### upon ratification of an intergovernmental agreement or of an amendment to an intergovernmental agreement , the member state concerned shall submit the agreement or the amendment of the agreement , including their annexes and other texts these agreements or amendments refer to explicitly , to the commission which shall make the received documents , with the exception of confidential parts identified according to article 7 , accessible to all other member states in electronic form . ### upon ratification of an intergovernmental agreement or of an amendment to an intergovernmental agreement , the member state concerned shall submit to the commission the agreement or the amendment of the agreement , including their annexes and other texts these agreements or amendments refer to explicitly insofar as these other texts contain elements which have an operational impact on the functioning of the internal energy market or the security of energy supply . member states may make available summaries of the information submitted . according to the instructions of the member state concerned , the commission shall make the received documents , with the exception of confidential parts identified according to article 7 , accessible to all other member states in electronic form .


### when a member state intends to enter into negotiations with a third country in order to amend an existing intergovernmental agreement or to conclude a new intergovernmental agreement , the member state shall inform the commission in writing of its intention at the earliest possible moment before the envisaged opening of the negotiations . the information provided to the commission shall include the relevant documentation , an indication of the provisions to be addressed in the negotiations , the objectives of the negotiations and other relevant information . in case of amendments to an existing agreement , the provisions that are to be renegotiated shall be indicated in the information provided to the commission . the commission shall make the received information accessible to all member states in electronic form . the member state concerned shall keep the commission informed regularly of the ongoing negotiations . on request of the commission or the member state concerned , the commission may participate as an observer in the negotiations . ### when a member state enters into negotiations with a third country in order to amend an existing intergovernmental agreement or to conclude a new intergovernmental agreement , the member state shall inform the commission in writing of the objectives of the negotiations , the provisions to be addressed in the negotiations , and other relevant information . in case of amendments to an existing agreement , the provisions that are to be renegotiated shall be indicated in the information provided to the commission . the member state concerned shall keep the commission informed regularly of the ongoing negotiations . on request of the commission or the member state concerned , the commission may participate as an observer in the negotiations .


### member states should already notify the intention to open negotiations to the commission with regard to new intergovernmental agreements or amendments to existing intergovernmental agreements . the commission should be kept informed regularly on the ongoing negotiations . it should have the right to participate as an observer in the negotiations . member states may also request the commission to assist them during their negotiations with third countries . ### member states should notify the commission when negotiations on a new intergovernmental agreement or amendments to existing intergovernmental agreements have been started . the commission should be kept informed regularly on the ongoing negotiations . at the request of the commission or the member state concerned , the commission may participate as an observer in the negotiations . member states may also request the commission to assist them during their negotiations with third countries , without jeopardising their ability to negotiate the content of the agreements .


### the proper functioning of the internal energy market requires that the energy imported into the union from third countries , is fully governed by the rules establishing an internal energy market . an internal energy market that is not functioning properly puts the eu in a vulnerable position with regard to security of energy supply . a high degree of transparency with regard to agreements between member states and third countries in the field of energy would allow the union to take coordinated action , in a spirit of solidarity , in order to ensure that such agreements are in accordance with union legislation and effectively secure the supply of energy . ### the proper functioning of the internal energy market and the safeguarding of consumer protection requires that the energy imported into the union from third countries , is fully governed by the rules establishing an internal energy market . an internal energy market that is not functioning properly puts the eu in a vulnerable position with regard to security of energy supply , while at the same time diminishing its political leverage at international level . a high degree of transparency with regard to agreements between member states and third countries in the field of energy would allow the union to take coordinated action , in a spirit of solidarity , in order to ensure that such agreements are in accordance with union legislation and effectively secure the supply of energy .


### the commission may on its own initiative until four weeks after it has been informed of the closure of the negotiations at the latest or on request from the member state which has negotiated the intergovernmental agreement , assess the compatibility of the negotiated agreement with union law before the agreement has been signed . in case the commission or the member state concerned ask for such an ex - ante assessment of the negotiated intergovernmental agreement with union law , the negotiated but not yet signed draft intergovernmental agreement shall be submitted to the commission for examination . the member state concerned shall refrain from signing the agreement for a period of four months following the submission of the draft intergovernmental agreement . in agreement with the member state concerned , the examination period might be prolonged . when a compatibility control has been requested , in the absence of an opinion by the commission within the examination period , the commission shall be deemed not to have raised objections . ### as early as possible and not later than two weeks after the closure of the negotiations , the member state concerned shall inform the commission of the closure of the negotiations and shall submit the negotiated but not yet signed draft intergovernmental agreement , including annexes thereto and other texts to which it refers explicitly , to the commission for examination . however , agreements between commercial entities are not subject to this obligation .


