### 5. the management and other staff of the coordinating authorities shall , in accordance with union or national law , be subject to a duty of professional secrecy both during and after their term of office , with regard to any confidential information which has come to their knowledge in the course of the performance of their tasks. member states shall ensure that the management and other staff are subject to rules guaranteeing that they can carry out their tasks in an objective , impartial and independent manner , in particular as regards their appointment , dismissal , remuneration and career prospects. ### 5. without prejudice to national or union legislation on whistleblower protection , the management and other staff of the coordinating authorities shall , in accordance with union or national law , be subject to a duty of professional secrecy both during and after their term of office , with regard to any confidential information which has come to their knowledge in the course of the performance of their tasks. member states shall ensure that the management and other staff are subject to rules guaranteeing that they can carry out their tasks in an objective , impartial and independent manner , in particular as regards their appointment , dismissal , remuneration and career prospects.


### the power to carry out on-site inspections of any premises that those providers or the other persons referred to in point (a) use for purposes related to their trade , business , craft or profession , or to request other public authorities to do so , in order to examine , seize , take or obtain copies of information relating to a suspected infringement of this regulation in any form , irrespective of the storage medium; ### the power to carry out remote or on-site inspections of any premises that those providers or the other persons referred to in point (a) use for purposes related to their trade , business , craft or profession , or to request other public authorities to do so , in order to examine , seize , take or obtain copies of information relating to a suspected infringement of this regulation in any form , irrespective of the storage medium;


### the power to request information , including to assess whether the measures taken to execute a detection order , removal order or blocking order comply with the requirements of this regulation. ### the power to request information , to assess the compliance with the requirements of this regulation.


### the power to order the cessation of infringements of this regulation and , where appropriate , to impose remedies proportionate to the infringement and necessary to bring the infringement effectively to an end; ### the power to order specific measures to bring about the cessation of infringements of this regulation and , where appropriate , to impose remedies proportionate to the infringement and necessary to bring the infringement effectively to an end;


### the infringement persists; ### the infringement persists and;


### adopt and submit an action plan setting out the necessary measures to terminate the infringement; ### adopt and submit an action plan setting out the necessary measures to terminate the infringement , subject to the approval of the coordinating authority;


### (ii) the infringement persists and causes serious harm; ### (ii) the infringement persists and causes serious harm that is greater than the likely harm to users relying on the service for legal purposes and;


### the provider has failed to take the necessary measures to terminate the infringement; ### the provider has failed to take necessary and proportionate measures to terminate the infringement;


### 2. member states shall ensure that any exercise of the investigatory and enforcement powers referred to in articles 27 , 28 and 29 is subject to adequate safeguards laid down in the applicable national law to respect the fundamental rights of all parties affected. in particular , those measures shall only be taken in accordance with the right to respect for private life and the rights of defence , including the rights to be heard and of access to the file , and subject to the right to an effective judicial remedy of all parties affected. ### 2. member states shall ensure that any exercise of the investigatory and enforcement powers referred to in articles 27 , 28 and 29 is subject to adequate safeguards laid down in the applicable national law to respect the fundamental rights of all parties affected. in particular , those measures shall be targeted and precise , be taken in accordance with the right to respect for private life and the rights of defence , including the rights to be heard and of access to the file , and subject to the right to an effective judicial remedy of all parties affected.


### coordinating authorities shall have the power to carry out searches on publicly accessible material on hosting services to detect the dissemination of known or new child sexual abuse material , using the indicators contained in the databases referred to in article 44(1) , points (a) and (b) , where necessary to verify whether the providers of hosting services under the jurisdiction of the member state that designated the coordinating authorities comply with their obligations under this regulation. ### coordinating authorities shall have the power to carry out searches on publicly accessible material on hosting services to detect the dissemination of known or new child sexual abuse material , using the indicators contained in the databases referred to in article 44(1) , points (a) and (b).


### article 32 ### deleted


### 2. member states shall ensure that the maximum amount of penalties imposed for an infringement of this regulation shall not exceed 6 % of the annual income or global turnover of the preceding business year of the provider. ### 2. member states shall ensure that the maximum amount of penalties imposed for an infringement of this regulation shall not exceed 6 % of the annual worldwide turnover of the preceding business year of the provider.


### 3. penalties for the supply of incorrect , incomplete or misleading information , failure to reply or rectify incorrect , incomplete or misleading information or to submit to an on-site inspection shall not exceed 1% of the annual income or global turnover of the preceding business year of the provider or the other person referred to in article 27. ### 3. penalties for the supply of incorrect , incomplete or misleading information , failure to reply or rectify incorrect , incomplete or misleading information or to submit to an on-site inspection shall not exceed 1% of the annual income or worldwide turnover of the preceding business year of the provider or the other person referred to in article 27.


### 4. member states shall ensure that the maximum amount of a periodic penalty payment shall not exceed 5 % of the average daily global turnover of the provider or the other person referred to in article 27 in the preceding financial year per day , calculated from the date specified in the decision concerned. ### 4. member states shall ensure that the maximum amount of a periodic penalty payment shall not exceed 5 % of the average daily worldwide turnover of the provider or the other person referred to in article 27 in the preceding financial year per day , calculated from the date specified in the decision concerned.


### specific items of material and transcripts of conversations that coordinating authorities or that the competent judicial authorities or other independent administrative authorities of a member state have identified , after a diligent assessment , as constituting child sexual abuse material or the solicitation of children , as applicable , for the eu centre to generate indicators in accordance with article 44(3); ### anonymised specific items of material and transcripts of conversations related to a specific person , specific group of people ,or specific incident that coordinating authorities or that the competent judicial authorities or other independent administrative authorities of a member state have identified , after a diligent assessment , as constituting child sexual abuse material or the solicitation of children , as applicable , for the eu centre to generate indicators in accordance with article 44(3);


### exact uniform resource locators indicating specific items of material that coordinating authorities or that competent judicial authorities or other independent administrative authorities of a member state have identified , after a diligent assessment , as constituting child sexual abuse material , hosted by providers of hosting services not offering services in the union , that cannot be removed due to those providers’ refusal to remove or disable access thereto and to the lack of cooperation by the competent authorities of the third country having jurisdiction , for the eu centre to compile the list of uniform resource locators in accordance with article 44(3). ### exact uniform resource locators indicating specific items of material related to a specific person , specific group of people ,or specific incident that coordinating authorities or that competent judicial authorities or other independent administrative authorities of a member state have identified , after a diligent assessment , as constituting child sexual abuse material , hosted by providers of hosting services not offering services in the union , that cannot be removed due to those providers’ refusal to remove or disable access thereto and to the lack of cooperation by the competent authorities of the third country having jurisdiction , for the eu centre to compile a public list of states that facilitate crimes against children by not ensuring expeditious removal of child sexual abuse material.


### member states shall take the necessary measures to ensure that the coordinating authorities that they designated receive , without undue delay , the material identified as child sexual abuse material , the transcripts of conversations identified as the solicitation of children , and the uniform resource locators , identified by a competent judicial authority or other independent administrative authority than the coordinating authority , for submission to the eu centre in accordance with the first subparagraph. ### member states shall take the necessary measures to ensure that the coordinating authorities that they designated receive , without undue delay ,the encrypted copies of the material identified as child sexual abuse material , the transcripts of conversations related to a specific person , specific group of people ,or specific incident identified as the solicitation of children , and the uniform resource locators , identified by a competent judicial authority or other independent administrative authority than the coordinating authority , for submission to the eu centre in accordance with the first subparagraph.


### where the commission has reasons to suspect that a provider of relevant information society services infringed this regulation in a manner involving at least three member states , it may recommend that the coordinating authority of establishment assess the matter and take the necessary investigatory and enforcement measures to ensure compliance with this regulation. ### where , in the reasoned opinion of the commission , there are grounds to suspect that a provider of relevant information society services infringed this regulation in a manner causing harm in at least three member states , it may recommend that the coordinating authority of establishment assess the matter.


### any other information that the coordinating authority that sent the request , or the commission , considers relevant , including , where appropriate , information gathered on its own initiative and suggestions for specific investigatory or enforcement measures to be taken. ### any other information that the coordinating authority that sent the request , or the commission , considers relevant , including , where appropriate , information gathered on its own initiative .


