### while this directive does not aim to harmonise national laws on the selection procedures and qualification criteria for board positions in detail , the introduction of certain minimum standards as regards the requirement for listed companies without balanced gender representation to take appointment decisions for non - executive directors on the basis of an objective comparative assessment of the qualifications of candidates in terms of suitability , competence and professional performance is necessary in order to attain gender balance among non - executives directors . only an eu - level measure can effectively help to ensure a competitive level - playing field throughout the union and avoid practical complications in business life . ### while this directive does not aim to harmonise national laws on the selection procedures and qualification criteria for board positions in detail , the introduction of certain minimum standards as regards the requirement for listed companies without balanced gender representation to take appointment decisions for non - executive directors on the basis of an objective comparative assessment of the qualifications of candidates in terms of suitability , competence and professional performance is necessary in order to attain gender balance among non - executives directors . only an eu - level measure can effectively help to ensure a competitive level - playing field throughout the union and avoid practical complications in business life and allow executives and directors to make full use of the opportunities the internal market has to offer .


### member states may have already taken measures providing for means to ensure a more balanced representation of women and men in company boards before the entry into force of this directive . such member states should have an opportunity to apply those measures in place of the procedural requirements relating to appointments where they can demonstrate that the measures taken are of equivalent efficacy in order to attain the objective of a presence of the under - represented sex of at least 40 per cent among non - executive directors of listed companies at the latest by 1 january 2020 or at the latest by 1 january 2018 in case of listed companies which are public undertakings . ### member states may have already taken measures providing for means to ensure a more balanced representation of women and men in company boards before the entry into force of this directive . such member states should have an opportunity to apply those measures in place of the procedural requirements relating to appointments where they can demonstrate that the measures taken are of equivalent efficacy in order to attain the objective of a presence of the under - represented sex of at least 40 per cent among non - executive directors of listed companies or the one third objective referred to in article 4 of this directive at the latest by 1 january 2020 or at the latest by 1 january 2018 in case of listed companies which are public undertakings . also e . g . self - regulatory measures aiming to ensure a more balanced representation of women and men among the non - executive directors of listed companies must be considered as relevant measures in this regard .


### this directive aims to improve the gender balance among directors of companies listed on stock exchanges and thus to contribute to the realisation of the principle of equal treatment between men and women , recognised as a fundamental right of the union . listed companies should therefore be required to disclose , upon the request of an unsuccessful candidate , not only the qualification criteria upon which the selection was based , but also the objective comparative assessment of those criteria and , where relevant , the considerations tilting the balance in favour of a candidate who is not of the under - represented sex . these limitations to the right to respect for private life with regard to the processing of personal data , recognised by the articles 7 and 8 of the charter , and the obligation for listed companies to supply that information , upon request , to the unsuccessful candidate , are necessary and , in conformity with the principle of proportionality , genuinely meet recognised objectives of general interest . they are therefore in line with the requirements for such limitations laid down in article 52 of the charter and with the relevant case - law of the court of justice . ### this directive aims to improve the gender balance among directors of companies listed on stock exchanges and thus to contribute to the realisation of the principle of equal treatment between men and women , recognised as a fundamental right of the union . listed companies should therefore be required to disclose , where possible , upon the request of an unsuccessful candidate , not only the qualification criteria upon which the selection was based , but also the objective comparative assessment of those criteria and , where relevant , the considerations tilting the balance in favour of a candidate who is not of the under - represented sex . this disclosure obligation does not apply where such disclosure would endanger trade secrets or would be impossible because the elected board member was proposed by the shareholders . these limitations to the right to respect for private life with regard to the processing of personal data , recognised by the articles 7 and 8 of the charter , and the obligation for listed companies to supply that information , upon request , to the unsuccessful candidate , are necessary and , in conformity with the principle of proportionality , genuinely meet recognised objectives of general interest . they are therefore in line with the requirements for such limitations laid down in article 52 of the charter and with the relevant case - law of the court of justice .


### member states shall ensure that listed companies are obliged to disclose , on the request of an unsuccessful candidate , the qualification criteria upon which the selection was based , the objective comparative assessment of those criteria and , where relevant , the considerations tilting the balance in favour of a candidate of the other sex . ### member states shall ensure that listed companies are obliged to disclose , on the request of an unsuccessful candidate , the qualification criteria upon which the selection was based , the objective comparative assessment of those criteria and , where relevant , the considerations tilting the balance in favour of a candidate of the other sex . this obligation does not apply where such disclosure would endanger trade secrets or would be impossible because the elected board member was proposed by the shareholders .


### without prejudice to article 4 and , member states which before the entry into force of this directive have already taken measures to ensure a more balanced representation of women and men among the non - executive directors of listed companies may suspend the application of the procedural requirements relating to appointments contained in article 4 , , and , provided that it can be shown that those measures enable members of the under - represented sex to hold at least 40 per cent of the non - executive director positions of listed companies by at the latest 1 january 2020 , or at the latest 1 january 2018 for listed companies which are public undertakings . ### without prejudice to article 4 , member states which before the entry into force of this directive have already taken measures to ensure a more balanced representation of women and men among the non - executive directors of listed companies or member states where other e . g . self - regulatory measures aiming to ensure a more balanced representation of women and men among the non - executive directors of listed companies exist may suspend the application of the procedural requirements relating to appointments contained in article 4 , , and and the application of article 5 , provided that it can be shown that those measures enable members of the under - represented sex to hold either at least 40 per cent of the non - executive director positions of listed companies or the one - third objective referred to in article 4 by at the latest 1 january 2020 , or at the latest 1 january 2018 for listed companies which are public undertakings . the member state in question shall notify this information to the commission .