### the commission may on its own initiative until four weeks after it has been informed of the closure of the negotiations at the latest or on request from the member state which has negotiated the intergovernmental agreement , assess the compatibility of the negotiated agreement with union law before the agreement has been signed . in case the commission or the member state concerned ask for such an ex - ante assessment of the negotiated intergovernmental agreement with union law , the negotiated but not yet signed draft intergovernmental agreement shall be submitted to the commission for examination . the member state concerned shall refrain from signing the agreement for a period of four months following the submission of the draft intergovernmental agreement . in agreement with the member state concerned , the examination period might be prolonged . when a compatibility control has been requested , in the absence of an opinion by the commission within the examination period , the commission shall be deemed not to have raised objections . ### as early as possible and not later than two weeks after closure of the negotiations the member state concerned shall inform the commission of the closure of the negotiations and shall submit the negotiated but not yet signed draft intergovernmental agreement , including its&#160 ; annexes and other texts it refers to explicitly , &#160 ; to the commission for examination . the commission shall , on its own initiative or at the request of the member state that negotiated the intergovernmental agreement , inform that member state , within two months after being informed of the closure of the negotiations , of any doubts on the compatibility of the negotiated agreement , and its annexes and other texts it refers to explicitly , with union law , in particular with eu competition law and eu internal energy market legislation . the member state concerned shall refrain from signing the agreement for a period of two months following the submission of the intergovernmental agreement . in the absence of a response from the commission within that period , the commission shall be deemed not to have raised objections . the member state shall postpone the signing of an intergovernmental agreement for another two months if it has received a response from the commission that the negotiated but not yet signed agreement , is not compatible with union law . within those two months the commission shall issue a legal opinion . 2 . where the legal opinion identifies incompatibility between the negotiated agreement and union law , the commission shall specify that incompatibility and shall make recommendations on how to eliminate the incompatibility . 3 . member states shall take due account of the commission ' s recommendations and , if necessary , renegotiate the agreement . if the recommendations are not taken into account and serious doubts persist about the compatibility of the signed intergovernmental agreement with union law , the commission shall consider launching infringement proceedings .


### the commission may on its own initiative until four weeks after it has been informed of the closure of the negotiations at the latest or on request from the member state which has negotiated the intergovernmental agreement , assess the compatibility of the negotiated agreement with union law before the agreement has been signed . in case the commission or the member state concerned ask for such an ex - ante assessment of the negotiated intergovernmental agreement with union law , the negotiated but not yet signed draft intergovernmental agreement shall be submitted to the commission for examination . the member state concerned shall refrain from signing the agreement for a period of four months following the submission of the draft intergovernmental agreement . in agreement with the member state concerned , the examination period might be prolonged . when a compatibility control has been requested , in the absence of an opinion by the commission within the examination period , the commission shall be deemed not to have raised objections . ### as early as possible and no later than four weeks after closure of the negotiations , the member state concerned shall inform the commission of the closure of the negotiations and shall submit the negotiated but not yet signed draft intergovernmental agreement , including its&#160 ; annexes and other texts it refers to explicitly , &#160 ; to the commission for examination . the commission shall inform that member state , within two months of being informed of the closure of the negotiations , of any doubts about the compatibility of the negotiated agreement , and its annexes and other texts it refers to explicitly , with union law , in particular with union competition law and internal energy market legislation , or with international agreements concluded by the union . the member state concerned shall refrain from signing the agreement for a period of two months following the submission of the intergovernmental agreement . in the absence of a response from the commission within that period , the commission shall be deemed not to have raised objections . the member state shall postpone the signing of an intergovernmental agreement for another two months if it has received a response from the commission that the negotiated but not yet signed agreement is not compatible with union law or international agreements concluded by the union . within those two months the commission shall issue a legal opinion . 2 . where the legal opinion identifies incompatibility between the negotiated agreement and union law or international agreements concluded by the union , the commission shall specify that incompatibility and shall make recommendations on how to eliminate the incompatibility . 3 . member states shall take due account of the commission ' s recommendations and , if necessary , renegotiate the agreement . if the recommendations are not taken into account and serious doubts persist about the compatibility of the signed intergovernmental agreement with union law or international agreements concluded by the union , the commission shall consider corrective measures to rectify the situation .


### upon ratification of an intergovernmental agreement or of an amendment to an intergovernmental agreement , the member state concerned shall submit the agreement or the amendment of the agreement , including their annexes and other texts these agreements or amendments refer to explicitly , to the commission which shall make the received documents , with the exception of confidential parts identified according to article 7 , accessible to all other member states in electronic form . ### upon ratification of an intergovernmental agreement or of an amendment to an intergovernmental agreement , the member state concerned shall submit to the commission the agreement or the amendment to the agreement , including its annexes . furthermore , where these agreements refer explicitly to other texts , member states shall submit those other texts insofar as they contain elements which impact on the functioning of the internal market for energy or on the security of energy supply in the union . however , agreements between commercial entities are not subject to this obligation .


### the commission should make all received information available to all other member states in electronic form . the commission should respect requests from member states to treat information , in particular commercial information , submitted as confidential . requests for confidentiality should however not restrict access of the commission itself to confidential information as the commission needs to have comprehensive information for its own assessment . the requests for confidentiality are without prejudice to the right of access to documents as provided for in regulation no 1049 / 2001 of the european parliament and of the council of 30 may 2001 regarding public access to european parliament , council and commission documents . ### the commission should make all received non - confidential information available to all other member states in electronic form . the commission should respect requests from member states to treat information , in particular commercial information , submitted as confidential . requests for confidentiality should however not restrict access of the commission itself to confidential information as the commission needs to have comprehensive information for its own assessment . the commission is responsible for guaranteeing the application of the confidentiality clause and its legal consequences . the requests for confidentiality are without prejudice to the right of access to documents as provided for in regulation no 1049 / 2001 of the european parliament and of the council of 30 may 2001 regarding public access to european parliament , council and commission documents .