### the coordinating authority of establishment shall assess the suspected infringement , taking into utmost account the request or recommendation referred to in paragraph 1. ### the coordinating authority of establishment shall assess the suspected infringement , taking into utmost account the request referred to in paragraph 1.


### where it considers that it has insufficient information to asses the suspected infringement or to act upon the request or recommendation and has reasons to consider that the coordinating authority that sent the request , or the commission , could provide additional information , it may request such information. the time period laid down in paragraph 4 shall be suspended until that additional information is provided. ### where it considers that it has insufficient information to asses the suspected infringement or to act upon the request and has reasons to consider that the coordinating authority that sent the request , or the commission , could provide additional information , it may request such information. the time period laid down in paragraph 4 shall be suspended until that additional information is provided.


### 4. the coordinating authority of establishment shall , without undue delay and in any event not later than two months following receipt of the request or recommendation referred to in paragraph 1 , communicate to the coordinating authority that sent the request , or the commission , the outcome of its assessment of the suspected infringement , or that of any other competent authority pursuant to national law where relevant , and , where applicable , an explanation of the investigatory or enforcement measures taken or envisaged in relation thereto to ensure compliance with this regulation. ### 4. the coordinating authority of establishment shall , without undue delay and in any event not later than two months following receipt of the request or recommendation referred to in paragraph 1 , communicate to the coordinating authority that sent the request , or the commission , the outcome of its assessment of the suspected infringement , or that of any other competent authority pursuant to national law where relevant , and , where applicable , details of the investigatory or enforcement measures taken or envisaged in relation thereto to ensure compliance with this regulation.


### adopt rules for the prevention and management of conflicts of interest in respect of its members , as well as for the members of the technological committee and of any other advisory group it may establish and publish annually on its website the declaration of interests of the members of the management board; ### adopt rules for the prevention and management of conflicts of interest in respect of its members , as well as for the members of the technological committee and of the survivors’ advisory board and publish annually on its website the declaration of interests of the members of the management board;


### appoint the members of the technology committee , and of any other advisory group it may establish; ### appoint the members of the technology committee and of the survivors’ advisory board;


### appoint the members of the technology committee , and of any other advisory group it may establish; ### appoint the members of the technology committee , and of the survivors’ advisory board;


### 1. providers of hosting services , providers of interpersonal communications services and providers of internet access services shall collect data on the following topics and make that information available to the eu centre upon request: ### 1. providers of hosting services , providers of publicly available number-independent interpersonal communications services and shall collect data on the following topics and make that information public:


### where the provider has been subject to a detection order issued in accordance with article 7: ### where the provider has been subject to an investigation order issued in accordance with article 7:


### — the measures taken to comply with the order , including the technologies used for that purpose and the safeguards provided; ### — the measures taken to comply with the order ,


### — the error rates of the technologies deployed to detect online child sexual abuse and measures taken to prevent or remedy any errors; ### — the rates of false positives and false negatives the technologies deployed to detect online child sexual abuse related to specific person , specific group of people or specific incident and steps taken to mitigate the harm caused by any inaccuracy


### the number of removal orders issued to the provider in accordance with article 14 and the average time needed for removing or disabling access to the item or items of child sexual abuse material in question; ### the number of removal orders issued to the provider in accordance with article 14 and the average time for removing or disabling access to the item or items of child sexual abuse material in question , counting from the moment the order entered the provider’s system ;


### the total number of items of child sexual abuse material that the provider removed or to which it disabled access , broken down by whether the items were removed or access thereto was disabled pursuant to a removal order or to a notice submitted by a competent authority , the eu centre or a third party or at the provider’s own initiative; ### the total number of items of child sexual abuse material that the provider removed or to which it disabled access , broken down by whether the items were removed or access thereto was disabled pursuant to a removal order or to a notice submitted by a judicial authority , competent authority , the eu centre , a national hotline , a trusted flagger or a private individual or at the provider’s own initiative;


### the number of blocking orders issued to the provider in accordance with article 16; ### deleted


### 2. the coordinating authorities shall collect data on the following topics and make that information available to the eu centre upon request: ### 2. the coordinating authorities shall collect data on the following topics and make that information publicly available redacting operationally sensitive data as appropriate and proving an unredacted version to the eu centre :


### the most important and recurrent risks of online child sexual abuse , as reported by providers of hosting services and providers of interpersonal communications services in accordance with article 3 or identified through other information available to the coordinating authority; ### the most important and recurrent risks of online child sexual abuse encountered , as reported by providers of hosting services and providers of publicly available number -independent interpersonal communications services in accordance with article 3 or identified through other information available to the coordinating authority;


### a list of the providers of hosting services and providers of interpersonal communications services to which the coordinating authority addressed a detection order in accordance with article 7; ### a list of the providers of hosting services and providers of interpersonal communications services to which the coordinating authority addressed a investigation order in accordance with article 7;


### the number of detection orders issued in accordance with article 7 , broken down by provider and by type of online child sexual abuse , and the number of instances in which the provider invoked article 8(3); ### the number of investigation orders issued in accordance with article 7 , broken down by provider and by type of online child sexual abuse , and the number of instances in which the provider invoked article 8(3);


### the number of removal orders issued in accordance with article 14 , broken down by provider , the time needed to remove or disable access to the item or items of child sexual abuse material concerned , and the number of instances in which the provider invoked article 14(5) and (6); ### the number of removal orders issued in accordance with article 14 , broken down by provider , the time needed to remove or disable access to the item or items of child sexual abuse material concerned , , including the time it took the coordinating authority to process the order and the number of instances in which the provider invoked article 14(5) and (6);


### the number of blocking orders issued in accordance with article 16 , broken down by provider , and the number of instances in which the provider invoked article 17(5); ### deleted


### 3. the eu centre shall collect data and generate statistics on the detection , reporting , removal of or disabling of access to online child sexual abuse under this regulation. the data shall be in particular on the following topics: ### 3. the eu centre shall collect data and generate statistics on the investigation order , reporting , removal of or disabling of access to online child sexual abuse under this regulation. the data shall include:


### the number of indicators in the databases of indicators referred to in article 44 and the development of that number as compared to previous years; ### the number of indicators in the databases of indicators referred to in article 44 and the change of that number as compared to previous years;


### the number of submissions of child sexual abuse material and solicitation of children referred to in article 36(1) , broken down by member state that designated the submitting coordinating authorities , and , in the case of child sexual abuse material , the number of indicators generated on the basis thereof and the number of uniform resource locators included in the list of uniform resource locators in accordance with article 44(3); ### the number of submissions of child sexual abuse material and solicitation of children referred to in article 36(1) , broken down by member state that designated the submitting coordinating authorities , and , in the case of child sexual abuse material , the number of indicators generated on the basis thereof and the number of still active uniform resource locators included in the list of uniform resource locators in accordance with article 44(3);


### the total number of reports submitted to the eu centre in accordance with article 12 , broken down by provider of hosting services and provider of interpersonal communications services that submitted the report and by member state the competent authority of which the eu centre forwarded the reports to in accordance with article 48(3); ### the total number of reports submitted to the eu centre in accordance with article 12 , broken down by provider of hosting services and provider of publicly available number-independent interpersonal communications services that submitted the report and by member state the competent authority of which the eu centre forwarded the reports to in accordance with article 48(3);


### the online child sexual abuse to which the reports relate , including the number of items of potential known and new child sexual abuse material and instances of potential solicitation of children , the member state the competent authority of which the eu centre forwarded the reports to in accordance with article 48(3) , and type of relevant information society service that the reporting provider offers; ### the online child sexual abuse to which the reports relate , including the number of items of potential child sexual abuse material and instances of potential solicitation of children , the member state the competent authority of which the eu centre forwarded the reports to in accordance with article 48(3) , and type of relevant information society service that the reporting provider offers;


### the number of reports that the eu centre considered manifestly unfounded , as referred to in article 48(2); ### the number of reports that the eu centre considered unfounded or manifestly unfounded , as referred to in article 48(2);


### the number of reports relating to potential new child sexual abuse material and solicitation of children that were assessed as not constituting child sexual abuse material of which the eu centre was informed pursuant to article 36(3) , broken down by member state; ### the number of reports relating to potential previously unknown child sexual abuse material and solicitation of children that were assessed as not constituting child sexual abuse material of which the eu centre was informed pursuant to article 36(3) , broken down by member state;


### where the same item of potential child sexual abuse material was reported more than once to the eu centre in accordance with article 12 or detected more than once through the searches in accordance with article 49(1) , the number of times that that item was reported or detected in that manner. ### where materially the same item of potential child sexual abuse material was reported more than once to the eu centre in accordance with article 12 or detected more than once through the searches in accordance with article 49(1) , the number of times that that item was reported or detected in that manner.


