orders, including the applicabletime period, the fines or periodic payments that may be imposed for failure to comply andredress the possibilities for redress.

9093/24
ANNEX

JAI.1

GR/ml

104

LIMITEEN

Article 29
Additional enforcement powers
3. 1.

2.

Where needed for carrying out their tasks under this Regulation, competent authorities
Coordinating Authorities shall have the additional enforcement powers referred to inparagraph 2, in respect of providers of relevant information society services falling within
the competence under the jurisdiction of their Member State, where that designated them,provided that:(a)all other powers pursuant to this Articles 27 and 28 to bring about the cessation of an
infringement of this Regulation have been exhausted;(b)and the infringement has not been remedied or is continuing and is persists;(c)

the infringement causes causing serious harm which cannot be avoided through theexercise of other powers available under Union or national law, also have the power
to take the following measures:

Coordinating Authorities shall have the additional enforcement powers to take thefollowing measures:(a)to require the management body of the providers, without undue delay, to examine
the situation, within a reasonable time period and to:(i)adopt and submit an action plan setting out the necessary measures to terminate
the infringement;(ii)

ensure that the provider takes those measures; and(iii) report on the measures taken;(b)where the competent authorities consider that a provider of relevant
information society services has not sufficiently complied with the requirementsof point (a), that the infringement has not been remedied or is continuing and iscausing serious harm, and that that infringement entails a criminal offence
involving a threat to the life or safety of persons or the infringement results in
the regular and structural facilitation of child sexual abuse offences, to requestthat the competent judicial authority or other independent administrative authorityof its the Member State that designated the Coordinating Authority to order the
temporary restriction of access of users of the service concerned by the infringement
or, only where that is not technically feasible, to the online interface of the provider
on which the infringement takes place. , where the Coordinating Authority considers
that:
(i)

the provider has not sufficiently complied with the requirements of point (a);(ii)

the infringement persists and causes serious harm;(iii) the infringement results in the regular and structural facilitation of child sexual
abuse offences.

9093/24
ANNEX

JAI.1

GR/ml

105

LIMITEEN3.

The Coordinating Authority competent authorities shall, prior to submitting the request
referred to in this paragraph 2, point (b), invite interested parties to submit written
observations within a period that shall not be less than two weeks, describing themeasures that it intends to request and identifying the intended addressee oraddressees thereof. The provider, the intended addressee or addressees and any otherthird party demonstrating a legitimate interest shall be entitled to participate in theproceedings before the competent judicial authority or other independentadministrative authority.
on its intention to submit that request within a reasonable time period set by that
Coordinating Authority. That time period shall not be less than two weeks.
The invitation to submit written observations shall:(a)describe the measures that it intends to request;(b)

identify the intended addressee or addressees thereof.

The provider, the intended addressee or addressees and any other third party demonstratinga legitimate interest shall be entitled to participate in the proceedings regarding the request.
4.

Any measure ordered upon the request referred to in paragraph 2, point (b), shall be
proportionate to the nature, gravity, recurrence and duration of the infringement, without
unduly restricting access to lawful information by users of the service concerned.
The temporary restriction of access shall be apply for a period of four weeks, subject to thepossibility for the competent judicial authority or other independent administrative
authority of the Member State, in its order, to allow the Coordinating Authority or othercompetent authorities, including the Coordinating Authorities, to extend that period forfurther periods of the same lengths, subject to a maximum number of extensions set by athat judicial authority or other independent administrative authority.
The Coordinating Authority competent authorities, including the Coordinating
Authorities, referred to in the second subparagraph shall only extend the period where
it considers, having regard to the rights and legitimate interests of all parties affected by thethat restriction and all relevant facts and circumstances, including any information that theprovider, the addressee or addressees and any other third party that demonstrated alegitimate interest may provide to it, it considers that both of the following conditions
have been met:

9093/24
ANNEX(a)the provider has failed to take the necessary measures to terminate the infringement;(b)

the temporary restriction does not unduly restrict access to lawful information byusers of the service, having regard to the number of users affected and whether any
adequate and readily accessible alternatives exist.

JAI.1

GR/ml

106

LIMITEEN

Where the Coordinating Authority competent authority, considers that the conditions set
out in the fifth fourth subparagraph, points (a) and (b) those two conditions have been
met but it cannot further extend the period pursuant to the fourth second subparagraph, it
shall submit a new request to the competent judicial authority or other independentadministrative authority, as referred to in the first subparagraph 2, point (b).
Article 30
Common provisions on investigatory and enforcement powers
4. 1.

The measures taken by the Coordinating Authorities competent authorities in the exerciseof their investigatory and enforcement powers listed in paragraphs 1, 2 and 3 referred toin Articles 27, 28 and 29 shall be effective, dissuasive and proportionate, having regard, inparticular, to the nature, gravity, recurrence and duration of the infringement of thisRegulation or suspected infringement to which those measures relate, as well as the
economic, technical and operational capacity of the provider of relevant informationsociety services concerned, where relevant applicable.

5. 2.

Member States shall lay down specific rules and procedures for the exercise of thepowers pursuant to paragraphs 1, 2 and 3 and shall ensure that any exercise of thosethe investigatory and enforcement powers referred to in Articles 27, 28 and 29 is subject toadequate safeguards laid down in the applicable national law in compliance with theCharter and with the general principles of Union law to respect the fundamental rights
of all parties affected. In particular, those measures shall only be taken in accordance withthe right to respect for private life and the rights of defence, including the rights to be heard
and of access to the file, and subject to the right to an effective judicial remedy of allparties affected parties.
Article 31
Searches to verify compliance

The competent authorities Coordinating Authorities shall have the power to carry out searches on
publicly accessible material on hosting services to detect the dissemination of known or new childsexual abuse material, using the indicators contained in the databases referred to in Article 44(1),points (a) and (b), where necessary to verify whether the providers of hosting services under thejurisdiction of the Member State that designated the Coordinating Authorities comply with their
obligations under this Regulation.

9093/24
ANNEX

JAI.1

GR/ml

107

LIMITEEN

Article 32
Notification of known child sexual abuse material
Coordinating Authorities shall have the power to notify providers of hosting services under thejurisdiction of the Member State that designated them of the presence on their service of one ormore specific items of known child sexual abuse material and to request them to remove or disable
access to that item or those items, for the providers’ voluntary consideration.
The request shall clearly set out the identification details of the Coordinating Authority making therequest and information on its contact point referred to in Article 25(5), the necessary information
for the identification of the item or items of known child sexual abuse material concerned, as wellas the reasons for the request. The request shall also clearly state that it is for the provider’svoluntary consideration.
Section 3
Other provisions on enforcement
Article 33
Jurisdiction
1.

The Member State in which the main establishment of the provider of relevant informationsociety services is located shall have jurisdiction for the purposes of this Regulation.

2.

A provider of relevant information society services which does not have an establishment
in the Union shall be deemed to be under the jurisdiction of the Member State where its
legal representative resides or is established.
Where a provider failed to appoint a legal representative in accordance with Article 24, all
Member States shall have jurisdiction. Where a Member State decides to exercise
jurisdiction under this subparagraph, it shall inform all other Member States and ensurethat the principle of ne bis in idem is respected.
Article 3467
Right of users of the service to lodge a complaint

1.

67

Users and any body, organisation or association mandated to exercise the rights
conferred by this Regulation on their behalf shall have the right to lodge a complaint
against providers of relevant information society services alleging an infringement of
this Regulation affecting them against providers of relevant information society services
with the Coordinating Authority designated by in the Member State where the user islocated resides or is established.

PCY comment: copied word for word from Art. 53 of the DSA.

9093/24
ANNEX

JAI.1

GR/ml

108

LIMITEEN2.

Coordinating Authorities shall provide child-friendly mechanisms to submit a complaint
under this Article and adopt a child-sensitive approach when handling complaints
submitted by children, taking due account of the child's age, maturity, views, needs andconcerns.

3.

The Coordinating Authority receiving the complaint shall assess the complaint and, whereappropriate, transmit it to the Coordinating Authority of establishment, accompanied,
where appropriate, by its reasoning.
Where the complaint falls under the responsibility of another competent authority in its
Member State, that designated the Coordinating Authority receiving the complaint, that
Coordinating Authority shall transmit it to that other competent authority.

4.

During these proceedings, both parties shall have the right to be heard and receive
appropriate information about the status of the complaint, in accordance withnational law.
Article 34ab68
Representation

1.

Without prejudice to Directive (EU) 2020/1828 or to any other type of representation
under national law, users of relevant information society services shall at least havethe right to mandate a body, organisation or association to exercise the rights
conferred by this Regulation on their behalf, provided the body, organisation or
association meets all of the following conditions:

2.

68

(a)

it operates on a non-profit basis;(b)

it has been properly constituted in accordance with the law of a Member State;(c)

its statutory objectives include a legitimate interest in ensuring that thisRegulation is complied with.

Providers of relevant information society services shall take the necessary technicaland organisational measures to ensure that complaints submitted by bodies,organisations or associations referred to in paragraph 1 of this Article on behalf ofusers recipients of the service through the mechanisms referred to in Article 34 areprocessed and decided upon with priority and without undue delay.

PCY comment: copied word for word from Art. 86 of the DSA.

9093/24
ANNEX

JAI.1

GR/ml

109

LIMITEEN

Article 3569
Penalties
1.

Member States shall lay down the rules on penalties applicable to infringements of theobligations pursuant to Chapters II and V of this Regulation by providers of relevant
information society services within their competence under their jurisdiction and shalltake all the necessary measures to ensure that they are implemented in accordance with
Article 27.
The pPenalties shall be effective, proportionate and dissuasive, taking into account therisk categorisation of services laid down in Article 5(2). Member States shall, by [Dateof application of this Regulation], notify the Commission of those rules and of thosemeasures and shall notify it, without delay, of any subsequent amendments affecting them.

2.

Member States shall ensure that the maximum amount of fines that may be penalties
imposed for an a failure to comply with an obligation laid down in Chapters II and V
infringement of this Regulation shall be not exceed 6 % of the annual worldwide income
or global turnover of the providers concerned in the preceding financial business year of
the provider. 3. Member States shall ensure that the maximum amount of the fine that
may be imposed Penalties for the supply of incorrect, incomplete or misleading
information, failure to reply or rectify incorrect, incomplete or misleading information or
and failure to submit to an on-site inspection shall be not exceed 1% of the annual income
or worldwide global turnover of the preceding business year of the provider or the otherperson concerned in the preceeding financial year referred to in Article 27.

34.

Member States shall ensure that the maximum amount of a periodic penalty payment shallbe not exceed 5 % of the average daily worldwide global turnover or income of theprovider or the other person referred to in Article 27 in the preceding financial year per
day, calculated from the date specified in the decision concerned.

45.

Member States shall ensure that the competent authorities, when deciding whether toimpose a penalty and when determining the type and level of penalty, account is taken of
all relevant circumstances, including:

69

(a)

the nature, gravity and duration of the infringement;(b)whether the infringement was intentional or negligent;(c)any previous infringements by the provider or the other person;(d)the financial strength of the provider or the other person;

PCY comment: copied word for word from Art. 52 of the DSA (except paragraph 4 that istaken from the TCO Regulation).

9093/24
ANNEX

JAI.1

GR/ml

110

LIMITEEN(e)the level of cooperation of the provider or the other person with the competentauthorities;(f)the nature and size of the provider or the other person, in particular whether it is a
micro, small or medium-sized enterprise;(g)

the degree of fault of the provider or other person, taking into account the technicaland organisational measures taken by the provider it to comply with this Regulation.
Section 4
Cooperation
Article 36
Identification and submission of online child sexual abuse

1.

Coordinating Authorities Competent authorities shall submit to the EU Centre, without
without undue delay and through the system established in accordance with Article 39(2):(a)

specific items of material and transcripts extracts of written conversations thatcompetent authorities Coordinating Authorities or that the competent judicial
authorities or other independent administrative authorities of a Member State haveidentified, after a diligent assessment, subject to adequate supervision oversightby judicial authorities, as constituting child sexual abuse material or the solicitationof children, as applicable, for the EU Centre to generate indicators in accordancewith Article 44(3);(b)

exact uniform resource locators indicating the electronic location of theinformation specific items of material that competent authorities Coordinating
Authorities or that competent judicial authorities or other independent administrative
authorities of a Member State have identified, after a diligent assessment, as
constituting child sexual abuse material, hosted by providers of hosting services notoffering services in the Union, that cannot be removed due to those providers’ refusal
to remove or disable access thereto and to the lack of cooperation by the competentauthorities of the third country having jurisdiction, for the EU Centre to compile thelist of uniform resource locators in accordance with Article 44(3);Member States shall take the necessary measures to ensure that the Coordinating
Authorities that they designated receive, without undue delay, the material identified as
child sexual abuse material, the transcripts extracts of written conversations identified as
the solicitation of children, and the uniform resource locators, identified by a competentauthority a competent judicial authority or other independent administrative authority thanthe Coordinating Authority, for submission to the EU Centre in accordance with the firstsubparagraph.

9093/24
ANNEX

JAI.1

GR/ml

111

LIMITEEN

1a.

By deviation from paragraph 1, last subparagraph, Member States may decide thatthe submission to the EU Centre, in accordance with the requirements specified inpoints (a) and (b) of paragraph 1, can be carried out by the competent authorities
without undue delay and through the system established in accordance with Article
39(2). Where a Member State is making use of this possibility, the competentauthority shall inform the Coordinating Authority of all the correspondence with the
EU Centre.

2.

Upon the request of the EU Centre where necessary to ensure that the data contained in the
databases referred to in Article 44(1) are complete, accurate and up-to-date, Coordinating
Authorities competent authorities shall verify or provide clarifications or additional
information as to whether the conditions of paragraph 1, points (a) and (b) have been and,
where relevant, continue to be met, in respect of a given submission to the EU Centre inaccordance with that paragraph.

3.

Member States shall ensure that, where their law enforcement authorities receive a reportof the dissemination of new child sexual abuse material or of the solicitation of children
forwarded to them by the EU Centre in accordance with Article 48(3), a diligent
assessment is conducted in accordance with paragraph 1 and, if the material orconversation is identified as constituting child sexual abuse material or as the solicitationof children, the Coordinating Authority competent authority submits the material to the
EU Centre, in accordance with that paragraph, within one two months from the date ofreception of the report or, where the assessment is particularly complex, two six months
from that date.

4.

They shall also ensure that, where the diligent assessment indicates that the material does
not constitute child sexual abuse material or the solicitation of children, the Coordinating
Authority is informed of that outcome and subsequently informs the EU Centre thereof,
within the time periods specified in the first subparagraph.
Article 3770
Cross-border cooperation among Coordinating Authorities

1.

70

Where a Coordinating Authority that is not the Coordinating Authority of establishment
has reasons to suspect that a provider of relevant information society services infringed thisRegulation in a manner negatively affecting the users of the service in the Member
State of that Coordinating Authority, it may shall request the Coordinating Authority of
establishment to assess the matter and to take the necessary investigatory and enforcement
measures to ensure compliance with this Regulation.

PCY comment: copied word for word from Art. 58 of the DSA.

9093/24
ANNEX

JAI.1

GR/ml

112

LIMITEEN

Where the Commission has reasons to suspect that a provider of relevant informationsociety services infringed this Regulation in a manner involving at least three Member
States, it may recommend that the Coordinating Authority of establishment assess thematter and take the necessary investigatory and enforcement measures to ensurecompliance with this Regulation.
2.

The A request or recommendation pursuant referred to in paragraph 1 shall be duly
reasoned and at least indicate:(a)the point of contact of the provider as set out in Article 23;(b)a description of the relevant facts, the provisions of this Regulation concerned andthe reasons why the Coordinating Authority that sent the request, or the Commission
suspects, that the provider infringed this Regulation including the description of thenegative effects of the alleged infringement;(c)any other information that the Coordinating Authority that sent the request, or theCommission, considers relevant, including, where appropriate, information gatheredon its own initiative and or suggestions for specific investigatory or enforcement
measures to be taken, including interim measures.

3.

The Coordinating Authority of establishment shall take utmost account of the requests
pursuant to paragraph 1 of this Article assess the suspected infringement, taking into
utmost account the request or recommendation referred to in paragraph 1. Where it
considers that it has insufficient information to asses the suspected infringement or to act
upon the request or recommendation and has reasons to consider that the Coordinating
Authority that sent the request, or the Commission, could provide additional information, it
may request such information. The time period laid down in paragraph 4 shall besuspended until that additional information is provided.

4.

The Coordinating Authority of establishment shall, without undue delay and in any event
not later than two months following receipt of the request or recommendation pursuant
referred to in paragraph 1, communicate to the Coordinating Authority that sent therequest, or the Commission, the outcome of its assessment of the suspected infringement,or that of any other competent authority pursuant to national law where relevant, and,
where applicable, an explanation of the investigatory or enforcement measures taken or
envisaged, if any, in relation thereto to ensure compliance with this Regulation.

9093/24
ANNEX

JAI.1

GR/ml

113

LIMITEEN

Article 38
Joint investigations
1.

Coordinating Authorities may participate in joint investigations, which may be coordinatedwith the support of the EU Centre, of matters covered by this Regulation, concerning
providers of relevant information society services that offer their services in several
Member States.
Such joint investigations are without prejudice to the tasks and powers of the participating
Coordinating Authorities and the requirements applicable to the performance of those tasks
and exercise of those powers provided for in this Regulation.

2.

The participating Coordinating Authorities shall make the results of the joint investigations
available to other Coordinating Authorities, the Commission and the EU Centre, throughthe system established in accordance with Article 39(2), for the fulfilment of theirrespective tasks under this Regulation.
Article 38a71
Mutual assistance1.

The Coordinating Authorities and the other competent authorities of the Member States
and the EU Centre Digital Services Coordinators and the Commission shall cooperate
closely and provide each other with mutual assistance in order to apply thisRegulation in a consistent and efficient manner. Mutual assistance shall include, inparticular, exchange of information in accordance with this Article and the duty of
the Digital Services Coordinator of establishment Coordinating Authority to inform all
the other Coordinating Authorities Digital Services Coordinators of destination, theBoard and the Commission about the opening of an investigation and the intention totake a final decision, including its assessment, in respect of a specific provider of a
relevant information society intermediary service.

2.

For the purpose of an investigation, a Coordinating Authority the Digital Services
Coordinator of establishment may request a Coordinating Authority in another Member
State other Digital Services Coordinators to provide specific information in theirpossession as regards a specific provider of relevant information society intermediaryservices or to exercise their investigative powers referred to in Article 27(1) 51(1) withregard to specific information located in their Member State. Where appropriate, theCoordinating Authority Digital Services Coordinator receiving the request may involveother competent authorities or other public authorities of the Member State inquestion.