### creating conditions for well managed mobility of people and promotion of people - to - people contacts ; ### creating conditions for well managed mobility of people and promotion of people - to - people contacts furthering mutual understanding ;


### sustainable and inclusive development in all aspects , poverty reduction , including through private - sector development ; promotion of internal economic , social and territorial cohesion , rural development , climate action and disaster resilience ; ### sustainable and inclusive development in all aspects , poverty reduction , including through private - sector development and sound education and training programmes , promotion of internal economic , social and territorial cohesion , rural development , climate action and disaster resilience ;


### sustainable and inclusive development in all aspects , poverty reduction , including through private - sector development ; promotion of internal economic , social and territorial cohesion , rural development , climate action and disaster resilience ; ### sustainable and inclusive development in all aspects , poverty reduction , including through private - sector development ; promotion of internal economic , social and territorial cohesion , rural development , climate action and disaster resilience , in addition to protection of the historical , artistic , archaeological , cultural and environmental heritage ;


### sustainable and inclusive development in all aspects , poverty reduction , including through private - sector development ; promotion of internal economic , social and territorial cohesion , rural development , climate action and disaster resilience ; ### sustainable and inclusive development in all aspects , poverty reduction , including through private - sector development ; promotion of internal economic , social and territorial cohesion , rural development , climate action , development of cultural heritage and disaster resilience ;


### it is necessary to ensure the european added value of all actions carried out within in the framework of the programme , and complementarity to activities of member states in compliance with article 167 of the treaty on the functioning of the european union and other activities , in particular in the field of culture , research , industrial and cohesion policy , enlargement policy and external relations . ### it is necessary to ensure the european added value of all actions carried out within in the framework of the programme , complementarity to activities of member states in compliance with article 167 of the treaty on the functioning of the european union and other activities , in particular in the field of culture , research , industrial and cohesion policy , enlargement policy and external relations , and policy coherence for development , in accordance with article 208 of the tfeu .


### to enhance the international dimension of education , training and youth notably in higher education by increasing the attractiveness of the union higher education institutions and supporting the union external action , including its development objectives through the promotion of mobility and cooperation between eu and third country higher education institutions and targeted capacity building in third countries . ### to enhance the international dimension of education , training and youth notably in higher education by increasing the attractiveness of the union higher education institutions , to support the union external action , including its development objectives , through the promotion of mobility and cooperation between eu and third country higher education institutions and targeted capacity building in third countries , where relevant , in accordance with the objectives specified in the external financing instruments from which the funding for the actions is derived .


### ‘ natural disturbance’ is any non - anthropogenic event or circumstance that causes significant emissions in forests or agricultural soils and the occurrence of which is beyond the control of the relevant member state provided the member state is also objectively unable to significantly limit the effect of the event or circumstance , even after its occurrence , on emissions ; ### ‘ natural disturbances’ are non - anthropogenic events or non - anthropogenic circumstances . for the purposes of this decision , these events or circumstances are those that cause significant emissions in forests and are beyond the control of , and not materially influenced by , a member state . these may include wildfires , insect and disease infestations , extreme weather events and / or geographical disturbances , beyond the control of , and not materially influenced by , a member state . these exclude harvesting and prescribed burning ;


### ‘ forest’ is an area of land of at least 0 , 5 hectare , with tree crown cover or an equivalent stocking level of at least 10 per cent of the area , covered with trees with the potential to reach a minimum height of at least 5 metres at maturity at their place of growth , including groups of growing young natural trees , or a plantation that has yet to reach a tree crown cover or equivalent stocking level of at least 10 per cent of the area or tree height of at least 5 metres , including any area that normally forms part of the forest area but on which there are temporarily no trees as a result of human intervention , such as harvesting , or as a result of natural causes , but which area can be expected to revert to forest ; ### ‘ forest’ is a minimum area of land of at least 0 , 05 - 1 , 0 hectare , with tree crown cover of more than 10 - 30 per cent with trees with the potential to reach a minimum height of 2 - 5 metres at maturity in situ . a forest may consist either of closed forest formations where trees of various storeys and undergrowth cover a high proportion of the ground or open forest . young natural stands and all plantations which have yet to reach a crown density of 10 - 30 per cent or tree height of 2 - 5 metres are included under forest , as are areas normally forming part of the forest area which are temporarily unstocked as a result of human intervention such as harvesting or natural causes but which are expected to revert to forest ;


### the delegation of power referred to in articles 2 , 4 , 6 , 7 and 9 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in articles 4 , 7 and 9 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### the lulucf accounting rules should reflect efforts made in the agriculture and forestry sectors to enhance the contribution of changes made to the use of land resources to the reduction of emissions . this decision should provide for accounting rules applicable on a mandatory basis to the forestry activities of afforestation , reforestation , deforestation and forest management , and to the agricultural activities of grazing land management and cropland management . it should also provide for accounting rules applicable on a voluntary basis to revegetation and wetland drainage and rewetting activities . ### the lulucf accounting rules should reflect efforts made in the agriculture and forestry sectors to enhance the contribution of changes made to the use of land resources to the reduction of emissions . this decision should provide for accounting rules applicable on a mandatory basis to the forestry activities of afforestation , reforestation , deforestation and forest management . it should also provide for accounting rules applicable on a voluntary basis to the agricultural activities of grazing land management and cropland management and to revegetation , wetland drainage and rewetting activities .