### 4. the providers of hosting services , providers of interpersonal communications services and providers of internet access services , the coordinating authorities and the eu centre shall ensure that the data referred to in paragraphs 1 , 2 and 3 , respectively , is stored no longer than is necessary for the transparency reporting referred to in article 84. the data stored shall not contain any personal data. ### 4. the providers of hosting services , providers of interpersonal communications services and providers of internet access services , the coordinating authorities and the eu centre shall ensure that the data stored pursuant to in paragraphs 1 , 2 and 3 , respectively , shall not contain any personal data.


### 5. they shall ensure that the data is stored in a secure manner and that the storage is subject to appropriate technical and organisational safeguards. those safeguards shall ensure , in particular , that the data can be accessed and processed only for the purpose for which it is stored , that a high level of security is achieved and that the information is deleted when no longer necessary for that purpose. they shall regularly review those safeguards and adjust them where necessary. ### 5. they shall ensure that the data is stored in a secure manner and that the storage is subject to appropriate technical and organisational safeguards. those safeguards shall ensure , in particular , that the data can be accessed and processed only for the purpose for which it is stored , that a high level of security is achieved and that the information is deleted when no longer necessary for that purpose. all access to this data shall be logged and the logs securely stored for five years. they shall regularly review those safeguards and adjust them where necessary.


### (2) given the central importance of relevant information society services , those aims can only be achieved by ensuring that providers offering such services in the union behave responsibly and take reasonable measures to minimise the risk of their services being misused for the purpose of child sexual abuse , those providers often being the only ones in a position to prevent and combat such abuse. the measures taken should be targeted , carefully balanced and proportionate , so as to avoid any undue negative consequences for those who use the services for lawful purposes , in particular for the exercise of their fundamental rights protected under union law , that is , those enshrined in the charter and recognised as general principles of union law , and so as to avoid imposing any excessive burdens on the providers of the services. ### (2) given the central importance of relevant information society services , those aims can only be achieved by ensuring that providers offering such services in the union behave responsibly and take reasonable measures to minimise the risk of their services being misused for the purpose of child sexual abuse , those providers often being in a position to prevent and to help combat such abuse. the measures taken should be targeted , carefully balanced , effective , evidence-based proportionate , and subject to constant review , so as to avoid any undue negative consequences for the fight against crime and for those who use the services for lawful purposes , in particular for the exercise of their fundamental rights protected under union law , that is , those enshrined in the charter and recognised as general principles of union law , and so as to avoid directly or indirectly imposing any excessive burdens on the providers of the services.


### (3) member states are increasingly introducing , or are considering introducing , national laws to prevent and combat online child sexual abuse , in particular by imposing requirements on providers of relevant information society services. in the light of the inherently cross-border nature of the internet and the service provision concerned , those national laws , which diverge , have a direct negative effect on the internal market. to increase legal certainty , eliminate the resulting obstacles to the provision of the services and ensure a level playing field in the internal market , the necessary harmonised requirements should be laid down at union level. ### (3) member states are increasingly introducing , or are considering introducing , national laws to prevent and combat online child sexual abuse , in particular by imposing requirements on providers of relevant information society services. in the light of the inherently cross-border nature of the internet and the service provision concerned , those national laws , which diverge , may have a direct negative effect on the internal market. to increase legal certainty , eliminate the resulting obstacles to the provision of the services and ensure a level playing field in the internal market , the necessary harmonised requirements should be laid down at union level.


### (4) therefore , this regulation should contribute to the proper functioning of the internal market by setting out clear , uniform and balanced rules to prevent and combat child sexual abuse in a manner that is effective and that respects the fundamental rights of all parties concerned. in view of the fast-changing nature of the services concerned and the technologies used to provide them , those rules should be laid down in technology-neutral and future-proof manner , so as not to hamper innovation. ### (4) therefore , this regulation should contribute to the proper functioning of the internal market by setting out clear , uniform and balanced rules to prevent and combat child sexual abuse in a manner that is demonstrably and durably effective and that respects the fundamental rights of all parties concerned. in view of the fast-changing nature of the services concerned and the technologies used to provide them , those rules should be laid down in technology-neutral and future-proof manner , so as not to hamper the fight against crime .


### (5) in order to achieve the objectives of this regulation , it should cover providers of services that have the potential to be misused for the purpose of online child sexual abuse. as they are increasingly misused for that purpose , those services should include publicly available interpersonal communications services , such as messaging services and web-based e-mail services , in so far as those service as publicly available. as services which enable direct interpersonal and interactive exchange of information merely as a minor ancillary feature that is intrinsically linked to another service , such as chat and similar functions as part of gaming , image-sharing and video-hosting are equally at risk of misuse , they should also be covered by this regulation. however , given the inherent differences between the various relevant information society services covered by this regulation and the related varying risks that those services are misused for the purpose of online child sexual abuse and varying ability of the providers concerned to prevent and combat such abuse , the obligations imposed on the providers of those services should be differentiated in an appropriate manner. ### (5) in order to achieve the objectives of this regulation , it should cover providers of services are misused for the purpose of online child sexual abuse. as they are increasingly misused to a significant extent for that purpose , those services could include publicly available number-independent interpersonal communications services , such as messaging services and web-based e-mail services , in so far as those services are publicly available. as online games which enable direct interpersonal and interactive exchange of information merely as a minor ancillary feature are also at risk of misuse , they should also be covered by this regulation. however , given the inherent differences between the various relevant information society services covered by this regulation and the related varying risks that those services are misused for the purpose of online child sexual abuse and varying ability of the providers concerned to prevent and combat such abuse , the obligations imposed on the providers of those services should be differentiated in an appropriate manner.


### (6) online child sexual abuse frequently involves the misuse of information society services offered in the union by providers established in third countries. in order to ensure the effectiveness of the rules laid down in this regulation and a level playing field within the internal market , those rules should apply to all providers , irrespective of their place of establishment or residence , that offer services in the union , as evidenced by a substantial connection to the union. ### (6) online child sexual abuse can also involves the misuse of information society services offered in the union by providers established in third countries. in order to ensure the effectiveness of the rules laid down in this regulation and a level playing field within the internal market , those rules should apply to all providers , irrespective of their place of establishment or residence , that offer services in the union , as evidenced by a substantial connection to the union.


### (9) article 15(1) of directive 2002/58/ec allows member states to adopt legislative measures to restrict the scope of the rights and obligations provided for in certain specific provisions of that directive relating to the confidentiality of communications when such restriction constitutes a necessary , appropriate and proportionate measure within a democratic society , inter alia , to prevent , investigate , detect and prosecute criminal offences , provided certain conditions are met , including compliance with the charter. applying the requirements of that provision by analogy , this regulation should limit the exercise of the rights and obligations provided for in articles 5(1) , (3) and 6(1) of directive 2002/58/ec , insofar as strictly necessary to execute detection orders issued in accordance with this regulation with a view to prevent and combat online child sexual abuse. ### (9) article 15(1) of directive 2002/58/ec allows member states to adopt legislative measures to restrict the scope of the rights and obligations provided for in certain specific provisions of that directive relating to the confidentiality of communications when such restriction constitutes a necessary , appropriate and proportionate measure within a democratic society , inter alia , to prevent , investigate , detect and prosecute criminal offences , provided certain conditions are met , including compliance with the charter , which , inter alia , requires the specific measures to be provided for by law and genuinely achieve objectives of general interest. applying the requirements of that provision by analogy , this regulation should limit the exercise of the rights and obligations provided for in articles 5(1) , (3) and 6(1) of directive 2002/58/ec , insofar as strictly necessary in line with article 52 of the charter to execute investigation orders issued in accordance with this regulation with a view to prevent and combat online child sexual abuse.