71

Copied from Article 57 of the DSA (changes vis-à-vis the DSA in italics).

9093/24
ANNEX

JAI.1

GR/ml

114

LIMITEEN3.

The Coordinating Authority Digital Services Coordinator receiving the request
pursuant to paragraph 2 shall comply with such request and inform the requesting
Coordinating Authority Digital Services Coordinator of establishment about the action
taken, without undue delay and no later than two months after its receipt, unless:(a)the scope or the subject matter of the request is not sufficiently specified,justified or proportionate in view of the investigative purposes; or(b)neither the requested Coordinating Authority Digital Service Coordinator norother competent authority or other public authority of that Member State is inpossession of the requested information nor can have access to it; or(c)the request cannot be complied with without infringing Union or national law.

The Digital Services Coordinator Coordinating Authority receiving the request shalljustify its refusal by submitting a reasoned reply, within the period set out in the firstsubparagraph.
Article 39
General cCooperation, coordination and information-sharing system
1.

Competent authorities Coordinating Authorities shall sincerely cooperate with eachother, other competent authorities of the Member States that designated the Coordinating
Authority, the Commission, the EU Centre and other relevant Union agencies, including
Europol, to facilitate the performance of their respective tasks under this Regulation and toensure its effective, efficient and consistent application and enforcement, without
prejudice to the possibility for Member States to provide for cooperation mechanisms
and regular exchanges of views between the competent authorities where relevant forthe performance of their respective tasks in accordance with this Regulation.

1a.

The authorities and agencies referred to in paragraph 1 may shall, including with thesupport from the EU Centre, coordinate their work for the performance of theirrespective tasks under this Regulation, with a view to ensuring its effective, efficientand consistent application and enforcement and avoiding interference with criminal
investigations in different Member States and to avoiding duplication of efforts.

2.

The EU Centre shall establish and maintain one or more reliable and secure information
sharing systems supporting communications between competent authorities Coordinating
Authorities, the Commission, the EU Centre, other relevant Union agencies and providersof relevant information society services.

9093/24
ANNEX

JAI.1

GR/ml

115

LIMITEEN

2a.

The information sharing system or systems referred to in paragraph 2 shall facilitate
compliance with the obligations set out in Article 83(2) by enabling automatedcollection collecting in an automated manner and enabling an easy retrieval
retrieving of relevant statistical information.

3.

The competent authorities Coordinating Authorities, the Commission, the EU Centre,
other relevant Union agencies and providers of relevant information society services shalluse the information-sharing system or systems referred to in paragraph 2 for all relevant
communications pursuant to this Regulation.

4.

The Commission shall adopt implementing acts laying down the practical and operationalarrangements for the functioning of the information-sharing system or systems referred toin paragraph 2 and their interoperability with other relevant systems. Those implementing
acts shall be adopted in accordance with the advisory procedure referred to in Article 87.

9093/24
ANNEX

JAI.1

GR/ml

116

LIMITEENCHAPTER IV
EU CENTRE TO PREVENT AND COMBAT CHILD SEXUAL ABUSE
Section 1
Principles
Article 40
Establishment and scope of action of the EU Centre
1.

A European Union Agency to prevent and combat child sexual abuse, the EU Centre on
Child Sexual Abuse, is established.

2.

The EU Centre shall contribute to the achievement of the objective of this Regulation by
supporting and facilitating the implementation of its provisions concerning the detection,
reporting, removal or disabling of access to, and blocking of online child sexual abuse andgather and share information and expertise and facilitate cooperation between relevantpublic and private parties in connection to the prevention and combating of child sexual
abuse, in particular online.
Article 41
Legal status

1.

The EU Centre shall be a body of the Union with legal personality.

2.

In each of the Member States the EU Centre shall enjoy the most extensive legal capacity
accorded to legal persons under their laws. It may, in particular, acquire and dispose of
movable and immovable property and be party to legal proceedings.

3.

The EU Centre shall be represented by its Executive Director.
Article 42
Seat

The seat of the EU Centre shall be [The Hague, The Netherlands]72.

72

PCY comment: choice of the seat is pending an inter-institutional agreement following theexample of the Anti-Money Laundering Authority.

9093/24
ANNEX

JAI.1

GR/ml

117

LIMITEENSection 2
Tasks
Article 43
Tasks of the EU Centre
The EU Centre shall:
(1)

(2)

facilitate the risk assessment and risk mitigation process referred to in Section 1 ofChapter II, by:(a)supporting the Commission in the preparation of the guidelines referred to in Article
3(8), Article 4(5), Article 6(4) and Article 11, including by collecting and providing
relevant information, expertise and best practices, taking into account advice fromthe Technology Committee referred to in Article 66;(b)upon request from a provider of relevant information services, providing an analysisof anonymised data samples for the purpose referred to in Article 3(3) and assistingin identifying and assessing technical aspects of specific mitigation measures
pursuant to Article 4(3a);(c)

upon request from the Coordinating Authority of establishment, providing an
opinion on technical aspects of the possible actions that it intends to require
pursuant to Article 5a(1), first subparagraph;.

(d)upon request from the Coordinating Authority of establishment, assisting inevaluating the mitigation measures taken by the provider, as well as evaluating
the level of the remaining risk and evaluating the self-assessment by theprovider for the risk categorisation pursuant to Article 5(2).

(e)

keep a record of the decisions by the Coordinating Authorities of establishment
on the risk categorisation of services notified to the EU Centre pursuant to
Article 5(2).

facilitate the detection process referred to in Section 2 of Chapter II, by:(a)providing the opinions on intended detection orders referred to in Article 7(3), firstsubparagraph, point (d);(aa) conducting simulation tests in connection to the possible issuance of detection
orders, in accordance with Article 47a;(b)

9093/24
ANNEX

maintaining and operating the databases of indicators referred to in Article 44;

JAI.1

GR/ml

118

LIMITE

EN

(3)

(4)

(c)

giving providers of hosting services and providers of interpersonal communications
services that received a detection order access to the relevant databases of indicatorsin accordance with Article 46;(d)making technologies available to providers for the execution of detection orders
issued to them, in accordance with Article 50(1);facilitate the reporting process referred to in Section 3 of Chapter II, by:(a)maintaining and operating the database of reports referred to in Article 45;(b)assessing, processing and, where necessary, forwarding the reports and providing
feedback thereon in accordance with Article 48;

facilitate the removal process referred to in Section 4 of Chapter II and the other processes
referred to in Section 5, 5a and 6 of that Chapter, by:(a)receiving the removal orders transmitted to it pursuant to Article 14(4) in order tofulfil the verification function referred to in Article 49(1);(aa) receiving decisions on a cross-border removal order transmitted to it pursuant
to Article 14a(5);(ab) receiving copies of final removal orders and thereto connected informationtransmitted to it pursuant to Article 15(2);(b)

cooperating with and responding to requests of Coordinating Authorities inconnection to intended blocking orders as referred to in Article 16(2);(c)

receiving and processing the blocking orders transmitted to it pursuant to Article
17(3);(ca) receiving copies of final blocking orders and thereto connected informationtransmitted to it pursuant to Article 18(2);(cb) receiving the delisting orders transmitted to it pursuant to Article 18b(2);(cc) receiving copies of final delisting orders and thereto connected informationtransmitted to it pursuant to Article 18c(3);(5)

9093/24
ANNEX(d)providing information and support to victims in accordance with Articles 20 and 21;(e)maintaining up-to-date records of contact points and legal representatives ofproviders of relevant information society services as provided in accordance with
Article 23(2) and Article 24(6);support the competent authorities, including the Coordinating Authorities, and theCommission in the performance of their tasks under this Regulation and facilitate
cooperation, coordination and communication in connection to matters covered by thisRegulation, by:

JAI.1

GR/ml

119

LIMITE

EN

(6)

(a)

creating and maintaining an online register listing the Coordinating Authorities andtheir contact points referred to in Article 25(6);(b)

providing assistance to the competent authorities Coordinating Authorities free ofcharge and in accordance with its tasks and obligations under this Regulation asprovided for in Article 25(7);(c)

assisting the Commission, upon its request, in connection to its tasks under thecooperation mechanism referred to in Article 37;(d)creating, maintaining and operating the information-sharing system referred to in
Article 39;(e)assisting the Commission in the preparation of the delegated and implementing acts
and the guidelines that the Commission adopts under this Regulation;(f)providing information to Coordinating Authorities, upon their request or on its own
initiative, relevant for the performance of their tasks under this Regulation, including
by informing the Coordinating Authority of establishment of potential infringements
identified in the performance of the EU Centre’s other tasks;

facilitate the generation and sharing of knowledge with other Union institutions, bodies,
offices and agencies, competent authorities including Coordinating Authorities, or otherrelevant authorities of the Member States to contribute to the achievement of the objectiveof this Regulation, by:(a)collecting, recording, analysing and providing information, providing analysis basedon anonymised and non-personal data gathering, and providing expertise on mattersregarding the prevention and combating of online child sexual abuse, in accordancewith Article 51;(b)

supporting the development and dissemination of research and expertise on thosematters and on assistance to victims, including by serving as a hub of expertise tosupport evidence-based policy and by inviting other Union institutions, bodies,
offices and agencies, competent authorities including Coordinating Authorities,
or other relevant authorities of the Member States to share information about
relevant prevention initiatives;(ba) making available the knowledge referred to in paragraphs (a) and (b) in the
database referred to in Article 50(4), and in accordance with Article 51;(c)9093/24
ANNEX

drawing up the annual reports referred to in Article 84;

JAI.1

GR/ml

120

LIMITEEN(7)develop or facilitate the further development of technologies to detect online childsexual abuse in accordance with Article 50 (1a).

(8)

advise the Commission with a view of preparing implementing acts for the approvalof technologies used to detect the dissemination of known or new child sexual abusematerial or the solicitation of children in accordance with Article 10 (2).
promote the prevention of child sexual abuse by supporting Member States
implementing comprehensive, tested and effective prevention measures focused on
victims and on (potential) offenders by:(a)gathering information about prevention initiatives (research, surveys andstudies, involving public EU or national resources). by(i) invite other Union institutions, bodies, offices and agencies, competentauthorities including Coordinating Authorities, or other relevant
authorities of the Member States to share information about relevant
prevention initiatives;(ii) identify and collecting, proactively, information on prevention
initiatives.

(b)assess these initiatives and their effectiveness to determine whether they can beconsidered as best practices. using a standardised assessment tool, namely the
EUCPN Qualiprev methodology, determining to what extent there is:(i)a clear description of the crime problem(s) the initiative wishes to address;(ii)

a clear description of the way in which the initiative addresses theidentified problem(s) and determines why it is expected to be effective;(iii) a robust and positive outcome evaluation, or at least strong indications oftheoretical plausibility.
(iv) sufficient information available about the nature of the initiative, its
original context, and the implementation of the activities to help
practitioners select, replicate or innovate from it.
(c)9093/24
ANNEX

upload information about prevention initiatives evaluated as best practices inthe database referred to in Article 50(4), and in accordance with Article 51.

JAI.1

GR/ml

121

LIMITEEN

Article 44
Databases of indicators
1.

2.

3.

The EU Centre shall create, maintain and operate databases of the following three types ofindicators of online child sexual abuse:(a)indicators to detect the dissemination of child sexual abuse material previously
detected and identified as constituting child sexual abuse material in accordance with
Article 36(1);(b)

indicators to detect the dissemination of child sexual abuse material not previously
detected and identified as constituting child sexual abuse material in accordance with
Article 36(1);(c)

indicators to detect the solicitation of children.

The databases of indicators shall solely contain:(a)relevant indicators, consisting of digital identifiers to be used to detect thedissemination of known or new child sexual abuse material or the solicitation ofchildren, as applicable, on hosting services and interpersonal communications
services, generated by the EU Centre in accordance with paragraph 3;(b)as regards paragraph 1, point (a), the relevant indicators shall include a lists of
uniform resource locators compiled by the EU Centre in accordance with paragraph
3 for the purpose of, respectively, the issuance of blocking orders in accordancewith Article 16 and the issuance of delisting orders in accordance with Article
18a;

(c)

the necessary additional information to facilitate the use of the indicators inaccordance with this Regulation, including identifiers allowing for a distinction
between images, videos and, where relevant, other types of material for the detectionof the dissemination of known and new child sexual abuse material and language
identifiers for the detection of solicitation of children.

The EU Centre shall generate the indicators referred to in paragraph 2, point (a), solely on
the basis of the child sexual abuse material and the solicitation of children identified assuch by the Coordinating Authorities or the courts or other independent competentauthorities of the Member States, submitted to it by the Coordinating Authorities pursuant
to Article 36(1), point (a), or by other competent authorities pursuant to Article 36(1a).
The EU Centre shall compile the lists of uniform resource locators referred to in paragraph
2, point (b), solely on the basis of the uniform resource locators submitted to it pursuant to
Article 36(1), point (b) for the purpose of, respectively, the issuance of blocking orders
in accordance of Article 16 and the issuance of delisting orders in accordance with
Article 18a.

9093/24
ANNEX

JAI.1

GR/ml

122

LIMITEEN4.

The EU Centre shall keep records of the submissions and of the process applied to generate
the indicators and compile the lists referred to in the first and second subparagraphs. It
shall keep those records for no longer than as long as the indicators, including the uniform
resource locators, to which they correspond are contained in the databases of indicators
referred to in paragraph 1.
Article 45
Database of reports

1.

The EU Centre shall create, maintain and operate a database for the reports submitted to itby providers of hosting services and providers of interpersonal communications services inaccordance with Article 12(1) and assessed and processed in accordance with Article 48.

2.

The database of reports shall contain the following information:

9093/24
ANNEX(a)the report;(b)where the EU Centre considered the report manifestly unfounded, the reasons and thedate and time of informing the provider in accordance with Article 48(2);(c)

where the EU Centre forwarded the report in accordance with Article 48(3), the date
and time of such forwarding and the name of the competent law enforcement
authority or authorities to which it forwarded the report or, where applicable,
information on the reasons for forwarding the report solely to Europol for further
analysis;(d)where applicable, information on the requests for and provision of additional
information referred to in Article 48(5);(e)

where available, information indicating that the provider that submitted a reportconcerning the dissemination of known or new child sexual abuse material removed
or disabled access to the material;(f)where applicable, information on the EU Centre’s request to the Coordinating
Authority competent authority of establishment to issue a removal order pursuant to
Article 14 in relation to the item or items of child sexual abuse material to which thereport relates;(g)

relevant indicators and ancillary tags associated with the reported potential childsexual abuse material.

JAI.1

GR/ml

123

LIMITEEN

Article 46
Access, accuracy and security
1.

Subject to paragraphs 2 and 3, solely EU Centre staff and auditors duly authorised by the
Executive Director shall have access to and be entitled to process the data contained in the
databases referred to in Articles 44 and 45.

2.

The EU Centre shall give providers of hosting services, providers of interpersonalcommunications services, and providers of internet access services and providers of
online search engines access to the databases of indicators referred to in Article 44, where
and to the extent necessary for them to execute the detection or blocking orders that theyreceived in accordance with Articles 7 or 16. It shall take measures to ensure that suchaccess remains limited to what is strictly necessary for the period of application of thedetection or blocking orders concerned and that such access does not in any way endanger
the proper operation of those databases and the accuracy and security of the data contained
therein.

3.

The EU Centre shall give Coordinating Authorities competent authorities access to the
databases of indicators referred to in Article 44 where and to the extent necessary for the
performance of their tasks under this Regulation.

4.

The EU Centre shall give Europol and the competent law enforcement authorities of theMember States access to the databases of indicators referred to in Article 44 where and to
the extent necessary for the performance of their tasks of investigating suspected childsexual abuse offences.

5.

The EU Centre shall give Europol access to the databases of reports referred to in Article
45, where and to the extent necessary for the performance of its tasks of assisting
investigations of suspected child sexual abuse offences

6.

The EU Centre shall provide the access referred to in paragraphs 2, 3, 4 and 5 only upon
the reception of a request, specifying the purpose of the request, the modalities of therequested access, and the degree of access needed to achieve that purpose. The requests forthe access referred to in paragraph 2 shall also include a reference to the detection order orthe blocking order, as applicable.
The EU Centre shall diligently assess those requests and only grant access where it
considers that the requested access is necessary for and proportionate to the specified
purpose.

9093/24
ANNEX

JAI.1

GR/ml

124

LIMITEEN7.

The EU Centre shall regularly verify that the data contained in the databases referred to in
Articles 44 and 45 is, in all respects, complete, accurate and up-to-date and continues to benecessary for the purposes of reporting, detection and blocking in accordance with thisRegulation, as well as facilitating and monitoring of accurate detection technologies andprocesses. In particular, as regards the uniform resource locators contained in the databasereferred to Article 44(1), point (a), the EU Centre shall, where necessary in cooperation
with the Coordination Authorities, regularly verify that the conditions of Article 36(1),point (b), continue to be met. Those verifications shall include audits, where appropriate.
Where necessary in view of those verifications, it shall immediately complement, adjust or
delete the data.

8.

The EU Centre shall ensure that the data contained in the databases referred to in Articles
44 and 45 is stored in a secure manner and that the storage is subject to appropriatetechnical and organisational safeguards. Those safeguards shall ensure, in particular, thatthe data can be accessed and processed only by duly authorised persons for the purpose forwhich the person is authorised and that a high level of security is achieved. The EU Centre
shall regularly review those safeguards and adjust them where necessary.
Article 47
Delegated acts relating to the databases

The Commission shall be empowered to adopt delegated acts in accordance with Article 86 in orderto supplement this Regulation with the necessary detailed rules concerning:(a)the types, precise content, set-up and operation of the databases of indicators referred to in
Article 44(1), including the indicators and the necessary additional information to becontained therein referred to in Article 44(2);(b)

the processing of the submissions by Coordinating Authorities, the generation of theindicators, the compilation of the lists of uniform resource locators and the record-keeping,referred to in Article 44(3);(c)

the precise content, set-up and operation of the database of reports referred to in Article
45(1);(d)access to the databases referred to in Articles 44 and 45, including the modalities of theaccess referred to in Article 46(1) to (5), the content, processing and assessment of therequests referred to in Article 46(6), procedural matters related to such requests and thenecessary measures referred to in Article 46(6);(e)

the regular verifications and audits to ensure that the data contained in those databases iscomplete, accurate and up-to-date referred to in Article 46(7) and the security of thestorage of the data, including the technical and organisational safeguards and regularreview referred to in Article 46(8).