### member states may also draw up and maintain accounts that accurately reflect emissions and removals resulting from revegetation , and wetland drainage and rewetting . ### member states may also choose to draw up and maintain accounts for the first accounting period that accurately reflect emissions and removals resulting from cropland management and grazing land management , revegetation , and wetland drainage and rewetting .


### contribute to economic growth and support the development of the single market resulting in the improvement of the competitiveness of the european economy , including small and medium sized enterprises . ### contribute to economic growth , wealth generation and job creation and support the development of the single market resulting in the improvement of the competitiveness of the european economy , including small and medium sized enterprises .


### telecommunications networks and services are increasingly becoming internet - based infrastructures , with broadband networks and digital services closely interrelated . the internet is becoming the dominant platform for communication , services , and doing business . therefore , the trans - european availability of fast internet access and digital services in the public interest is essential for economic growth and the single market . ### telecommunications networks and services are increasingly becoming internet - based infrastructures , with broadband networks and digital services closely interrelated . the internet is becoming the dominant platform for communication , services , and doing business . therefore , the trans - european availability of fast internet access and digital services in the public interest is essential for economic growth , competitiveness and the single market .


### stimulate europe - wide deployment of fast and ultra - fast broadband networks which , in turn , shall facilitate the development and deployment of trans - european digital services . ### stimulate europe - wide deployment of fast and ultra - fast broadband networks which , in turn , shall facilitate the development and deployment of trans - european digital services and ensure the sustained competitiveness of european industry ;


### contribute to improvements in daily life for citizens , businesses and governments through the promotion of the interconnection and interoperability of national telecommunication networks as well as access to such networks . ### contribute to improvements in daily life for citizens , businesses and governments through the promotion of the interconnection and interoperability of national telecommunication networks as well as access to such networks , bearing in mind that the more sparsely populated and less developed regions must be included and served with connections .


### the deployment of broadband networks to link island , landlocked and peripheral regions with the central regions of the union ensuring in those regions that speeds of data transmission are sufficient to permit broadband connectivity of 30 mbps and above ; ### the deployment of broadband networks to link island , landlocked and peripheral regions with the central regions of the union ensuring in those regions that speeds of data transmission are sufficient to permit broadband connectivity of 30 mbps and above , taking into account the demand for ultra - fast internet ;


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission with regard to the establishment and amendment of the lists of animal diseases and zoonoses which qualify for union funding , as well as the establishment of work programmes . when amending the list of animal diseases qualifying for emergency measures funding , the commission should take into account the animal diseases which must be notified in accordance with council directive 82 / 894 / eec of 21 december 1982 on the notification of animal diseases within the community . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission in respect of the implementation of annual work programmes . this implementing power should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers .


### the commission shall , by means of implementing acts , adopt common or separate annual or multiannual work programmes for the implementation of the measures referred to in title ii , except for section 1 of chapter i and section 1 of chapter ii . those implementing acts shall be adopted in accordance with the examination procedure referred to in article&#160 ; 39 . ### to further specify the direction of the work programmes and take into account developments concerning animal health and welfare and plant health , the commission shall be empowered to adopt delegated acts in accordance with article 38a laying down : priorities based on the objectives set out in article 2 , as reflected in the work programmes referred to in paragraph 1a ; essential evaluation criteria for the national programmes referred to in articles 10 , 23 and 27 ; the list of specific tasks of particular importance for the union which benefit from a rate of union funding of 100% , referred to in article 6 .


### the payment request for a given year in respect of a national programme shall be submitted by the member state to the commission by 31 march of the following year . ### the payment request for a given year in respect of a national programme shall be submitted by the member state to the commission by 30 april of the following year .


### in order to swiftly address the emergence and spread of harmful new psychoactive substances in the union , member states should apply the provisions of the framework decision 2004 / 757 / jha to new psychoactive substances posing severe health , social and safety risks within twelve months from their submission to permanent market restriction under [ regulation no … / … on new psychoactive substances ] . ### in order to swiftly address the emergence and spread of harmful new psychoactive substances in the union , member states should apply the provisions of the framework decision 2004 / 757 / jha to new psychoactive substances posing severe health , social and safety risks as quickly as possible and in any event no later than twelve months from their submission to permanent market restriction under [ regulation no … / … on new psychoactive substances ] .


