### (8) given the importance of cybersecurity for the resilience of critical entities and in the interest of consistency , a coherent approach between this directive and directive (eu) xx/yy of the european parliament and of the council20 [proposed directive on measures for a high common level of cybersecurity across the union; (hereafter “nis 2 directive”)] is necessary wherever possible. in view of the higher frequency and particular characteristics of cyber risks , the nis 2 directive imposes comprehensive requirements on a large set of entities to ensure their cybersecurity. given that cybersecurity is addressed sufficiently in the nis 2 directive , the matters covered by it should be excluded from the scope of this directive , without prejudice to the particular regime for entities in the digital infrastructure sector. ### (8) given the importance of cybersecurity for the resilience of critical entities and in the interest of consistency , a coherent approach between this directive and directive (eu) xx/yy of the european parliament and of the council20 [proposed directive on measures for a high common level of cybersecurity across the union; (hereafter “nis 2 directive”)] is necessary wherever possible. in view of the higher frequency and particular characteristics of cyber risks , the nis 2 directive imposes comprehensive requirements on a large set of entities to ensure their cybersecurity. given that cybersecurity is addressed sufficiently in the nis 2 directive , the matters covered by it should be excluded from the scope of this directive , without prejudice to the particular regime for entities in the digital infrastructure sector. as a result , the supervision of entities identified as critical or equivalent to critical under this directive , in matters that fall under the scope of the nis2 directive , will be a responsibility of the competent authorities designated under the nis 2 directive.


### (11) the actions of member states to identify and help ensure the resilience of critical entities should follow a risk-based approach that targets efforts to the entities most relevant for the performance of vital societal functions or economic activities. in order to ensure such a targeted approach , each member state should carry out , within a harmonised framework , an assessment of all relevant natural and man-made risks that may affect the provision of essential services , including accidents , natural disasters , public health emergencies such as pandemics , and antagonistic threats , including terrorist offences. when carrying out those risk assessments , member states should take into account other general or sector-specific risk assessment carried out pursuant to other acts of union law and should consider the dependencies between sectors , including from other member states and third countries. the outcomes of the risk assessment should be used in the process of identification of critical entities and to assist those entities in meeting the resilience requirements of this directive. ### (11) the actions of member states to identify and help ensure the resilience of critical entities should follow a risk-based approach that targets efforts to the entities most relevant for the performance of vital societal functions or economic activities. in order to ensure such a targeted approach , each member state should carry out , within a harmonised framework , an assessment of all relevant natural and man-made risks that may affect the provision of essential services , including accidents , natural disasters , public health emergencies such as pandemics , and antagonistic threats , including terrorist offences. when carrying out those risk assessments , member states should take into account other general or sector-specific risk assessment carried out pursuant to other acts of union law and should consider the dependencies between sectors , including from other member states and third countries. the outcomes of the risk assessment should be used in the process of identification of critical entities and to assist those entities in meeting the resilience requirements of this directive. the commission should also be able to support critical entities based in third countries with advisory expertise , at their request;


### (11) the actions of member states to identify and help ensure the resilience of critical entities should follow a risk-based approach that targets efforts to the entities most relevant for the performance of vital societal functions or economic activities. in order to ensure such a targeted approach , each member state should carry out , within a harmonised framework , an assessment of all relevant natural and man-made risks that may affect the provision of essential services , including accidents , natural disasters , public health emergencies such as pandemics , and antagonistic threats , including terrorist offences. when carrying out those risk assessments , member states should take into account other general or sector-specific risk assessment carried out pursuant to other acts of union law and should consider the dependencies between sectors , including from other member states and third countries. the outcomes of the risk assessment should be used in the process of identification of critical entities and to assist those entities in meeting the resilience requirements of this directive. ### (11) the actions of member states to identify and help ensure the resilience of critical entities should follow a risk-based approach that targets efforts to the entities most relevant for the performance of vital societal functions or economic activities. in order to ensure such a targeted approach , each member state should carry out , within a harmonised framework , an assessment of all relevant natural and man-made risks that may affect the provision of essential services , including accidents , natural disasters , public health emergencies such as pandemics , and antagonistic threats , including terrorist offences , in order to avoid a shortage of critical resources needed for the development of the infrastructure in question. when carrying out those risk assessments , member states should take into account other general or sector-specific risk assessment carried out pursuant to other acts of union law and should consider the dependencies between sectors , including from other member states and third countries. the outcomes of the risk assessment should be used in the process of identification of critical entities and to assist those entities in meeting the resilience requirements of this directive.


### (12) in order to ensure that all relevant entities are subject to those requirements and to reduce divergences in this respect , it is important to lay down harmonised rules allowing for a consistent identification of critical entities across the union , while also allowing member states to reflect national specificities. therefore , criteria to identify critical entities should be laid down. in the interest of effectiveness , efficiency , consistency and legal certainty , appropriate rules should also be set on notification and cooperation relating to , as well as the legal consequences of , such identification. in order to enable the commission to assess the correct application of this directive , member states should submit to the commission , in a manner that is as detailed and specific as possible , relevant information and , in any event , the list of essential services , the number of critical entities identified for each sector and subsector referred to in the annex and the essential service or services that each entity provides and any thresholds applied. ### (12) in order to ensure that all relevant entities are subject to those requirements and to reduce divergences in this respect , it is important to lay down harmonised rules allowing for a consistent identification of critical entities across the union , while also allowing member states to reflect national specificities. therefore , criteria to identify critical entities should be laid down. in the interest of effectiveness , efficiency , consistency and legal certainty , appropriate rules should also be set on notification and cooperation relating to , as well as the legal consequences of , such identification. in order to enable the commission to assess the correct application of this directive , member states should submit to the commission , in a manner that is as detailed and specific as possible , relevant information and , in any event , the list of essential services , the number of critical entities identified for each sector and subsector referred to in the annex and the essential service or services that each entity provides and any thresholds applied. in order to avoid divergent application of this directive and improve the functioning of the internal market , a common list of essential services should be established by the commission in cooperation with the member states through the procedure for the adoption of delegated acts.


### (19) member states should support critical entities in strengthening their resilience , in compliance with their obligations under this directive , without prejudice to the entities’ own legal responsibility to ensure such compliance. member states could in particular develop guidance materials and methodologies , support the organisation of exercises to test their resilience and provide training to personnel of critical entities. moreover , given the interdependencies between entities and sectors , member states should establish information sharing tools to support voluntary information sharing between critical entities , without prejudice to the application of competition rules laid down in the treaty on the functioning of the european union. ### (19) member states should support critical entities in strengthening their resilience , in compliance with their obligations under this directive , without prejudice to the entities’ own legal responsibility to ensure such compliance. member states could in particular develop guidance materials and methodologies , support the organisation of exercises to test their resilience and provide training to personnel of critical entities. moreover , given the interdependencies between entities and sectors , member states should establish information sharing tools to support information sharing between critical entities , without prejudice to the application of competition rules laid down in the treaty on the functioning of the european union.


### (20) in order to be able to ensure their resilience , critical entities should have a comprehensive understanding of all relevant risks to which they are exposed and analyse those risks. to that aim , they should carry out risks assessments , whenever necessary in view of their particular circumstances and the evolution of those risks , yet in any event every four years. the risk assessments by critical entities should be based on the risk assessment carried out by member states. ### (20) in order to be able to ensure their resilience , critical entities should have a comprehensive understanding of all relevant risks to which they are exposed and analyse those risks. to that aim , they should carry out risks assessments , whenever necessary in view of their particular circumstances and the evolution of those risks , yet in any event every two years. the risk assessments by critical entities should be based on the risk assessment carried out by member states.