### (11) a substantial connection to the union should be considered to exist where the relevant information society services has an establishment in the union or , in its absence , on the basis of the existence of a significant number of users in one or more member states , or the targeting of activities towards one or more member states. the targeting of activities towards one or more member states should be determined on the basis of all relevant circumstances , including factors such as the use of a language or a currency generally used in that member state , or the possibility of ordering products or services , or using a national top level domain. the targeting of activities towards a member state could also be derived from the availability of a software application in the relevant national software application store , from the provision of local advertising or advertising in the language used in that member state , or from the handling of customer relations such as by providing customer service in the language generally used in that member state. a substantial connection should also be assumed where a service provider directs its activities to one or more member state as set out in article 17(1) , point (c) , of regulation (eu) 1215/2012 of the european parliament and of the council44. mere technical accessibility of a website from the union shouldnot , alone , be considered as establishing a substantial connection to the union. ### (11) a substantial connection to the union should be considered to exist where the relevant information society services has an establishment in the union or , in its absence , on the basis of the existence of a significant number , in relation to population size of users in one or more member states , or the targeting of activities towards one or more member states. the targeting of activities towards one or more member states should be determined on the basis of all relevant circumstances , including factors such as the use of a language or a currency generally used in that member state , or the possibility of ordering products or services , or using a national top level domain. the targeting of activities towards a member state could also be derived from the availability of a software application in the relevant national software application store , from the provision of local advertising or advertising in the language used in that member state , or from the handling of customer relations such as by providing customer service in the language generally used in that member state. a substantial connection should also be assumed where a service provider directs its activities to one or more member state as set out in article 17(1) , point (c) , of regulation (eu) 1215/2012 of the european parliament and of the council44. mere technical accessibility of a website from the union cannot , alone , be considered as establishing a substantial connection to the union.


### (14) with a view to minimising the risk that their services are misused for the dissemination of known or new child sexual abuse material or the solicitation of children , providers of hosting services and providers of publicly available interpersonal communications services should assess such risk for each of the services that they offer in the union. to guide their risk assessment , a non-exhaustive list of elements to be taken into account should be provided. to allow for a full consideration of the specific characteristics of the services they offer , providers should be allowed to take account of additional elements where relevant. as risks evolve over time , in function of developments such as those related to technology and the manners in which the services in question are offered and used , it is appropriate to ensure that the risk assessment is updated regularly and when needed for particular reasons. ### (14) with a view to minimising the risk that their services are misused for the dissemination of online child sexual abuse material , providers of hosting services and providers of publicly available number-independent interpersonal communications services that are exposed to substantial amount of child sexual abuse material should assess the existence of a significant risk stemming from the design and functioning of of the services that they offer in the union. to guide their risk assessment , a non-exhaustive list of elements to be taken into account should be provided. to allow for a full consideration of the specific characteristics of the services they offer , providers should be allowed to take account of additional elements where relevant. as risks evolve over time , in function of developments such as those related to technology and the manners in which the services in question are offered and used , it is appropriate to ensure that the risk assessment , as well as the effectiveness and proportionality of specific measures are updated regularly and when needed for particular reasons.


### (15) some of those providers of relevant information society services in scope of this regulation may also be subject to an obligation to conduct a risk assessment under regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] with respect to information that they store and disseminate to the public. for the purposes of the present regulation , those providers may draw on such a risk assessment and complement it with a more specific assessment of the risks of use of their services for the purpose of online child sexual abuse , as required by this regulation. ### (15) some of those providers of relevant information society services in scope of this regulation may also be subject to an obligation to conduct a risk assessment under regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] with respect to information that they store and disseminate to the public , which should form the basis for the risk assessment under this instrument. for the purposes of the present regulation , those providers may draw on such a risk assessment and complement it with a more specific assessment of the risks of use of their services for the purpose of online child sexual abuse , as required by this regulation.


### (16) in order to prevent and combat online child sexual abuse effectively , providers of hosting services and providers of publicly available interpersonal communications services should take reasonable measures to mitigate the risk of their services being misused for such abuse , as identified through the risk assessment. providers subject to an obligation to adopt mitigation measures pursuant to regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] may consider to which extent mitigation measures adopted to comply with that obligation , which may include targeted measures to protect the rights of the child , including age verification and parental control tools , may also serve to address the risk identified in the specific risk assessment pursuant to this regulation , and to which extent further targeted mitigation measures may be required to comply with this regulation. ### (16) in order to prevent and combat online child sexual abuse effectively , providers of hosting services and providers of publicly available number-independent interpersonal communications services should take reasonable specific measures to mitigate their services being misused for the dissemination of known child sexual abuse material. providers subject to an obligation to adopt mitigation measures pursuant to regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec] may consider to which extent mitigation measures adopted to comply with that obligation , may also serve to address the risk identified in the specific risk assessment pursuant to this regulation , and to which extent further targeted mitigation measures may be required to comply with this.


### (17) to allow for innovation and ensure proportionality and technological neutrality , no exhaustive list of the compulsory mitigation measures should be established. instead , providers should be left a degree of flexibility to design and implement measures tailored to the risk identified and the characteristics of the services they provide and the manners in which those services are used. in particular , providers are free to design and implement , in accordance with union law , measures based on their existing practices to detect online child sexual abuse in their services and indicate as part of the risk reporting their willingness and preparedness to eventually being issued a detection order under this regulation , if deemed necessary by the competent national authority. ### (17) to allow for innovation and ensure proportionality and technological neutrality , no exhaustive list of the compulsory specific measures should be established. instead , providers should be left a degree of flexibility to design and implement measures tailored to the risk exposure and the characteristics of the services they provide and the manners in which those services are used. in particular , providers are free to design and implement , in accordance with union law , measures based on their existing practices. specific measures could include providing technical measures and tools that allow users to manage their own privacy visibility , reachability and safety , such as mechanisms for users to block or mute other users , mechanisms that ask for confirmation before displaying certain content , tools that prompt or warn users.


### (18) in order to ensure that the objectives of this regulation are achieved , that flexibility should be subject to the need to comply with union law and , in particular , the requirements of this regulation on mitigation measures. therefore , providers of hosting services and providers of publicly available interpersonal communications services should , when designing and implementing the mitigation measures , give importance not only to ensuring their effectiveness , but also to avoiding any undue negative consequences for other affected parties , notably for the exercise of users’ fundamental rights. in order to ensure proportionality , when determining which mitigation measures should reasonably be taken in a given situation , account should also be taken of the financial and technological capabilities and the size of the provider concerned. when selecting appropriate mitigation measures , providers should at least duly consider the possible measures listed in this regulation , as well as , where appropriate , other measures such as those based on industry best practices , including as established through self-regulatory cooperation , and those contained in guidelines from the commission. when no risk has been detected after a diligently conducted or updated risk assessment , providers should not be required to take any mitigation measures. ### (18) in order to ensure that the objectives of this regulation are achieved , that flexibility should be subject to the need to comply with union law and , in particular , the requirements of this regulation on mitigation measures. therefore , providers of hosting services and providers of publicly available number-independent interpersonal communications services should , when designing and implementing the specific measures , give importance not only to ensuring their effectiveness , but also to avoiding any undue negative consequences for other affected parties , notably for the exercise of users’ fundamental rights. in order to ensure proportionality , when determining which specific measures that should reasonably be taken in a given situation , account should also be taken of the ongoing effectiveness of the measures and the financial and technological capabilities and the size of the provider concerned. when selecting appropriate specific measures , providers should at least duly consider the possible measures listed in this regulation , quantifying the expected impact of the available measures. objective data on ongoing effectiveness must be provided , in order for any measure to be recognised as best practice.


### (19) in the light of their role as intermediaries facilitating access to software applications that may be misused for online child sexual abuse , providers of software application stores should be made subject to obligations to take certain reasonable measures to assess and mitigate that risk. the providers should make that assessment in a diligent manner , making efforts that are reasonable under the given circumstances , having regard inter alia to the nature and extent of that risk as well as their financial and technological capabilities and size , and cooperating with the providers of the services offered through the software application where possible. ### (19) in the light of their role as intermediaries facilitating access to software applications that may be misused for online child sexual abuse , providers of software application stores should be made subject to obligations to take certain reasonable measures. the providers should only make available on their platform software applications if prior to the use of their service they have obtained the contact details of the provider of software application developing team with the cooperation of the specific providers of the services offered through the software application.