### in article 1 , point 1 is replaced by the following : ' ‘ drug’ means : any of the substances covered by the 1961 united nations single convention on narcotic drugs and the 1971 united nations convention on psychotropic substances ; any of the substances listed in the annex ; any new psychoactive substance posing severe health , social and safety risks , subjected to permanent market restriction on the basis of [ article 13 of regulation no … / … on new psychoactive substances ] ; ' ### in article 1 , point 1 is replaced by the following : ' ‘ drugs’ : means any of the following substances : any of the substances covered by the 1961 united nations single convention on narcotic drugs and the 1971 united nations convention on psychotropic substances ; any of the substances listed in the annex ; any new psychoactive substance posing severe health , social and safety risks , subjected to permanent market restriction on the basis of [ article 13 of regulation no … / … on new psychoactive substances ] ; any mixture or solution containing one or more substances listed in points , and ; '


### in article 1 , point 1 is replaced by the following : ' ‘ drug’ means : any of the substances covered by the 1961 united nations single convention on narcotic drugs and the 1971 united nations convention on psychotropic substances ; any of the substances listed in the annex ; any new psychoactive substance posing severe health , social and safety risks , subjected to permanent market restriction on the basis of [ article 13 of regulation no … / … on new psychoactive substances ] ; ' ### in article 1 , point 1 is replaced by the following : ' ‘ drugs’ : shall mean any of the following substances : any of the substances covered by the 1961 united nations single convention on narcotic drugs and the 1971 united nations convention on psychotropic substances ; any of the substances listed in the annex ; any new psychoactive substance posing severe health , social and safety risks , subjected to permanent market restriction on the basis of [ article 13 of regulation no … / … on new psychoactive substances ] ; any mixture or solution containing one or more substances listed in points , and ; '


### the president of the economic and financial committee . ### three of the six independent persons referred to in article 6 .


### before requesting information in accordance with paragraph 3 and 4 , the esrb shall duly consult the relevant european supervisory authority in order to ensure that the request is proportionate . ### before requesting information in accordance with paragraph 3 and 4 , the esrb shall duly consult the relevant european supervisory authority in order to ensure that the request is proportionate . the additional obligation of data provision incurred by financial institutions at the request of the esrb should not lead to any disproportionate increase in administrative burdens .


### the chair and vice - chair of the esrb shall be elected for a term of 5 years by and from the members of the general board who are also members of the general council of the ecb . they may be re - elected . ### the chair of the esrb shall be the president of the ecb . his or her term of office shall be the same as his or her term of office as president of the ecb .


### where a recommendation referred to in letter of article 3 is addressed to one or more member states , one or more european supervisory authorities , or one or more national supervisory authorities , the addressees shall communicate the actions undertaken in response to the recommendations to the esrb or explain why they have not acted . the council and , where relevant , the european supervisory authorities shall be informed . ### where a recommendation referred to in point of article 3 is addressed to the commission , one or more member states , one or more european supervisory authorities , or one or more national supervisory authorities , the addressees shall communicate the actions undertaken in response to the recommendations to the esrb or explain why they have not acted . the council and , where relevant , the european supervisory authorities shall be informed .


### the esrb may address a reasoned request to the european supervisory authorities to provide data that are not in summary or collective form . ### pursuant to a reasoned request by the esrb , the european supervisory authorities shall provide data that are not in summary or collective form .


### the steering committee shall assist in the decision - making process of the esrb by supporting the preparation of the meetings of the general board , reviewing the documents to be discussed and monitoring the progress of the esrb’s ongoing work . ### the steering committee shall assist in the decision - making process of the esrb by supporting the preparation of the meetings of the general board , reviewing the documents to be discussed and monitoring the progress of the esrb’s ongoing work . where the general board is called upon to take decisions on sector - specific matters , the steering committee shall work in close collaboration with the competent european authority and its appropriate stakeholder group for the purpose of compiling the papers for meetings .


### in order to increase their weight and legitimacy , such warnings and recommendations should be transmitted through the council and , where appropriate , the european banking authority established by regulation no … / … the european parliament and of the council , the european securities and markets authority established by regulation no … / … of the european parliament and of the council , and the european insurance or the occupational pension authority established by regulation no … / …of the european parliament and of the council . ### in order to increase their weight and legitimacy , such warnings and recommendations should be transmitted directly to the addressees , and in copy to the european parliament , the council and , where appropriate , the european banking authority established by regulation no … / … the european parliament and of the council , the european securities and markets authority established by regulation no … / … of the european parliament and of the council , and the european insurance or the occupational pension authority established by regulation no … / …of the european parliament and of the council .


### the vice - chair of the esrb ; ### the first and second vice - chairs of the esrb ;


### in order to increase their weight and legitimacy , such warnings and recommendations should be transmitted through the council and , where appropriate , the european banking authority established by regulation no … / … the european parliament and of the council , the european securities and markets authority established by regulation no … / … of the european parliament and of the council , and the european insurance or the occupational pension authority established by regulation no … / …of the european parliament and of the council . ### in order to increase their weight and legitimacy , such warnings and recommendations should be transmitted through the european parliament , the council and , where appropriate , the esa .


### the warnings or recommendations shall also be transmitted to the council and , where addressed to one or more national supervisory authority , to the european supervisory authorities . ### the warnings or recommendations shall also be transmitted to the european parliament , the council and , where addressed to one or more national supervisory authority , to the european supervisory authorities .