### 1. this directive: ### 1. this directive lays down measures with a view to achieve a high level of resilience of critical entities within the union in order to ensure an effective provision of essential services and to improve the functioning of the internal market.


### 2. this directive shall not apply to matters covered by directive (eu) xx/yy [proposed directive on measures for a high common level of cybersecurity across the union; (‘nis 2 directive’)] , without prejudice to article 7. ### 2. this directive shall not apply to matters covered by directive (eu) xx/yy [proposed directive on measures for a high common level of cybersecurity across the union; (‘nis 2 directive’)] , without prejudice to article 7. this directive is without prejudice to the competences of member states concerning the maintenance of public security , defence and national security in compliance with union law. as a consequence: (a) public administration entities that carry out activities in the areas of public security , law enforcement , defence or national security are excluded. (b) entities in the sectors referred to in the annex carrying out activities of a dual nature in connection with or for the benefit of public security , law enforcement , defence or national security are excluded.


### (2) “resilience” means the ability to prevent , resist , mitigate , absorb , accommodate to and recover from an incident that disrupts or has the potential to disrupt the operations of a critical entity; ### (2) “resilience” means the ability to prevent , resist , manage , mitigate , absorb , accommodate to and recover from an incident that disrupts or has the potential to disrupt the operations of a critical entity;


### (6) “risk” means any circumstance or event having a potential adverse effect on the resilience of critical entities; ### (6) “risk” means any vulnerability , circumstance or event having a potential adverse effect on the resilience of critical entities;


### 1. each member state shall adopt by [three years after entry into force of this directive] a strategy for reinforcing the resilience of critical entities. this strategy shall set out strategic objectives and policy measures with a view to achieving and maintaining a high level of resilience on the part of those critical entities and covering at least the sectors referred to in the annex. ### 1. each member state shall adopt by [two years after entry into force of this directive] a strategy for reinforcing the resilience of critical entities. this strategy shall set out strategic objectives and policy measures with a view to achieving and maintaining a high level of resilience on the part of those critical entities and covering at least the sectors referred to in the annex.


### 1. each member state shall adopt by [three years after entry into force of this directive] a strategy for reinforcing the resilience of critical entities. this strategy shall set out strategic objectives and policy measures with a view to achieving and maintaining a high level of resilience on the part of those critical entities and covering at least the sectors referred to in the annex. ### 1. each member state shall adopt by [one year after entry into force of this directive] a strategy for reinforcing the resilience of critical entities. this strategy shall set out strategic objectives and policy measures with a view to achieving and maintaining a high level of resilience on the part of those critical entities and covering at least the sectors referred to in the annex.


### strategic objectives and priorities for the purposes of enhancing the overall resilience of critical entities taking into account cross-border and cross-sectoral interdependencies; ### strategic objectives and priorities for the purposes of enhancing the overall resilience of critical entities taking into account cross-border and cross-sectoral interdependencies and the connections in the supply chains;


### a description of measures necessary to enhance the overall resilience of critical entities , including a national risk assessment , the identification of critical entities and of entities equivalent to critical entities , and the measures to support critical entities taken in accordance with this chapter; ### a description of measures necessary to enhance the overall resilience of critical entities , including a national risk assessment , the identification of critical entities and of entities equivalent to critical entities , and the measures to support critical entities taken in accordance with this chapter including measures to enhance cooperation between the public and private entities;


### competent authorities designated pursuant to article 8 shall establish a list of essential services in the sectors referred to in the annex. they shall carry out by [three years after entry into force of this directive] , and subsequently where necessary , and at least every four years , an assessment of all relevant risks that may affect the provision of those essential services , with a view to identifying critical entities in accordance with article 5(1) , and assisting those critical entities to take measures pursuant to article 11. ### the commission is empowered to adopt a delegated act in accordance with article 21 in order to establish a list of essential services in the sectors , subsectors and types of entities referred to in the annex. the commission shall adopt the delegated act no later than six months following the date of entry into force of this directive. competent authorities designated pursuant to article 8 shall carry out by [three years after entry into force of this directive] , and subsequently where necessary , and at least every four years , an assessment of all relevant risks that may affect the provision of the essential services listed in the delegated act , with a view to identifying critical entities in accordance with article 5(1) , and assisting those critical entities to take measures pursuant to article 11.


### 1. competent authorities designated pursuant to article 8 shall establish a list of essential services in the sectors referred to in the annex. they shall carry out by [three years after entry into force of this directive] , and subsequently where necessary , and at least every four years , an assessment of all relevant risks that may affect the provision of those essential services , with a view to identifying critical entities in accordance with article 5(1) , and assisting those critical entities to take measures pursuant to article 11. ### 1. competent authorities designated pursuant to article 8 shall establish a list of essential services in the sectors referred to in the annex. they shall carry out by [one year after entry into force of this directive] , and subsequently where necessary , and at least every two years , an assessment of all relevant risks that may affect the provision of those essential services , with a view to identifying critical entities in accordance with article 5(1) , and assisting those critical entities to take measures pursuant to article 11.


### any risks arising from the dependencies between the sectors referred to in the annex , including from other member states and third countries , and the impact that a disruption in one sector may have on other sectors; ### any risks arising from the dependencies between the sectors referred to in the annex , including from other member states and third countries , and the impact that a disruption in one sector may have on other sectors and the internal market;


### for the purposes of point (c) of the first subparagraph , member states shall cooperate with the competent authorities of other member states and third countries , as appropriate. ### for the purposes of point (c) of the first subparagraph , member states shall closely cooperate with the commission and the competent authorities of other member states and third countries.


### 4. each member state shall provide the commission with data on the types of risks identified and the outcomes of the risk assessments , per sector and sub-sector referred to in the annex , by [three years after entry into force of this directive] and subsequently where necessary and at least every four years. ### 4. each member state shall provide the commission with data on the types of risks identified and the outcomes of the risk assessments , per sector and sub-sector referred to in the annex , by [one year after entry into force of this directive] and subsequently where necessary and at least every two years.


### 5. the commission may , in cooperation with the member states , develop a voluntary common reporting template for the purposes of complying with paragraph 4. ### 5. the commission shall , in cooperation with the member states , develop a voluntary common reporting template for the purposes of complying with paragraph 4.


### 6. for the purposes of chapter iv , member states shall ensure that critical entities , following the notification referred in paragraph 3 , provide information to their competent authorities designated pursuant to article 8 of this directive on whether they provide essential services to or in more than one third of member states. where that is so , the member state concerned shall notify , without undue delay , to the commission the identity of those critical entities. ### 6. for the purposes of chapter iv , member states shall ensure that critical entities , following the notification referred in paragraph 3 , provide information to their competent authorities designated pursuant to article 8 of this directive on whether they provide essential services to or in more than three member states. where that is so , the member state concerned shall notify , without undue delay , to the commission the identity of those critical entities.


### the geographic area that could be affected by an incident , including any cross-border impacts; ### the geographic area that could be affected by an incident , including any cross-border and cross-sector impacts;


### 3. by [three years and six months after entry into force of this directive] , and every year thereafter , the single points of contact shall submit a summary report to the commission and to the critical entities resilience group on the notifications received , including the number of notifications , the nature of notified incidents and the actions taken in accordance with article 13(3). ### 3. by [one year and six months after entry into force of this directive] , and every year thereafter , the single points of contact shall submit a summary report to the commission and to the critical entities resilience group on the notifications received , including the number of notifications , the nature of notified incidents and the actions taken in accordance with article 13(3).


### 1. member states shall support critical entities in enhancing their resilience. that support may include developing guidance materials and methodologies , supporting the organisation of exercises to test their resilience and providing training to personnel of critical entities. ### 1. member states shall support critical entities in enhancing their resilience. that support may include developing guidelines and guidance materials and methodologies , supporting the organisation of exercises to test their resilience and providing periodic training to personnel of critical entities.