### (20) with a view to ensuring effective prevention and fight against online child sexual abuse , when mitigating measures are deemed insufficient to limit the risk of misuse of a certain service for the purpose of online child sexual abuse , the coordinating authorities designated by member states under this regulation should be empowered to request the issuance of detection orders. in order to avoid any undue interference with fundamental rights and to ensure proportionality , that power should be subject to a carefully balanced set of limits and safeguards. for instance , considering that child sexual abuse material tends to be disseminated through hosting services and publicly available interpersonal communications services , and that solicitation of children mostly takes place in publicly available interpersonal communications services , it should only be possible to address detection orders to providers of such services. ### (20) with a view to ensuring effective prevention and fight against online child sexual abuse , when data on the impact of specific measures demonstrate that their impact is below pre-determined targets e , the coordinating authorities designated by member states under this regulation should be empowered to request the implementation of additional targeted and proportionate risk mitigation measures . in order to avoid any undue interference with fundamental rights and to ensure proportionality , that power should be subject to a carefully balanced set of targets , limits and safeguards. for instance , considering that child sexual abuse material tends to be disseminated through hosting services and publicly available number-independent interpersonal communications services , and that solicitation of children mostly takes place in publicly available number-independent interpersonal communications services , it should only be possible to address investigation orders to providers of such services in relation to specific suspects or specific group of suspects or a specific incident .


### (21) furthermore , as parts of those limits and safeguards , detection orders should only be issued after a diligent and objective assessment leading to the finding of a significant risk of the specific service concerned being misused for a given type of online child sexual abuse covered by this regulation. one of the elements to be taken into account in this regard is the likelihood that the service is used to an appreciable extent , that is , beyond isolated and relatively rare instances , for such abuse. the criteria should vary so as to account of the different characteristics of the various types of online child sexual abuse at stake and of the different characteristics of the services used to engage in such abuse , as well as the related different degree of intrusiveness of the measures to be taken to execute the detection order. ### (21) furthermore , as parts of those limits and safeguards , investigation orders should only be issued after a diligent and objective assessment leading to the finding that the order is necessary and proportionate .


### (22) however , the finding of such a significant risk should in itself be insufficient to justify the issuance of a detection order , given that in such a case the order might lead to disproportionate negative consequences for the rights and legitimate interests of other affected parties , in particular for the exercise of users’ fundamental rights. therefore , it should be ensured that detection orders can be issued only after the coordinating authorities and the competent judicial authority or independent administrative authority having objectively and diligently assessed , identified and weighted , on a case-by-case basis , not only the likelihood and seriousness of the potential consequences of the service being misused for the type of online child sexual abuse at issue , but also the likelihood and seriousness of any potential negative consequences for other parties affected. with a view to avoiding the imposition of excessive burdens , the assessment should also take account of the financial and technological capabilities and size of the provider concerned. ### (22) it should be ensured that investigation orders can be issued only after the coordinating authorities and the competent judicial authority or independent administrative authority having objectively and diligently assessed , identified and weighted , on a case-by-case basis , not only the likelihood and seriousness of the potential consequences of the service being misused for the type of online child sexual abuse at issue , but also the specific results anticipated by the measure , the likelihood and seriousness of any potential negative consequences for other parties affected. with a view to avoiding the imposition of excessive burdens , the assessment should also take account of the financial and technological capabilities and size of the provider concerned.


### (23) in addition , to avoid undue interference with fundamental rights and ensure proportionality , when it is established that those requirements have been met and a detection order is to be issued , it should still be ensured that the detection order is targeted and specified so as to ensure that any such negative consequences for affected parties do not go beyond what is strictly necessary to effectively address the significant risk identified. this should concern , in particular , a limitation to an identifiable part or component of the service where possible without prejudice to the effectiveness of the measure , such as specific types of channels of a publicly available interpersonal communications service , or to specific users or specific groups of users , to the extent that they can be taken in isolation for the purpose of detection , as well as the specification of the safeguards additional to the ones already expressly specified in this regulation , such as independent auditing , the provision of additional information or access to data , or reinforced human oversight and review , and the further limitation of the duration of application of the detection order that the coordinating authority deems necessary. to avoid unreasonable or disproportionate outcomes , such requirements should be set after an objective and diligent assessment conducted on a case-by-case basis. ### (23) in addition , to avoid undue interference with fundamental rights and ensure proportionality , when it is established that those requirements have been met and a investigation order is to be issued , it should still be ensured that the order is targeted and specific enough so as to ensure that any such negative consequences for affected parties do not go beyond what is strictly necessary. this should concern , in particular , a limitation to an identifiable part or component of the service where possible without prejudice to the effectiveness of the measure , such as specific types of channels of a publicly available number-independent interpersonal communications service , or to specific users or specific groups of users. to avoid unreasonable or disproportionate outcomes , such requirements should be set after an objective and diligent assessment conducted on a case-by-case basis.


### (24) the competent judicial authority or the competent independent administrative authority , as applicable in accordance with the detailed procedural rules set by the relevant member state , should be in a position to take a well-informed decision on requests for the issuance of detections orders. that is of particular importance to ensure the necessary fair balance of the fundamental rights at stake and a consistent approach , especially in connection to detection orders concerning the solicitation of children. therefore , a procedure should be provided for that allows the providers concerned , the eu centre on child sexual abuse established by this regulation (‘eu centre’) and , where so provided in this regulation , the competent data protection authority designated under regulation (eu) 2016/679 to provide their views on the measures in question. they should do so as soon as possible , having regard to the important public policy objective at stake and the need to act without undue delay to protect children. in particular , data protections authorities should do their utmost to avoid extending the time period set out in regulation (eu) 2016/679 for providing their opinions in response to a prior consultation. furthermore , they should normally be able to provide their opinion well within that time period in situations where the european data protection board has already issued guidelines regarding the technologies that a provider envisages deploying and operating to execute a detection order addressed to it under this regulation. ### (24) the competent judicial authority should have the data necessary to be in a position to take a well-informed decision on requests for the issuance of investigation orders. that is of particular importance to ensure the necessary fair balance of the fundamental rights at stake and a consistent approach , especially in connection to investigation orders concerning the solicitation of children. therefore , a procedure should be provided for that allows the providers concerned , the eu centre on child sexual abuse established by this regulation (‘eu centre’) and , where so provided in this regulation , the competent data protection authority designated under regulation (eu) 2016/679 to provide their views on the measures in question. they should do so without undue delay , having regard to the important public policy objective at stake and the need to act to protect children. furthermore , data protection authorities should normally be able to provide their opinion in a timely manner in situations where the european data protection board has already issued guidelines regarding the technologies that a provider envisages deploying and operating to execute a investigation order addressed to it under this regulation.


### (25) where new services are concerned , that is , services not previously offered in the union , the evidence available on the potential misuse of the service in the last 12 months is normally non-existent. taking this into account , and to ensure the effectiveness of this regulation , the coordinating authority should be able to draw on evidence stemming from comparable services when assessing whether to request the issuance of a detection order in respect of such a new service. a service should be considered comparable where it provides a functional equivalent to the service in question , having regard to all relevant facts and circumstances , in particular its main characteristics and functionalities , the manner in which it is offered and used , the user base , the applicable terms and conditions and risk mitigation measures , as well as the overall remaining risk profile. ### deleted


### (26) the measures taken by providers of hosting services and providers of publicly available interpersonal communications services to execute detection orders addressed to them should remain strictly limited to what is specified in this regulation and in the detection orders issued in accordance with this regulation. in order to ensure the effectiveness of those measures , allow for tailored solutions , remain technologically neutral , and avoid circumvention of the detection obligations , those measures should be taken regardless of the technologies used by the providers concerned in connection to the provision of their services. therefore , this regulation leaves to the provider concerned the choice of the technologies to be operated to comply effectively with detection orders and should not be understood as incentivising or disincentivising the use of any given technology , provided that the technologies and accompanying measures meet the requirements of this regulation. that includes the use of end-to-end encryption technology , which is an important tool to guarantee the security and confidentiality of the communications of users , including those of children. when executing the detection order , providers should take all available safeguard measures to ensure that the technologies employed by them cannot be used by them or their employees for purposes other than compliance with this regulation , nor by third parties , and thus to avoid undermining the security and confidentiality of the communications of users. ### (26) the measures taken by providers of hosting services and providers of publicly available number-independent interpersonal communications services to execute investigation orders addressed to them should remain strictly limited to what is specified in this regulation. this regulation leaves to the provider concerned the choice of the technologies to be operated to comply effectively with orders and should not be understood as incentivising or disincentivising the use of any given technology , provided that the technologies and accompanying measures are not undermined . that includes the use of end-to-end encryption technology , which is an important tool to guarantee the security and confidentiality of the communications of users , including those of children. any weakening of encryption could potentially be abused by malicious third parties. nothing in this regulation should therefore be interpreted as prohibiting or weakening end-to-end encryption.