9093/24
ANNEX

JAI.1

GR/ml

125

LIMITEEN

Article 47a
Simulation tests to assist in connection to the possible issuance of detection orders
1.

Where requested by the Coordinating Authority of establishment, the EU Centre
shall conduct the tests referred to in Article 7(2), last subparagraph. Those tests shall,in particular, consist of the EU Centre engaging in the exchange of simulated childsexual abuse material or in the simulated solicitation of children, as applicable, so as
to determine whether and if so, to which extent and in which manner the service inquestion, or certain identifiable parts or components thereof, can be used, where
relevant by certain specific users or groups or types of users, for the purpose of childsexual abuse.

2.

The tests referred to in paragraph 1 shall:(a)only be conducted involving accounts specifically set up and solely operated by
the EU Centre for the purpose of those tests;(b)

only be conducted by duly authorised staff of the EU Centre, subject toadequate safeguards and supervision, and be duly documented;(c)

be designed and conducted by the EU Centre in an accurate and objective
manner, so as to lead to non-biased and representative outcomes.

(d)

not involve any exchange of child sexual abuse material, nor involve orotherwise affect communications, with or between any users other than therelevant staff of the Centre;(e)be conducted without the knowledge of the service provider concerned.

3.

The EU Centre shall design and prepare conduct the test referred to in paragraph 1
in cooperation with the Coordinating Authority of establishment that made therequest and, where so requested, also with the relevant law enforcement authorities
indicated in the request. That Coordinating Authority shall in any event inform therelevant law enforcement authorities of the tests in due time prior to the beginning of
the tests.

4.

The EU Centre shall, without undue delay, report to the Coordinating Authority of
establishment that made the request on the outcomes of the tests referred to inparagraph 1. Those reports shall not contain any personal data.
The EU Centre shall store those reports. It may make those reports or some or all of
the outcomes of the tests available to other Coordinating Authorities and it may use
those reports or outcomes for the performance of its other tasks under thisRegulation, subject to the protection of confidential information.

9093/24
ANNEX

JAI.1

GR/ml

126

LIMITEEN5.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 in order to supplement this Regulation with the necessary detailed rules
concerning the tests referred to in paragraph 1, in particular as regards procedural
aspects, the design and conduct of those tests, the necessary safeguards andsupervision, cooperation, reporting and storage, as well as the making available andfurther use of the reports or their outcomes.
Article 48
Reporting

1.

The EU Centre shall expeditiously assess and process reports submitted by providers of
hosting services and providers of interpersonal communications services in accordancewith Article 12 to determine whether the reports are manifestly unfounded or are to be
forwarded.

2.

Where the EU Centre considers that the report is manifestly unfounded, it shall inform theprovider that submitted the report, specifying the reasons why it considers the report to be
unfounded.

3

Where the EU Centre considers that there are reasonsable grounds for the EU Centre toconsider that the a report is not manifestly unfounded, it shall forward the report,
together with any additional relevant information available to it, to Europol and to thecompetent law enforcement authority or authorities of the Member State likely to havejurisdiction to investigate or prosecute the potential child sexual abuse to which the report
relates.
Where that competent law enforcement authority or those competent law enforcement
authorities cannot be determined with sufficient certainty, the EU Centre shall forward thereport, together with any additional relevant information available to it, to Europol, forfurther analysis and subsequent referral by Europol to the competent law enforcement
authority or authorities.

4.

Where a provider that submitted the report has indicated that the report requires urgent
action, the EU Centre shall assess and process that report as a matter of priority and, where
it forwards the report in accordance with paragraph 3 and it considers that the reportrequires urgent action, shall ensure that the forwarded report is marked as such.
The EU Centre shall perform the assessment and processing referred to inparagraphs 1, 2 and 3 of this Article as a matter of priority in respect of reports
submitted in accordance with Article 13(2), first subparagraph. In particular, where
there are reasonable grounds for the EU Centre to consider that the report is founded
and that there is likely to be an imminent threat to the life or safety of a childincluding when the report indicates ongoing abuse, it shall immediately forward thereport in accordance with paragraph 3, marking it as requiring urgent action.

9093/24
ANNEX

JAI.1

GR/ml

127

LIMITEENIn other cases, Where the EU Centre considers, in respect of a report submitted inaccordance with Article 13(2), first subparagraph, that there is not likely to be an
imminent threat to the life of a child including when the report does not indicate
ongoing abuse, it shall forward indicate that when forwarding the report inaccordance with paragraph 3 without such marking and it shall also inform theprovider that submitted the report and the competent authority, indicating specifying
in all cases the outcome of the assessment and the reasons explaining that outcome
why it considers that there is not likely to be an imminent threat to the life of a child.
5.

Where the report does not contain all the information required in Article 13, the EU Centre
may request the provider that submitted the report to provide the missing information.

6.

Where so requested by a competent law enforcement authority of a Member State in order
to avoid interfering with activities for the prevention, detection, investigation andprosecution of child sexual abuse offences, the EU Centre shall:(a)communicate to the provider that submitted the report that it is not to inform the userconcerned, specifying the time period during which the provider is not to do so;(b)where the provider that submitted the report is a provider of hosting services and thereport concerns the potential dissemination of child sexual abuse material,
communicate to the provider that it is not to remove or disable access to the material,
specifying the time period during which the provider is not to do so.

7.

The time periods referred to in the first subparagraph, points (a) and (b), shall be thosespecified in the competent law enforcement authority’s request to the EU Centre, provided
that they remain limited to what is necessary to avoid interference with the relevant
activities and does not exceed 18 months, as well as constitute necessary andproportionate restrictions and respect the essence of the rights of the victims.

8.

The EU Centre shall verify whether a provider of hosting services that submitted a reportconcerning the potential dissemination of child sexual abuse material removed or disabled
access to the material, insofar as the material is publicly accessible. Where it considers thatthe provider did not remove or disable access to the material expeditiously, the EU Centre
shall inform the Coordinating Authority of establishment thereof.
Article 49
Searches and notification

1.

9093/24
ANNEX

The EU Centre shall have the power to conduct searches on hosting services for the
dissemination of publicly accessible child sexual abuse material, using the relevant
indicators from the database of indicators referred to in Article 44(1), points (a) and (b), in
the following situations:

JAI.1

GR/ml

128

LIMITE

EN

2.

(a)

where so requested to support a victim by verifying whether the provider of hosting
services removed or disabled access to one or more specific items of known childsexual abuse material depicting the victim, in accordance with Article 21(4), point
(c);

(b)

where so requested to assist a Coordinating Authority competent authority byverifying the possible need for the issuance of a detection order or a removal order inrespect of a specific service or the effectiveness of a detection order or a removal
order that the Coordinating Authority issued, in accordance with Article 25(7), points(c) and (d), respectively;(c)where so requested to assist a Coordinating Authority, by verifying theeffectiveness of a detection order that the competent judicial authorities or otherindependent administrative authorities issued, in accordance with Article 25(7),point (d).

Where so requested to assist a competent authority, The EU Centre shall have the power tonotify, after having conducted the searches referred to in paragraph 1, providers of hosting
services of the presence of one or more specific items of known child sexual abusematerial on their services and request them to remove or disable access to that item or
those items, for the providers’ voluntary consideration.
The request shall clearly set out the identification details of the EU Centre and a contact
point, the necessary information for the identification of the item or items, as well as thereasons for the request. The request shall also clearly state that it is for the provider’svoluntary consideration.
3.

Where so requested by a competent law enforcement authority of a Member State in order
to avoid interfering with activities for the prevention, detection, investigation andprosecution of child sexual abuse offences, the EU Centre shall not submit a notice, for as
long as necessary to avoid such interference but no longer than 18 months.
Article 50
Technologies, information and expertise1.

The EU Centre shall make available technologies that providers of hosting services andproviders of interpersonal communications services may acquire, install and operate, freeof charge, where relevant subject to reasonable licensing conditions, to execute detection
orders in accordance with Articles 10(1) and 10a.
To that aim, the EU Centre shall compile lists of such technologies, having regard to therequirements of this Regulation and in particular those of Article 10(2).

9093/24
ANNEX

JAI.1

GR/ml

129

LIMITEEN

Before including specific technologies on those lists, the EU Centre shall request theopinion of its Technology Committee and of the European Data Protection Board. The
Technology Committee and the European Data Protection Board shall deliver theirrespective opinions within eight weeks. That period may be extended by a further six
weeks where necessary, taking into account the complexity of the subject matter. The
Technology Committee and the European Data Protection Board shall inform the EU
Centre of any such extension within one month of receipt of the request for consultation,
together with the reasons for the delay.
1a.

The EU Centre shall, in cooperation with Coordinating Authorities, providers of
hosting services and providers of interpersonal communications services and, where
relevant, independent experts, develop or facilitate the further development oftechnologies to detect online child sexual abuse, in such a manner as to ensure thatthose technologies are capable of meeting the requirements of this Regulation, inparticular Article 10(3).
The Technology Committee shall provide an annual orientation report including
detailed opinions from experts, accompanied by the opinion of the European Data
Protection Board. The Technology Committee may also, on an ad hoc basis, uponrequest of the Management Board and in accordance with the rules of procedure set
out in Article 66(2) and (7)(d), deliver an opinion on the use of the technologies thatare used for a specific order. The deadlines set out in the third subparagraph shallapply mutatis mutandis.

1b.

Where the EU Centre has been requested, in accordance with this Regulation, toprovide an opinion, information or other assistance on technologies, including afunctional and security audit at the source code level, that may be used for the
execution of a specific order issued under this Regulation, it may, in accordance with
Article 66, request the Technology Committee for its opinion thereon. In that case,the rules of the third paragraph on the time period for providing that opinion shallapply.

2.

The EU Centre shall collect, record, analyse and make available relevant, objective,
reliable and comparable information on matters related to the prevention and combating ofchild sexual abuse, in particular:9093/24
ANNEX(a)information obtained in the performance of its tasks under this Regulation
concerning detection, reporting, removal or disabling of access to, and blocking of
online child sexual abuse;(b)

information resulting from the research, surveys and studies referred to inparagraph 3;(c)information resulting from research or other activities conducted by Member States’
authorities, other Union institutions, bodies, offices and agencies, the competentauthorities of third countries, international organisations, research centres and civilsociety organisations.

JAI.1

GR/ml

130

LIMITEEN

3.

Where necessary for the performance of its tasks under this Regulation, the EU Centre
shall carry out, participate in or encourage research, surveys and studies, either on its own
initiative or, where appropriate and compatible with its priorities and its annual work
programme, at the request of the European Parliament, the Council or the Commission.

4 3a.

The EU Centre shall keep a database encompassing all research, surveys and studies,
involving public EU or national resources, as referred to in paragraphs 2 and 3 andthe information resulting thereof. That database shall not contain any personal data
other than information identifying the authors and any other persons having
contributed to the research, survey and studies.
The competent authorities Coordinating Authorities may consult this database where
necessary for the performance of their tasks under this Regulation reference
purposes.
The EU Centre may decide to provide the appropriate level of access for consultationof this database to other entities and individuals upon reasoned request, if therequesting entities and individuals can justify that such access could contribute to theachievement of the objectives of this Regulation.

4.

The EU Centre shall provide the information referred to in paragraph 2 and the information
resulting from the research, surveys and studies referred to in paragraph 3, including its
analysis thereof, and its opinions on matters related to the prevention and combating of
online child sexual abuse to other Union institutions, bodies, offices and agencies,
Coordinating Authorities, other competent authorities and other public authorities of theMember States, either on its own initiative or at request of the relevant authority. Where
appropriate, the EU Centre shall make such information publicly available. By exploiting
this database, the EU Centre, functioning as a centralisad hub for knowledge
dissemination in accordance with Article 43 paragraph 6, aims to prevent duplicationof efforts and initiatives, promoting efficiency and collaboration among stakeholders.

5.

The EU Centre shall develop a communication strategy and promote dialogue with civilsociety organisations and providers of hosting or interpersonal communications services toraise public awareness of online child sexual abuse and measures to prevent and combat
such abuse.

9093/24
ANNEX

JAI.1

GR/ml

131

LIMITEENSection 3
Processing of information
Article 51
Processing activities and data protection
1.

In so far as is necessary for the performance of its tasks under this Regulation, the EU
Centre may process personal data.

2.

The EU Centre shall process personal data as strictly necessary for the purposes of:

9093/24
ANNEX(a)providing the opinions on intended detection orders referred to in Article 7(3);(b)

cooperating with and responding to requests of Coordinating Authorities inconnection to intended blocking orders as referred to in Article 16(2);(c)

receiving and processing blocking orders transmitted to it pursuant to Article 17(3);(d)

cooperating with Coordinating Authorities in accordance with Articles 20 and 21 on
tasks related to victims’ rights to information and assistance;(e)maintaining up-to-date records of contact points and legal representatives ofproviders of relevant information society services as provided in accordance with
Article 23(2) and Article 24(6);(f)

creating and maintaining an online register listing the Coordinating Authorities andtheir contact points referred to in Article 25(6);(g)

providing assistance to Coordinating Authorities in accordance with Article 25(7);(h)

assisting the Commission, upon its request, in connection to its tasks under thecooperation mechanism referred to in Article 37;(i)create, maintain and operate the databases of indicators referred to in Article 44;(j)create, maintain and operate the database of reports referred to in Article 45;(k)providing and monitoring access to the databases of indicators and of reports inaccordance with Article 46;(l)performing data quality control measures in accordance with Article 46(7);

JAI.1

GR/ml

132

LIMITEEN

(m) assessing and processing reports of potential online child sexual abuse in accordancewith Article 48;(n)cooperating with Europol and partner organisations in accordance with Articles 53
and 54, including on tasks related to the identification of victims;(o)generating statistics in accordance with Article 83.

3.

The EU Centre shall store the personal data referred to in paragraph 2 only where and for
as long as strictly necessary for the applicable purposes listed in paragraph 2.

4.

It shall ensure that the personal data is stored in a secure manner and that the storage issubject to appropriate technical and organisational safeguards. Those safeguards shallensure, in particular, that the personal data can be accessed and processed only for the
purpose for which it is stored, that a high level of security is achieved and that the personal
data is deleted when no longer strictly necessary for the applicable purposes. It shallregularly review those safeguards and adjust them where necessary.
Section 4
Cooperation
Article 52
Contact officers

1.

Each Coordinating Authority shall designate at least one contact officer, who shall be themain contact point for the EU Centre in the Member State concerned. The contact officers
may be seconded to the EU Centre. Where several contact officers are designated, theCoordinating Authority shall designate one of them as the main contact officer.

2.

Contact officers shall assist in the exchange of information between the EU Centre and the
Coordinating Authorities that designated them. Where the EU Centre receives reports
submitted in accordance with Article 12 concerning the potential dissemination of newchild sexual abuse material or the potential solicitation of children, the contact officers
designated by the competent Member State shall facilitate the process to determine theillegality of the material or conversation, in accordance with Article 36(1).

3.

The Management Board shall determine the rights and obligations of contact officers in
relation to the EU Centre. Contact officers shall enjoy the privileges and immunities
necessary for the performance of their tasks.

4.

Where contact officers are seconded to the EU Centre, the EU Centre shall cover the costsof providing them with the necessary premises within the building and adequate support
for contact officers to perform their duties. All other costs that arise in connection with thedesignation of contact officers and the performance of their tasks shall be borne by the
Coordinating Authority that designated them.

9093/24
ANNEX

JAI.1

GR/ml

133

LIMITEEN

Article 53
Cooperation with Europol
1.

Where necessary for the performance of its tasks under this Regulation, within theirrespective mandates, the EU Centre shall cooperate with Europol.

2.

Europol and the EU Centre shall provide each other with the fullest possible access torelevant information and information systems, where necessary for the performance of
their respective tasks and in accordance with the acts of Union law regulating such access.
Without prejudice to the responsibilities of the Executive Director, the EU Centre shall
maximise efficiency by sharing administrative functions with Europol, including functions
relating to personnel management, information technology (IT) and budget
implementation.

3.

The terms of cooperation and working arrangements shall be laid down in a memorandumof understanding73.
Article 53a
Cooperation with other Union agencies and bodies

1.

In addition to the obligation to cooperate with Europol in accordance with Article 53,
where necessary for the performance of its tasks under this Regulation, the EU
Centre may cooperate with other Union agencies and bodies, in particular the EU
Agency for Fundamental Rights, the European Union Agency for Cybersecurity, theEuropean Data Protection Supervisor and the European Data Protection Board inaccordance with the respective mandates of the EU Centre and those other Union
agencies and bodies.

2.

The EU Centre may conclude memoranda of understanding with Union agencies andbodies referred to in paragraph 1, laying down the terms of cooperation.
Article 54
Cooperation with partner organisations

1.

Where necessary for the performance of its tasks under this Regulation, the EU Centre may
cooperate with organisations and networks with information and expertise on mattersrelated to the prevention and combating of online child sexual abuse, including civilsociety organisations and semi-public organisations.

2.

The EU Centre may conclude memoranda of understanding with organisations referred toin paragraph 1, laying down the terms of cooperation, including on data sharing.

73

PCY comment: following the changes proposed by the Presidency in Article 62, theManagement Board is the body that will conclude MoU.

9093/24
ANNEX

JAI.1

GR/ml

134

LIMITEEN

Article 54a
Cooperation with third countries and international organisations
1.

In so far as is necessary in order to achieve the objectives set out in this Regulation,
and without prejudice to the respective competences of the Member States and theinstitutions of the Union, the EU Centre may cooperate with, the competentauthorities of third countries and/or with international organisations.
To this end, the EU Centre may, subject to prior approval by the Commission,
establish working arrangements with the authorities of third countries andinternational organisations. These arrangements shall not create legal obligations
incumbent on the Union and its Member States.

2.

The EU Centre shall be open to the participation in its work of third countries thathave entered into agreements with the Union to this effect.
Under the relevant provisions of the agreements referred to in the firstsubparagraph, arrangements shall be developed specifying, in particular, the nature,extent and manner in which the third countries concerned will participate in thework of the EU Centre, including provisions relating to participation in the initiatives
undertaken by the EU Centre, financial contributions and staff. As regards staff
matters, those arrangements shall, in any event, comply with the Staff Regulations.

3.