### ensure adequate employee security management , including by setting out categories of personnel exercising critical functions , establishing access rights to sensitive areas , facilities and other infrastructure , and to sensitive information as well as identifying specific categories of personnel in view of article 12; ### ensure adequate employee security management , including by setting out categories of personnel exercising critical functions , ensuring appropriate training requirements and qualifications , establishing access rights to sensitive areas , facilities and other infrastructure , and to sensitive information as well as identifying specific categories of personnel in view of article 12;


### ensure adequate employee security management , including by setting out categories of personnel exercising critical functions , establishing access rights to sensitive areas , facilities and other infrastructure , and to sensitive information as well as identifying specific categories of personnel in view of article 12; ### ensure adequate employee security management and training , including by setting out categories of personnel exercising critical functions , establishing access rights to sensitive areas , facilities and other infrastructure , and to sensitive information as well as identifying specific categories of personnel in view of article 12;


### raise awareness about the measures referred to in points (a) to (e) among relevant personnel. ### raise awareness about the measures referred to in points (a) to (e) among relevant personnel also through training.


### 2. an entity shall be considered a critical entity of particular european significance when it has been identified as a critical entity and it provides essential services to or in more than one third of member states and has been notified as such to the commission pursuant to article 5(1) and (6) , respectively. ### 2. an entity shall be considered a critical entity of particular european significance when it has been identified as a critical entity and it provides essential services to or in more than three member states and has been notified as such to the commission pursuant to article 5(1) and (6) , respectively.


### the critical entities resilience group shall be composed of representatives of the member states and the commission. where relevant for the performance of its tasks , the critical entities resilience group may invite representatives of interested parties to participate in its work. ### the critical entities resilience group shall be composed of representatives of the member states and the commission. where relevant for the performance of its tasks , the critical entities resilience group may invite representatives of interested parties and stakeholders to participate in its work.


### supporting the commission in assisting member states in reinforcing their capacity to contribute to ensuring the resilience of critical entities in accordance with this directive; ### supporting the commission in assisting member states in reinforcing their capacity to contribute to ensuring the resilience of critical entities in accordance with this directive and promoting its uniform implementation in the member states;


### evaluating the strategies on the resilience of critical entities referred to in article 3 and identifying best practices in respect of those strategies; ### evaluating the national strategies on the resilience of critical entities referred to in article 3 , the member states preparedness and identifying best practices in respect of those strategies;


### facilitating the exchange of best practices with regard to the identification of critical entities by the member states in accordance with article 5 , including in relation to cross-border dependencies and regarding risks and incidents; ### facilitating the exchange of information and best practices with regard to the identification of critical entities by the member states in accordance with article 5 , including in relation to cross-border dependencies and regarding risks and incidents;


### 4. by [24 months after entry into force of this directive] and every two years thereafter , the critical entities resilience group shall establish a work programme in respect of actions to be undertaken to implement its objectives and tasks , which shall be consistent with the requirements and objectives of this directive. ### 4. by [12 months after entry into force of this directive] and every two years thereafter , the critical entities resilience group shall establish a work programme in respect of actions to be undertaken to implement its objectives and tasks , which shall be consistent with the requirements and objectives of this directive.


### 7. the commission shall provide to the critical entities resilience group a summary report of the information provided by the member states pursuant to articles 3(3) and 4(4) by [three years and six months after entry into force of this directive] and subsequently where necessary and at least every four years. ### 7. the commission shall provide to the critical entities resilience group a summary report of the information provided by the member states pursuant to articles 3(3) and 4(4) by [three years and six months after entry into force of this directive] and subsequently where necessary and at least every four years. the commission shall regularly publish a summary report of the activities of the critical entities resilience group.


### 7. the commission shall provide to the critical entities resilience group a summary report of the information provided by the member states pursuant to articles 3(3) and 4(4) by [three years and six months after entry into force of this directive] and subsequently where necessary and at least every four years. ### 7. the commission shall provide to the critical entities resilience group a summary report of the information provided by the member states pursuant to articles 3(3) and 4(4) by [one year and six months after entry into force of this directive] and subsequently where necessary and at least every four years.


### 6. a delegated act adopted pursuant to article 11(4) shall enter into force only if no objection has been expressed either by the european parliament or by the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by two months at the initiative of the european parliament or of the council. ### 6. a delegated act adopted pursuant to article 11(4) shall enter into force only if no objection has been expressed either by the european parliament or by the council within a period of three months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by three months at the initiative of the european parliament or of the council.


### (1) “critical entity” means a public or private entity of a type referred to in the annex , which has been identified as such by a member state in accordance with article 5; ### (1) “critical entity” means a public or private entity of a type referred to in the annex , which has been identified as such by a member state or the commission in accordance with article 5;


### the strategy shall be updated where necessary and at least every four years. ### the strategy shall be updated where necessary and at least every two years.


### 1. by [three years and three months after entry into force of this directive] member states shall identify for each sector and subsector referred to in the annex , other than points 3 , 4 and 8 thereof , the critical entities. ### 1. by [one year and six months after entry into force of this directive] member states shall identify for each sector and subsector referred to in the annex , other than points 3 , 4 and 8 thereof , the critical entities.


### 7. member states shall , where necessary and in any event at least every four years , review and , where appropriate , update the list of identified critical entities. ### 7. member states shall , where necessary and in any event at least every two years , review and , where appropriate , update the list of identified critical entities.


### where those updates lead to the identification of additional critical entities , paragraphs 3 , 4 , 5 and 6 shall apply. in addition , member states shall ensure that entities that are no longer identified as critical entities pursuant to any such update are notified thereof and are informed that they are no longer subject to the obligations pursuant to chapter iii as from the reception of that information. ### where those updates lead to the identification of additional critical entities , paragraphs 3 , 4 , 5 and 6 shall apply. in addition , member states shall ensure that entities that are no longer identified as critical entities pursuant to any such update are notified thereof and are informed in due time that they are no longer subject to the obligations pursuant to chapter iii as from the reception of that information.


### 2. member states shall submit to the commission by [three years and three months after the entry into force of this directive] the following information: ### 2. member states shall submit to the commission by [one year and six months after the entry into force of this directive] the following information:


### they shall subsequently submit that information where necessary , and at least every four years. ### they shall subsequently submit that information where necessary , and at least every two years.


### 3. the commission may , after consultation of the critical entities resilience group , adopt guidelines to facilitate the application of the criteria referred to in paragraph 1 , taking into account the information referred to in paragraph 2. ### 3. the commission shall , after consultation of the critical entities resilience group , adopt guidelines to facilitate the application of the criteria referred to in paragraph 1 , taking into account the information referred to in paragraph 2.


### 1. as regards the sectors referred to in points 3 , 4 and 8 of the annex , member states shall , by [three years and three months after entry into force of this directive] , identify the entities that shall be treated as equivalent to critical entities for the purposes of this chapter. they shall apply the provisions of articles 3 , 4 , 5(1) to (4) and (7) , and 9 in respect of those entities. ### 1. as regards the sectors referred to in points 3 , 4 and 8 of the annex , member states shall , by [one year and six months after entry into force of this directive] , identify the entities that shall be treated as equivalent to critical entities for the purposes of this chapter. they shall apply the provisions of articles 3 , 4 , 5(1) to (4) and (7) , and 9 in respect of those entities.