### (27) in order to facilitate the providers’ compliance with the detection obligations , the eu centre should make available to providers detection technologies that they may choose to use , on a free-of-charge basis , for the sole purpose of executing the detection orders addressed to them. the european data protection board should be consulted on those technologies and the ways in which they should be best deployed to ensure compliance with applicable rules of union law on the protection of personal data. the advice of the european data protection board should be taken into account by the eu centre when compiling the lists of available technologies and also by the commission when preparing guidelines regarding the application of the detection obligations. the providers may operate the technologies made available by the eu centre or by others or technologies that they developed themselves , as long as they meet the requirements of this regulation. ### (27) in order to facilitate the providers’ compliance with the investigation orders , the eu centre should make available to providers approved technologies that they may choose to use , on a free-of-charge basis , for the sole purpose of executing the investigation orders addressed to them. the european data protection board should be consulted on the acceptability or otherwise of those technologies and the ways in which they should be deployed , if at all , in compliance with applicable union law on the protection of personal data and with the charter of fundamental rights. the authoritative position of the european data protection board should be fully taken into account by the eu centre and also by the commission when preparing guidelines regarding the application of the obligations. the providers may operate the technologies made available by the eu centre or by others or technologies that they developed themselves , as long as they meet the requirements of this regulation and other applicable eu law , such as regulation 2016/679.


### (28) with a view to constantly assess the performance of the detection technologies and ensure that they are sufficiently reliable , as well as to identify false positives and avoid to the extent erroneous reporting to the eu centre , providers should ensure human oversight and , where necessary , human intervention , adapted to the type of detection technologies and the type of online child sexual abuse at issue. such oversight should include regular assessment of the rates of false negatives and positives generated by the technologies , based on an analysis of anonymised representative data samples. in particular where the detection of the solicitation of children in publicly available interpersonal communications is concerned , service providers should ensure regular , specific and detailed human oversight and human verification of conversations identified by the technologies as involving potential solicitation of children. ### (28) with a view to constantly assess the performance of the technologies and ensure that they are sufficiently accurate , as well as to identify false positives and false negatives and to avoid erroneous reporting to the eu centre , providers should ensure adequate human oversight and , where necessary , human intervention , adapted to the type of technologies and the type of online child sexual abuse at issue. such oversight should include regular assessment of the rates of false negatives and positives generated by the technologies , based on an analysis of anonymised representative data samples.


### (29) providers of hosting services and providers of publicly available interpersonal communications services are uniquely positioned to detect potential online child sexual abuse involving their services. the information that they may obtain when offering their services is often indispensable to effectively investigate and prosecute child sexual abuse offences. therefore , they should be required to report on potential online child sexual abuse on their services , whenever they become aware of it , that is , when there are reasonable grounds to believe that a particular activity may constitute online child sexual abuse. where such reasonable grounds exist , doubts about the potential victim’s age should not prevent those providers from submitting reports. in the interest of effectiveness , it should be immaterial in which manner they obtain such awareness. such awareness could , for example , be obtained through the execution of detection orders , information flagged by users or organisations acting in the public interest against child sexual abuse , or activities conducted on the providers’ own initiative. those providers should report a minimum of information , as specified in this regulation , for competent law enforcement authorities to be able to assess whether to initiate an investigation , where relevant , and should ensure that the reports are as complete as possible before submitting them. ### (29) the information providers may obtain when offering their services is often indispensable to effectively investigate and prosecute child sexual abuse offences. therefore , they should be required to report potential online child sexual abuse on their services , whenever they become aware of it , that is , when there are reasonable grounds to believe that a particular activity may constitute online child sexual abuse. in the interest of effectiveness , it should be immaterial in which manner they obtain such awareness. those providers should report a minimum of information , as specified in this regulation , for competent law enforcement authorities to be able to assess whether to initiate an investigation , where relevant , and should ensure that the reports are as complete as possible before submitting them.


### (32) the obligations of this regulation do not apply to providers of hosting services that do not offer their services in the union. however , such services may still be used to disseminate child sexual abuse material to or by users in the union , causing harm to children and society at large , even if the providers’ activities are not targeted towards member states and the total numbers of users of those services in the union are limited. for legal and practical reasons , it may not be reasonably possible to have those providers remove or disable access to the material , not even through cooperation with the competent authorities of the third country where they are established. therefore , in line with existing practices in several member states , it should be possible to require providers of internet access services to take reasonable measures to block the access of users in the union to the material. ### (32) the obligations of this regulation do not apply to providers of hosting services that do not offer their services in the union. however , such services may still be used to disseminate child sexual abuse material to or by users in the union , causing harm to children and society at large , even if the providers’ activities are not targeted towards member states and the total numbers of users of those services in the union are limited. in view of the very high number of ratifications of the un convention on the rights of the child or its optional protocol on child pornography globally , it should always be possible to have those providers remove or disable access to the material. where problems arise in relation to specific jurisdictions , commission and member states should use all reasonable means at their disposal to encourage and lead international efforts to remedy the situation.


### (34) considering that acquiring , possessing , knowingly obtaining access and transmitting child sexual abuse material constitute criminal offences under directive 2011/93/eu , it is necessary to exempt providers of relevant information society services from criminal liability when they are involved in such activities , insofar as their activities remain strictly limited to what is needed for the purpose of complying with their obligations under this regulation and they act in good faith. ### deleted


### (44) in order to provide clarity and enable effective , efficient and consistent coordination and cooperation both at national and at union level , where a member state designates more than one competent authority to apply and enforce this regulation , it should designate one lead authority as the coordinating authority , whilst the designated authority should automatically be considered the coordinating authority where a member state designates only one authority. for those reasons , the coordinating authority should act as the single contact point with regard to all matters related to the application of this regulation , without prejudice to the enforcement powers of other national authorities. ### (44) in order to provide clarity and enable effective , efficient and consistent coordination and cooperation both at national and at union level , where a member state designates more than one competent authority to apply and enforce this regulation , it should designate one lead authority as the coordinating authority , whilst the designated authority should automatically be considered the coordinating authority where a member state designates only one authority. for those reasons , the coordinating authority should act as the single contact point with regard to all matters related to contributing to the achievements of the objective of this regulation , , including for trusted organisations providing assistance to victims and providing education and awareness raising , without prejudice to the enforcement powers of other national authorities.


### (44) in order to provide clarity and enable effective , efficient and consistent coordination and cooperation both at national and at union level , where a member state designates more than one competent authority to apply and enforce this regulation , it should designate one lead authority as the coordinating authority , whilst the designated authority should automatically be considered the coordinating authority where a member state designates only one authority. for those reasons , the coordinating authority should act as the single contact point with regard to all matters related to the application of this regulation , without prejudice to the enforcement powers of other national authorities. ### (44) in order to provide clarity and enable effective , efficient and consistent coordination and cooperation both at national and at union level , where a member state designates more than one competent authority to apply and enforce this regulation , it should designate one lead authority as the coordinating authority , whilst the designated authority should automatically be considered the coordinating authority where a member state designates only one authority. for those reasons , the coordinating authority should act as the single contact point with regard to all matters related to the application of this regulation , and related to achieving the objective of this regulation , including prevention matters without prejudice to the enforcement powers of other national authorities. it is essential to ensure the training of officials who could be in close contact with victims , including law enforcement officers , judges , prosecutors , lawyers and forensic experts and social workers , in order to ensure that such officials are able to understand the problems that child victims can face , and in order to ensure that the situation is prevented and mitigated if necessary. the coordinating authority should therefore also act as single point of contact with regard to all matters related to the achievement of the objective of this regulation , including prevention , with regard to awareness raising and training of officials.