### the esrb may request information from the european supervisory authorities in summary or collective form , such that individual financial institutions cannot be identified . if the requested data are not available to those authorities or are not made available in a timely manner , the esrb may request the data from national supervisory authorities , national central banks or other authorities of member states . ### on request by the esrb , the european supervisory authorities shall provide information in summary or collective form , such that individual financial institutions cannot be identified . if the requested data are not available to those authorities or are not made available in a timely manner , and in any event within 60 days of the request , national supervisory authorities , national central banks or other authorities of member states shall provide the data pursuant to a request by the esrb .


### the council shall examine this regulation on the basis of a report from the commission three years after its entry into force and shall determine whether the missions and organisation of the esrb need to be reviewed after having received an opinion from the ecb . ### the european parliament and the council shall examine this regulation on the basis of a report from the commission three years after its entry into force and shall determine whether the missions and organisation of the esrb need to be reviewed after having received an opinion from the ecb . the report should assess , in particular , whether : - the architecture of the esfs needs to be simplified and reinforced , in order to increase the coherence between the macro and the micro levels as well as between the esas ; - the regulatory powers of the esas need to be increased ; - the evolution of the esfs is consistent with that of the global evolution ; - there is sufficient diversity and excellence within the esfs ;


### the esrb should also monitor compliance with its recommendations , based on reports from addressees , in order to ensure that its warnings and recommendations are effectively followed . addressees of recommendations should act on them unless inaction can be adequately justified . ### the esrb should also monitor compliance with its recommendations , based on reports from addressees , in order to ensure that its warnings and recommendations are effectively followed . addressees of recommendations should act on them unless inaction can be adequately justified , in particular towards the european parliament .


### when the agenda of a meeting contains points pertaining to the competence of several national supervisory authorities in the same member state , the respective high level representative shall only participate in the discussion on items falling under his or her competence . ### with regard to the representation of national supervisory authorities , the respective high level representatives shall rotate depending on the item discussed , unless the national supervisory authorities have agreed on a common representative .


### the esrb shall also examine specific issues at the invitation of the council or the commission . ### the esrb shall also examine specific issues at the invitation of the european parliament , the council or the commission .


### the esrb may request information from the european supervisory authorities in summary or collective form , such that individual financial institutions cannot be identified . if the requested data are not available to those authorities or are not made available in a timely manner , the esrb may request the data from national supervisory authorities , national central banks or other authorities of member states . ### on the request of the esrb , the european supervisory authorities shall provide information in summary or collective form . if the requested data are not available to those authorities or are not made available in a timely manner , national supervisory authorities , national central banks or other authorities of member states shall provide the appropriate data pursuant to a request by the esrb .


### the esrb should , where appropriate , issue warnings and recommendations of a general nature concerning the community as a whole , individual member states or groups of member states , with a specified timeline for the relevant policy response . ### the esrb should , where appropriate , issue warnings and recommendations of a general nature concerning the community as a whole , individual member states or groups of member states , with a specified timeline for the relevant policy response . where such warnings or recommendations are addressed to individual or a group of member states , the esrb should also propose appropriate support measures that could , for example , be provided by the european system of central banks .


### in order to increase their weight and legitimacy , such warnings and recommendations should be transmitted through the council and , where appropriate , the european banking authority established by regulation no … / … the european parliament and of the council , the european securities and markets authority established by regulation no … / … of the european parliament and of the council , and the european insurance or the occupational pension authority established by regulation no … / …of the european parliament and of the council . ### in order to increase their weight and legitimacy , such warnings and recommendations should be transmitted through the european parliament , the council and , where appropriate , the european supervisory authority .


### if the esrb decides that its recommendation has not been followed and that the addressees have failed to explain their inaction appropriately , it shall inform the council and , where relevant , the european supervisory authorities concerned . ### if the esrb decides that its recommendation has not been followed or it is not satisfied on how the addressees have followed up the recommendations , and that the addressees have failed to provide adequate justifications , it shall inform the european parliament , the council and , where relevant , the european supervisory authorities concerned .


### the advisory technical committee shall be composed of the following : a representative of each national central bank and a representative of the ecb ; one representative per member state of the competent national supervisory authority ; one representative of the european banking authority ; one representative of the european insurance and occupational pensions authority ; one representative of the european securities and markets authority ; two representatives of the commission ; one representative of the economic and financial committee . the supervisory authorities of each member state shall choose one representative in the committee . when the agenda of a meeting contains points pertaining to the competence of several national supervisory authorities in the same member state , the respective representative shall participate only for the agenda items falling under his competence . ### the advisory technical committee shall be composed of 15 experts with acknowledged competences and guaranteed independence proposed by the steering committee . they shall represent a wide range of experiences and skills . they shall be approved by the general board for a four - year mandate , renewable once .