### 8. the commission shall publish a list of member states’ single points of contacts. ### 8. the commission shall publish a list of member states’ single points of contacts and encourage member states to share best practices and collaborate via their single points of contact


### 3. member states shall establish information sharing tools to support voluntary information sharing between critical entities in relation to matters covered by this directive , in accordance with union and national law on , in particular , competition and protection of personal data. ### 3. member states shall establish information sharing tools to support information sharing between critical entities in relation to matters covered by this directive , in accordance with union and national law on , in particular , competition and protection of personal data.


### member states shall ensure that critical entities assess within six months after receiving the notification referred to in article 5(3) , and subsequently where necessary and at least every four years , on the basis of member states’ risk assessments and other relevant sources of information , all relevant risks that may disrupt their operations. ### member states shall ensure that critical entities assess within six months after receiving the notification referred to in article 5(3) , and subsequently where necessary and at least every two years , on the basis of member states’ risk assessments and other relevant sources of information , all relevant risks that may disrupt their operations.


### 3. upon request of the member state that identified the critical entity and with the agreement of the critical entity concerned , the commission shall organise advisory missions , in accordance with the arrangements set out in article 15(4) , (5) , (7) and (8) , to provide advice to the critical entity concerned in meeting its obligations pursuant to chapter iii. the advisory mission shall report its findings to the commission , that member state and the critical entity concerned. ### 3. upon request of the member state that identified the critical entity and with the agreement of the critical entity concerned , the commission shall organise advisory missions , in accordance with the arrangements set out in article 15(4) , (5) , (7) and (8) , to provide advice to the critical entity concerned in meeting its obligations pursuant to chapter iii. the advisory mission shall report its findings to the commission , that member state and the critical entity concerned. the commission may also offer advisory missions to critical entities based in third countries at their request.


### the commission shall periodically review the functioning of this directive , and report to the european parliament and to the council. the report shall in particular assess the impact and added value of this directive on ensuring the resilience of critical entities and whether the scope of the directive should be extended to cover other sectors or subsectors. the first report shall be submitted by [six years after the entry into force of this directive] and shall assess in particular whether the scope of the directive should be extended to include the food production , processing and distribution sector. ### the commission shall periodically review the functioning of this directive , and report to the european parliament and to the council. the report shall in particular assess the impact and added value of this directive on ensuring the resilience of critical entities and whether the scope of the directive should be extended to cover other sectors or subsectors. the first report shall be submitted by [two years after the entry into force of this directive] and shall assess in particular whether the scope of the directive should be extended to include the food production , processing and distribution sector.


### (4) as regulation (eu) no 531/2012 expires on 30 june 2022 , the aim of this regulation is to recast it while introducing new measures to increase transparency , including on the use of value added services in roaming and ensure a genuine rlah experience in terms of quality of service and access to emergency services while roaming. the duration of this new regulation is set for 10 years , until 2032 , to provide certainty in the market and minimise regulatory burden while introducing a mechanism for intervening at wholesale level in the interim if market developments so require. ### (4) as regulation (eu) no 531/2012 expires on 30 june 2022 , the aim of this regulation is to recast it while introducing new measures to increase transparency , including on the use of value added services in roaming and ensure a genuine rlah experience in terms of quality of service and access to emergency services while roaming. the duration of this new regulation is set for 10 years , until 2032 , to provide certainty in the market and minimise regulatory burden while introducing review on the wholesale level and rules on the deployment of new network technologies accompanied by a legislative proposal if market developments so require.


### (35) a contract which includes any type of regulated retail roaming service should specify the characteristics of that regulated retail roaming service , including the expected level of quality of service. the provider should make available information on relevant factors that can affect the quality of service , such as availability of certain technologies , coverage or variation due to external factors such as topography. ### (35) a contract which includes any type of regulated retail roaming service should specify the characteristics of that regulated retail roaming service , including the expected level of quality of service. the provider should make available clear and comprehensible information on relevant factors that can affect the quality of service , such as availability of certain technologies , coverage or variation due to external factors such as topography , as well as information regarding transfer rate and available access technologies of each visited operator in each member state.


### (63) since the objectives of this regulation , namely to provide for a common approach for ensuring that users of public mobile communications networks , when travelling within the union , do not pay excessive prices for union-wide roaming services in comparison with competitive national prices , while increasing transparency and ensuring sustainability of the provision of retail roaming services at domestic prices as well as a genuine rlah experience in terms of quality of service and access to emergency services while roaming , cannot be sufficiently achieved by the member states but can rather be better achieved at union level , the union may adopt measures , in accordance with the principle of subsidiarity as set out in article 5 of the treaty on european union. in accordance with the principle of proportionality as set out in that article , this regulation does not go beyond what is necessary in order to achieve those objectives. ### (63) since the objectives of this regulation , namely to provide for a common approach for ensuring that users of public mobile communications networks , when travelling within the union , and while using non-terrestrial networks with automatic handover on board aircrafts or marine vessels , do not pay excessive prices for union-wide roaming services in comparison with competitive national prices , while increasing transparency and consumer rights , as well as ensuring sustainability of the provision of retail roaming services at domestic prices as well as a genuine rlah experience in terms of quality of service and access to emergency services while roaming , cannot be sufficiently achieved by the member states but can rather be better achieved at union level , the union may adopt measures , in accordance with the principle of subsidiarity as set out in article 5 of the treaty on european union. in accordance with the principle of proportionality as set out in that article , this regulation does not go beyond what is necessary in order to achieve those objectives.


### the quality of service that can reasonably be expected when roaming in the union. ### clear and comprehensible information about the quality of service that can reasonably be expected when roaming in the union including the estimated download and upload speed of the data access services.


### the first , second , fifth and sixth subparagraphs , with the exception of the reference to the fair use policy and the surcharge applied in accordance with article 7 , shall also apply to voice and sms roaming services used by roaming customers travelling outside the union and provided by a roaming provider. ### the first , second , fifth and sixth subparagraphs , with the exception of the reference to the fair use policy and the surcharge applied in accordance with article 7 , shall also apply to voice and sms roaming services used by roaming customers travelling outside the union and provided by a roaming provider and for using non-terrestrial networks on board of aircrafts or marine vessels.


### 5. roaming providers shall make available information to their customers on how to avoid inadvertent roaming in border regions. roaming providers shall take reasonable steps to protect their customers from paying roaming charges for inadvertently accessed roaming services while situated in their home member state. ### 5. roaming providers shall make available information to their customers on how to avoid inadvertent roaming while using of non-terrestrial networks with automatic handover on board aircrafts or marine vessels and in border regions. roaming providers shall take reasonable steps to protect their customers from paying roaming charges for inadvertently accessed roaming services while situated in their home member state.


### an automatic message from the roaming provider shall inform the roaming customer that the latter may access emergency services free of charge by calling the single european emergency number ‘112’ and by alternative means of access to emergency services through emergency communications mandated in the visited member state. the information shall be delivered to the roaming customer’s mobile device by an sms message , every time the roaming customer enters a member state other than that of his domestic provider. it shall be provided free of charge at the moment the roaming customer initiates a roaming service , by an appropriate means adapted to facilitate its receipt and easy comprehension. ### an automatic message from the roaming provider shall inform the roaming customer that the latter may access emergency services free of charge by calling the single european emergency number ‘112’ and by alternative means of access to emergency services through emergency communications mandated in the visited member state and any alternative public warning systems as set down in article 110 of directive (eu) 2018/19721a . the information shall be delivered to the roaming customer’s mobile device by an sms message , every time the roaming customer enters a member state other than that of his domestic provider. it shall be provided free of charge at the moment the roaming customer initiates a roaming service , by an appropriate means adapted to facilitate its receipt and easy comprehension.