### (49) in order to verify that the rules of this regulation , in particular those on mitigation measures and on the execution of detection orders , removal orders or blocking orders that it issued , are effectively complied in practice , each coordinating authority should be able to carry out searches , using the relevant indicators provided by the eu centre , to detect the dissemination of known or new child sexual abuse material through publicly available material in the hosting services of the providers concerned. ### (49) in order to verify that the rules of this regulation , in particular those on specific measures and on the execution of investigation orders , removal orders , are effectively complied with , each coordinating authority should be able to carry out relevant searches.


### (50) with a view to ensuring that providers of hosting services are aware of the misuse made of their services and to afford them an opportunity to take expeditious action to remove or disable access on a voluntary basis , coordinating authorities of establishment should be able to notify those providers of the presence of known child sexual abuse material on their services and requesting removal or disabling of access thereof , for the providers’ voluntary consideration. such notifying activities should be clearly distinguished from the coordinating authorities’ powers under this regulation to request the issuance of removal orders , which impose on the provider concerned a binding legal obligation to remove or disable access to the material in question within a set time period. ### deleted


### (55) it is essential for the proper functioning of the system of mandatory detection and blocking of online child sexual abuse set up by this regulation that the eu centre receives , via the coordinating authorities , material identified as constituting child sexual abuse material or transcripts of conversations identified as constituting the solicitation of children , such as may have been found for example during criminal investigations , so that that material or conversations can serve as an accurate and reliable basis for the eu centre to generate indicators of such abuses. in order to achieve that result , the identification should be made after a diligent assessment , conducted in the context of a procedure that guarantees a fair and objective outcome , either by the coordinating authorities themselves or by a court or another independent administrative authority than the coordinating authority. whilst the swift assessment , identification and submission of such material is important also in other contexts , it is crucial in connection to new child sexual abuse material and the solicitation of children reported under this regulation , considering that this material can lead to the identification of ongoing or imminent abuse and the rescuing of victims. therefore , specific time limits should be set in connection to such reporting. ### (55) it is essential for the proper functioning of this regulation that the eu centre receives , via the coordinating authorities , anonymised specific items of material identified as constituting child sexual abuse material or transcripts of conversations identified as constituting the solicitation of children related to a specific person or a specific group of people or specific incident , such as may have been found for example during criminal investigations , so that that material or conversations can serve as an accurate and reliable basis for the eu centre to generate indicators of such abuses. in order to achieve that result , the identification should be made after a diligent assessment , conducted in the context of a procedure that guarantees a fair and objective outcome , either by the coordinating authorities themselves or by a court or another independent administrative authority than the coordinating authority. whilst the swift assessment , identification and submission of such material is important also in other contexts , it is crucial in connection to child sexual abuse material reported under this regulation , considering that this material can lead to the identification of ongoing or imminent abuse and the rescuing of victims. therefore , specific time limits should be set.


### (56) with a view to ensuring that the indicators generated by the eu centre for the purpose of detection are as complete as possible , the submission of relevant material and transcripts should be done proactively by the coordinating authorities. however , the eu centre should also be allowed to bring certain material or conversations to the attention of the coordinating authorities for those purposes. ### (56) with a view to ensuring that the indicators generated by the eu centre are as complete as possible , the submission of relevant material and transcripts should be done proactively by the coordinating authorities. however , the eu centre should also be allowed to bring certain material or conversations to the attention of the coordinating authorities for those purposes.


### (70) longstanding union support for both inhope and its member hotlines recognises that hotlines are in the frontline in the fight against online child sexual abuse. the eu centre should leverage the network of hotlines and encourage that they work together effectively with the coordinating authorities , providers of relevant information society services and law enforcement authorities of the member states. the hotlines’ expertise and experience is an invaluable source of information on the early identification of common threats and solutions , as well as on regional and national differences across the union. ### (70) longstanding union support for both inhope and its member hotlines recognises that hotlines are in the frontline in the fight against online child sexual abuse. the eu centre should leverage the network of hotlines and encourage that they work together effectively with the coordinating authorities , providers of relevant information society services and law enforcement authorities of the member states. the hotlines’ expertise and experience is an invaluable source of information on the early identification of common threats and solutions , as well as on regional and national differences across the union. child helplines are equally in the frontline in the fight against online child sexual abuse. therefore , the eu centre should also recognise the work of child helplines in victim response , and the existing referral mechanisms between child helplines and hotlines. the eu centre should coordinate services for victims.


### (78) regulation (eu) 2021/1232 of the european parliament and of the council45provides for a temporary solution in respect of the use of technologies by certain providers of publicly available interpersonal communications services for the purpose of combating online child sexual abuse , pending the preparation and adoption of a long-term legal framework.this regulation provides that long-term legal framework. regulation (eu) 2021/1232 should therefore be repealed. ### (78) regulation (eu) 2021/1232 of the european parliament and of the council45provides for a temporary solution in respect of the use of technologies by certain providers of publicly available interpersonal communications services for the purpose of combating online child sexual abuse. regulation (eu) 2021/1232 should therefore be repealed.


### this regulation lays down uniform rules to address the misuse of relevant information society services for online child sexual abuse in the internal market. ### this regulation lays down uniform rules to address the misuse of relevant information society services for online child sexual abuse in order to contribute to the proper functioning of the internal market and to create a safe , predictable and trusted online environment that facilitates innovation and in which fundamental rights enshrined in the charter are effectively protected.


### obligations on providers of hosting services and providers of interpersonal communication services to detect and report online child sexual abuse; ### obligations on providers of hosting services and providers of publicly available number-independent interpersonal communication services to identify and report online child sexual abuse;


### 4. this regulation limits the exercise of the rights and obligations provided for in 5(1) and (3) and article 6(1) of directive 2002/58/ec insofar as necessary for the execution of the detection orders issued in accordance with section 2 of chapter 1 of this regulation. ### 4. this regulation limits the exercise of the rights and obligations provided for in 5(1) and (3) and article 6(1) of directive 2002/58/ec insofar as necessary for the execution of the investigation orders issued in accordance with section 2 of chapter 1 of this regulation.


### ‘hosting service’ means an information society service as defined in article 2 , point (f) , third indent , of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec]; ### ‘hosting service’ means an information society service as defined in article 3 , point (g) , third indent , of regulation (eu) …/… [on a single market for digital services (digital services act) and amending directive 2000/31/ec];


### ‘interpersonal communications service’ means a publicly available service as defined in article 2 , point 5 , of directive (eu) 2018/1972 , including services which enable direct interpersonal and interactive exchange of information merely as a minor ancillary feature that is intrinsically linked to another service; ### ‘number-independent interpersonal communications service’ means a publicly available service as defined in article 2 , point 7 , of directive (eu) 2018/1972;


### ‘internet access service’ means a service as defined in article 2(2) , point 2 , of regulation (eu) 2015/2120 of the european parliament and of the council49; ### deleted


### (ii) an interpersonal communications service; ### (ii) a publicly available number-independent interpersonal communications service;


### (iv) an internet access service. ### deleted


### 1. providers of hosting services and providers of interpersonal communications services shall identify , analyse and assess , for each such service that they offer , the risk of use of the service for the purpose of online child sexual abuse. ### 1. providers of hosting services and providers of publicly available number-independent interpersonal communications services that are exposed to substantial amount of child sexual abuse material shall identify , analyse and assess , for each such service that they offer , risks stemming from the design , functioning , including algorithmic systems of the service for the purpose of online child sexual abuse.