The Management Board shall adopt a strategy for relations with third countries orinternational organisations concerning matters for which the EU Centre iscompetent. The Commission shall ensure that the EU Centre operates within its
mandate and the existing insitutional framework by concluding an appropriate
working arrangement with the EU Centre's Executive Director.
Section 5
Organisation
Article 55
Administrative and management structure

The administrative and management structure of the EU Centre shall comprise:(a)a Management Board, which shall exercise the functions set out in Article 57;(b)an Executive Board which shall perform the tasks set out in Article 62;(c)an Executive Director of the EU Centre, who shall exercise the responsibilities set out in
Article 64;(d)a Technology Committee as an advisory group, which shall exercise the tasks set out in
Article 66.

9093/24
ANNEX

JAI.1

GR/ml

135

LIMITEENPart 1: Management Board
Article 56
Composition of the Management Board
1.

The Management Board shall be composed of one representative from each Member Stateand one two representatives of the Commission, all as members with voting rights.

2.

The Management Board shall also include one independent expert observer designated by
the European Parliament, without the right to vote.
Europol may designate a representative to attend the meetings of the Management Board
as an observer on matters involving Europol, without the right to vote, at the request of
the Chairperson of the Management Board.

3.

Each member of the Management Board shall have an alternate. The alternate shallrepresent the member in his/her absence.

4.

Members of the Management Board and their alternates shall be appointed in the light of
their knowledge in the field of combating child sexual abuse, taking into account relevant
managerial, administrative and budgetary skills competencies. Member States shallappoint a representative of their Coordinating Authority, within four months of [date ofentry into force of this Regulation]. All parties represented in the Management Board shallmake efforts to limit turnover of their representatives, in order to ensure continuity of its
work. All parties shall aim to achieve a balanced representation between men and womenon the Management Board.

5.

The term of office for members and their alternates shall be four years. That term may berenewed.
Article 57
Functions of the Management Board

1.

The Management Board shall:(a)give the general orientations for the EU Centre's activities;(aa) be responsible for the overall planning and the execution of the tasks conferredon the EU Centre pursuant to Article 43, and it shall adopt all the decisions of
the EU Centre with the exception of the decisions that shall be taken by theManagement Board in accordance with Article 5774;

74

Formerly Art 62(1).

9093/24
ANNEX

JAI.1

GR/ml

136

LIMITEEN(b)contribute to facilitate the effective cooperation with and between the Coordinating
Authorities;(c)adopt rules for the prevention and management of conflicts of interest in respect ofits members, as well as for the members of the Technological Committee and of any
other advisory group it may establish and publish annually on its website thedeclaration of interests of the members of the Management Board. The consent of
its members must be obtained prior to publication;(d)adopt the assessment of performance of the Executive Board referred to in Article
61(2);(e)adopt and make public its Rules of Procedure;(f)appoint the members of the Technology Committee, and of any other advisory groupit may establish;(fa) consult the Victims Board in all cases where, in the performance of its tasks
pursuant to points (a) and (h), interests of victims are concerned;

75
76
77

(g)

adopt the opinions on intended detection orders referred to in Article 7(4), on thebasis of a draft opinion provided by the Executive Director;(h)adopt and regularly update the communication and dissemination plans referred to in
Article 77(3) based on an analysis of needs;(i)adopt, by 30 November of each year, on the basis of a proposal by the Executive
Director, the draft Single Programming Document, and shall transmit it for
information to the European Parliament, the Council and the Commission by 31
January the following year, as well as any other updated version of the
document75;(j)adopt the draft annual budget of the EU Centre and exercise other functions in
respect of the EU Centre’s budget76;(k)

assess and adopt a consolidated annual activity report on the EU Centre's
activities, including an overview of the fulfilment of its tasks and send it, by 1
July each year, to the European Parliament, the Council, the Commission and
the Court of Auditors and make the consolidated annual activity reportpublic77;

Formerly Art 62(2)(a).
Formerly Art 62(2)(b).
Formerly Art 62(2)(c).

9093/24
ANNEX

JAI.1

GR/ml

137

LIMITEEN(l)adopt an anti-fraud strategy, proportionate to fraud risks taking into accountthe costs and benefits of the measures to be implemented, an efficiency gains
and synergies strategy, a strategy for cooperation with third countries and/orinternational organisations, and a strategy for the organisational management
and internal control systems78;(m) exercise, with respect to the staff of the EU Centre, the powers conferred by the
Staff Regulations on the Appointing Authority and by the Conditions of
Employment of Other Servants on the EU Centre Empowered to Conclude aContract of Employment79 ("the appointing authority powers")80;

78
79

80
81
82
83
84
85
86
87

(n)

adopt appropriate implementing rules for giving effect to the Staff Regulations
and the Conditions of Employment of Other Servants in accordance with
Article 110(2) of the Staff Regulations81;(o)appoint the Executive Director and remove him/her from office, in accordancewith Article 6582;(p)

appoint an Accounting Officer, who may be the Commission's Accounting
Officer, subject to the Staff Regulations and the Conditions of Employment ofother servants, who shall be totally independent in the performance of his/herduties83;(q)

ensure adequate follow-up to findings and recommendations stemming from theinternal or external audit reports and evaluations, as well as from investigationsof the European Anti-Fraud Office (OLAF) 84;(r)

adopt the financial rules applicable to the EU Centre85;(s)take all decisions on the establishment of the EU Centre's internal structures
and, where necessary, their modification86;(t)

appoint a Data Protection Officer87;

Formerly Art 62(2)(d).
Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying
down the Staff Regulations of Officials and the Conditions of Employment of Other
Servants of the European Communities and instituting special measures temporarily
applicable to officials of the Commission (OJ L 56, 4.3.1968, p. 1)
Formerly Art 62(2)(g).
Formerly Art 62(2)(h).
Formerly Art 62(2)(i).
Formerly Art 62(2)(j).
Formerly Art 62(2)(k).
Formerly Art 62(2)(l).
Formerly Art 62(2)(m).
Formerly Art 62(2)(n).

9093/24
ANNEX

JAI.1

GR/ml

138

LIMITEEN(u)adopt internal guidelines further specifying the procedures for the processing of
information in accordance with Article 51, after consulting the European Data
Protection Supervisor88;(v)

authorise the conclusion of memoranda of understanding referred to in Articles
53(3), 53a(2) and Article 54(2) 89.

32.

With respect to the powers mentioned in paragraph 2 point (m) and (n) (g) and (h),the Executive Management Board shall adopt, in accordance with Article 110(2) of
the Staff Regulations, a decision based on Article 2(1) of the Staff Regulations andArticle 6 of the Conditions of Employment, delegating relevant appointing authority
powers to the Executive Director. The Executive Director shall be authorised to subdelegate those powers.

43.

In exceptional circumstances, the Executive Management Board may by way of adecision temporarily suspend the delegation of the appointing authority powers to the
Executive Director and any sub-delegation by the latter and exercise them itself ordelegate them to one of its members or to a staff member other than the Executive
Director.
Article 58
Chairperson of the Management Board

1.

The Management Board shall elect a Chairperson and a Deputy Chairperson from amongits members. The Chairperson and the Deputy Chairperson shall be elected by a majorityof two thirds of the members of the Management Board.
The Deputy Chairperson shall automatically replace the Chairperson if he/she is prevented
from attending to his/her duties.

2.

The term of office of the Chairperson and the deputy Chairperson shall be four years. Theirterm of office may be renewed once. If, however, their membership of the Management
Board ends at any time during their term of office, their term of office shall automatically
expire on that date.

3.

The detailed procedure for the election of the Chairperson and the Vice-Chairperson
shall be set out in the rules of procedure of the Management Board.

88
89

Formerly Art 62(2)(o).
Formerly Art 62(2)(p).

9093/24
ANNEX

JAI.1

GR/ml

139

LIMITEEN

Article 59
Meetings of the Management Board
1.

The Chairperson shall convene the meetings of the Management Board.

2.

The Executive Director shall take part in the deliberations, without the right to vote.

3.

The Management Board shall hold at least two ordinary meetings a year. In addition, it
shall meet on the initiative of its Chairperson, at the request of the Commission, or at therequest of at least one-third of its members.

4.

The Management Board may invite any person whose opinion may be of interest to attend
its meetings as an observer, including representatives of the Victims Board.

5.

The members of the Management Board and their alternates may, subject to its rules ofprocedure, be assisted at the meetings by advisers or experts, including representatives of
the Victims Board.

6.

The EU Centre shall provide the secretariat for the Management Board.
Article 60
Voting rules of the Management Board

1.

Unless provided otherwise in this Regulation, the Management Board shall take decisions
by absolute majority of its members with voting rights.

2.

Each member shall have one vote. In the absence of a member with the right to vote,his/her alternate shall be entitled to exercise his/her right to vote.

3.

The Executive Director shall not take part in the voting.

4.

The Management Board's rules of procedure shall establish more detailed voting
arrangements, in particular the circumstances in which a member may act on behalf ofanother member.

5.

The decisions referred to in Article 57(1), points (c), (j) to (l), (n) to (r) and (v) may
only be taken if the representative of the Commission casts a positive vote. For the
purposes of taking the decisions referred to in Article 57(1), point (i), the consent of
the representative of the Commission shall only be required on the elements of thedecision not related to the annual and multi-annual working programme of the EU
Centre.

9093/24
ANNEX

JAI.1

GR/ml

140

LIMITEENPart 2: Executive Board90
Article 61
Composition and appointment of the Executive Board
1.

The Executive Board shall be composed of the Chairperson and the Deputy Chairperson of
the Management Board, two other members appointed by the Management Board fromamong its members with the right to vote and two representatives of the Commission to theManagement Board. The Chairperson of the Management Board shall also be the
Chairperson of the Executive Board.
The Executive Director shall participate in meetings of the Executive Board without theright to vote.

2.

The term of office of members of the Executive Board shall be four years. In the course of
the 12 months preceding the end of the four-year term of office of the Chairperson and fivemembers of the Executive Board, the Management Board or a smaller committee selectedamong Management Board members including a Commission representative shall carryout an assessment of performance of the Executive Board. The assessment shall take into
account an evaluation of the Executive Board members’ performance and the EU Centre’s
future tasks and challenges. Based on the assessment, the Management Board may extend
their term of office once.
Article 62
Tasks of the Executive Board

1.

The Executive Board shall be responsible for the overall planning and the execution of thetasks conferred on the EU Centre pursuant to Article 43. The Executive Board shall adopt
all the decisions of the EU Centre with the exception of the decisions that shall be taken by
the Management Board in accordance with Article 57.

2.

In addition, the Executive Board shall have the following tasks:

90

(a)

adopt, by 30 November of each year, on the basis of a proposal by the Executive
Director, the draft Single Programming Document, and shall transmit it for
information to the European Parliament, the Council and the Commission by 31
January the following year, as well as any other updated version of the document;(b)adopt the draft annual budget of the EU Centre and exercise other functions in
respect of the EU Centre’s budget;

PCY comment: Articles 61 to 63 have been deleted but to avoid mistakes in the crossreferences, Articles 64 to 89 have not been renumbered at this stage.

9093/24
ANNEX

JAI.1

GR/ml

141

LIMITEEN(c)assess and adopt a consolidated annual activity report on the EU Centre's activities,
including an overview of the fulfilment of its tasks and send it, by 1 July each year,
to the European Parliament, the Council, the Commission and the Court of Auditorsand make the consolidated annual activity report public;(d)adopt an anti-fraud strategy, proportionate to fraud risks taking into account the costs
and benefits of the measures to be implemented, an efficiency gains and synergies
strategy, a strategy for cooperation with third countries and/or internationalorganisations, and a strategy for the organisational management and internal control
systems(e)adopt rules for the prevention and management of conflicts of interest in respect ofits members;(f)adopt its rules of procedure;(g)

exercise, with respect to the staff of the EU Centre, the powers conferred by the Staff
Regulations on the Appointing Authority and by the Conditions of Employment of
Other Servants on the EU Centre Empowered to Conclude a Contract of
Employment91 ("the appointing authority powers");(h)adopt appropriate implementing rules for giving effect to the Staff Regulations andthe Conditions of Employment of Other Servants in accordance with Article 110(2)of the Staff Regulations;(i)

appoint the Executive Director and remove him/her from office, in accordance with
Article 65;(j)appoint an Accounting Officer, who may be the Commission's Accounting Officer,
subject to the Staff Regulations and the Conditions of Employment of other servants,
who shall be totally independent in the performance of his/her duties;(k)ensure adequate follow-up to findings and recommendations stemming from theinternal or external audit reports and evaluations, as well as from investigations of
the European Anti-Fraud Office (OLAF);(l)adopt the financial rules applicable to the EU Centre;(m) take all decisions on the establishment of the EU Centre's internal structures and,
where necessary, their modification.
(n)

91

appoint a Data Protection Officer;

Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying
down the Staff Regulations of Officials and the Conditions of Employment of Other
Servants of the European Communities and instituting special measures temporarily
applicable to officials of the Commission (OJ L 56, 4.3.1968, p. 1)

9093/24
ANNEX

JAI.1

GR/ml

142

LIMITEEN(o)adopt internal guidelines further specifying the procedures for the processing of
information in accordance with Article 51, after consulting the European Data
Protection Supervisor;(p)authorise the conclusion of memoranda of understanding referred to in Article 53(3)and Article 54(2).

3.

With respect to the powers mentioned in paragraph 2 point (g) and (h), the Executive
Board shall adopt, in accordance with Article 110(2) of the Staff Regulations, a decision
based on Article 2(1) of the Staff Regulations and Article 6 of the Conditions of
Employment, delegating relevant appointing authority powers to the Executive Director.
The Executive Director shall be authorised to sub-delegate those powers.

4.

In exceptional circumstances, the Executive Board may by way of a decision temporarilysuspend the delegation of the appointing authority powers to the Executive Director andany sub-delegation by the latter and exercise them itself or delegate them to one of its
members or to a staff member other than the Executive Director.

5.

Where necessary because of urgency, the Executive Board may take certain provisional
decisions on behalf of the Management Board, in particular on administrative management
matters, including the suspension of the delegation of the appointing authority powers andbudgetary matters.
Article 63
Voting rules of the Executive Board

1.

The Executive Board shall take decisions by simple majority of its members. Each memberof the Executive Board shall have one vote. The Chairperson shall have a casting vote incase of a tie.

2.

The representatives of the Commission shall have a right to vote whenever matterspertaining to Article 62(2), points (a) to (l) and (p) are discussed and decided upon. For the
purposes of taking the decisions referred to in Article 62(2), points (f) and (g), therepresentatives of the Commission shall have one vote each. The decisions referred to in
Article 62(2), points (b) to (e), (h) to (l) and (p), may only be taken if the representatives of
the Commission casts a positive vote. For the purposes of taking the decisions referred toin Article 62(2), point (a), the consent of the representatives of the Commission shall only
be required on the elements of the decision not related to the annual and multi-annual
working programme of the EU Centre.
The Executive Board's rules of procedure shall establish more detailed voting
arrangements, in particular the circumstances in which a member may act on behalf ofanother member.

9093/24
ANNEX

JAI.1

GR/ml

143

LIMITEENPart 3: Executive Director
Article 64
Responsibilities of the Executive Director
1.

The Executive Director shall manage the EU Centre. The Executive Director shall be
accountable to the Management Board.

2.

The Executive Director shall report to the European Parliament on the performance of
his/her duties when invited to do so. The Council may invite the Executive Director toreport on the performance of his/her duties.

3.

The Executive Director shall be the legal representative of the EU Centre.

4.

The Executive Director shall be responsible for the implementation of the tasks assigned to
the EU Centre by this Regulation. In particular, the Executive Director shall be responsiblefor:9093/24
ANNEX(a)the day-to-day administration of the EU Centre;(b)

preparing decisions to be adopted by the Management Board;(c)implementing decisions adopted by the Management Board;(d)preparing the Single Programming Document and submitting it to the Executive
Management Board after consulting the Commission;(e)

implementing the Single Programming Document and reporting to the Executive
Management Board on its implementation;(f)preparing the Consolidated Annual Activity Report (CAAR) on the EU Centre’s
activities and presenting it to the Executive Management Board for assessment andadoption;(g)

preparing an action plan following-up conclusions of internal or external audit
reports and evaluations, as well as investigations by the European Anti-Fraud Office(OLAF) and by the European Public Prosecutor’s Office (EPPO) and reporting on
progress twice a year to the Commission and regularly to the Management Board andthe Executive Board;(h)protecting the financial interests of the Union by applying preventive measuresagainst fraud, corruption and any other illegal activities, without prejudicing theinvestigative competence of OLAF and EPPO by effective checks and, if
irregularities are detected, by recovering amounts wrongly paid and by reporting
any criminal conduct in respect of which the EPPO could exercise its
competence in accordance with Article 24 of Regulation (EU) 2017/1939., whereappropriate, by imposing effective, proportionate and dissuasive administrative,
including financial penalties;

JAI.1

GR/ml

144

LIMITEEN(i)preparing an anti-fraud strategy, an efficiency gains and synergies strategy, a strategy
for cooperation with third countries and/or international organisations and a strategy
for the organisational management and internal control systems for the EU Centre
and presenting them to the Executive Management Board for approval;(j)preparing draft financial rules applicable to the EU Centre;(k)preparing the EU Centre’s draft statement of estimates of revenue and expenditureand implementing its budget;(l)preparing and implementing an IT security strategy, ensuring appropriate risk
management for all IT infrastructure, systems and services, which are developed or
procured by the EU Centre as well as sufficient IT security funding.

(m) implementing the annual work programme of the EU Centre under the control of the
Executive Management Board;(n)drawing up a draft statement of estimates of the EU Centre’s revenue andexpenditure as part of the EU Centre’s Single Programming Document andimplementing the budget of the EU Centre pursuant to Article 67;(o)preparing a draft report describing all activities of the EU Centre with a section on
financial and administrative matters;(p)fostering recruitment of appropriately skilled and experienced EU Centre staff, while
ensuring gender balance.

5.

Where exceptional circumstances so require, the Executive Director may decide to locate
one or more staff in another Member State for the purpose of carrying out the EU Centre’stasks in an a more efficient, effective and coherent manner. Before deciding to establish a
local office, the Executive Director shall obtain the prior consent of the Commission, theManagement Board and the Member State concerned. The decision shall be based on an
appropriate cost-benefit analysis that demonstrates in particular the added value of suchdecision and specify the scope of the activities to be carried out at the local office in amanner that avoids unnecessary costs and duplication of administrative functions of the EU
Centre. A headquarters agreement with the Member State(s) concerned may be concluded.

6.

Without prejudice to the powers of the Commission and of the Management Boardand of the Executive Board, the Executive Director shall be independent in theperformance of the duties and shall neither seek nor take instructions from any
government nor from any other body.