### member states shall submit all existing and provisionally applied intergovernmental agreements between them and third countries in their entirety , including their annexes and other texts they refer to explicitly and all amendments thereto to the commission at the latest three months after the entry into force of this decision . the commission shall make the received documents accessible in electronic form to all other member states . existing or provisionally applied intergovernmental agreements which have already been communicated in accordance with regulation no 994 / 2010 to the commission at the date of entry into force of this decision , which are fulfilling the requirements of this paragraph , shall be considered as communicated for the purposes of this decision . ### member states shall submit to the commission at the latest three months after the entry into force of this decision all intergovernmental agreements between them and third countries , including their annexes and all amendments thereto , as well as other texts they refer to explicitly insofar as these other texts contain elements which have an operational impact on the functioning of the internal energy market or the security of energy supply . the commission shall make the received documents , except confidential parts , accessible in electronic form to all other member states . within 12 months after the reception of the respective intergovernmental agreements , the commission , in cooperation with the eeas regarding the union ' s external policies , shall evaluate the agreements communicated and inform the concerned member states about the possible incompatibility of their agreements with union law and with international agreements concluded by the union . existing or provisionally applied intergovernmental agreements which have already been communicated in accordance with regulation no 994 / 2010 to the commission at the date of entry into force of this decision , which are fulfilling the requirements of this paragraph , shall be considered as communicated for the purposes of this decision .


### member states should already notify the intention to open negotiations to the commission with regard to new intergovernmental agreements or amendments to existing intergovernmental agreements . the commission should be kept informed regularly on the ongoing negotiations . it should have the right to participate as an observer in the negotiations . member states may also request the commission to assist them during their negotiations with third countries . ### member states should have the option of informing the commission of negotiations with regard to new intergovernmental agreements or amendments to existing intergovernmental agreements . where a member state opts to inform the commission , the commission should be kept informed regularly on the ongoing negotiations . member states may invite the commission to participate as an observer in the negotiations . member states may also request the commission to assist them during their negotiations with third countries .


### when providing information to the commission in accordance with article 3 , the member state may indicate whether any part of the information , in particular commercial information , is to be regarded as confidential and whether the information provided can be shared with other member states . the commission shall respect these indications . requests for confidentiality do not restrict access of the commission itself to confidential information . ### when providing information to the commission in accordance with article 3 , the member state may indicate whether any part of the information , in particular commercial information , is to be regarded as confidential and whether the information provided can be shared with other member states . the commission shall respect these indications . requests for confidentiality do not restrict access of the commission itself to confidential information . the commission shall ensure that access to the confidential information is strictly limited to the commission staff for whom it is absolutely necessary to have the information available for the purposes referred to in articles 4 , 5 and 6 .


### reviews carried out pursuant to articles 18 and 19 shall be carried out expeditiously and shall normally be concluded within 12 months of the date of initiation of the review . in any event , reviews pursuant to articles 18 and 19 shall be concluded within 15 months of initiation . in exceptional cases , having regard to the complexity of the investigation , the commission may decide , no later than 9 months after the initiation of the investigation , to extend this time limit , for a period up to , but in no case longer than , 18 months . ### reviews carried out pursuant to articles 18 and 19 shall be carried out expeditiously and shall normally be concluded within 11 months of the date of initiation of the review . in any event , reviews pursuant to articles 18 and 19 shall be concluded within 14 months of initiation . no later than seven and a half month after the initiation of the investigation pursuant to article 11 the commission shall consult the member states on the bases of the findings of the investigation . the member states shall in this consultation indicate to the commission whether they expect an intense controversy in the decision making process pursuant to articles 14 and 15 for definitive action with the need to submit the draft implementing act after the delivery of a negative opinion within the examination procedure pursuant to article 5 of the regulation no 182 / 2011 to the appeal body pursuant to article 6 of the same regulation . if so the commission may decide , no later than 8 months after the initiation of the investigation , to extend the time limit for a period up to , but in no case longer than , 15 months . the commission shall make this decision public .


### for proceedings pursuant to article 10 , an investigation shall , whenever possible , be concluded within one year . in any event , such investigations shall be concluded within 13 months of initiation , in accordance with the findings made pursuant to article 13 for undertakings or the findings made pursuant to article 15 for definitive action . in exceptional cases , having regard to the complexity of the investigation , the commission may decide , no later than 8 months after the initiation of the investigation , to extend this time limit , for a period up to , but in no case longer than , 18 months . ### for proceedings pursuant to article 10 , an investigation shall , whenever possible , be concluded within 11 months . in any event , such investigations shall be concluded within 12 months of initiation , in accordance with the findings made pursuant to article 13 for undertakings or the findings made pursuant to article 15 for definitive action .


### provisional duties may be imposed if proceedings have been initiated in accordance with article 5 , if a notice has been given to that effect and interested parties have been given an adequate opportunity to submit information and make comments in accordance with article 5 , if a provisional affirmative determination has been made of dumping and consequent injury to the union industry , and if the union interest calls for intervention to prevent such injury . the provisional duties shall be imposed no earlier than 60 days and no later than 9 months from the initiation of the proceedings . in exceptional cases , having regard to the complexity of the investigation , the commission may decide , no later than 8 months after the initiation of the investigation , to extend this time limit , to a period up to , but in no case longer than , 12 months . ### provisional duties may be imposed if proceedings have been initiated in accordance with article 5 , if a notice has been given to that effect and interested parties have been given an adequate opportunity to submit information and make comments in accordance with article 5 , if a provisional affirmative determination has been made of dumping and consequent injury to the union industry , and if the union interest calls for intervention to prevent such injury . the provisional duties shall be imposed no earlier than 60 days and no later than 8 months from the initiation of the proceedings . in case the member states indicate to the commission pursuant to article 6 that they expect an intense controversy in the decision making process pursuant to article 9 for definitive action with the need to submit the draft implementing act after the delivery of a negative opinion within the examination procedure pursuant to article 5 of the regulation no 182 / 2011 to the appeal body pursuant to article 6 of the same regulation , the commission may decide , no later than 8 months after the initiation of the investigation , to extend this time limit , to a period up to , but in no case longer than , 9 months .