### where a recommendation referred to in letter of article 3 is addressed to one or more member states , one or more european supervisory authorities , or one or more national supervisory authorities , the addressees shall communicate the actions undertaken in response to the recommendations to the esrb or explain why they have not acted . the council and , where relevant , the european supervisory authorities shall be informed . ### where a recommendation referred to in point of article 3 is addressed to one or more member states , one or more european supervisory authorities , or one or more national supervisory authorities , the addressees shall communicate the actions undertaken in response to the recommendations to the esrb or explain why they have not acted . the european parliament , the council and , where relevant , the european supervisory authorities shall be informed .


### each member of the general board with a voting right shall have one vote . ### the general board shall strive for consensus . where consensus cannot be achieved each member of the general board with a voting right shall have one vote . any member of the board may , at any time , request a vote on a draft warning or a draft recommendation .


### in performing its tasks , the esrb shall seek , where appropriate , the advice of relevant private sector stakeholders . ### in performing its tasks , the esrb shall seek , where appropriate , the advice of relevant private or public sector stakeholders , particularly but not exclusively , the stakeholder groups of the esas .


### the esrb may request information from the european supervisory authorities in summary or collective form , such that individual financial institutions cannot be identified . if the requested data are not available to those authorities or are not made available in a timely manner , the esrb may request the data from national supervisory authorities , national central banks or other authorities of member states . ### on request by the esrb , the european supervisory authorities shall provide information in summary or collective form , such that individual financial institutions cannot be identified . if the requested data are not available to those authorities or are not made available in a timely manner , national supervisory authorities , national central banks or other authorities of member states shall provide the data pursuant to a request by the esrb .


### the present community arrangements place too little emphasis on macro - prudential oversight . responsibility for macro - prudential analysis remains fragmented , and is conducted by various authorities at different levels with no mechanism to ensure that macro - prudential risks are adequately identified and that warnings and recommendations are issued clearly , followed up and translated into action . ### a proper functioning of union and global financial systems and the mitigation of threats thereto require enhanced consistency between macro and the micro supervision . as stated in the turner review , “a regulatory response to the global banking crisis” , of march 2009 , ' sounder arrangements require either increased national powers , implying a less open single market , or a greater degree of european integration ' . given the role of a sound financial system in terms of its contribution to competitiveness and growth in the union and its impact on the real economy , the de larosière group , followed by the eu institutions , have opted for a greater degree of european integration .


### the warnings or recommendations shall also be transmitted to the council and , where addressed to one or more national supervisory authority , to the european supervisory authorities . ### the warnings or recommendations shall also be transmitted to the addressees in accordance with paragraph 2 , to the council and , where addressed to one or more national supervisory authority , to the european supervisory authorities .


### when the agenda of a meeting contains points pertaining to the competence of several national supervisory authorities in the same member state , the respective high level representative shall only participate in the discussion on items falling under his or her competence . ### with regard to the representation of national supervisory authorities , the respective high level representatives shall rotate according to the item to be discussed , unless the national supervisory authorities have agreed on a common representative .


### the esrb may request information from the european supervisory authorities in summary or collective form , such that individual financial institutions cannot be identified . if the requested data are not available to those authorities or are not made available in a timely manner , the esrb may request the data from national supervisory authorities , national central banks or other authorities of member states . ### on request by the esrb , the european supervisory authorities shall provide information in summary or collective form , such that individual financial institutions cannot be identified . if the requested data are not available to those authorities or are not made available in a timely manner , and in any event within 60 days of the request , national supervisory authorities , national central banks or other authorities of member states shall provide the data pursuant to a request by the esrb .


### one high level representative per member state of the competent national supervisory authorities ; ### one high level representative per member state of the competent national supervisory authorities , in accordance with paragraph 3 ;


### when significant risks to the achievement of the objective in article 3 are identified , the esrb shall provide warnings and , where appropriate , issue recommendations for remedial action . ### when significant risks to the achievement of the objective in article 3 are identified , the esrb shall provide warnings and , where appropriate , issue recommendations for remedial action , including , where appropriate , for legislative initiatives .


### cooperate closely with the european system of financial supervisors and , where appropriate , provide the european supervisory authorities with the information on systemic risks required for the achievement of their tasks ; ### cooperate closely with all the other parties to the esfs and , where appropriate , provide the european supervisory authorities with the information on systemic risks required for the achievement of their tasks ;


### the esrb shall report at least annually to the european parliament and to the council . ### the esrb shall report at least biannually to the european parliament and to the council .


### five other members of the general board who are also members of the general council of the ecb . they shall be elected by and from the members of the general board who are also members of the general council of the ecb for a period of two years . ### five other members of the general board who are also members of the general council of the ecb , including the vice - president of the ecb , with regard to the need for a balanced representation of member states and those within and outside the euro area . they shall be elected by and from among the members of the general board who are also members of the general council of the ecb for a period of four years ;


### five other members of the general board who are also members of the general council of the ecb . they shall be elected by and from the members of the general board who are also members of the general council of the ecb for a period of two years . ### two other members of the general board who are also members of the general council of the ecb , representing euro and non - euro area member states . they shall be elected by and from among the members of the general board who are also members of the general council of the ecb for a period of two years ;


### when the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay . ### when the personal data breach is likely to have a serious adverse effect on the protection of the personal data or privacy of the data subject , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay .


### the data are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort ; or ### the data are meant to serve solely the purposes of art . 83 , are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort ; or


### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . the controller shall use all reasonable measures to verify the identity of a data subject requesting access to data .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , addressing such economic loss and social harm should be the first and utmost priority . after that , the controller should notify the breach to the supervisory authority without undue delay . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation , damage to reputation or money loss . the notification to the supervisory authority should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that a breach which may significantly adversely affect the protection of the personal data or the privacy of the data subject concerned has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as significantly adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ' personal data in the employment context . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject . ### consent shall be freely given and the data subject shall not be forced to consent for processing of its data , especially where there is a significant imbalance between data subject and controller . this may be the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ' personal data in the employment context . however , when the purpose of data processing is in the interest of the data subject and the data subject is subsequently able to withdraw consent without detriment , the consent should provide a valid legal ground for processing . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach which significantly affects the data subject , the controller shall , without undue delay after having become aware of it , notify the personal data breach to the supervisory authority .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation . ### the delegation of power referred to in article 8 , article 9 , article 12 , article 20 , article 23 , article 30 , article 33 , article 34 , article 39 , article 43 , article 44 , article 79 and article 82 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation .


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 8 , article 9 , article 12 , article 20 , article 23 , article 30 , article 33 , article 34 , article 39 , article 43 , article 44 , article 79 , and article 82 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach , the controller shall without undue delay notify the personal data breach to the supervisory authority .


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person . in order to determine whether a person can be identified , account should be taken of : the means likely reasonably to be used by the controller or any other natural or legal person who accesses the data to identify such a person and b ) the measures that the controller or the processor has put in place in order to prevent the information from fully identifying a natural person . a natural person is ' indirectly identifiable ' when the data processed allows the controller to solely individualise one person from another and the controller cannot verify its identity .


### ‘ the data subject ' s consent’ means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; ### ' the data subject ' s consent ' means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; by ' clear affirmative action ' is meant any unequivocal action that is the result of a choice and that implies , for its complete execution , a necessary data processing ;


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 8 , article 9 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### the period for which the personal data will be stored ; ### the criteria for determining the period for which the personal data will be stored for each purpose ;


### right to be forgotten and to erasure ### right to erasure


### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that identification numbers , location data , online identifiers or other specific factors as such need not necessarily be considered as personal data in all circumstances . ### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that a study should be conducted , on a case - by - case basis and in accordance with technological developments , into whether identification numbers , location data , online identifiers or other specific factors as such must necessarily be considered as personal data .


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data or an identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ;


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person to whom data have been disclosed by the controller , in particular by reference to an identification number , location data , online identifier or other unique identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ;


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation . ### the delegation of power referred to in article 6 , article 8 , article 12 , article 14 , article 15 , article 17 , article 20 , article 23 , article 26 , article 37 , article 39 , article 43 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in article 8 , article 9 , article 12 , article 20 , article 23 , article 30 , article 33 , article 34 , article 39 , article 43 , article 44 , article 79 , and article 82 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , addressing such economic loss and social harm should be the first and utmost priority . after that , the controller should notify the breach to the supervisory authority without undue delay . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation , damage to reputation or money loss . the notification to the supervisory authority should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 6 , article 8 , article 12 , article 14 , article 15 , article 17 , article 20 , article 23 , article 26 , article 37 , article 39 , article 43 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . ### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the particular categories of personal data , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in article 8 , article 9 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation . ### the power to adopt delegated acts referred to in article 8 , article 9 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation .


### when the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay . ### when the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject , or when the intervention of the data subject can decisively mitigate the possible adverse effects of the personal data breach , the controller shall , together with the other urgent measures and before the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a significant personal data breach , the controller shall without undue delay notify the personal data breach to the supervisory authority . data breach shall be considered significant if it could adversely affect privacy of the data subject .


### the data subject shall have the right to withdraw his or her consent at any time . the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal . ### the data subject shall have the right to withdraw his or her consent at any time . the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal . if the consent is still necessary for the execution of a contract , its withdrawal implies the willingness to terminate the contract .


### ‘ the data subject ' s consent’ means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; ### ' the data subject ' s consent ' means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; by ' clear affirmative action ' is meant any unequivocal action that is the result of a choice and that implies , for its complete execution , a necessary data processing ;


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 8 , article 9 , article 12 , article 20 , article 23 , article 30 , article 33 , article 34 , article 39 , article 43 , article 44 , article 79 , and article 82 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### where the controller referred to in paragraph 1 has made the personal data public , it shall take all reasonable steps , including technical measures , in relation to data for the publication of which the controller is responsible , to inform third parties which are processing such data , that a data subject requests them to erase any links to , or copy or replication of that personal data . where the controller has authorised a third party publication of personal data , the controller shall be considered responsible for that publication . ### where the controller referred to in paragraph 1 has transferred the personal data , or has made such data public without being clearly instructed by the data subject to do so , it shall take all reasonable steps in relation to data for the publication of which the controller is responsible , to inform third parties which are processing such data , that a data subject requests them to erase any links to , or copy or replication of that personal data . where the controller has authorised a third party publication of personal data , the controller shall be considered responsible for that publication .