### 1. recalls the importance , for a properly functioning and competitive internal market , of effective better law-making tools that take subsidiarity and proportionality fully into account when drawing up scientifically based and balanced legislation , particularly for consumers and smes; ### 1. recalls the importance , for a properly functioning and competitive internal market , of effective better law-making tools , that take subsidiarity and proportionality fully into account when drawing up scientifically based and balanced legislation , particularly for consumers and smes; welcomes the use of the better law making tools and the cooperation with think-tanks , underlines the necessity of simplifying these tools and make them easy to understand and use by the stakeholders , and of taking into account the economic impact assessment when drawing legislation that affects the consumers and the smes , considers that the necessary period for adaptation to the new rules and regulations for the smes must be better taken into account;


### 2. reiterates that internal market objectives such as improving competitiveness , digitalisation , sustainability and consumer protection should be underpinned by the enhanced use of scrutiny instruments such as the regulatory fitness and performance programme (refit) and the regulatory scrutiny board; ### 2. reiterates that internal market objectives such as improving competitiveness , digitalisation , sustainability and consumer protection should be underpinned by the enhanced use of scrutiny instruments , welcomes the use of such instruments as the regulatory fitness and performance programme (refit) , the regulatory scrutiny board for the period 2017-2019 and stresses the importance of further use of scrutiny instruments , enhancing and improving them like the fit for future platform (f4f) or other dedicated platforms;


### 2. recalls that the principle of subsidiarity enshrined in article 5 of the treaty on european union aims to ensure that decisions are taken as closely as possible to citizens and that constant checks are carried out to verify that action at eu level is justified in the light of the possibilities available at national , regional or local level and to guarantee that the eu does not take action , except in the areas that fall within its exclusive competence , unless it is more effective than action taken at national , regional or local level; recalls , too , that the principle of proportionality requires that any action taken by the eu should not go beyond what is necessary to achieve the objectives of the treaties; ### 2. recalls that the importance of the principle of subsidiarity as enshrined in article 5 of the treaty on european union; recalls , too , that the principle of proportionality requires that any action taken by the eu shall not exceed what is necessary to achieve the objectives of the treaties;


### 3. underlines that smes in particular will continue to face serious repercussions due to the covid-19 pandemic and need more flexibility to react quickly to the ever-changing demands of our economy; reiterates that cutting red tape , the ‘think small first’ principle and fostering a society that values entrepreneurship need to be priorities within internal market legislation; ### 3. underlines that smes in particular will continue to face serious repercussions due to the covid-19 pandemic and other unforeseen events with serious economical impact and need more flexibility to react quickly to the ever-changing demands of our economy; reiterates that cutting red tape , the ‘think small first’ principle and fostering a society that values entrepreneurship need to be priorities within internal market legislation;


### 3. underlines that the use of directives as legislative instruments allows for better compliance with and respect for the principle of subsidiarity; ### deleted


### 4. calls on the member states’ authorities at national and regional level , and on stakeholders to become more closely involved at an early stage of the decision-making process , with subsidiarity and proportionality checks and administrative burden assessments of eu legislation; calls further on the member states to ensure the swift and consistent transposition , implementation and enforcement of legislation , and to avoid ‘gold-plating’ that can undermine the smooth functioning of the internal market; ### 4. calls on the member states’ authorities at national and regional level , and on stakeholders to become more closely involved at an early stage of the decision-making process , using the tools in place at the european institutions level , the professional and sectorial associations , with subsidiarity and proportionality checks and administrative burden assessments of eu legislation; calls further on the member states to ensure the swift and consistent transposition , implementation and enforcement of legislation , and to avoid ‘gold-plating’ that can undermine the smooth functioning of the internal market;


### 4. notes the conclusions of the task force on subsidiarity , proportionality and ‘doing less more efficiently’; draws attention to the fact that parliament declined the invitation to participate by appointing members to the task force , with full respect for its institutional role as the only directly elected body of the european union and of ensuring democratic scrutiny of the activity of european union; ### 4. notes the conclusions of the task force on subsidiarity , proportionality and ‘doing less more efficiently’;


### 5. suggests that the introduction of a ‘red card’ instrument , enabling a legislative proposal from the commission to be withdrawn if 55 % of national parliaments raise an objection , should be discussed at the conference on the future of europe; ### 5. suggests that an increased role for national parliaments and the power of raising objections should be discussed at the conference on the future of europe;


### 8. believes that the refit platform should be expanded to widen its focus from regulatory burdens to matters of subsidiarity and proportionality; warns against the rigid application by the commission of a ‘one in , one out’ principle in the implementation of better law-making processes. ### 8. believes that the refit platform should be expanded to widen its focus from regulatory burdens to matters of subsidiarity and proportionality; warns against the rigid application by the commission of a ‘one in , one out’ principle in the implementation of better law-making processes; highlights the role played by the european economic and social committee and the committee of the regions in the refit programme , as their input capturing the views of regional and local authorities as well as organised civil society is important for a balanced policy assessment process.


### 9. emphasises that impact assessment is a key instrument to ensure that subsidiarity and proportionality are respected and to promote accountability; welcomes the fact that the two principles are part of the quality review performed by the regulatory scrutiny board; emphasises , however , that the independence of the board could be further improved; ### 9. emphasises that ex-ante impact assessments are an important tool in order to reach well-informed decisions and a key instrument to ensure that subsidiarity and proportionality are respected ; welcomes the fact that the two principles are part of the quality review performed by the regulatory scrutiny board; emphasises , however , that the independence of the board could be further improved;


### 11. notes that in 2017 the regulatory scrutiny board examined a total of 53 impact assessments , that in 12 cases it estimated that it was necessary to improve their analysis of subsidiarity and eu added value , and that 30 opinions contained comments on proportionality; notes that in 2018 it examined 75 impact assessments , that in 16 cases it was necessary to improve their analysis of subsidiarity and eu added value , and that 47 opinions contained remarks aimed at improving the analysis of proportionality and comparisons of policy options; underlines that in 2019 the board examined only one impact assessment; ### 11. notes that in 2017 the regulatory scrutiny board examined a total of 53 impact assessments , that in 12 cases it estimated that it was necessary to improve their analysis of subsidiarity and eu added value , and that 30 opinions contained comments on proportionality; notes that in 2018 it examined 75 impact assessments , that in 16 cases it was necessary to improve their analysis of subsidiarity and eu added value , and that 47 opinions contained remarks aimed at improving the analysis of proportionality and comparisons of policy options; regrets the fact that in 2019 the board only examined one impact assessment;


### 12. supports the commission’s commitment to ‘ex ante evaluation’ before considering possible legislative changes; believes that the european union and the authorities of the member states should continue to work closely together to ensure better evaluation of the real impact of eu regulations on citizens , on the economy , on the structure of the society and on the environment; ### 12. supports the commission’s commitment to ‘ex ante evaluation’ before considering legislative acts; believes that the commission and the national authorities should continue to cooperate closely in order to evaluate the real impact of eu legislation on citizens , businesses and on the environment;


### 14. welcome the ‘one-in , one-out’ approach based on stakeholder involvement , through which the commission aims to offset newly introduced burdens by relieving people and businesses of equivalent burdens at eu level in the same policy area; emphasises , however , that the implementation of this approach should not lead to mechanical decisions to repeal legislation or lower standards; ### 14. is wary about the ‘one-in , one-out’ approach proposed by the commission , which aims to offset newly introduced burdens by relieving citizens and businesses of equivalent burdens at eu level in the same policy area , as this approach could lead to mechanical decisions to repeal legislation and lower common standards;


### 15. welcomes , in this regard , the establishment by the commission of the fit for future platform , a high-level expert group with the participation of various stakeholders , member state experts , and representatives of the committee of the regions and the european economic and social committee , which advises the commission on how to identify potentially burdensome existing eu legislation and how to simplify and modernise it , including through digitalisation; ### 15. welcomes , in this regard , the establishment by the commission of the fit for future platform in 2020 , building on the experience with the refit platform , a high-level expert group with the participation of various stakeholders , member state experts , and representatives of the committee of the regions and the european economic and social committee , which advises the commission on how to identify potentially burdensome existing eu legislation and how to simplify and modernise it , including through digitalisation;


### 16. instructs its president to forward this resolution to the council and the commission. ### 16. instructs its president to forward this resolution to the commission and the council as well as to the national parliaments , the committee of the regions and the european economic and social committee.