### the relevant provisions of articles 5 and 6 shall apply to any reinvestigation carried out pursuant to this article , except that such reinvestigation shall be carried out expeditiously and shall normally be concluded within nine months of the date of initiation of the reinvestigation . in any event , such reinvestigations shall in all cases be concluded within one year of initiation of the reinvestigation . ### the relevant provisions of articles 5 and 6 shall apply to any reinvestigation carried out pursuant to this article , except that such reinvestigation shall be carried out expeditiously and shall normally be concluded within six months of the date of initiation of the reinvestigation . in any event , such reinvestigations shall in all cases be concluded within ten months of initiation of the reinvestigation .


### the relevant provisions of this regulation with regard to procedures and the conduct of investigations , excluding those relating to time - limits , shall apply to any review carried out pursuant to paragraphs 2 , 3 and 4 . reviews carried out pursuant to paragraphs 2 and 3 shall be carried out expeditiously and shall normally be concluded within 12 months of the date of initiation of the review . in any event , reviews pursuant to paragraphs 2 and 3 shall be concluded within 15 months of initiation . in exceptional cases , having regard to the complexity of the investigation , the commission may decide , no later than 9 months after the initiation of the investigation , to extend this time limit , for a period up to , but in no case longer than , 18 months . reviews pursuant to paragraph 4 shall in all cases be concluded within nine months of the date of initiation . if a review carried out pursuant to paragraph 2 is initiated while a review under paragraph 3 in ongoing in the same proceeding , the review pursuant to paragraph 3 shall be concluded at the same time as the review pursuant to paragraph 2 ' ### the relevant provisions of this regulation with regard to procedures and the conduct of investigations , excluding those relating to time - limits , shall apply to any review carried out pursuant to paragraphs 2 , 3 and 4 . reviews carried out pursuant to paragraphs 2 and 3 shall be carried out expeditiously and shall normally be concluded within 12 months of the date of initiation of the review . in any event , reviews pursuant to paragraphs 2 and 3 shall be concluded within 14 months of initiation . no later than seven and a half months after the initiation of the investigation pursuant to article 6 the commission shall consult the member states on the bases of the findings of the investigation . the member states shall in this consultation indicate to the commission whether they expect an intense controversy in the decision making process pursuant to article 9 for definitive action with the need to submit the draft implementing act after the delivery of a negative opinion within the examination procedure pursuant to article 5 of the regulation no 182 / 2011 to the appeal body pursuant to article 6 of the same regulation . if so the commission may decide , no later than eight months after the initiation of the investigation , to extend the time limit for a period up to , but in no case longer than , 15 months . the commission shall make this decision public . reviews pursuant to paragraph 4 shall in all cases be concluded within nine months of the date of initiation . if a review carried out pursuant to paragraph 2 is initiated while a review under paragraph 3 in ongoing in the same proceeding , the review pursuant to paragraph 3 shall be concluded at the same time as the review pursuant to paragraph 2 .


### the provisional duties shall be imposed no earlier than 60 days , and no later than 9 months , from the initiation of the proceedings . in exceptional cases , having regard to the complexity of the investigation , the commission may decide , no later than 8 months after the initiation of the investigation , to extend this time limit , to a period up to , but in no case longer than , 12 months . ### the provisional duties shall be imposed no earlier than 60 days , and no later than 8 months , from the initiation of the proceedings . in case the member states indicate to the commission pursuant to article 11 that they expect an intense controversy in the decision making process pursuant to articles 14 and 15 for definitive action with the need to submit the draft implementing act after the delivery of a negative opinion within the examination procedure pursuant to article 5 of the regulation no 182 / 2011 to the appeal body pursuant to article 6 of the same regulation , the commission may decide , no later than 8 months after the initiation of the investigation , to extend this time limit , to a period up to , but in no case longer than , 9 months .


### the powers to adopt the delegated acts referred to in article 2 and shall be conferred on the commission for an indeterminate period of time . ### the powers to adopt the delegated acts referred to in articles 2 and , 4 , and 23 shall be conferred on the commission for an indeterminate period of time .


### for proceedings initiated pursuant to article 5 , an investigation shall , whenever possible , be concluded within one year . in any event , such investigations shall be concluded within 15 months of initiation , in accordance with the findings made pursuant to article 8 for undertakings or the findings made pursuant to article 9 for definitive action . in exceptional cases , having regard to the complexity of the investigation , the commission may decide , no later than 9 months after the initiation of the investigation , to extend this time limit , for a period up to , but in no case longer than , 18 months . ### for proceedings initiated pursuant to article 5 , an investigation shall , whenever possible , be concluded within one year . in any event , such investigations shall be concluded within 14 months of initiation , in accordance with the findings made pursuant to article 8 for undertakings or the findings made pursuant to article 9 for definitive action .


### the delegation of power referred to in article 2 and may be revoked at any time by the european parliament or by the council . ### the delegation of power referred to in article 2 , , 4 and 23 may be revoked at any time by the european parliament or by the council .