9093/24
ANNEX

JAI.1

GR/ml

145

LIMITEEN

Article 65
Executive Director
1.

The Executive Director shall be engaged as a temporary agent of the EU Centre under
Article 2(a) of the Conditions of Employment of Other Servants.

2.

The Executive Director shall be appointed by the Executive Management Board, from alist of candidates proposed by the Commission, following an open and transparent
selection procedure.

3.

For the purpose of concluding the contract with the Executive Director, the EU Centre
shall be represented by the Chairperson of the Executive Management Board.

4.

The term of office of the Executive Director shall be five years. Six months before the endof the Executive Director’s term of office, the Commission Management Board, with thesupport of the Commission, shall complete an assessment that takes into account anevaluation of the Executive Director's performance and the EU Centre's future tasks andchallenges.

5.

The Executive Management Board, acting on a proposal from the Commission that takes
into account the assessment referred to in paragraph 3, may extend the term of office of the
Executive Director once, for no more than five years.

6.

An Executive Director whose term of office has been extended may not participate inanother selection procedure for the same post at the end of the overall period.

7.

The Executive Director may be dismissed only upon a decision of the Executive
Management Board acting on a proposal from the Commission.

8.

The Executive Management Board shall take decisions on appointment, extension of theterm of office or dismissal of the Executive Director by a majority of two-thirds of its
members with voting rights.

9093/24
ANNEX

JAI.1

GR/ml

146

LIMITEEN

Subsection 5: Technology Committee and Victims Board
Article 66
Establishment and tasks of the Technology Committee
1.

The Technology Committee shall consist of technical experts appointed by theManagement Board in view of their excellence, their independence, and particulararea of expertise, to ensure a conplete and varied set of skills and expertise theMember States, the Commission and Europol’s Innovation Hub Management Board inview of their excellence and their independence, following the publication of a call for
expressions of interest in the Official Journal of the European Union. Member States shall
may appoint nominate two up to four technical experts each, of which theManagement Board shall select a maximum of two per Member State while theCommission and Europol’s Innovation Hub shall appoint may nominate up to two
one technical experts each, from which the Management Board shall select one ofeach. The Management Board may appoint up to eleven additional experts beyond
those nominated by Member States, or appointed by the Commission and Europol.
These experts shall be selected in view of their excellence and they shall act in thegeneral interest, observing the principles of neutrality and transparency. Theseexperts nominated by Member States are not seconded national experts but experts
mandated by Member States to perform technical expertise missions on an ad hoc
basis upon request by the Management Board.
The experts of the Technology Committee shall act in the general interest, observing
the principles of neutrality and transparency.

1a.

The Technology Committee is shall be divided in sub-working groups specialised inassessing specific categories of technologies or types of technologies used to preventand combat for the support of the fight against online child sexual abuse. These Those
sub-working groups may call on external experts on an ad hoc basis to assist with thetasks defined in points c) and d) of paragraph 7.

2.

Procedures concerning the appointment of the members of the Technology Committee andits operation shall be specified in the rules of procedure of the Management Board andshall be made public.

3.

The members of the Committee shall be independent in carrying out their tasks asmembers of the Committee and shall act in the public interest. The list of members of theCommittee shall be made public and shall be updated by the EU Centre on its website.

9093/24
ANNEX

JAI.1

GR/ml

147

LIMITEEN

4.

When a member no longer meets the criteria of acting in the general interest, neutrality
or transparency in the framework of his/her mandate independence, he or she shallinform the Management Board. Alternatively, the Management Board may declare, on a
proposal of at least one third of its members or the member appointed by of theCommission, a lack of independence that the member is no longer acting in the generalinterest, or that he or she does not meet the neutrality or transparency criteria andrevoke the appointment of that member person concerned. The Management Board
Member States, the Commission and Europol’s Innovation Hub shall appoint a newmember In that case, a replacement shall be appointed for the remaining term of officeremainder of the mandate of the member concerned in accordance with the proceduredescribed in paragraph 1 for ordinary members.

5.

The mandates of members of the Technology Committee shall be four years. Thosemandates shall be renewable once.

6.

The Technology Committee shall(a)contribute to the EU Centre’s opinions referred to in Article 7(3), first subparagraph,point (d);(aa) contribute to the EU Centre’s activities related to the development, or
facilitation of the development, of technologies to detect online child sexual
abuse, in accordance with Article 50(1a);(ab) contribute to the EU Centre’s activities related to the advice provided to theCommission with a view of preparing implementing acts for the approval oftechnologies used to detect the dissemination of known or new child sexual
abuse material or the solicitation of children in accordance with Article 10 (2).

92

(b)

contribute to the EU Centre’s assistance to the Coordinating Authorities, theManagement Board, the Executive Board and the Executive Director, in respect ofmatters related to the use of technology;(c)provide internally an annual expertise on the technological tools made available
by the EU Centre, in the form of an annual guidance report containing theexperts' opinions and an assessment of the EDPB 92 upon request, expertise on
matters related to the use of technology for the purposes of prevention and detectionof child sexual abuse online;(d)provide internally expertise through after having involved the relevant a subworking group or groups, on an ad hoc basis and at the request of theManagement Board, acting by a qualified majority on a proposal from a
Member State.

PCY comment: moved to Article 83(3)(k) (new).

9093/24
ANNEX

JAI.1

GR/ml

148

LIMITEEN

Article 66a
Appointment and tasks of the Victims and Survivors Board
1.

The Victims and Survivors Board shall be comprised of adult victims and survivorsof child sexual abuse and recognised experts in providing assistance to victims who,
following a call for expressions of interest published in the Official Journal of theEuropean Union, will shall be appointed by the Management Board on the basis of
their personal experience, expertise and independence.

2.

The procedures governing the appointment of the members of the Victims andSurvivors Board, its functioning and the conditions governing the transmission of
information to the Victims and Survivors Board shall be laid down in theManagement Board’s Rrules of Pprocedure, and shall be published.

3.

The members of the Victims and Survivors Board shall be independent in carryingout their tasks as members thereof of the Board and shall act in the interest of
persons affected by victims of online child sexual abuse. The EU Centre shall publish
on its website and keep up to date maintain updated the list of the members of theVictims and Survivors Board.

4.

Members who cease to be independent shall inform the Management Board
accordingly. Otherwise In addition, the Management Board, at the proposal of atleast one third of its members or of the member appointed by the Commission, may
determine that they a given member lacks sufficient independence and revoke their
appointment. The Management Board shall appoint a replacement new members to
replace them for the remainder of mandate of the member concerned theirpredecessors’ term of office, following the same procedure as the one governing
ordinary members referred to in paragraph 1.

5.

The term of office mandate of members of the Victims and Survivors Board shall befour years. It may be renewed once by the Management Board.

6.

The Executive Director and the Management Board may consult the Victims andSurvivors Board in connection with all matters concerning persons affected by
victims of online child sexual abuse.

7.

The Victims and Survivors Board has the following tasks:9093/24
ANNEX(a)make the concerns of victims survivors visible heard and represent theirinterests in connection to the work of the EU Centre;(b)advise the Management Board in matters referred to in Article 57 (1)(fa),sentence 2;

JAI.1

GR/ml

149

LIMITEEN(c)advise the Executive Director and the Management Board as foreseen when
consulted in accordance with paragraph 6;(d)incorporate contribute their experience and expertise to the work of the EU
Centre as a knowledge hub as regards preventing and combating online childsexual abuse and, assisting and supporting victims; survivors(e)contribute own proposals for the work of the competent authorities;(f)contribute to the work of the EU Centre in connection to European networks ofvictims and survivors of child sexual abuse.
Section 6
Establishment and Structure of the Budget
Subsection 1
Single Programming Document
Article 67
Establishment of the budget Budget establishment and implementation

1.

Each year the Executive Director shall draw up a provisional draft statement of estimatesof the EU Centre’s revenue and expenditure for the following financial year,
corresponding to the calendar year, including an the establishment plan, and shall send
it to the Executive Management Board.

2.

The provisional draft estimate shall be based on the objectives and expected results of
the annual programming document, and shall take into account the financial
resources necessary to achieve those objectives and expected results, in accordancewith the principle of performance-based budgeting.

23.

The Executive Management Board shall, on the basis of the provisional draft statement of
estimates, adopt a provisional draft estimate of the EU Centre’s revenue and expenditure
for the following financial year and shall send it to the Commission by 31 January each
year.

4.

The Commission shall send the draft estimate to the budgetary authority together
with the draft general budget of the Union. The draft estimate shall also be madeavailable to the EU Centre.

5.

On the basis of the draft estimate, the Commission shall enter in the draft generalbudget of the Union the estimates that it considers necessary for the establishment
plan and the amount of the contribution to be charged to the general budget, which it
shall place before the budgetary authority in accordance with Articles 313 and 314
TFEU.

9093/24
ANNEX

JAI.1

GR/ml

150

LIMITEEN6.

The budgetary authority shall authorise the appropriations for the contribution fromthe general budget of the Union to the EU Centre.

7.

The budgetary authority shall adopt the EU Centre's establishment plan.

8.

The Management Board shall adopt the EU Centre's budget. It shall become final
following the final adoption of the general budget of the Union and, if necessary, it
shall be adjusted accordingly.

9.

For any building project likely to have significant implications for the budget of the
EU Centre, Delegated Regulation (EU) 2019/715 shall apply.

3.

The Executive Management Board shall send the final draft estimate of the EU Centre’s
revenue and expenditure, which shall include a draft establishment plan, to the European
Parliament, the Council and the Commission by 31 March each year.

4.

The Commission shall send the statement of estimates to the European Parliament and theCouncil, together with the draft general budget of the Union.

5.

On the basis of the statement of estimates, the Commission shall enter in the draft generalbudget of the Union the estimates that it considers necessary for the establishment plan andthe amount of the contribution to be charged to the general budget, which it shall place
before the European Parliament and the Council in accordance with Articles 313 and 314
of the Treaty on the Functioning of the European Union.

6.

The European Parliament and the Council shall authorise the appropriations for thecontribution from the Union to the EU Centre.

7.

The European Parliament and the Council shall adopt the EU Centre’s establishment plan.

8.

The EU Centre’s budget shall be adopted by the Executive Management Board. It shallbecome final following the final adoption of the general budget of the Union. Where
necessary, it shall be adjusted accordingly.

9.

The Executive Director shall implement the EU Centre’s budget.

10.

Each year the Executive Director shall send to the European Parliament and the Council all
information relevant to the findings of any evaluation procedures.

9093/24
ANNEX

JAI.1

GR/ml

151

LIMITEEN

Subsection 2
Presentation, implementation and control of the budget of the EU Centre
Article 68 69
Structure of the Bbudget
1.

Estimates of all revenue and expenditure for of the EU Centre shall be prepared eachfinancial year, which shall correspond to the calendar year, and shall be shown in the EU
Centre’s budget, which shall be balanced in terms of revenue and of expenditure. and shallbe shown in the EU Centre’s budget. The financial year shall correspond to thecalendar year.

2.

The EU Centre’s budget shall be balanced in terms of revenue and of expenditure.

3.

Without prejudice to other resources, the EU Centre’s revenue shall comprise:(a)a contribution from the Union entered in the general budget of the Union;(b)

any voluntary financial contribution from the Member States;(c)

any contribution from third countries participating in the work of the EU
Centre, as provided for in Article 54a;(d)possible Union funding in the form of delegation agreements or ad hoc grants inaccordance with the EU Centre’s financial rules referred to in Article 70 andwith the provisions of the relevant instruments supporting the policies of theUnion;(e)charges for publications and any service provided by the EU Centre.

4.

The expenditure of the EU Centre shall include staff remuneration, administrativeand infrastructure expenses, and operational expenditure.

2.

Without prejudice to other resources, the EU Centre’s revenue shall comprise acontribution from the Union entered in the general budget of the Union, .

3.

The EU Centre may benefit from Union funding in the form of delegation agreements or
ad hoc grants in accordance with its financial rules referred to in Article 68 and with theprovisions of the relevant instruments supporting the policies of the Union.

4.

The EU Centre’s expenditure shall include staff remuneration, administrative andinfrastructure expenses, and operating costs.

5.

Budgetary commitments for actions relating to large-scale projects extending over morethan one financial year may be broken down into several annual instalments.

9093/24
ANNEX

JAI.1

GR/ml

152

LIMITEEN

Article 69 70
Presentation of accounts and discharge
1.

The EU Centre’s accounting officer shall send the provisional accounts for the financial
year (year N) to the Commission's accounting officer and to the Court of Auditors by 1
March of the following financial year (year N + 1).

1a.

The EU Centre’s accounting officer shall also provide the required accounting
information for consolidation purposes to the Commission’s accounting officer, in themanner and format required by the latter by 1 March of year N + 1.

2.

The EU Centre shall send a the report on the budgetary and financial management for year
N to the European Parliament, the Council, the Commission and the Court of Auditors by
31 March of year N + 1.

3.

The Commission's accounting officer shall send the EU Centre’s provisional accounts foryear N, consolidated with the Commission's accounts, to the Court of Auditors by 31
March of year N + 1. On receipt of the Court of Auditor’s observations on the EU
Centre’s provisional accounts for year N, the EU Centre’s accounting officer shalldraw up the EU Centre’s final accounts under his or her own responsibility. The
Executive Director shall submit them to the Management Board for an opinion.

4.

The Management Board shall deliver an opinion on the EU Centre’s final accounts for yearN.

5.

The EU Centre’s accounting officer shall, by 1 July of year N + 1, send the final accounts
for year N to the European Parliament, the Council, the Commission, and the Court of
Auditors and national parliaments, together with the Management Board's opinion.

6.

A link to the pages of the website containing Tthe final accounts of the EU Centre foryear N shall be published in the Official Journal of the European Union by 15 Novemberof year N + 1.

7.

The Executive Director shall send to the Court of Auditors, by 30 September of year N + 1,
a reply to the observations made in its annual report. He or she The Executive Director
shall also send the this reply to the Management Board and to the Commission.

8.

The Executive Director shall submit to the European Parliament, at the latter's request, any
information required for the smooth application of the discharge procedure for year N, in
accordance with Article 261(3) of Regulation (EU, Euratom) 2018/1046 of theEuropean Parliament and of the Council.

9.

On a recommendation from the Council acting by a qualified majority, the European
Parliament shall, before 15 May of year N + 2, grant give a discharge to the Executive
Director in respect of the implementation of the budget for year N.

9093/24
ANNEX

JAI.1

GR/ml

153

LIMITEEN

Article 70 68
Financial rules
The financial rules applicable to the EU Centre shall be adopted by the Executive Management
Board after consultation with the Commission. They shall not depart from Delegated Regulation(EU) 2019/71593 unless such a departure is specifically required for the operation of the EU Centre
and the Commission has given its prior consent.
The EU Centre shall establish and implement its budget in line with its financial rules and the
Financial Regulation (EU) 2018/1046.
Section 7
Staff
Article 71
General provisions
1.

The Staff Regulations and the Conditions of Employment of Other Servants and the rules
adopted by agreement between the institutions of the Union for giving effect thereto shallapply to the EU Centre for all matters not covered by this Regulation.

2.

The Executive Management Board, in agreement with the Commission, shall adopt thenecessary implementing measures, in accordance with the arrangements provided for in
Article 110 of the Staff Regulations.

3.

The EU Centre staff, in particular those working in areas related to detection, reporting andremoval of online child sexual abuse, shall have access to appropriate counselling andsupport services.
Article 72
Seconded national experts and other staff

1.

The EU Centre may make use of seconded national experts or other staff not employed byit.

2.

The Executive Management Board shall adopt rules related to staff from Member States,
including the contact officers referred to in Article 52, to be seconded to the EU Centre andupdate them as necessary. Those rules shall include, in particular, the financial
arrangements related to those secondments, including insurance and training. Those rules
shall take into account the fact that the staff is seconded and to be deployed as staff of the
EU Centre. They shall include provisions on the conditions of deployment. Where
relevant, the Executive Management Board shall aim to ensure consistency with the rules
applicable to reimbursement of the mission expenses of the statutory staff.

93

OJ L 122, 10.5.2019, p. 1.

9093/24
ANNEX

JAI.1

GR/ml

154

LIMITEEN

Article 73
Privileges and immunities
Protocol No 7 on the Privileges and Immunities of the European Union annexed to the Treaty on the
Functioning of the European Union shall apply to the EU Centre and its staff.
Privileges and immunities of contact officers and members of their families shall be subject to anagreement between the Member State where the seat of the EU Centre is located and the otherMember States. That agreement shall provide for such privileges and immunities as are necessary
for the proper performance of the tasks of contact officers.
Article 74
Obligation of professional secrecy
1.

Members of the Management Board and the Executive Board, and all members of the staffof the EU Centre, including officials seconded by Member States on a temporary basis, andall other persons carrying out tasks for the EU Centre on a contractual basis, shall be
subject to the requirements of professional secrecy pursuant to Article 339 of the Treaty on
the Functioning of the European Union even after their duties have ceased.

2.

The Executive Management Board shall ensure that individuals who provide any service,directly or indirectly, permanently or occasionally, relating to the tasks of the EU Centre,
including officials and other persons authorised by the Executive Management Board or
appointed by the coordinating authorities for that purpose, are subject to requirements ofprofessional secrecy equivalent to those in paragraph 1.

3.

The EU Centre shall establish practical arrangements for implementing the confidentiality
rules referred to in paragraphs 1 and 2.

4.

The EU Centre shall apply Commission Decision (EU, Euratom) 2015/44494.
Article 75
Security rules on the protection of classified and sensitive non-classified information

1.

94
95

The EU Centre shall adopt its own security rules equivalent to the Commission’s security
rules for protecting European Union Classified Information (EUCI) and sensitive nonclassified information, as set out in Commission Decisions (EU, Euratom) 2015/44395 and(EU, Euratom) 2015/444. The security rules of the EU Centre shall cover, inter alia,
provisions for the exchange, processing and storage of such information. The Executive
Management Board shall adopt the EU Centre’s security rules following approval by theCommission.

Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules forprotecting EU classified information (OJ L 72, 17.3.2015, p. 53).
Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in theCommission (OJ L 72, 17.3.2015, p. 41).

9093/24
ANNEX

JAI.1

GR/ml

155

LIMITEEN

2.

Any administrative arrangement on the exchange of classified information with therelevant authorities of a third country or, in the absence of such arrangement, any
exceptional ad-hoc release of EUCI to those authorities, shall be subject to theCommission’s prior approval.
Section 8
General provisions
Article 76
Language arrangements

The provisions laid down in Regulation No 196 shall apply to the EU Centre. The translation
services required for the functioning of the EU Centre shall be provided by the Translation Centre
for the bodies of the European Union.
Article 77
Transparency and communication
1.