### b. whereas the extensive use of asbestos in construction poses a threat to building users and occupants; ### b. whereas the asbestos residues in buildings and constructions containing asbestos poses a threat to building users and occupants;


### 1. calls on the commission to bring forward , on the basis of article 169(3) and article 114(1) of the treaty on the functioning of the european union , a legislative proposal introducing mandatory screening for the presence of asbestos in buildings before their sale or rental and laying down minimum requirements for locating and identifying all materials containing asbestos in buildings constructed before 2005 , or the year in which the national ban on asbestos was introduced , under the following conditions: ### 1. calls on the commission to consider in addition bringing forward , on the basis of article 169(3) and article 114(1) of the treaty on the functioning of the european union , a legislative proposal which introduces a mandatory screening for the presence of asbestos in buildings built before 2005 , or the year in which the national ban on asbestos was introduced , before an initial sale or rental , and clear harmonised standards for locating and identifying all materials containing asbestos in buildings , while being socially fair and taking into consideration the owner of the buildings under the following conditions:


### a. the screening shall consists of a diagnosis of the presence of asbestos and must be followed by action to reduce the risk posed by any asbestos detected; ### a. the screening shall consists of a diagnosis of the presence of any asbestos or the lack thereof and must be followed by recommendations on what actions are needed to reduce the risk posed by any asbestos detected , including if encapsulating or total removal is necessary;


### b. the screening shall be validated by an asbestos risk certificate detailing the areas screened and , where appropriate , the action taken to reduce the risk posed by asbestos; ### b. the screening shall be validated by an asbestos certificate detailing the areas screened , the presence or lack thereof of any asbestos and , where appropriate , by recommendations on what actions are needed to reduce the risk posed by asbestos;


### 1. the development of models to detect , monitor and check asbestos in private and public buildings , land , infrastructure , logistics and piping; ### 1. the development of models to detect , register , monitor and check asbestos in private and public buildings , land , infrastructure , logistics and piping;


### 3. the development of information campaigns on asbestos to provide relevant information to workers , employers , owners , tenants , users of buildings and infrastructure , and citizens about the risks and legal obligations relating to asbestos; ### 3. the development of information campaigns on asbestos to provide relevant information to workers , employers , owners , tenants , users of buildings and infrastructure , and citizens about the risks , including of the synergistic effect of tobacco use and asbestos exposure , and legal obligations relating to asbestos and existing accompanying measures for the safe removal of asbestos;


### 4. recalls that a study by italian scientists has shown that ingestion of water containing asbestos fibres significantly increases the risk of gastric and colorectal cancers; ### 4. recalls that a study by italian scientists has raised the important question of whether ingestion of water containing asbestos fibres increases the risk of gastric and colorectal cancers; stresses that , even if this analysis alone cannot make it possible to definitively conclude , at this stage , on the link between the ingestion of asbestos via water and the development of cancers of the gastrointestinal tract , the precautionary principle should apply given the uncertainties involved; considers that more research should be conducted on this important question;


### 4. the establishment of centres for the treatment and inerting of waste containing asbestos by providing for the phasing out of the disposal of such waste in landfills; ### 4. the establishment of centres and the promotion of research for the treatment and inerting of waste containing asbestos by providing for the phasing out of the disposal of such waste in landfills;


### 5. calls on the commission to set out a european strategy for the complete elimination of asbestos; calls on all member states to adopt national action plans to implement that strategy; considers that the commission should coordinate the national action plans , in particular through the adoption of a framework directive on this matter; ### 5. calls on the commission to set out a european strategy for the complete elimination of asbestos; calls on all member states to adopt national action plans to implement that strategy; considers that the commission should coordinate the national action plans , in particular through the adoption of a framework directive on this matter; points out that the safe removal of asbestos is an example of the need to apply the principle of health in all policies and is directly connected to recent and upcoming union policy initiatives such as the green deal with the renovation wave and europe’s beating cancer plan;


### 5. the establishment of a european framework for public and accessible asbestos registers , together with a mapping of the exact location of asbestos on public and private sites; ### 5. the establishment of a european framework for public and accessible asbestos registers , based on asbestos certificates delivered after the screening of buildings to map the exact location of asbestos on public and private sites;


### 6. a roadmap for asbestos-free workplaces and an asbestos-free environment , which could establish priority sectors and be subject to periodic evaluation every five years of the progress made by the national and regional authorities; ### 6. a roadmap for asbestos-free workplaces and an asbestos-free environment , which could establish priority sectors , comprise support for safe removal , and be subject to periodic evaluation every five years of the progress made by the national and regional authorities;


### 9. calls on the eu to work with other international organisations and third countries to achieve a global ban on asbestos; ### 9. calls on the eu to work with other international organisations , notably the world health organization , and third countries to achieve a global ban on asbestos;


### 5. notes that the vertical block exemption regulation has been inadequately adapted to recent market developments , notably the growth of online sales and online platforms; welcomes the impact assessment recently launched by the commission and calls for further steps to address the issue; ### 5. notes that the vertical block exemption regulation has been inadequately adapted to recent market developments , notably the growth of online sales and online platforms; welcomes the impact assessment recently launched by the commission and calls for further steps to address the issue; underlines that selective distribution agreements and contractual clauses should not lead to the fragmentation of the single market by creating barriers to cross-border trade and distribution; believes that national market segmentation prevents full and fair competition in the union;