### draft by the court of justice ### the following new second paragraph shall be added to article 50 : to deal with matters in which there is a high volume of pending cases , the general court may set up an appropriate number of specialised chambers to which proceedings in the matters in question shall be assigned . the number of specialised chambers may not be less than two . the present second and third paragraphs of article 50 shall become the third and fourth paragraphs . ’


### draft by the court of justice in order to enable the specialised courts to continue to function satisfactorily in the absence of a judge who , while not suffering from disablement deemed to be total , is prevented from participating in judicial business for an extended period of time , provision should be made for the possibility of attaching temporary judges to those courts . ### in order to enable the specialised courts to continue to function satisfactorily in the absence of a judge who , while not suffering from disablement deemed to be total , is prevented from participating in judicial business for an extended period of time , provision should be made for the possibility of attaching temporary judges to those courts . the appointment of temporary judges should offer every guarantee as regards the independence and impartiality and the competence and suitability of the persons appointed , as well as making for equality and balance in terms of their home member states .


### draft by the court of justice ### once the number of judges of the general court has been increased , the question of their appointment will naturally arise . regarding the system for appointing judges , member states should agree on rules offering every guarantee as regards the independence and impartiality and the competence and suitability of the persons appointed , as well as making for equality and balance in terms of their home member states .


### draft by the court of justice consequently , the necessary measures should be taken to address this situation , and the possibility , provided for by the treaties , of increasing the number of judges of the general court is such as to enable both the volume of pending cases and the excessive duration of proceedings before the general court to be reduced within a short time . ### consequently , the necessary measures should be taken to address this situation , and the possibility , provided for by the treaties , of increasing the number of judges of the general court from 27 to 39 is such as to enable both the volume of pending cases and the excessive duration of proceedings before the general court to be reduced within a short time .


### draft by the court of justice the parliament and the council , acting in accordance with article 257 tfeu , may attach temporary judges to the specialised courts in order to cover the absence of judges who , while not suffering from disablement deemed to be total , are prevented from participating in judicial business for an extended period of time . in that event , the parliament and the council shall lay down the conditions under which the temporary judges shall be appointed , their rights and duties , the detailed rules governing the performance of their duties and the circumstances in which they shall cease to perform those duties . ### the parliament and the council , acting in accordance with article 257 tfeu , may attach temporary judges to the specialised courts in order to cover the absence of judges who , while not suffering from disablement deemed to be total , are prevented from participating in judicial business for an extended period of time . in that event , the parliament and the council shall lay down the conditions under which the temporary judges shall be appointed , their rights and duties , the detailed rules governing the performance of their duties and the circumstances in which they shall cease to perform those duties . those provisions shall ensure , moreover , that the temporary judges enjoy the same rights and are entitled to assume the same functions as permanent judges , in order to guarantee the uncompromised authority of the court ' s judgments .


### a separate annual trigger import volume is set for imports from central american country for products mentioned in paragraph 1 as indicated in the table in the annex to this regulation . the importation of the products mentioned in paragraph 1 at the preferential customs duty rate shall , in addition to the proof of origin established under annex iii of the agreement with central america , be subject to the presentation of an export certificate issued by the competent authority of the republic of the central american country from which the products are exported . once the trigger volume is met during the corresponding calendar year , the commission may , in accordance with the examination procedure referred to in article 12 , temporarily suspend the preferential customs duty during that same year for a period of time not exceeding three months , and not going beyond the end of the calendar year . ### a separate annual trigger import volume is set for imports from central american country for products mentioned in paragraph 1 as indicated in the table in the annex to this regulation . the importation of the products mentioned in paragraph 1 at the preferential customs duty rate shall , in addition to the proof of origin established under annex iii of the agreement with central america , be subject to the presentation of an export certificate issued by the competent authority of the republic of the central american country from which the products are exported . once the trigger volume is met during the corresponding calendar year , the commission shall , in accordance with the advisory procedure referred to in article 12 , temporarily suspend the preferential customs duty during that same year for a period of time not exceeding three months , and not going beyond the end of the calendar year . only reasons of force majeure shall prevent the suspension from being imposed .


### a separate annual trigger import volume is set for imports from central american country for products mentioned in paragraph 1 as indicated in the table in the annex to this regulation . the importation of the products mentioned in paragraph 1 at the preferential customs duty rate shall , in addition to the proof of origin established under annex iii of the agreement with central america , be subject to the presentation of an export certificate issued by the competent authority of the republic of the central american country from which the products are exported . once the trigger volume is met during the corresponding calendar year , the commission may , in accordance with the examination procedure referred to in article 12 , temporarily suspend the preferential customs duty during that same year for a period of time not exceeding three months , and not going beyond the end of the calendar year . ### a separate annual trigger import volume is set for imports from central american country for products mentioned in paragraph 1 as indicated in the table in the annex to this regulation . the importation of the products mentioned in paragraph 1 at the preferential customs duty rate shall , in addition to the proof of origin established under annex iii of the agreement with central america , be subject to the presentation of an export certificate issued by the competent authority of the republic of the central american country from which the products are exported . once the trigger volume is met during the corresponding calendar year , the commission shall , in accordance with the examination procedure referred to in article 12 , temporarily suspend the preferential customs duty during that same year for a period of time not exceeding three months , and not going beyond the end of the calendar year . only reasons of force majeure shall prevent the suspension from being imposed .


### list of market operators referred to in article 3a ) e - commerce platforms 2 . internet payment gateways 3 . social networks 4 . search engines 5 . cloud computing services 6 . application stores ### list of market operators referred to in article 3a ) 5 . cloud computing services that store critical infrastructure data of the european union


### member states shall ensure that public administrations and market operators take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems . ### member states shall ensure that public administrations and market operators take appropriate technical and organisational measures to detect and effectively manage the risks posed to the security of the networks and information systems which they control and use in their operations . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems .


### the magnitude and frequency of deliberate or accidental security incidents is increasing and represents a major threat to the functioning of networks and information systems . such incidents can impede the pursuit of economic activities , generate substantial financial losses , undermine user confidence and cause major damage to the economy of the union . ### the magnitude and frequency of deliberate or accidental security incidents is increasing and represents a major threat to the functioning of networks and information systems . such incidents can impede the pursuit of economic activities , generate substantial financial losses , undermine user confidence and cause major damage to the economy of the union . there has been a growing recognition that control systems are vulnerable to cyber - attacks from numerous sources , including hostile governments , terrorist groups and other malicious intruders . smart attacks and coordinated attacks could have severe impacts to the stability , performance , and economics of the infrastructure .


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data .


### the controller or the processor may be exempted from this liability , in whole or in part , if the controller or the processor proves that they are not responsible for the event giving rise to the damage . ### the controller may be exempted from this liability , in whole or in part , if the controller proves that it is not responsible for the event giving rise to the damage .


### ‘ main establishment’ means as regards the controller , the place of its establishment in the union where the main decisions as to the purposes , conditions and means of the processing of personal data are taken ; if no decisions as to the purposes , conditions and means of the processing of personal data are taken in the union , the main establishment is the place where the main processing activities in the context of the activities of an establishment of a controller in the union take place . as regards the processor , ‘ main establishment’ means the place of its central administration in the union ; ### ' main establishment ' means the location as determined by the data controller or data processor on the basis of the following transparent and objective criteria : the location of the group ' s european headquarters , or , the location of the company within the group with delegated data protection responsibilities , or , the location of the company which is best placed to address and enforce the rules as set out in this regulation , or , the place where the main decisions as to the purposes of processing are taken for the regional group ;


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; , the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; , the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises , in consultation with relevant stakeholders .


### within the limits of this regulation , personal data may be processed for historical , statistical or scientific research purposes only if : ### within the limits of this regulation , personal data may be processed for historical , statistical or scientific purposes under paragraph 2 of article 6 and point of article 9 only if :


### data protection by design and by default ### data protection by design


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers46 . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in implementing the provisions of this regulation , it shall be ensured that no mandatory requirements for specific technical features are imposed on products and services , including terminal or other electronic communications equipment , which could impede the placing of equipment on the market and the free circulation of such equipment in and between member states .


### in order to demonstrate compliance with this regulation , the controller or processor should document each processing operation . each controller and processor should be obliged to co - operate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations . ### in order to demonstrate compliance with this regulation , the controller should document each processing operation under its responsibility . each controller should be obliged to co - operate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations .


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . a single assessment shall be sufficient to address a set of processing operations that present similar risks .


### a transfer based on standard data protection clauses or binding corporate rules as referred to in points , or of paragraph 2 shall not require any further authorisation . ### a transfer based on points , , or of paragraph 2 shall not require any further authorisation .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission , in certain limited circumstances . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . ### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the particular categories of personal data , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach .


### assist the controller in ensuring compliance with the obligations pursuant to articles 30 to 34 ; ### insofar as this is possible given the nature of the processing , the information available to the processor and his ability to assist with reasonable effort , an agreement on how compliance will be ensured with the obligations pursuant to articles 28 to 34 ;


### the principles of protection should apply to any information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable . ### the principles of protection should apply only to specific information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken : only of those means likely reasonably to be used by the controller or by any other natural or legal person to identify the individual , and of the reasonable likeliness of a person being identified . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable from the data .


### the controller shall carry out the erasure without delay , except to the extent that the retention of the personal data is necessary : ### the controller shall carry out the erasure without undue delay , except to the extent that the retention and dissemination of the personal data is necessary :


### the period for which the personal data will be stored ; ### the maximum period for which the personal data will be stored .


### each controller and processor and , if any , the controller ' s representative , shall maintain documentation of all processing operations under its responsibility . ### each controller and processor and , if any , the controller ' s representative , shall maintain documentation of the policies and measures taken to ensure that the processing of personal data under its responsibility is performed in compliance with article 22 .


### ‘ controller’ means the natural or legal person , public authority , agency or any other body which alone or jointly with others determines the purposes , conditions and means of the processing of personal data ; where the purposes , conditions and means of processing are determined by union law or member state law , the controller or the specific criteria for his nomination may be designated by union law or by member state law ; ### ' controller ' means the natural or legal person , public authority , agency or any other body which alone or jointly with others determines the purposes of the processing of personal data ; where the purposes of processing are determined by union law or member state law , the controller or the specific criteria for his nomination may be designated by union law or by member state law ;


### these purposes cannot be otherwise fulfilled by processing data which does not permit or not any longer permit the identification of the data subject ; ### these purposes cannot be reasonably fulfilled by processing data which does not permit or not any longer permit the identification of the data subject ;


### consent shall not provide a legal basis for the processing , where there is a significant imbalance between the position of the data subject and the controller . ### consent shall not provide a legal basis for the processing , when it has not been given freely , particularly in such a case where there is a significant imbalance between the position of the data subject and the controller as regards this specific consent .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals . ### such measures and procedures shall : take due account of existing technical standards and regulations in the area of public safety and security follow the principle of technology , service and business model neutrality be based on global industry - led efforts and standards take due account of international developments


### before a supervisory authority adopts a measure referred to in paragraph 2 , this supervisory authority shall communicate the draft measure to the european data protection board and the commission . ### before the competent supervisory authority adopts a measure referred to in paragraph 2 , this competent supervisory authority shall communicate the draft measure to the european data protection board and the commission .