Regulation (EC) No 1049/200197 shall apply to documents held by the EU Centre. The
Management Board shall, within six months of the date of its first meeting, adopt thedetailed rules for applying that Regulation.

2.

The processing of personal data by the EU Centre shall be subject to Regulation (EU)2018/1725. The Management Board shall, within six months of the date of its firstmeeting, establish measures for the application of that Regulation by the EU Centre,
including those concerning the appointment of a Data Protection Officer of the EU Centre.
Those measures shall be established after consultation of the European Data Protection
Supervisor.

3.

The EU Centre may engage in communication activities on its own initiative within its
field of competence. Communication activities shall be carried out in accordance with
relevant communication and dissemination plans adopted by the Management Board.

96

Regulation No 1 determining the languages to be used by the European Economic
Community (OJ 17, 6.10.1958, p. 385/58).
Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May
2001 regarding public access to European Parliament, Council and Commission documents,
Official Journal L 145, 31/05/2001 P. 0043 – 0048.

979093/24
ANNEX

JAI.1

GR/ml

156

LIMITEEN

Article 78
Anti-fraud measures
1.

In order to combat fraud, corruption and other unlawful activities, Regulation (EU,
Euratom) No 883/201398 shall apply.

2.

The EU Centre shall accede to the Interinstitutional Agreement of 25 May 1999 between
the European Parliament, the Council of the European Union and the Commission of theEuropean Communities concerning internal investigations by OLAF within six months
from [date of start of operations as set out in Article 82] and shall adopt the appropriate
provisions applicable to its staff using the template set out in the Annex to that Agreement.

3.

The European Court of Auditors shall have the power of audit, on the basis of documents
and on the spot, over all grant beneficiaries, contractors and subcontractors who havereceived Union funds from the EU Centre.

4.

OLAF may, within the scope of its mandate, carry out investigations, including which
may also include on-the-spot checks and inspections with a view to establishing whether
there has been fraud, corruption or any other illegal activity affecting the financial interestsof the Union in connection with a grant or a contract funded by the EU Centre, in
accordance with the provisions and procedures laid down in Regulation (EU, Euratom) No
883/2013 and Council Regulation (Euratom, EC) No 2185/9699.

5.

Without prejudice to paragraphs 1, 2, 3, and 4, cooperation agreements with third countries
and international organisations, contracts, grant agreements and grant decisions of the EU
Centre shall contain provisions expressly empowering the European Court of Auditors and
OLAF to conduct such audits and investigations, in accordance with their respective
competences.

98

Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of
11 September 2013 concerning investigations conducted by the European Anti-Fraud Office(OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of
the Council and Council Regulation (Euratom) No 1074/1999. (OJ L 248, 18.9.2013, p. 1).
Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-thespot checks and inspections carried out by the Commission in order to protect the European
Communities' financial interests against fraud and other irregularities. (OJ L 292,
15.11.1996, p. 2).

999093/24
ANNEX

JAI.1

GR/ml

157

LIMITEEN

Article 79
Liability
1.

The EU Centre's contractual liability shall be governed by the law applicable to thecontract in question.

2.

The Court of Justice of the European Union shall have jurisdiction to give judgment
pursuant to any arbitration clause contained in a contract concluded by the EU Centre.

3.

In the case of non-contractual liability, the EU Centre shall, in accordance with the generalprinciples common to the laws of the Member States, make good any damage caused by its
departments or by its staff in the performance of their duties.

4.

The Court of Justice of the European Union shall have jurisdiction in disputes overcompensation for damages referred to in paragraph 3.

5.

The personal liability of its staff towards the Centre shall be governed by the provisions
laid down in the Staff Regulations or Conditions of Employment applicable to them.
Article 80
Administrative inquiries

The activities of the EU Centre shall be subject to the inquiries of the European Ombudsman inaccordance with Article 228 of the Treaty on the Functioning of the European Union.
Article 81
Headquarters Agreement and operating conditions
1.

The necessary arrangements concerning the accommodation to be provided for the EU
Centre in the Member State where the seat of the EU Centre is located and the facilities tobe made available by that Member State, together with the specific rules applicable in that
Member State to the Executive Director, members of the Executive Board, EU Centre staff
and members of their families shall be laid down in a Headquarters Agreement between the
EU Centre and the Member State where the seat of the EU Centre is located, concluded
after obtaining the approval of the Executive Management Board and no later than
[2 years after the entry into force of this Regulation].

2.

The Member State where the seat of the EU Centre is located shall provide the best
possible conditions to ensure the smooth and efficient functioning of the EU Centre,
including multilingual, European-oriented schooling and appropriate transport connections.

9093/24
ANNEX

JAI.1

GR/ml

158

LIMITEEN

Article 82
Start of the EU Centre's activities
1.

9093/24
ANNEX

The Commission shall be responsible for the establishment and initial operation of the EU
Centre until the Executive Director has taken up his or her duties following his or her
appointment by the Executive Management Board in accordance with Article 65(2). For
that purpose:(a)the Commission may designate a Commission official to act as interim Executive
Director and exercise the duties assigned to the Executive Director;(b)by derogation from Article 62(2)(g) and until the adoption of a decision as referred toin Article 62(4), the interim Executive Director shall exercise the appointing
authority power;(c)the Commission may offer assistance to the EU Centre, in particular by seconding
Commission officials and national experts seconded to the Commission to carryout the activities of the EU Centre under the responsibility of the interim Executive
Director or the Executive Director;(d)the interim Executive Director may authorise all payments covered by appropriations
entered in the EU Centre's budget after approval by the Executive Management
Board and may conclude contracts, including staff contracts, following the adoptionof the EU Centre's establishment plan.

JAI.1

GR/ml

159

LIMITEENCHAPTER VDATA COLLECTION AND TRANSPARENCY REPORTING
Article 83
Data collection
1.

Providers of relevant information society services that were subject to orders issued
under Articles 7, 14, 14a, 16 and 18a Providers of hosting services, providers ofinterpersonal communications services, providers of internet access services shall collectdata on the following topics and make that information available to the EU Centre uponrequest:(a)9093/24
ANNEX

where the provider has been subject to a detection order issued in accordance with
Article 7:–

the measures taken to comply with the order, including the technologies used
for that purpos e and the safeguards provided;–

the error rates of the technologies deployed to detect online child sexual abuse
and measures taken to prevent or remedy any errors;–

in relation to complaints and cases submitted by users in connection to themeasures taken to comply with the order, the number of complaints submitted
directly to the provider, the number of cases brought before a judicial authority,
the basis for those complaints and cases, the decisions taken in respect of thosecomplaints and in those cases, the average time needed for taking thosedecisions and the number of instances where those decisions were subsequently
reversed;(b)

the number of removal orders and cross-border removal orders issued to theprovider in accordance with Articles 14, indicating the number of those ordersthat were subject to the procedure for cross-border removal orders referred toin Article 14a. and 14a the average time needed for removing or disabling access tothe item or items of child sexual abuse material in question;(c)the total number of items of child sexual abuse material that the provider removed or
to which it disabled access, broken down by whether the items were removed oraccess thereto was disabled pursuant to a removal order, cross-border removal
order or to a notice submitted by a Competent Authority, the EU Centre or a third
party or at the provider’s own initiative;(d)the number of blocking orders issued to the provider in accordance with Article 16;

JAI.1

GR/ml

160

LIMITEEN

(da) the number of delisting orders issued to the provider in accordance with Article
18a, indicating the number of those orders that were subject to the procedure
for cross-border delisting orders referred to in Article 18aa;(e)2.

Relying to the extent possible on information collected in an automated manner bymeans of the secure information sharing system or systems referred to in Article
39(2a), as well as on any similar system that might be used for the exchange of
information at national level, the Coordinating Authorities shall collect data on thefollowing topics and make that information available to the EU Centre upon request:(a)9093/24
ANNEX

the number of instances in which the provider invoked Article 8(3), Article 14(5) or(6), or Article 17(4a) or (5) or Article 18b(4) or (5), together with the reasons
grounds therefore;

the follow-up given to reports of potential online child sexual abuse that the EU
Centre forwarded in accordance with Article 48(3), specifying for each report:–

whether the report led to the launch of a criminal investigation or contributed
to an ongoing investigation, led to taking any other action led to no action;–

where the report led to the launch of a criminal investigation or contributed toan ongoing investigation, the state of play or outcome of the investigation; ,including whether the case was closed at pre-trial stage, whether the case led tothe imposition of penalties,–

whether victims were identified and rescued and if so their numbers
differentiating by gender and age, and whether any suspects were arrested
and any perpetrators were convicted and if so their numbers;–

where the report led to any other action, the type of action, the state of play oroutcome of that action and the reasons for taking it;–

where no action was taken, the reasons for not taking any action;(b)

the most important and recurrent risks of online child sexual abuse, as reported byproviders of hosting services and providers of interpersonal communications services
in accordance with Article 5 3 or identified through other information available to the
Coordinating Authority;(c)a list of the providers of hosting services and providers of interpersonalcommunications services to which the Coordinating Authority addressed a detection
order in accordance with Article 7;(d)the number of detection orders issued in accordance with Article 7, broken down by
provider and by type of online child sexual abuse, and the number of instances inwhich the provider invoked Article 8(3);

JAI.1

GR/ml

161

LIMITEEN

(e)a list of providers of hosting services to which the Coordinating Authority issued aremoval order or cross-border removal order were was issued in accordance with
Articles 14 and 14a;(f)

the number of removal orders issued in accordance with Article 14, broken down by
provider, the time needed to remove or disable access to the item or items of childsexual abuse material concerned, and the number of instances in which the provider
invoked Article 14(5) and (6);(g)

the number of blocking orders issued in accordance with Article 16, broken down by
provider, and the number of instances in which the provider invoked Article 17(4a)or (5);(h)a list of relevant information society services to which the Coordinating
Authority addressed a decision taken pursuant to Articles 27, 28 or 29, the typeof decision taken, and the reasons for taking it;(i)

the instances in which the opinion of the EU Centre pursuant to Article 7(4)(d)substantially deviated from the opinion of the Coordinating Authority, specifying thepoints at which it deviated and the main reasons for the deviation;.

(ha) the number of complaints received in accordance with Article 34 broken downby what the alleged infringement of this Regulation was concerned with andwho submitted the complaint.
3.

9093/24
ANNEX

The EU Centre shall collect data and generate statistics on the detection, reporting,removal of or disabling of access to, blocking and delisting of online child sexual abuse
under this Regulation. The data shall be constitute in particular on the following topics.
(a)the number of indicators in the databases of indicators referred to in Article 44 andthe development of that number as compared to previous years;(b)the number of submissions of child sexual abuse material and solicitation of childrenreferred to in Article 36(1), broken down by Member State that designated thesubmitting Coordinating Authorities, and, in the case of child sexual abuse material,
the number of indicators generated on the basis thereof and the number of uniform
resource locators included in the list of uniform resource locators in accordance with
Article 44(3);(c)

the total number of reports submitted to the EU Centre in accordance with Article 12,
broken down by provider of hosting services and provider of interpersonalcommunications services that submitted the report and by Member State thecompetent authority of which the EU Centre forwarded the reports to in accordancewith Article 48(3);

JAI.1

GR/ml

162

LIMITEEN(d)the online child sexual abuse to which the reports relate, including the number of
items of potential known and new child sexual abuse material and instances ofpotential solicitation of children included in the reports the Member State thecompetent authority of which the EU Centre forwarded the reports to in accordancewith Article 48(3), and type of relevant information society service that the reporting
provider offers;(e)the number of reports that the EU Centre considered manifestly unfounded, as
referred to in Article 48(2);(f)

the number of reports relating to potential new child sexual abuse material andsolicitation of children that were assessed as not constituting child sexual abusematerial of which the EU Centre was informed pursuant to Article 36(3), broken
down by Member State;(g)

the results of the searches in accordance with Article 49(1), including the number ofimages, videos and URLs by Member State where the material is hosted;(h)where the same item of potential child sexual abuse material was reported more thanonce to the EU Centre in accordance with Article 12 or detected more than once
through the searches in accordance with Article 49(1), the number of times that that
item was reported or detected in that manner.

(i)the number of notices and number of providers of hosting services notified by the EU
Centre pursuant to Article 49(2);(j)

number of victims of online child sexual abuse assisted by the EU Centre pursuant to
Article 21(2), and the number of these victims that requested to receive suchassistance in a manner accessible to them due to disabilities;(k)a report describing and analysing the relevant technologies, including the
published opinions of the European Data Protection Board pursuant to Article
50(1) on the technologies made available by the EU Centre.

4.

Providers of relevant information society services that were subject to orders issued
under Articles 7, 14, 14a, 16 and 18a The providers of hosting services, providers ofinterpersonal communications services and providers of internet access services, theCoordinating Authorities [or other competent authorities] and the EU Centre shallensure that the data referred to in paragraphs 1, 2 and 3, respectively, is stored no longer
than is necessary for for the transparency reporting referred to in Article 84. The datastored referred to in paragraphs 1 to 3 shall not contain any personal data.

5.

They shall ensure that the data is stored in a secure manner and that the storage is subject
to appropriate technical and organisational safeguards. Those safeguards shall ensure, inparticular, that the data can be accessed and processed only for the purpose for which it isstored, that a high level of security is achieved and that the information is deleted when nolonger necessary for that purpose. They shall regularly review those safeguards and adjust
them where necessary.

9093/24
ANNEX

JAI.1

GR/ml

163

LIMITEEN56.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 in order to supplement this Regulation with the necessary detailed rules
concerning the process of data collection and categorisation of the data to be collectedpursuant to paragraphs 1 to 4 for the purposes of follow up of the reports and theapplication of the Regulation.
Article 84
Transparency reporting1.

Each provider of relevant information society services that were was subject to orders
issued under Articles 7, 14, 14a, 16 and 18a during the relevant calendar year shalldraw up an annual report on its activities under this Regulation. That report shall compile
the information referred to in Article 83(1).
The providers shall, by 31 January of every year subsequent to the year to which the report
relates, make the report available to the public and communicate it to the Coordinating
Authority of establishment, the Commission and the EU Centre.

2.

Each Coordinating Authority shall draw up an annual report on its activities under thisRegulation. That report shall compile the information referred to in Article 83(2). It shall,by 31 March of every year subsequent to the year to which the report relates, make thereport available to the public and communicate it to the Commission and the EU Centre.

3.

Where a Member State has designated several competent authorities pursuant to Article 25,
it shall ensure that the Coordinating Authority draws up a single report covering theactivities of all competent authorities under this Regulation and that the Coordinating
Authority receives all relevant information and support needed to that effect from the othercompetent authorities concerned.

4.

The EU Centre, working in close cooperation with the Coordinating Authorities, shall draw
up an annual report on its activities under this Regulation. That report shall also compile
and analyse the information contained in the reports referred to in paragraphs 2 and Article
83(3). The EU Centre shall, by 30 June of every year subsequent to the year to which thereport relates, make the report available to the public and communicate it to theCommission.

5.

The annual transparency reports referred to in paragraphs 1, 2 and 3 shall not include any
information that may prejudice ongoing activities for the assistance to victims or theprevention, detection, investigation or prosecution of child sexual abuse offences. They
shall also not contain any personal data.

6.

The Commission shall be empowered to adopt delegated acts in accordance with Article 86
in order to supplement this Regulation with the necessary templates and detailed rules
concerning the form, precise content and other details of the reports and the reporting
process pursuant to paragraphs 1, 2 and 3.

9093/24
ANNEX

JAI.1

GR/ml

164

LIMITEENCHAPTER VI
FINAL PROVISIONS
Article 85
Evaluation
1.

By [five years after the entry into force of this Regulation], and every five years thereafter,
the Commission shall evaluate this Regulation and submit a report on its application to theEuropean Parliament and the Council.
In this report, the Commission shall consider, in particular:2.

9093/24
ANNEX(a)the effectiveness of this Regulation in achieving its objective to prevent andcombat in a targeted, carefully balanced and proportionate manner the use of
relevant information society services for online child sexual abuse in the internalmarket;(b)

the impact of the application of this Regulation on fundamental rights, notably:i.

children’s rights to physical and mental integrity, the prohibition of
torture and inhuman and degrading treatment, their right to respect for
private and family life and their right to protection of personal data, andtheir right to such protection and care as is necessary for their well-being,laid down in Articles 3, 4, 7, 8 and 24 of the Charter respectively;ii.

users’ rights to respect for private and family life, to protection of
personal data, and the freedom of expression and information, laid downin Articles 7, 8 and 11 of the Charter respectively; andiii.

providers of relevant information society services’ freedom to conduct abusiness, laid down in Article 16 of the Charter;By [five years after the entry into force of this Regulation], and every five years thereafter,
the Commission shall ensure that an evaluation in accordance with Commission guidelinesof the EU Centre’s performance in relation to its objectives, mandate, tasks andgovernance and location is carried out. The evaluation shall, in particular, address thepossible need to modify the tasks of the EU Centre, and the financial implications of any
such modification.

JAI.1

GR/ml

165

LIMITEEN

3.

On the occasion of every second evaluation referred to in paragraph 2, the results achievedby the EU Centre shall be assessed by the Commission, having regard to it’s the EU
Centre’s objectives and tasks, including an assessment of whether the continuation of the
EU Centre is still justified with regard to those objectives and tasks.

4.

The Commission shall report to the European Parliament and the Council the findings ofthe evaluation referred to in paragraph 3. The findings of the evaluation shall be madepublic.

5.

For the purpose of carrying out the evaluations referred to in paragraphs 1, 2 and 3, theCoordinating Authorities and Member States and the EU Centre shall provide information
to the Commission at its request.

6.

In carrying out the evaluations referred to in paragraphs 1, 2 and 3, the Commission shalltake into account the relevant evidence at its disposal.

7.

Where appropriate, the reports referred to in paragraphs 1 and 4 shall be accompanied bylegislative proposals.
Article 86
Exercise of the delegation

1.

The power to adopt delegated acts is conferred on the Commission subject to theconditions laid down in this Article.

2.

The power to adopt delegated acts referred to in Articles 3, 4, 5, 5b, 8, 13, 14, 17, 18b, 47,
47a, 83 and 84 shall be conferred on the Commission for an indeterminate period of timefrom [date of adoption of the Regulation].

3.