### any previously identified instances of use of its services for the purpose of online child sexual abuse; ### deleted


### the existence and implementation by the provider of a policy and the availability of functionalities to address the risk referred to in paragraph 1 , including through the following: ### the existence and implementation by the provider of a policy and the availability and effectiveness of functionalities to address the risk referred to in paragraph 1 , including through the following:


### — prohibitions and restrictions laid down in the terms and conditions; ### deleted


### — measures taken to enforce such prohibitions and restrictions; ### deleted


### — functionalities enabling age verification; ### — functionalities enabling the effective protection of children online ;


### the manner in which users use the service and the impact thereof on that risk; ### deleted


### the manner in which the provider designed and operates the service , including the business model , governance and relevant systems and processes , and the impact thereof on that risk; ### the manner in which the provider designed and operates the service , including the business model , governance and relevant systems and processes , the design of their recommender systems and any other relevant algorithmic system and the impact thereof on that risk;


### the extent to which the service is used or is likely to be used by children; ### deleted


### (ii) where the service is used by children , the different age groups of the child users and the risk of solicitation of children in relation to those age groups; ### deleted


### — enabling users to search for other users and , in particular , for adult users to search for child users; ### — enabling users to publicly search for other users and , in particular , for adult users to search for child users;


### — enabling users to establish contact with other users directly , in particular through private communications; ### — enabling users to initiate unsolicited contact with other users directly , in particular through private communications;


### the provider may request the eu centre to perform an analysis of representative , anonymized data samples to identify potential online child sexual abuse , to support the risk assessment. ### the provider may request the eu centre to perform an analysis of methodology for risk assessment in order to support the risk assessment.


### the costs incurred by the eu centre for the performance of such an analysis shall be borne by the requesting provider. however , the eu centre shall bear those costs where the provider is a micro , small or medium-sized enterprise , provided the request is reasonably necessary to support the risk assessment. ### the costs incurred by the eu centre for the performance of such an analysis shall be borne by the requesting provider. however , the eu centre shall bear those costs where the provider is a micro , small or medium-sized enterprise. the centre may reject the request on the basis that it is not reasonably necessary to support the risk assessment.


### the commission shall be empowered to adopt delegated acts in accordance with article 86 in order to supplement this regulation with the necessary detailed rules on the determination and charging of those costs and the application of the exemption for micro , small and medium-sized enterprises. ### deleted


### for a service which is subject to a detection order issued in accordance with article 7 , the provider shall update the risk assessment at the latest two months before the expiry of the period of application of the detection order; ### for a service which is subject to a investigation order issued in accordance with article 7 , the provider shall update the risk assessment at the latest two months before the expiry of the period of application of the order;


### risk mitigation ### specific measures


### 1. providers of hosting services and providers of interpersonal communications services shall take reasonable mitigation measures , tailored to the risk identified pursuant to article 3 , to minimise that risk. such measures shall include some or all of the following: ### 1. providers of hosting services and providers of publicly available number-independent interpersonal communications services that are exposed to substantial amount of child sexual abuse material shall take proportionate and effective specific measures , tailored to the serious risk identified pursuant to article 3. such measures shall include some or all of the following:


### adapting , through appropriate technical and operational measures and staffing , the provider’s content moderation or recommender systems , its decision-making processes , the operation or functionalities of the service , or the content or enforcement of its terms and conditions; ### adapting , through appropriate technical and operational measures and staffing , the provider’s content moderation or recommender systems , its decision-making processes , the operation or functionalities of the service ,


### reinforcing the provider’s internal processes or the internal supervision of the functioning of the service; ### adapting the provider’s internal processes or the internal supervision of the functioning of the service;


### 2. the mitigation measures shall be: ### 2. the specific measures shall be:


### effective in mitigating the identified risk; ### effective and proportionate in mitigating the identified serious risk;


### targeted and proportionate in relation to that risk , taking into account , in particular , the seriousness of the risk as well as the provider’s financial and technological capabilities and the number of users; ### targeted and proportionate in relation to that risk , taking into account , in particular , the seriousness of the risk , any impact on the functionality of the service as well as the provider’s financial and technological capabilities and the number of users;


### 3. providers of interpersonal communications services that have identified , pursuant to the risk assessment conducted or updated in accordance with article 3 , a risk of use of their services for the purpose of the solicitation of children , shall take the necessary age verification and age assessment measures to reliably identify child users on their services , enabling them to take the mitigation measures. ### deleted


### 4. providers of hosting services and providers of interpersonal communications services shall clearly describe in their terms and conditions the mitigation measures that they have taken. that description shall not include information that may reduce the effectiveness of the mitigation measures. ### 4. where appropriate providers of hosting services and providers of interpersonal communications services shall clearly describe in their terms of service the mitigation measures that they have taken. that description shall not include information that is likely to reduce the effectiveness of the mitigation measures.


### 5. the commission , in cooperation with coordinating authorities and the eu centre and after having conducted a public consultation , may issue guidelines on the application of paragraphs 1 , 2 , 3 and 4 , having due regard in particular to relevant technological developments and in the manners in which the services covered by those provisions are offered and used. ### 5. the commission , in cooperation with coordinating authorities and the eu centre and after having conducted a public consultation , may issue guidelines on the application of paragraphs 1 and 2 , having due regard in particular to relevant technological developments and in the manners in which the services covered by those provisions are offered and used.


### 1. providers of hosting services and providers of interpersonal communications services shall transmit , by three months from the date referred to in article 3(4) , to the coordinating authority of establishment a report specifying the following: ### 1. providers of hosting services and providers of publicly available number-independent interpersonal communications services shall transmit , by three months from the date referred to in article 3(4) , to the coordinating authority of establishment a report specifying the following:


### the process and the results of the risk assessment conducted or updated pursuant to article 3 , including the assessment of any potential remaining risk referred to in article 3(5); ### the results of the risk assessment conducted or updated pursuant to article 3 , including the assessment of any remaining serious risk referred to in article 3(5);


### any mitigation measures taken pursuant to article 4. ### any specific measures taken pursuant to article 4.


### 2. within three months after receiving the report , the coordinating authority of establishment shall assess it and determine , on that basis and taking into account any other relevant information available to it , whether the risk assessment has been carried out or updated and the mitigation measures have been taken in accordance with the requirements of articles 3 and 4. ### 2. within three months after receiving the report , the coordinating authority of establishment shall assess it and determine , on that basis and taking into account any other relevant information available to it , whether the risk assessment has been carried out or updated and the specific measures and implementation plans have been taken in accordance with the requirements of articles 3 and 4.


### where necessary for that assessment , that coordinating authority may require further information from the provider , within a reasonable time period set by that coordinating authority. that time period shall not be longer than two weeks. ### where necessary for that assessment , that coordinating authority may require further information from the provider , to be provided without undue delay .


### the time period referred to in the first subparagraph shall be suspended until that additional information is provided. ### deleted


### 4. without prejudice to articles 7 and 27 to 29 , where the requirements of articles 3 and 4 have not been met , that coordinating authority shall require the provider to re-conduct or update the risk assessment or to introduce , review , discontinue or expand , as applicable , the mitigation measures , within a reasonable time period set by that coordinating authority. that time period shall not be longer than one month. ### 4. without prejudice to articles 7 and 27 to 29 , where the requirements of articles 3 and 4 have not been met , that coordinating authority shall require the provider to make specific updates to the risk assessment within a reasonable time period set by that coordinating authority. that time period shall not be longer than one month.


### 6. providers shall , upon request , transmit the report to the providers of software application stores , insofar as necessary for the assessment referred to in article 6(2). where necessary , they may remove confidential information from the reports. ### deleted


### make reasonable efforts to assess , where possible together with the providers of software applications , whether each service offered through the software applications that they intermediate presents a risk of being used for the purpose of the solicitation of children; ### make reasonable efforts to to ensure that software applications , whether each service offered through the software applications can only make available on their platform software applications if prior to the use of their service they have obtained the contact details of the provider of software application developing team ;


### take reasonable measures to prevent child users from accessing the software applications in relation to which they have identified a significant risk of use of the service concerned for the purpose of the solicitation of children; ### deleted


### take the necessary age verification and age assessment measures to reliably identify child users on their services , enabling them to take the measures referred to in point (b). ### deleted


### 2. in assessing the risk referred to in paragraph 1 , the provider shall take into account all the available information , including the results of the risk assessment conducted or updated pursuant to article 3. ### deleted


### 3. providers of software application stores shall make publicly available information describing the process and criteria used to assess the risk and describing the measures referred to in paragraph 1. that description shall not include information that may reduce the effectiveness of the assessment of those measures. ### deleted


### 4. the commission , in cooperation with coordinating authorities and the eu centre and after having conducted a public consultation , may issue guidelines on the application of paragraphs 1 , 2 and 3 , having due regard in particular to relevant technological developments and to the manners in which the services covered by those provisions are offered and used. ### deleted


### 2 detection obligations ### 2 investigation obligations


### issuance of detection orders ### issuance of investigation orders