### the period for which the personal data will be stored ; ### the expected period for which the personal data will be stored ;


### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate . ### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate , except where the data originate from a publicly available source or where the transfer is provided by law or the processing is used for purposes relating to the professional activities of the person concerned .


### the controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function . the data protection officer shall directly report to the management of the controller or the processor . ### the data protection organisation or data protection officer shall perform his or her duties and tasks independently .


### ‘ the data subject ' s consent’ means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; ### ' the data subject ' s consent ' means any freely given specific and informed indication of his or her wishes by which the data subject signifies agreement to personal data relating to them being processed ;


### the commission may lay down standard forms and specifying standard procedures for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized - enterprises . those implementing acts shall be adopted in accordance with the examination procedure set out in article 87 . ### the commission shall lay down standard forms and specify standard procedures for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized - enterprises . those implementing acts shall be adopted in accordance with the examination procedure set out in article 87 .


### ‘ main establishment’ means as regards the controller , the place of its establishment in the union where the main decisions as to the purposes , conditions and means of the processing of personal data are taken ; if no decisions as to the purposes , conditions and means of the processing of personal data are taken in the union , the main establishment is the place where the main processing activities in the context of the activities of an establishment of a controller in the union take place . as regards the processor , ‘ main establishment’ means the place of its central administration in the union ; ### ' main establishment ' means the location as determined by the data controller or data processor on the basis of the following transparent and objective criteria : the location of the group ' s european headquarters , or , the location of the company within the group with delegated data protection responsibilities , or , the location of the company which is best placed to address and enforce the rules as set out in this regulation , or , the place where the main decisions as to the purposes of processing are taken for the regional group ;


### the main establishment of a controller in the union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment . the main establishment of the processor should be the place of its central administration in the union . ### where a controller or a processor has multiple establishments in the union , including but not limited to cases where the controller or the processor is a group of undertakings , the main establishment of a controller in the union for the purposes of this regulation should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment .


### the commission may specify the electronic format referred to in paragraph 1 and the technical standards , modalities and procedures for the transmission of personal data pursuant to paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the electronic format , related functionalities and procedures for the transmission of personal data pursuant to paragraph 2 , shall be determined by the controller by reference to the most appropriate industry standards available or as defined by industry stakeholders or standardisation bodies . the commission shall promote and assist industry , stakeholders and standardisation bodies in the mapping and adoption of technical standards , modalities and procedures for the transmission of personal data pursuant to paragraph 2 .


### ‘ the data subject ' s consent’ means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; ### ‘ the data subject ' s consent’ means any freely given specific , informed and unambiguous indication of his or her wishes by which the data subject signifies agreement to personal data relating to them being processed ;


### in order to demonstrate compliance with this regulation , the controller or processor should document each processing operation . each controller and processor should be obliged to co - operate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations . ### in order to demonstrate compliance with this regulation , the controller should document each processing operation . each controller should be obliged to cooperate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations .


### within the limits of this regulation , personal data may be processed for historical , statistical or scientific research purposes only if : ### within the limits of this regulation , personal data may be processed for historical , statistical or scientific purposes under paragraph 2 of article 6 and point of article 9 only if :


### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts and may be addressed by any supervisory authority and other bodies in the union instead of the controller , with regard to the obligations of the controller under this regulation ; ### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts and shall be addressed by the competent supervisory authority , with regard to the obligations of the controller under this regulation ;


### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages or for other reasons , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . the supervisory authority shall , without delay , communicate those measures , with full reasons , to the european data protection board and to the commission . ### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects within their territory , when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages , by clear breach or unjustified inaction of the competent supervisory authority , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . the supervisory authority shall , without delay , communicate those measures , with full reasons , to the competent supervisory authority , the european data protection board , the commission and the controller or processor .


### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be given in writing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be given in writing .


### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . ### where a controller determines the purposes of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them .


### the transfer is necessary for the purposes of the legitimate interests pursued by the controller or the processor , which cannot be qualified as frequent or massive , and where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and based on this assessment adduced appropriate safeguards with respect to the protection of personal data , where necessary . ### the transfer is necessary for the purposes of the legitimate interests pursued by the controller or the processor , and where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and based on this assessment adduced appropriate safeguards with respect to the protection of personal data , where necessary .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers46 . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission . in implementing the provisions of this regulation , it shall be ensured that no mandatory requirements for specific technical features are imposed on products and services , including terminal or other electronic communications equipment , which could impede the placing of equipment on the market and the free circulation of such equipment in and between member states .


### if the data subject ' s consent is to be given in the context of a written declaration which also concerns another matter , the requirement to give consent must be presented distinguishable in its appearance from this other matter . ### if the data subject ' s consent is to be given in the context of a written declaration which also concerns another matter , the requirement to give consent must be presented conspicuously in its appearance from this other matter .


### the commission may specify the electronic format referred to in paragraph 1 and the technical standards , modalities and procedures for the transmission of personal data pursuant to paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the electronic format , related functionalities and procedures for the transmission of personal data pursuant to paragraph 2 , shall be determined by the controller by reference to the most appropriate industry standards available or as defined by industry stakeholders or standardisation bodies .


### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ' personal data in the employment context . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject . ### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject .


### ‘ the data subject ' s consent’ means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; ### ' the data subject ' s consent ' means any freely given specific and informed indication of his or her wishes by which the data subject signifies agreement to personal data relating to them being processed ;


### the controller or processor acting on the controller ' s behalf shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where : ### the controller or processor acting on the controller ' s behalf may consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where :


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach relating to special categories of personal date , personal data which are subject to professional secrecy , personal data relating to criminal offences or to the suspicion of a criminal act or personal data relating to bank or credit card accounts , which seriously threaten the rights or legitimate interests of the data subject , the controller shall without undue delay notify the personal data breach to the supervisory authority .


### where the list provided for in paragraph 4 involves processing activities which are related to the offering of goods or services to data subjects in several member states , or to the monitoring of their behaviour , or may substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 prior to the adoption of the list . ### where processing activities relate to the offering of goods or services to data subjects in several member states , or to the monitoring of their behaviour , or may substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 .


### in order to ensure a consistent level of protection for individuals throughout the union and to prevent divergences hampering the free movement of data within the internal market , a regulation is necessary to provide legal certainty and transparency for economic operators , including micro , small and medium - sized enterprises , and to provide individuals in all member states with the same level of legally enforceable rights and obligations and responsibilities for controllers and processors , to ensure consistent monitoring of the processing of personal data , and equivalent sanctions in all member states as well as effective co - operation by the supervisory authorities of different member states . to take account of the specific situation of micro , small and medium - sized enterprises , this regulation includes a number of derogations . in addition , the union institutions and bodies , member states and their supervisory authorities are encouraged to take account of the specific needs of micro , small and medium - sized enterprises in the application of this regulation . the notion of micro , small and medium - sized enterprises should draw upon commission recommendation 2003 / 361 / ec of 6 may 2003 concerning the definition of micro , small and medium - sized enterprises . ### in order to ensure a consistent level of protection for individuals throughout the union and to prevent divergences hampering the free movement of data within the internal market , a regulation is necessary to provide legal certainty and transparency for economic operators , including micro , small and medium - sized enterprises , and to provide individuals in all member states with the same level of legally enforceable rights and obligations and responsibilities for controllers and processors , to ensure consistent monitoring of the processing of personal data , and equivalent sanctions in all member states as well as effective co - operation by the supervisory authorities of different member states . to take account of the specific situation of micro , small and medium - sized enterprises , this regulation includes a number of derogations . in addition , the union institutions and bodies , member states and their supervisory authorities are encouraged to take account of the specific needs of micro , small and medium - sized enterprises in the application of this regulation , and also take into account the ' think small first ' principle , so that the interests of micro , small and medium - sized enterprises are taken into account at the very early stages of policy making . the notion of micro , small and medium - sized enterprises should draw upon commission recommendation 2003 / 361 / ec of 6 may 2003 concerning the definition of micro , small and medium - sized enterprises .


### complying with the requirements for prior authorisation or prior consultation of the supervisory authority pursuant to article 34 and ; ### existence of appropriate documentation of data processing to enable compliance with the obligations arising from the regulation ;


### processing is necessary for the purposes of the legitimate interests pursued by a controller , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child . this shall not apply to processing carried out by public authorities in the performance of their tasks . ### processing is necessary for the purposes of the legitimate interests pursued by a controller , or by the third party or parties in whose interest the data is processed , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child . this shall not apply to processing carried out by public authorities in the performance of their tasks .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object in the cases of points , and of article 6 on predominant , and protection - worthy grounds relating to their particular situation , at any time to the processing of their personal data . in the case of a justified objection the processing by the controller may no longer refer to this data


### the commission may specify the electronic format referred to in paragraph 1 and the technical standards , modalities and procedures for the transmission of personal data pursuant to paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the electronic format , related functionalities and procedures for the transmission of personal data pursuant to paragraph 2 , shall be determined by the controller by reference to the most appropriate industry standards available or as defined by industry stakeholders or standardisation bodies . the commission shall promote and assist industry , stakeholders and standardisation bodies in the mapping and adoption of technical standards , modalities and procedures for the transmission of personal data pursuant to paragraph 2 .


### the main establishment of a controller in the union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment . the main establishment of the processor should be the place of its central administration in the union . ### where a controller or a processor has multiple establishments in the union , including but not limited to cases where the controller or the processor is a group of undertakings , the main establishment of a controller in the union for the purposes of this regulation should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation . ### the delegation of power referred to in article 14 , article 26 , article 33 , article 35 , article 37 , article 39 and article 43 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay . where this cannot achieved within a reasonable time period , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ‘ journalistic’ for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes . ### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly and irrespective of the medium which is used to transmit them .


### every natural person should have the right not to be subject to a measure which is based on profiling by means of automated processing . however , such measure should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child . ### every natural or legal person should have the right not to be subject to a measure which is based on profiling by means of automated processing . however , such measure should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child .


### the right to lodge a complaint to the supervisory authority and the contact details of the supervisory authority ; ### the right to lodge a complaint to the supervisory authority ;


### ‘ main establishment’ means as regards the controller , the place of its establishment in the union where the main decisions as to the purposes , conditions and means of the processing of personal data are taken ; if no decisions as to the purposes , conditions and means of the processing of personal data are taken in the union , the main establishment is the place where the main processing activities in the context of the activities of an establishment of a controller in the union take place . as regards the processor , ‘ main establishment’ means the place of its central administration in the union ; ### ' main establishment ' means the location as determined by the data controller or data processor on the basis of the following transparent and objective criteria : the location of the group ' s european headquarters , or , the location of the company within the group with delegated data protection responsibilities , or , the location of the company which is best placed to address and enforce the rules as set out in this regulation , or , the place where the main decisions as to the purposes of processing are taken for the regional group ;