The delegation of power referred to in Articles 3, 4, 5, 5b, 8, 13, 14, 17, 18b, 47, 47a, 83
and 84 may be revoked at any time by the European Parliament or by the Council. A
decision to revoke shall put an end to the delegation of the power specified in that decision.
It shall take effect the day after the publication of the decision in the Official Journal of theEuropean Union or at a later date specified therein. It shall not affect the validity of any
delegated acts already in force.

4.

Before adopting a delegated act, the Commission shall consult experts designated by each
Member State in accordance with the principles laid down in the Inter-institutional
Agreement of 13 April 2016 on Better Law-Making.

5.

As soon as it adopts a delegated act, the Commission shall notify it simultaneously to theEuropean Parliament and to the Council.

9093/24
ANNEX

JAI.1

GR/ml

166

LIMITEEN6.

A delegated act adopted pursuant to Articles 3, 4, 5, 5b, 8, 13, 14, 17, 18b, 47, 47a, 83 and84 shall enter into force only if no objection has been expressed either by the European
Parliament or the Council within a period of two months of notification of that act to theEuropean Parliament and the Council or if, before the expiry of that period, the European
Parliament and the Council have both informed the Commission that they will not object.
That period shall be extended by two months at the initiative of the European Parliament orof the Council.
Article 87
Committee procedure1.

For the purposes of the adoption of the implementing acts referred to in Articles 10(2) and39(4), the Commission shall be assisted by a committee. That committee shall be acommittee within the meaning of Regulation (EU) No 182/2011.

1a.

With regard to the implementing acts referred to in Article 10(2), Article 5 ofRegulation (EU) No 182/2011 shall apply. Where the committee delivers no opinion,
the Commission shall not adopt the draft implementing act and Article 5(4), the third
subparagraph, of Regulation (EU) No 182/2011 shall apply.

2.

Where reference is made to this paragraph With regard to the implementing acts
referred to in Article 39(4), Article 4 of Regulation (EU) No 182/2011 shall apply.

Article 88100
Amendment and repeal of Regulation (EU) 2021/1232
1.

100

In Article 10 of Regulation (EU) 2021/1232, the second subparagraph is deleted.

PCY comment: The vast majority of delegations are in favour of ensuring that there is nointerruption of the detection of child sexual abuse online by the providers due to the legal
obstacles that would emerge if the Temporary Regulation expired before a new legal
framework is ready to replace it.
The proposed edits in Articles 88 and 89 aim to ensure that there is sufficient time to prepare
the implementation of this Regulation before the Temporary Regulation expires.
Specifically, they aim to ensure that there is sufficient time for the providers to conduct therisk assessment thoroughly and, if needed, receive a detection order, before the Temporary
Regulation expires.
The edits take into account the fact that some obligations will take longer to implement thanothers. In particular, the provisions concerning the set-up of the EU Centre and notably thecreation of the databases of indicators and the setup of the necessary IT systems, as well as
the process to evaluate the necessity and proportionality of the detection orders, are likely totake longer than the other provisions of the Regulation.
The approach resulting from the proposed edits requires that the present proposal is adopted
and published in the Official Journal of the EU before the current expiry date of the
Temporary Regulation, i.e. 3 April 2026.

9093/24
ANNEX

JAI.1

GR/ml

167

LIMITEEN

2.

Regulation (EU) 2021/1232 is repealed from [date of application 54 months after entry
into force of this Regulation].
Article 89
Entry into force and application

This Regulation shall enter into force on the twentieth day following that of its publication in the
Official Journal of the European Union.
It shall apply from 6 18 [24 months after its entry into force of this Regulation]. However:-

Article 88(1) shall apply from [date of entry into force of this Regulation];-

Articles 7 to 13a, Articles 20 to 2122a, Article 25(7)(d), Articles 43(2) and, (3) and6(ba), Articles 44 to 50, and Articles 83(3) and 84(4) shall apply from [date 48 months
after entry into force of this Regulation];

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels,
For the European Parliament

For the Council

The President

The President

9093/24
ANNEX

JAI.1

GR/ml

168

LIMITEEN

ANNEX ITEMPLATE FOR DETECTION ORDERS
referred to in Article 8(1) of Regulation (EU) .../… [laying down rules to prevent and combat
child sexual abuse]
DETECTION ORDER ISSUED IN ACCORDANCE WITH REGULATION (EU) …/…
LAYING DOWN RULES TO PREVENT AND COMBAT CHILD SEXUAL ABUSE (‘THE
REGULATION’)SECTION 1: Authorities having requested and issued the detection order:
Name of the Coordinating Authority having requested the issuance of the detection order:(Text)Name of the competent judicial authority or the independent administrative authority having
issued or having authorised the issuing by the Coordinating Authority of the detection order:(Text)
Reference of the detection order:(Text)SECTION 2: Addressee of the detection order
Name of the provider and, where applicable, of its legal representative:(Text)
Contact point of the provider:(Text)

9093/24
ANNEX

JAI.1

GR/ml

169

LIMITEEN

SECTION 3: Relevant service, targeting and specification
The detection order applies to the following service provided by the provider in the Union:(Text)
Further information regarding the targeting and specification of the detection order, in accordancewith Article 7(7) of the Regulation:(Text)SECTION 4: Measures to execute the detection order, including additional safeguards
In accordance with Article 8(1) of the Regulation, the provider is to take the measures specified in
Article 10 of the Regulation to execute the detection order including the safeguards specified
therein.
The provider is to take those measures to detect the following:☐☐☐

The dissemination of known child sexual abuse material as defined in Article 2, letter (m),of the Regulation
The dissemination of new child sexual abuse material as defined in Article 2, letter (n), of
the Regulation
The solicitation of children as defined in Article 2, letter (o), of the Regulation

Where the detection order concerns the solicitation of children, in accordance with Article 7(7),last subparagraph, of the Regulation, the detection order applies only to publicly available
interpersonal communications where one of the users is a child user, as defined in Article 2, point(i), of the Regulation.
The provider is to execute the detection order using the following indicators made available by the
EU Centre on Child Sexual Abuse (‘the EU Centre’), in accordance with Article 37 of theRegulation.
☐☐☐

The indicators contained in the database referred to in Article 44(1), point (a), of theRegulation
The indicators contained in the database referred to in Article 44(1), point (b), of theRegulation
The indicators contained in the database referred to in Article 44(1), point (c), of theRegulation

In order to obtain access to the relevant indicators, the provider is to contact the EU Centre at thefollowing address:(Contact information and contact point of EU Centre)

9093/24
ANNEX

JAI.1

GR/ml

170

LIMITEEN

Where applicable, information regarding the additional safeguards that the provider is to put inplace, in accordance with Article 7(8) of the Regulation:(Text)
Where relevant, additional information regarding the measures that the provider is to take to
execute the detection order:(Text)SECTION 5: Reasons, period of application and reporting
The reasons for issuing the removal detection order are as follows:(Sufficiently detailed statement of reasons for issuing the detection order)
The detection order applies from …….. (date) to ……. (date).
The following reporting requirements apply, in accordance with Article 9(3) of the Regulation:(Text)SECTION 6: Contact details for follow-up
Contact details of the Coordinating Authority having requested the issuance of the detection orderfor feedback on the execution of the detection order or further clarification, including thecommunications referred to in Article 8(3) of the Regulation:(Text)

9093/24
ANNEX

JAI.1

GR/ml

171

LIMITEEN

SECTION 7: Information about redress
Competent court before which the detection order can be challenged, in accordance with Article
9(1) of the Regulation:(Text)
Time periods for challenging the detection order (days/months starting from):(Text)
References or links to provisions of national law regarding redress:(Text)
Where relevant, additional information regarding redress:(Text)
A lack of compliance with this detection order may result in penalties pursuant to Article 35 of theRegulation.
SECTION 8: Date, stamp and signature
Date of issuance of the detection order:(Text)
Time stamp:(Text)
Electronic signature of the competent judicial authority or independent administrative authority
having issued the detection order:

9093/24
ANNEX

JAI.1

GR/ml

172

LIMITEEN

ANNEX IITEMPLATE FOR INFORMATION ABOUT THE IMPOSSIBILITY TO EXECUTE THE
DETECTION ORDER
referred to in Article 8(3) of Regulation (EU) .../… [laying down rules to prevent and combat
child sexual abuse]

SECTION 1: Addressee of the detection order
Name of the provider and, where applicable, of its legal representative:(Text)
Contact point of the provider:(Text)
Contact details of the provider and, where applicable, of its legal representative:(Text)
File reference of the provider:(Text)SECTION 2: Information regarding the detection order
Name of the Coordinating Authority having requested the issuance of the detection order:(Text)Name of the competent judicial authority or independent administrative authority having issued
the detection order:(Text)
Reference of the detection order:(Text)
Date and time of receipt of the detection order, including time zone:(Text)

9093/24
ANNEX

JAI.1

GR/ml

173

LIMITEEN

SECTION 3: Non-execution
The provider cannot execute the detection order within the mandatory time period for the following
reasons (tick the relevant box(es)):☐☐

The detection order contains one or more manifest errors
The detection order does not contain sufficient information

Specify the manifest error(s) and/or the further information or clarification necessary, as applicable:(Text)SECTION 4: Date, time and signature
Date and time, including time zone:(Text)
Signature:(Text)

9093/24
ANNEX

JAI.1

GR/ml

174

LIMITEEN

ANNEX IIITEMPLATE FOR REPORTS
referred to in Article 13(2) of Regulation (EU) .../…[ laying down rules to prevent and combat
child sexual abuse]
REPORT OF POTENTIAL ONLINE CHILD SEXUAL ABUSE ISSUED IN
ACCORDANCE WITH REGULATION (EU) …/… LAYING DOWN RULES TOPREVENT AND COMBAT CHILD SEXUAL ABUSE (‘THE REGULATION’)SECTION 1: Reporting provider
Name of the provider and, where applicable, of its legal representative:(Text)
Contact point of the provider:(Text)
Contact information of the provider and, where applicable, of its legal representative:(Text)SECTION 2: Information on the report
1)

Does the report require urgent action, notably because of an imminent threat to the life orsafety of the child or children appearing to be victim of the potential online child sexual
abuse:☐☐

Yes
No

Reasons for urgent action(Text – attach data as necessary)
2)Type of potential online child sexual abuse to which the report relates:☐☐☐

9093/24
ANNEX

Known child sexual abuse material, as defined in Article 2, letter (m), of the Regulation
New child sexual abuse material, as defined in Article 2, letter (n), of the Regulation
Solicitation of children, as defined in Article 2, letter (o), of the Regulation

JAI.1

GR/ml

175

LIMITEEN

3)

Content data related to the reported potential online child sexual abuse, including images,
videos and texts, as applicable:(Text – attach data as necessary)
4)

Other available data related to the reported potential online child sexual abuse, including
metadata related to media files and communications (date, time, time zone):(Text – attach data as necessary)
5)

Information concerning the geographic location related to the potential online child sexual
abuse:-IP address of upload, with associated date and time stamp, including time zone, andport number:(Text)-

Where available, other information concerning the geographical location (postal code,
GPS data of media files, etc.):(Text)

6)

Information concerning the identity of any user or users involved in the potential online childsexual abuse, including:-

Username:(Text)-

Email address:(Text)-

Phone number:(Text)-

Other information (mailing address, profile information, other email addresses, otherphone numbers, billing information, last login date, other user information or uniqueuser identifier):(Text)

9093/24
ANNEX

JAI.1

GR/ml

176

LIMITEEN

7)

Type of service provided by the provider:☐☐hosting service, as defined in Article 2, point a, of the Regulationinterpersonal communication service, as defined in Article 2, point (b), of theRegulation

Addition information about the service, including webpage/URL:(Text)
8)

Manner in which the provider became aware of the potential child sexual abuse:
☐
☐
☐

☐
☐
☐

Measures taken to execute a detection order issued in accordance with Article 7 of theRegulation
Notification by a public authority, including notification by the Competent Authority of
establishment in accordance with Article 32 of the Regulation
Notification by a hotline, including a trusted flagger within the meaning of Article 22 19
of Regulation (EU) 2022/2065 …/… [on a Single Market For Digital Services (Digital
Services Act) and amending Directive 2000/31/EC]
Flagged by a user
Measures taken on the provider’s own motion
Other

In accordance with Article 12(1) of the Regulation, providers are not to report potential online childsexual abuse detected through a removal order issues in accordance with the Regulation.
Specification of details regarding the manner in which the provider became aware, as indicatedabove:(Text)
9)

Has the provider reported, or will it report, the potential online child sexual abuse to a publicauthority or to another entity competent to receive such reports of a third country?
☐
☐

Yes
No

If yes, indicate the following:-

name of the public authority or other entity:(Text)-

reference number of the case reported to the public authority or other entity:(Text)

9093/24
ANNEX

JAI.1

GR/ml

177

LIMITEEN

10)

If the report concerns the dissemination of potential known or new child sexual abusematerial, has the provider removed or disabled access to the material?
☐
☐

11)

Yes
No

Has the provider taken any decision in respect of the user or users involved in relation to thepotential online child sexual abuse (blocking account, suspending or terminating the provisionof the service)?
☐
☐

Yes
No

If yes, specify decision:(Text)
12)

Where available, information about the child or children appearing to be victim of thepotential online child sexual abuse:-

Username:(Text)-

Email address:(Text)-

Phone number:(Text)-

Other (mailing address, profile information, other email addresses, other phone
numbers, billing information, last login date, other user information or unique user
identifier):(Text)

13)

Where relevant, other information related to the potential online child sexual abuse:(Text – attach data as necessary)

9093/24
ANNEX

JAI.1

GR/ml

178

LIMITEEN

SECTION 3: Date, time and signature
Date and time of issuance of the report, including time zone:(Text)
Time stamp:(Text)
Signature:(Text)

9093/24
ANNEX

JAI.1

GR/ml

179

LIMITEEN

ANNEX IVTEMPLATE FOR REMOVAL ORDERS
referred to in Article 14(3) of Regulation (EU) .../… [laying down rules to prevent and combat
child sexual abuse]
REMOVAL ORDER ISSUED IN ACCORDANCE WITH REGULATION (EU) …/…
LAYING DOWN RULES TO PREVENT AND COMBAT CHILD SEXUAL ABUSE (‘THE
REGULATION’)SECTION 1: Authorities having requested and issued the removal order
Name of the Coordinating Authority having requested the issuance of the removal order:(Text)Name of the competent judicial authority or the independent administrative authority having
issued the removal order:(Text)
Reference of the removal order:(Text)SECTION 2: Addressee of the removal order and service concerned
Name of the provider and, where applicable, of its legal representative:(Text)
Contact point:(Text)
Specific service for which the removal order is issued:(Text)

9093/24
ANNEX

JAI.1

GR/ml

180

LIMITEEN

SECTION 3: Child sexual abuse material concerned and temporary non-disclosure
The provider is to remove or disable access in all Member States, as soon as possible and in any
event within 24 hours of receipt of this removal order, the following the child sexual abusematerial:(Exact URL and, where necessary, additional information)
The material constitutes child sexual abuse material, as defined in Article 2, point (l), of theRegulation, as it constitutes material that meets one or more of the following elements of thedefinition of child pornography and/or of the definition of pornographic performance, set out in
Article 2, points (c) and (e), respectively, of Directive 2011/93/EU of the European Parliament andof the Council101 (tick the relevant box(es)):
☐
☐
☐
☐
☐
☐

Any material that visually depicts a child engaged in real or simulated sexually explicit
conduct
Any depiction the sexual organs of a child for primarily sexual purposes
Any material that visually depicts any person appearing to be a child engaged in real or
simulated sexually explicit conduct or any depiction of the sexual organs of any person
appearing to be a child, for primarily sexual purposes
Realistic images of a child engaged in sexually explicit conduct or realistic images ofthe sexual organs of a child, for primarily sexual purposes
Material that visually depicts a live exhibition aimed at an audience of a child engaged
in real or simulated sexually explicit conduct
Material that visually depicts a live exhibition aimed at an audience of the sexual organsof a child for primarily sexual purposes

Tick, where applicable:☐

To avoid interference with activities for the prevention, detection, investigation, andprosecution of child sexual abuse offences, the provider is not to disclose any
information regarding the removal of or disabling of access to the child sexual abusematerial in accordance with Article 15(4) of the Regulation, during the following
period:(Text)SECTION 3a: Information to the competent authority of the Member State where thehosting service provider has its main establishment or where its legal representative resides
or is established101

Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011
on combating the sexual abuse and sexual exploitation of children and child pornography,
and replacing Council Framework Decision 2004/68/JHA (OJ L 335 of 17.12.2011, p.1).