### (3) it is necessary to improve the conditions for data sharing in the internal market , by creating a harmonised framework for data exchanges. sector-specific legislation can develop , adapt and propose new and complementary elements , depending on the specificities of the sector , such as the envisaged legislation on the european health data space25 and on access to vehicle data. moreover , certain sectors of the economy are already regulated by sector-specific union law that include rules relating to cross-border or union wide sharing or access to data26 . this regulation is therefore without prejudice to regulation (eu) 2016/679 of the european parliament and of the council (27 ) , and in particular the implementation of this regulation shall not prevent cross border transfers of data in accordance with chapter v of regulation (eu) 2016/679 from taking place , directive (eu) 2016/680 of the european parliament and of the council (28 ) , directive (eu) 2016/943 of the european parliament and of the council (29 ) , regulation (eu) 2018/1807 of the european parliament and of the council (30 ) , regulation (ec) no 223/2009 of the european parliament and of the council (31 ) , directive 2000/31/ec of the european parliament and of the council (32 ) , directive 2001/29/ec of the european parliament and of the council (33 ) , directive (eu) 2019/790 of the european parliament and of the council (34 ) , directive 2004/48/ec of the european parliament and of the council (35 ) , directive (eu) 2019/1024 of the european parliament and of the council (36 ) , as well as regulation 2018/858/eu of the european parliament and of the council (37 ) , directive 2010/40/eu of the european parliament and of the council (38 ) and delegated regulations adopted on its basis , and any other sector-specific union legislation that organises the access to and re-use of data. this regulation should be without prejudice to the access and use of data for the purpose of international cooperation in the context of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties. a horizontal regime for the re-use of certain categories of protected data held by public sector bodies , the provision of data sharing services and of services based on data altruism in the union should be established. specific characteristics of different sectors may require the design of sectoral data-based systems , while building on the requirements of this regulation. where a sector-specific union legal act requires public sector bodies , providers of data sharing services or registered entities providing data altruism services to comply with specific additional technical , administrative or organisational requirements , including through an authorisation or certification regime , those provisions of that sector-specific union legal act should also apply. ### (3) it is necessary to improve the conditions for data sharing in the internal market , by creating a harmonised framework for data exchanges. sector-specific legislation can develop , adapt and propose new and complementary elements , depending on the specificities of the sector , such as the envisaged legislation on the european health data space25 and on access to vehicle data. moreover , certain sectors of the economy are already regulated by sector-specific union law that include rules relating to cross-border or union wide sharing or access to data26 . this regulation is therefore without prejudice to regulation (eu) 2016/679 of the european parliament and of the council (27 ) , and in particular the implementation of this regulation shall not prevent cross border transfers of data in accordance with chapter v of regulation (eu) 2016/679 from taking place , directive (eu) 2016/680 of the european parliament and of the council (28 ) , directive (eu) 2016/943 of the european parliament and of the council (29 ) , regulation (eu) 2018/1807 of the european parliament and of the council (30 ) , regulation (ec) no 223/2009 of the european parliament and of the council (31 ) , directive 2000/31/ec of the european parliament and of the council (32 ) , directive 2001/29/ec of the european parliament and of the council (33 ) , directive (eu) 2019/790 of the european parliament and of the council (34 ) , directive 2004/48/ec of the european parliament and of the council (35 ) , directive (eu) 2019/1024 of the european parliament and of the council (36 ) , as well as regulation 2018/858/eu of the european parliament and of the council (37 ) , directive 2010/40/eu of the european parliament and of the council (38 ) and delegated regulations adopted on its basis , and any other sector-specific union legislation that organises the access to and re-use of data. this regulation should be without prejudice to the access and use of data for the purpose of international cooperation in the context of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties. a horizontal regime for the re-use of certain categories of protected data held by public sector bodies , the provision of data intermediaries and of services based on data altruism in the union should be established. specific characteristics of different sectors may require the design of sectoral data-based systems , while building on the requirements of this regulation. where a sector-specific union legal act requires public sector bodies , providers of data sharing services or registered entities providing data altruism services to comply with specific additional technical , administrative or organisational requirements , including through an authorisation or certification regime , those provisions of that sector-specific union legal act should also apply.


### (5) the idea that data that has been generated at the expense of public budgets should benefit society has been part of union policy for a long time. directive (eu) 2019/1024 as well as sector-specific legislation ensure that the public sector makes more of the data it produces easily available for use and re-use. however , certain categories of data (commercially confidential data , data subject to statistical confidentiality , data protected by intellectual property rights of third parties , including trade secrets and personal data not accessible on the basis of specific national or union legislation , such as regulation (eu) 2016/679 and directive (eu) 2016/680) in public databases is often not made available , not even for research or innovative activities. due to the sensitivity of this data , certain technical and legal procedural requirements must be met before they are made available , in order to ensure the respect of rights others have over such data. such requirements are usually time- and knowledge-intensive to fulfil. this has led to the underutilisation of such data. while some member states are setting up structures , processes and sometimes legislate to facilitate this type of re-use , this is not the case across the union. ### (5) the idea that data that has been generated at the expense of public budgets should benefit society has been part of union policy for a long time. directive (eu) 2019/1024 as well as sector-specific legislation ensure that the public sector makes more of the data it produces easily available for use and re-use. however , certain categories of data (commercially confidential data , data subject to statistical confidentiality , data protected by intellectual property rights of third parties , including trade secrets and personal data not accessible on the basis of specific national or union legislation , such as regulation (eu) 2016/679 and directive (eu) 2016/680) in public databases is often not made available , not even for research or innovation beneficial to society. due to the sensitivity of this data , certain technical and legal procedural requirements must be met before they are made available , in order to ensure the respect of rights others have over such data. such requirements are usually time- and knowledge-intensive to fulfil. this has led to the underutilisation of such data. while some member states are setting up structures , processes and sometimes legislate to facilitate this type of re-use , this is not the case across the union.


### (6) there are techniques enabling privacy-friendly analyses on databases that contain personal data , such as anonymisation , pseudonymisation , differential privacy , generalisation , or suppression and randomisation. application of these privacy-enhancing technologies , together with comprehensive data protection approaches should ensure the safe re-use of personal data and commercially confidential business data for research , innovation and statistical purposes. in many cases this implies that the data use and re-use in this context can only be done in a secure processing environment set in place and supervised by the public sector. there is experience at union level with such secure processing environments that are used for research on statistical microdata on the basis of commission regulation (eu) 557/2013 (39 ). in general , insofar as personal data are concerned , the processing of personal data should rely upon one or more of the grounds for processing provided in article 6 of regulation (eu) 2016/679. ### (6) there are techniques enabling privacy-friendly analyses on databases that contain personal data , such as anonymisation , pseudonymisation , differential privacy , generalisation , or suppression and randomisation. member states should provide support to public sector bodies to optimise data collection and data generation so as to make optimal use of such techniques , thus making as much data possible available for sharing. application of these privacy-enhancing technologies , together with comprehensive data protection approaches should ensure the safe re-use of personal data and commercially confidential business data for research , innovation and statistical purposes. in many cases this implies that the data use and re-use in this context can only be done in a secure processing environment set in place and supervised by the public sector. there is experience at union level with such secure processing environments that are used for research on statistical microdata on the basis of commission regulation (eu) 557/2013 (39 ). in general , insofar as personal data are concerned , the processing of personal data should rely upon one or more of the grounds for processing provided in article 6 of regulation (eu) 2016/679.


### (15) furthermore , it is important to protect commercially sensitive data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage. in order to ensure the protection of fundamental rights or interests of data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in that third-country there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the commission may adopt implementing acts that declare that a third country provides a level of protection that is essentially equivalent to those provided by union or national law. the assessment of the level of protection afforded in such third-country should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data holders , public sector bodies or data sharing providers in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies. ### (15) furthermore , it is important to protect commercially sensitive data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage. in order to ensure the protection of fundamental rights or interests of data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in that third-country there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the commission may adopt implementing acts that declare that a third country provides a level of protection that is essentially equivalent to those provided by union or national law. the assessment of the level of protection afforded in such third-country should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data holders , public sector bodies or data intermediaries in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies.


### (21) in order to incentivise the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. it should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data holders with management of the consent , including consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. data processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors. ### (21) in order to incentivise the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. the single information point should seek to present relevant information on data held by public sector bodies in two additional wide-circulation european languages , in order to stimulate cross-border data re-use within the eu. the commission should collect and make public and easily accessible information about all member states’ single information points. the single information point should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data holders with management of the consent , including consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. data processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors.