### each member state shall notify to the commission the rules adopted pursuant to paragraph 1 , by the date specified in article 91 at the latest and , without delay , any subsequent amendment affecting them . ### each member state shall notify to the commission the rules adopted pursuant to paragraph 1 , in order for the commission to verify the consistency with the other member states rules , by the date specified in article 91 at the latest and , without delay , any subsequent amendment affecting them .


### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that identification numbers , location data , online identifiers or other specific factors as such need not necessarily be considered as personal data in all circumstances . ### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that identification numbers , location data , online identifiers or other specific factors as such need not necessarily be considered as personal data in all circumstances , but shall be considered as one , when processed with the intention of targeting particular content at an individual or of singling that individual out for any other purpose ;


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in article 6 , article 8 , article 12 , article 14 , article 15 , article 17 , article 20 , article 23 , article 26 , article 30 , article 37 , article 39 , article 43 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that a breach which may significantly adversely affect the protection of the personal data or the privacy of the data subject concerned has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as significantly adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### the controller shall communicate any rectification or erasure carried out in accordance with articles 16 and 17 to each recipient to whom the data have been disclosed , unless this proves impossible or involves a disproportionate effort . ### any rectification or erasure carried out in accordance with articles 16 and 17 is extended to each recipient to whom the data have been disclosed without the control of the data subject .


### the offering of goods or services to such data subjects in the union ; or ### the offering of goods and services to such data subjects in the union , including services provided without financial costs to the individual , or ;


### the main establishment of a controller in the union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment . the main establishment of the processor should be the place of its central administration in the union . ### the main establishment of a controller or a processor in the union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in article 8 , article 9 , article 12 , article 20 , article 23 , article 30 , article 33 , article 34 , article 39 , article 43 , article 44 , article 79 , and article 82 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### general objective and specific objective ### general objective


### the priorities of the programme shall be the following : to support the preparation , coherent application and effective implementation of union law , with a view of strengthening the customs union in terms of efficiency , effectiveness and uniformity . to strengthen the competitiveness of european businesses through the facilitation of legitimate trade , the reduction of compliance costs and administrative burden , and the protection against unfair competition , to support customs in protecting citizens , safety and security and the environment . to ensure the protection of the financial and economic interests of the european union and the member states ; to contribute to the efficient functioning of customs authorities by improving their administrative capacity , to fight fraud and to enhance competitiveness , safety and security by enhancing cooperation with international organisations , third countries , other governmental authorities , economic operators and their organisations . ### the specific objectives of the programme shall be the following : to support the preparation , coherent application and effective implementation of union law , with a view of strengthening the customs union in terms of efficiency , effectiveness and uniformity ; to strengthen the competitiveness of european businesses through the facilitation of legitimate trade , the reduction of compliance costs and administrative burdens , and protection against unfair competition ; to prevent fraud so as to protect citizens , safety and security and the environment ; to fight fraud and to enhance competitiveness , safety and security by enhancing cooperation with international organisations , third countries , other governmental authorities , economic operators and their organisations ; to strengthen the competitiveness of european businesses through the facilitation of trade and the reduction of compliance costs to ensure the protection of the financial and economic interests of the european union and of the member states ; to contribute to the efficient functioning of customs authorities by improving their administrative capacity . 2 . each of the specific objectives listed above shall be measured by an indicator based on the perception of programme stakeholders regarding the contribution made by the programme to the realisation of the specific objectives . the indicators shall be established and , if necessary , modified in an annual work programme .


### the general objective of the programme shall be to strengthen the internal market through an efficient and effective customs union . 2 . the specific objective of the programme shall be to support the functioning of the customs union , in particular through cooperation between participating countries , their customs authorities , other competent authorities , their officials and external experts . 3 . the achievement of this objective shall be measured on the basis of the following indicators : the availability of the common communication network for the european information systems ; the feedback from participants in programme actions and users of the programme . ### the general objective of the programme shall be to support the functioning of the customs union and to strengthen the internal market through cooperation between participating countries , their customs authorities , their officials and external experts . that objective shall be measured by , inter alia , the following indicators : – the evolution of the perception of programme stakeholders regarding the contribution made by the programme to the strengthening of the internal market ; – the functioning of the customs union ; – the harmonising and standardising procedures for customs controls .


### the programme objectives take into account the problems and challenges identified for customs in the next decade . the programme should continue to play a role in vital areas like the coherent implementation of union customs and related law . moreover , the focus of the programme will be on protecting the financial and economic interests of the union , safeguarding safety and security , trade facilitation , among others through collaborative efforts to fight fraud and increasing the administrative capacity of customs authorities . ### the programme objectives take into account the problems and challenges identified for customs in the next decade . the programme should continue to play a role in vital areas like the coherent implementation of union customs and related law . moreover , the focus of the programme will be on protecting the financial and economic interests of the union , facilitating trade and increasing the administrative capacity of customs authorities . however , given the dynamics of the new challenges and the need to protect citizens from security and safety risks posed by international trade in goods , additional emphasis should be placed on combating fraud . furthermore , in times of scarce resources , there is an even stronger pressure to base customs controls on efficient and effective risk targeting , in order to reinforce customs risk management .