9093/24
ANNEX

JAI.1

GR/ml

181

LIMITEEN

Please tick the relevant box(es):□The Member State where the hosting service provider has its main establishment or
where its legal representative resides or is established is other than the Member State of
the issuing competent authority□

A copy of the removal order is sent to the competent authority of the Member State
where the hosting service provider has its main establishment or where its legal
representative resides or is established□The removal order is sent through the competent authority of the Member State where
the hosting service provider has its main establishment or where its legal representative
resides or is established

SECTION 4: Contact details for follow-up
Contact details of the Coordinating competent Aauthority having requested the issuance of issued
the removal order for feedback on the execution of the removal order or further clarification,
including the communications referred to in Article 14(5), (6) and (7) of the Regulation:(Text)SECTION 5: Reasons
The reasons for issuing the removal order are as follows:(Sufficiently detailed statement of reasons for issuing the removal order)
SECTION 6: Information about redress
Competent court before which the removal order can be challenged, in accordance with Article
15(1) of the Regulation:(Text)
Time periods for challenging the detection removal order (days/months starting from):(Text)
References or links to provisions of national law regarding redress:(Text)

9093/24
ANNEX

JAI.1

GR/ml

182

LIMITEEN

Where relevant, additional information regarding redress:(Text)
A lack of compliance with this removal order may result in penalties pursuant to Article 35 of theRegulation.
SECTION 7: Date, stamp and electronic signature
Date of issuance of the removal order:(Text)
Time stamp:(Text)
Electronic signature of the competent judicial authority or independent administrative authority
having issued the removal order:(Text)

9093/24
ANNEX

JAI.1

GR/ml

183

LIMITEEN

ANNEX VTEMPLATE FOR INFORMATION ABOUT THE IMPOSSIBILITY TO EXECUTE THE
REMOVAL ORDER
referred to in Article 14(5) and (6) of Regulation (EU) .../… [laying down rules to prevent andcombat child sexual abuse]

SECTION 1: Addressee of the removal order
Name of the provider and, where applicable, of its legal representative:(Text)
Contact point:(Text)
Contact details of the provider and, where applicable, of its legal representative:(Text)
File reference of the provider:(Text)SECTION 2: Information regarding the removal order
Name of the Coordinating Authority having requested the issuance of the removal order:(Text)Name of the competent judicial authority or independent administrative authority having issued
the removal order(Text)
Reference of the removal order(Text)
Date and time of receipt of the removal order, including time zone:(Text)

9093/24
ANNEX

JAI.1

GR/ml

184

LIMITEEN

SECTION 3: Non-execution
The provider cannot execute the removal order within the mandatory time period for the following
reasons (tick the relevant box(es)):☐☐☐

Force majeure or de facto impossibility not attributable to the provider of hosting services,
including for objectively justifiable technical or operational reasons
The removal order contains one or more manifest errors
The removal order does not contain sufficient information

Provide further information regarding the reasons for non-execution, specifying the reasons of force
majeure or de facto impossibility, the manifest error(s) and/or the further information or
clarification necessary, as applicable:(Text)SECTION 4: Date, time and signature
Date and time, including time zone:(Text)
Signature:(Text)

9093/24
ANNEX

JAI.1

GR/ml

185

LIMITEEN

ANNEX VITEMPLATE FOR INFORMATION ON THE EXECUTION OF THE REMOVAL ORDER
referred to in Article 14(7) of Regulation (EU) .../…[laying down rules to prevent and combat
child sexual abuse]

SECTION 1: Addressee of the removal order
Name of the provider and, where applicable, of its legal representative:(Text)
Point of contact:(Text)
Contact details of the provider and, where applicable, of its legal representative:(Text)
File reference of the provider:(Text)SECTION 2: Information regarding the removal order
Name of the Coordinating Authority having requested the issuance of the removal order:(Text)
Competent judicial authority or independent administrative authority having issued the removal
order:(Text)
Reference of the removal order:(Text)
Date and time of receipt of the removal order, including time zone:(Text)

9093/24
ANNEX

JAI.1

GR/ml

186

LIMITEEN

SECTION 3: Measures taken to execute the removal order
To execute the removal order, the provider has taken the following measure (tick the relevant
box):
☐
☐

Removed the child sexual abuse material
Disabled access to the child sexual abuse material in all Member States

Date and time of taking of the measure, including time zone:(Text)SECTION 4: Date, time and signature
Date and time, including time zone:(Text)
Signature:(Text)

9093/24
ANNEX

JAI.1

GR/ml

187

LIMITEEN

ANNEX VIITEMPLATE FOR BLOCKING ORDERS
referred to in Article 17(1) of Regulation (EU) .../… [laying down rules to prevent and combat
child sexual abuse]
BLOCKING ORDER ISSUED IN ACCORDANCE WITH REGULATION (EU) …/…
LAYING DOWN RULES TO PREVENT AND COMBAT CHILD SEXUAL ABUSE (‘THE
REGULATION’)SECTION 1: Authorities having requested and issued the blocking order
Name of the Coordinating Authority having requested the issuance of the blocking order:(Text)Name of the competent judicial authority or the independent administrative authority having
issued the blocking order:(Text)
Reference of the blocking order:(Text)SECTION 2: Addressee of the blocking order
Name of the provider and, where applicable, of its legal representative:(Text)
Contact point:(Text)

9093/24
ANNEX

JAI.1

GR/ml

188

LIMITEEN

SECTION 3: Measures to execute the blocking order, including additional safeguards:
The provider is to take the necessary measures to prevent users in the Union from having accessto the known child sexual abuse material indicated by the following URLs:(Text)The blocking order applies to the following service provided by the provider in the Union:(Text)
When executing the blocking order, the provider is to respect the following limits and/or to provide
for the following safeguards, as referred to in Article 16(5) of the Regulation:(Text)SECTION 4: Reasons, period of application and reporting
The reasons for issuing the blocking order are as follows:(Sufficiently detailed statement of reasons for issuing the blocking order)
The blocking order applies from … (date) to ……. (date)
The following reporting requirements apply, in accordance with Article 18(6) of the Regulation:(Text)SECTION 5: Contact details for follow-up
Contact details of the Coordinating Authority competent authority having requested the issuanceof issued the order for feedback on the execution of the blocking order or further clarification,
including the communications referred to in Article 17(5), (4a) and (5a) of the Regulation:(Text)

9093/24
ANNEX

JAI.1

GR/ml

189

LIMITEEN

SECTION 6: Information about redress
Competent court before which the blocking order can be challenged, in accordance with Article
18(1) of the Regulation:(Text)
Time periods for challenging the blocking order (days/months starting from):(Text)
References or links to provisions of national law regarding redress:(Text)
Where relevant, additional information regarding redress:(Text)
A lack of compliance with this blocking order may result in penalties pursuant to Article 35 of theRegulation.
SECTION 7: Date, time and electronic signature:
Date of issuance of the blocking order:(Text)
Time stamp:(Text)
Electronic signature of the competent judicial authority or independent administrative authority
having issued the blocking order:(Text)

9093/24
ANNEX

JAI.1

GR/ml

190

LIMITEEN

ANNEX VIIITEMPLATE FOR INFORMATION ABOUT THE IMPOSSIBILITY TO EXECUTE THE
BLOCKING ORDER
referred to in Article 17(4a) and (5) of Regulation (EU) .../… [laying down rules to prevent andcombat child sexual abuse]

SECTION 1: Addressee of the blocking order
Name of the provider and, where applicable, of its legal representative:(Text)
Point of contact:(Text)
Contact details of the provider and, where applicable, of its legal representative:(Text)
File reference of the addressee(Text)SECTION 2: Information regarding the blocking order
Name of the Coordinating Authority having requested the issuance of the blocking order:(Text)
Competent judicial authority or independent administrative authority having issued the blocking
order(Text)
Reference of the blocking order(Text)
Date and time of receipt of the blocking order, including time zone:(Text)

9093/24
ANNEX

JAI.1

GR/ml

191

LIMITEEN

SECTION 3: Non-execution
The provider cannot execute the blocking order within the mandatory time period for the following
reasons (tick the relevant box(es)):☐☐☐

Force majeure or de facto impossibility not attributable to the provider ofhosting services, including for objectively justifiable technical or operational
reasons
The blocking order contains one or more manifest errors
The blocking order does not contain sufficient information

Specify the manifest error(s) and/or the further information or clarification necessary, as applicable:(Text)
Provide further information regarding the reasons for non-execution, specifying the reasonsof force majeure or de facto impossibility, the manifest error(s) and/or the further
information or clarification necessary, as applicable:(Text)SECTION 4: Date, time and signature
Date and time, including time zone:(Text)
Signature:(Text)

9093/24
ANNEX

JAI.1

GR/ml

192

LIMITEEN

ANNEX IXTEMPLATE FOR INFORMATION ON THE EXECUTION OF THE BLOCKING ORDER
referred to in Article 17(5a) of Regulation (EU) .../…[laying down rules to prevent and combat
child sexual abuse]

SECTION 1: Addressee of the blocking order
Name of the provider and, where applicable, of its legal representative:(Text)
Point of contact:(Text)
Contact details of the provider and, where applicable, of its legal representative:(Text)
File reference of the provider:(Text)SECTION 2: Information regarding the blocking order
Competent authority having issued the blocking order:(Text)
Reference of the blocking order:(Text)
Date and time of receipt of the blocking order, including time zone:(Text)

9093/24
ANNEX

JAI.1

GR/ml

193

LIMITEEN

SECTION 3: Measures taken to execute the blocking order
To execute the blocking order, the provider has taken the following measures, indicating inparticular whether the provider has prevented access to child sexual abuse material:(Text)
Date and time of taking of the measure, including time zone:(Text)SECTION 4: Date, time and signature
Date and time, including time zone:(Text)
Signature:(Text)

9093/24
ANNEX

JAI.1

GR/ml

194

LIMITEEN

ANNEX XTEMPLATE FOR DELISTING ORDERS
referred to in Article 18b(1) of Regulation (EU) .../… [laying down rules to prevent and combat
child sexual abuse]
DELISTING ORDER ISSUED IN ACCORDANCE WITH REGULATION (EU) …/…
LAYING DOWN RULES TO PREVENT AND COMBAT CHILD SEXUAL ABUSE (‘THE
REGULATION’)SECTION 1: Authorities having issued the delisting order
Name of the competent authority having issued the delisting order:(Text)
Reference of the delisting order:(Text)SECTION 1a: Information to the competent authority of the Member State where theprovider has its main establishment or where its legal representative resides or is established
Please tick the relevant box(es):□The Member State where the provider has its main establishment or where its legal
representative resides or is established is other than the Member State of the issuingcompetent authority□

A copy of the delisting order is sent to the competent authority of the Member State
where the provider has its main establishment or where its legal representative resides
or is established□

The delisting order is sent through the competent authority of the Member State where
the provider has its main establishment or where its legal representative resides or isestablished9093/24
ANNEX

JAI.1

GR/ml

195

LIMITEEN

SECTION 2: Addressee of the delisting order
Name of the provider and, where applicable, of its legal representative:(Text)
Contact point:(Text)SECTION 3: Measures to execute the delisting order, including additional safeguards:
The provider is to take the necessary measures to prevent the dissemination of known childsexual abuse material in the Union, indicated by the following URLs:(Text)The delisting order applies to the following service provided by the provider in the Union:(Text)SECTION 4: Reasons, period of application and reporting
The reasons for issuing the delisting order are as follows:(Text)The blocking delisting order applies from … (date) to ……. (date)
The following reporting requirements apply, in accordance with Article 18a(5) of theRegulation:(Text)SECTION 5: Information about redress
Competent court before which the delisting order can be challenged, in accordance with
Article 18c(1) of the Regulation:(Text)

9093/24
ANNEX

JAI.1

GR/ml

196

LIMITEENTime periods for challenging the delisting order (days/months starting from):(Text)
References or links to provisions of national law regarding redress:(Text)
Where relevant, additional information regarding redress:(Text)SECTION 67: Date, time and electronic signature:
Date of issuance of the delisting order:(Text)
Time stamp:(Text)
Electronic signature of the competent authority having issued the delisting order:(Text)
A lack of compliance with this delisting order may result in penalties pursuant to Article 35 of
the Regulation.

9093/24
ANNEX

JAI.1

GR/ml

197

LIMITEEN

ANNEX XITEMPLATE FOR INFORMATION ABOUT THE IMPOSSIBILITY TO EXECUTE THE
DELISTING ORDER
referred to in Article 18b(4) and (5) of Regulation (EU) .../… [laying down rules to prevent andcombat child sexual abuse]

SECTION 1: Addressee of the delisting order
Name of the provider and, where applicable, of its legal representative:(Text)
Point of contact:(Text)
Contact details of the provider and, where applicable, of its legal representative:(Text)
File reference of the addressee:(Text)SECTION 2: Information regarding the delisting order
Competent authority having issued the delisting order:(Text)
Reference of the delisting order:(Text)
Date and time of receipt of the delisting order, including time zone:(Text)

9093/24
ANNEX

JAI.1

GR/ml

198

LIMITEEN

SECTION 3: Non-execution
The provider cannot execute the delisting order within the mandatory time period for thefollowing reasons (tick the relevant box(es)):☐☐☐

Force majeure or de facto impossibility not attributable to the provider,including for objectively justifiable technical or operational reasons
The delisting order contains one or more manifest errors
The delisting order does not contain sufficient information

Provide further information regarding the reasons for non-execution, specifying the reasonsof force majeure or de facto impossibility, the manifest error(s) and/or the further
information or clarification necessary, as applicable:(Text)SECTION 4: Date, time and signature
Date and time, including time zone:(Text)
Signature:(Text)

9093/24
ANNEX

JAI.1

GR/ml

199

LIMITEEN

ANNEX XIITEMPLATE FOR INFORMATION ON THE EXECUTION OF THE DELISTING ORDER
referred to in Article 18b(6) of Regulation (EU) .../…[laying down rules to prevent and combat
child sexual abuse]

SECTION 1: Addressee of the delisting order
Name of the provider and, where applicable, of its legal representative:(Text)
Point of contact:(Text)
Contact details of the provider and, where applicable, of its legal representative:(Text)
File reference of the provider:(Text)SECTION 2: Information regarding the delisting order
Competent authority having issued the delisting order:(Text)
Reference of the delisting order:(Text)
Date and time of receipt of the delisting order, including time zone:(Text)

9093/24
ANNEX

JAI.1

GR/ml

200

LIMITEEN

SECTION 3: Measures taken to execute the delisting order
To execute the delisting order, the provider has taken the following measures, indicating inpraticular whether the provider has prevented search results for the online location withchild sexual abuse material to appear:(Text)
Date and time of taking of the measure, including time zone:(Text)SECTION 4: Date, time and signature
Date and time, including time zone:(Text)
Signature:(Text)

9093/24
ANNEX

JAI.1

GR/ml

201

LIMITEEN

ANNEX XIIICORRELATION TABLE
Chapters
I

II

III

9093/24
ANNEX

ArticlesArticle 1 (Subject matter and scope)
Article 2 (Definitions)
Article 3 (Risk Assessment)
Article 4 (Risk Mitigation)
Article 5 (Risk Reporting)
Article 6 (Obligations for software application stores)
Article 7 (Issuance of detection orders)
Article 8 (Additional rules regarding detection orders)
Article 9 (Redress, information, reporting and modification of
detection orders)
Article 10 (Technologies and safeguards)
Article 11 (Guidelines regarding detection obligations)
Article 12 (Reporting obligations)
Article 13 (Specific requirements of reporting)
Article 14 (Removal orders)
Article 15 (Redress and provision of information)
Article 16 (Blocking orders)
Article 17 (Additional rules regarding blocking orders)
Article 18 (Redress, information and reporting blocking orders)
Article 19 (Liability of providers)
Articles 20 (Victims’ rights to information)
Article 21 (Victims’ rights of assistance and support for removal
Article 22 (Preservation of information)
Article 23 (Points of contact)
Article 24 (Legal Representative)
Article 2 (Coordinating Authorities for child sexual abuse issues
and other competent authorities)
Article 26 (Requirements for coordinating authorities)
Article 27 (Investigatory powers)
Article 28 (Enforcement powers)
Article 29 (Additional enforcement powers)
Article 30 (Common provisions on investigatory andenforcement powers)
Article 31 (Searches to verify compliance)
Article 32 (Notification of known child sexual abuse material)
Article 33 (Jurisdiction)
Article 34 (Right of users of the service to lodge a complaint)
Article 35 (Penalties)
Article 36 (Identification and submission of online child sexual
abuse)
Article 37 (Cross-border cooperation among coordinating
authorities)
Article 38 (Joint investigations)
Article 39 (General cooperation and information sharing system)

JAI.1

Recitals
Recitals 1-12
Recital 13
Recital 14-15
Recital 16
Recitals 17-18
Recitals 19
Recitals 20-22
Recitals 20-22
Recital 23
Recitals 24-26
Recital 27-28
Recital 29
Recital 29
Recitals 30 - 31
Recitals 30, 32
Recitals 33-34
Recitals 33-34
Recital 33
Recital 34
Recital 35
Recitals 36-38
Recital 39
Recital 40
Recitals 41-42
Recitals 43-45
Recital 46
Recitals 47-48
Recitals 47-48
Recitals 47-48
Recitals 47-48
Recital 49
Recital 50
Recital 51
Recital 52
Recital 53
Recitals 54-56
Recital 57
Recital 57
Recital 58

GR/ml

202

LIMITEEN

Chapters

IV

ArticlesArticle 40 (Establishment and scope of action of the EU Centre)
Article 41 (Legal status)
Article 42 (Seat)
Article 43 (Tasks of the EU Centre)
Article 44 (Databases of indicators)
Article 45 (Database of reports)
Article 46 (Access, accuracy and security)
Article 47 (Delegated acts related to the databases)
Articles 48 (Reporting)
Article 49 (Searches and notifications)
Article 50 (Technologies, information and expertise)
Article 51 (Processing activities and data protection)
Article 52 (Contact officers)
Article 53 (Cooperation with Europol)
Article 54 (Cooperation with partner organisations)
Article 55 (Administrative and management structure)
Article 56 (Composition of the Management Board)
Article 57 ( Functions of the Management Board)
Article 58 (Chairperson of the Management Board)
Article 59 ( Meetings of the Management Board)
Article 60 (Voting rules of the Management Board)
Article 61 (Composition and appointment of the Executive
Board)
Article 62 (Tasks of the Executive Board)
Article 63 (Voting rules of the Executive Board)
Article 64 (Responsibilities of the Executive Director)
Article 65 (Executive Director)
Article 66 (Establishment and tasks of the Technology
Committee)
Article 67 (Budget establishment and implementation)
Article 68 (Financial rules)
Article 69 (Budget)
Article 70 (Presentation of accounts and discharge)
Article 71 (General Provisions)
Article 72 (Seconded national experts and other staff)
Article 73 (Privileges and immunities)
Article 74 (Obligation of professional secrecy)9093/24
ANNEX

JAI.1

Recitals
Recital 59
Recital 59
Recital 59
Recital 60
Recital 61
Recitals 62-63
Recital 64
Recital 64
Recital 65
Recital 66
Recital 67
Recital 68
Recitals 69-72
Recitals 69-72
Recitals 69-72
Recitals 73
Recital 74
ANNEX to theLegislative Financial
Statement
ANNEX to theLegislative Financial
Statement
ANNEX to theLegislative Financial
Statement
ANNEX to theLegislative Financial
Statement
ANNEX to theLegislative Financial
Statement
-

GR/ml

203

LIMITEEN

Chapters

VVI

9093/24
ANNEX

ArticlesArticle 75 (Security rules on the protection of classified andsensitive non-classified information
Article 76 (Language arrangements)
Article 77 (Transparency and communication)
Article 78 (Anti-fraud measures)
Article 79 (Liability)
Article 80 (Administrative inquires)
Article 81 (Headquarters agreement and operating conditions)
Article 82 (Start of the EU Centre’s activities)
Article 83 (Data collection)
Article 84 (Transparency reporting)
Article 85 (Evaluation)
Article 86 (Exercise of the delegation)
Article 87 (Committee procedure)
Article 88 (Repeal)
Article 89 (Entry into force and application)

JAI.1

Recitals
ANNEX to theLegislative Financial
Statement
Recitals 75-77
Recitals 79-82
Recital 88
Recitals 83-84

GR/ml

204

LIMITEEN

ANNEX XIVMETHODOLOGY AND CRITERIA FOR THE RISK CATEGORISATION OFSERVICES102

102 PCY comment: See WK 3036/2024 REV 3

9093/24
ANNEX

JAI.1

GR/ml

205

LIMITE

EN