### (22) providers of data sharing services (data intermediaries) are expected to play a key role in the data economy , as a tool to facilitate the aggregation and exchange of substantial amounts of relevant data. data intermediaries offering services that connect the different actors have the potential to contribute to the efficient pooling of data as well as to the facilitation of bilateral data sharing. specialised data intermediaries that are independent from both data holders and data users can have a facilitating role in the emergence of new data-driven ecosystems independent from any player with a significant degree of market power. this regulation should only cover providers of data sharing services that have as a main objective the establishment of a business , a legal and potentially also technical relation between data holders , including data subjects , on the one hand , and potential users on the other hand , and assist both parties in a transaction of data assets between the two. it should only cover services aiming at intermediating between an indefinite number of data holders and data users , excluding data sharing services that are meant to be used by a closed group of data holders and users. providers of cloud services should be excluded , as well as service providers that obtain data from data holders , aggregate , enrich or transform the data and licence the use of the resulting data to data users , without establishing a direct relationship between data holders and data users , for example advertisement or data brokers , data consultancies , providers of data products resulting from value added to the data by the service provider. at the same time , data sharing service providers should be allowed to make adaptations to the data exchanged , to the extent that this improves the usability of the data by the data user , where the data user desires this , such as to convert it into specific formats. in addition , services that focus on the intermediation of content , in particular on copyright-protected content , should not be covered by this regulation. data exchange platforms that are exclusively used by one data holder in order to enable the use of data they hold as well as platforms developed in the context of objects and devices connected to the internet-of-things that have as their main objective to ensure functionalities of the connected object or device and allow value added services , should not be covered by this regulation. ‘consolidated tape providers’ in the sense of article 4 (1) point 53 of directive 2014/65/eu of the european parliament and of the council42 as well as ‘account information service providers’ in the sense of article 4 point 19 of directive (eu) 2015/2366 of the european parliament and of the council43 should not be considered as data sharing service providers for the purposes of this regulation. entities which restrict their activities to facilitating use of data made available on the basis of data altruism and that operate on a not-for-profit basis should not be covered by chapter iii of this regulation , as this activity serves objectives of general interest by increasing the volume of data available for such purposes. ### (22) data intermediation services are expected to play a key role in the data economy , as a tool to facilitate the aggregation and exchange of substantial amounts of relevant data. data intermediaries offering services that connect the different actors have the potential to contribute to the efficient pooling of data as well as to the facilitation of bilateral data sharing. specialised data intermediaries that are independent from both data holders and data users can have a facilitating role in the emergence of new data-driven ecosystems independent from any player with a significant degree of market power. this regulation should only cover data intermediation services that have as a main objective the establishment of a business , a legal and potentially also technical relation between data holders , including data subjects , on the one hand , and potential users on the other hand , and assist both parties in a transaction of data assets between the two. it should only cover services aiming at intermediating between an indefinite number of data holders and data users , excluding data sharing services that are meant to be used by a closed group of data holders and users. data intermediation services do not share data themselves , but only provide an intermediation service to entities wishing to engage in data sharing. providers of cloud services should be excluded , as well as service providers that obtain data from data holders , aggregate , enrich or transform the data and licence the use of the resulting data to data users , without establishing a direct relationship between data holders and data users , for example advertisement or data brokers , data consultancies , providers of data products resulting from value added to the data by the service provider. at the same time , data intermediation services should be allowed to make adaptations to the data exchanged , to the extent that this improves the usability of the data by the data user , where the data user desires this , such as to convert it into specific formats. in addition , services that focus on the intermediation of content , in particular on copyright-protected content , should not be covered by this regulation. data exchange platforms that are exclusively used by one data holder in order to enable the use of data they hold as well as platforms developed in the context of objects and devices connected to the internet-of-things that have as their main objective to ensure functionalities of the connected object or device and allow value added services , should not be covered by this regulation. ‘consolidated tape providers’ in the sense of article 4 (1) point 53 of directive 2014/65/eu of the european parliament and of the council42 as well as ‘account information service providers’ in the sense of article 4 point 19 of directive (eu) 2015/2366 of the european parliament and of the council43 should not be considered as data sharing service providers for the purposes of this regulation. entities which restrict their activities to facilitating use of data made available on the basis of data altruism and that operate on a not-for-profit basis should not be covered by chapter iii of this regulation , as this activity serves objectives of general interest by increasing the volume of data available for such purposes.


### (35) there is a strong potential in the use of data made available voluntarily by data subjects based on their consent or , where it concerns non-personal data , made available by legal persons , for purposes of general interest. such purposes would include healthcare , combating climate change , improving mobility , facilitating the establishment of official statistics or improving the provision of public services. support to scientific research , including for example technological development and demonstration , fundamental research , applied research and privately funded research , should be considered as well purposes of general interest. this regulation aims at contributing to the emergence of pools of data made available on the basis of data altruism that have a sufficient size in order to enable data analytics and machine learning , including across borders in the union. ### (35) there is a strong potential in the use of data made available voluntarily by data subjects based on their consent or , where it concerns non-personal data , made available by legal persons , for purposes of general interest. such purposes would include healthcare , combating climate change , improving mobility , improving education , facilitating the establishment of official statistics or improving the provision of public services. support to scientific research , including for example technological development and demonstration , fundamental research , applied research and privately funded research , should also be considered purposes of general interest. this regulation aims at contributing to the emergence of pools of interoperable data made available on the basis of data altruism that have a sufficient size in order to enable data analytics and machine learning , including across borders in the union.


### (36) legal entities that seek to support purposes of general interest by making available relevant data based on data altruism at scale and meet certain requirements , should be able to register as ‘data altruism organisations recognised in the union’. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. data subjects in this respect would consent to specific purposes of data processing , but could also consent to data processing in certain areas of research or parts of research projects as it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the voluntary compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a general interest purpose. such trust should result in particular from a place of establishment within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available. ### (36) legal entities that seek to support purposes of general interest by making available relevant data based on data altruism at scale and meet certain requirements , should be able to register as ‘data altruism organisations recognised in the union’. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. data subjects in this respect would consent to specific purposes of data processing , but could also consent to data processing in certain areas of research or parts of research projects as it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. this should be done without prejudice to and in accordance with regulation (eu) 2016/679. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the voluntary compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a general interest purpose. such trust should result in particular from a place of establishment within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available.


### (38) data altruism organisations recognised in the union should be able to collect relevant data directly from natural and legal persons or to process data collected by others. typically , data altruism would rely on consent of data subjects in the sense of article 6(1)(a) and 9(2)(a) and in compliance with requirements for lawful consent in accordance with article 7 of regulation (eu) 2016/679. in accordance with regulation (eu) 2016/679 , scientific research purposes can be supported by consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research or only to certain areas of research or parts of research projects. article 5(1)(b) of regulation (eu) 2016/679 specifies that further processing for scientific or historical research purposes or statistical purposes should , in accordance with article 89(1) of regulation (eu) 2016/679 , not be considered to be incompatible with the initial purposes. ### (38) data altruism organisations recognised in the union should be able to collect relevant data directly from natural and legal persons or to process data collected by others under an appropriate legal basis established under regulation (eu) 2016/679. where they are processing personal data or data controllers or processors in the meaning of regulation (eu) 2016/679 , they are bound by the rules of that regulation. typically , data altruism would rely on consent of data subjects in the sense of article 6(1)(a) and 9(2)(a) and in compliance with requirements for lawful consent in accordance with article 7 of regulation (eu) 2016/679. in accordance with regulation (eu) 2016/679 , scientific research purposes can be supported by consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research or only to certain areas of research or parts of research projects. article 5(1)(b) of regulation (eu) 2016/679 specifies that further processing for scientific or historical research purposes or statistical purposes should , in accordance with article 89(1) of regulation (eu) 2016/679 , not be considered to be incompatible with the initial purposes.


### (40) in order to successfully implement the data governance framework , a european data innovation board should be established , in the form of an expert group. the board should consist of representatives of the member states , the commission and representatives of relevant data spaces and specific sectors (such as health , agriculture , transport and statistics). the european data protection board should be invited to appoint a representative to the european data innovation board. ### (40) in order to successfully implement the data governance framework , a european data innovation board should be established , in the form of an expert group. the board should consist of representatives of the member states , the commission and representatives of relevant data spaces and specific sectors (such as health , agriculture , transport and statistics). the european data protection board , the eu-level coordination board of supervisory authorities for artificial intelligence1a ,and the cybersecurity cooperation group 2a should be invited to appoint a representative to the european data innovation board.