EUROPEAN COMMISSION Brussels, 10.1.2017 COM(2017) 8 final 2017/0002(COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC



EXPLANATORY MEMORANDUM 1.CONTEXT OF THE PROPOSAL •Reasons for and objectives of the proposal Article 16(1) of the Treaty on the Functioning of the European Union (TFEU), as introduced by the Lisbon Treaty, establishes the principle that everyone has the right to the protection of personal data concerning them. Moreover, in Article 16(2) TFEU, the Lisbon Treaty introduced a specific legal basis for adopting rules on the protection of personal data. Article 8 of the Charter of Fundamental Rights of the European Union enshrines the protection of personal data as a fundamental right. The right to the protection of personal data also applies to the processing of personal data by EU institutions, bodies, offices and agencies. Regulation (EC) No 45/2001, the main piece of existing EU legislation on personal data protection in the Union institutions, was adopted in 2001 with two objectives in mind: to protect the fundamental right to data protection and to guarantee the free flow of personal data throughout the Union. It was complemented by Decision No 1247/2002/EC. On 27 April 2016, the European Parliament and the Council adopted the General Data Protection Regulation (Regulation (EU) 2016/679), which will become applicable on 25 May 2018. This Regulation calls for Regulation (EC) No 45/2001 to be adapted to the principles and rules laid down in Regulation (EU) 2016/679 in order to provide a strong and coherent data protection framework in the Union and to enable both instruments to be applicable at the same time. It is consistent with the coherent approach to personal data protection throughout the Union to align, as far as possible, the data protection rules for Union institutions, bodies, offices and agencies with the data protection rules adopted for the Member States. Whenever the provisions of the proposal are based on the same concept as the provisions of Regulation (EU) 2016/679, these two provisions should be interpreted homogeneously, in particular because the scheme of the proposal should be understood as the equivalent of the scheme of Regulation (EU) 2016/679. The review of Regulation (EC) No 45/2001 also takes into account the results of enquiries and stakeholder consultations, and the evaluation study on its application over the last 15 years. This initiative is not within the Regulatory Fitness Programme (REFIT). •Consistency with existing policy provisions in the policy area The proposal aims to align the provisions of Regulation (EC) No 45/2001 with the principles and rules laid down in Regulation (EU) 2016/679 in order to provide a strong and coherent data protection framework in the Union. The proposal also incorporates the relevant rules laid down in Regulation (EC) XXXX/XX [e-Privacy Regulation] with regard to the protection of terminal equipment of end-users. •Consistency with other Union policies Not applicable 2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY •Legal basis The protection of natural persons in relation to the processing of their personal data is a fundamental right laid down in Article 8(1) of the Charter of Fundamental Rights of the European Union. This proposal is based on Article 16 TFEU, which is the legal basis for adopting data protection rules. This Article allows for the adoption of rules relating to the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies when carrying out activities which fall within the scope of Union law. It also allows for the adoption of rules relating to the free movement of personal data, including personal data processed by those institutions, bodies, offices and agencies. •Subsidiarity (for non-exclusive competence) The subject- matter of this Regulation falls within the domain of exclusive competence of the Union, since only the Union can adopt rules governing the processing of personal data by the Union’s institutions.

•Proportionality In accordance with the principle of proportionality, to achieve the basic objectives of ensuring an equivalent level of protection of natural persons with regard to the processing of personal data and the free flow of personal data throughout the Union it is necessary and appropriate to lay down rules on processing personal data by Union institutions, bodies, offices and agencies. This Regulation does not go beyond what is necessary for achieving the objectives pursued in accordance with Article 5(4) of the Treaty on European Union. •Choice of the instrument A Regulation is considered the appropriate legal instrument to define the framework on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and the free movement of such data. It provides natural persons with legally enforceable rights, specifies the data processing obligations of the controllers in the Union institutions, bodies, offices and agencies. It also provides for an independent supervisory authority, the European Data Protection Supervisor, to be responsible for monitoring the processing of personal data by the Union institutions, bodies, offices and agencies. 3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS The Commission carried out stakeholder consultations in 2010 and 2011 and an impact assessment in the context of preparing the data protection reform package which informs on the changes proposed to Regulation (EC) No 45/2001. In this context, the Commission also conducted a survey of Commission data protection coordinators (DPCs). As regards the practical application of Regulation (EC) No 45/2001 by Union institutions, bodies, offices and agencies, information was gathered from the European Data Protection Supervisor (EDPS), other Union institutions, bodies, offices and agencies, other Commission DG’s and an external contractor. A questionnaire was send to the Network of data protection officers (DPOs). The data protection officers from a number of Union’s institutions, bodies, offices and agencies held workshops on the reform of Regulation 45/2001 on 9 July 2015, 22 October 2015, 19 January 2016 and 15 March 2016. The Commission decided in 2013 to conduct an evaluation study on the application to date of Regulation (EC) No 45/2001, which it outsourced to an external contractor. The final deliverables of the evaluation study (final report, five case studies and article-by-article analysis) were submitted to the Commission on 8 June 2015. The evaluation showed that the governance system structured around DPOs and the EDPS is effective. It found that the sharing of powers between DPOs and the EDPS is clear and well balanced, and that both have an appropriate range of powers. Difficulties could, however, arise from a lack of authority due to insufficient support for the DPOs from their management. The evaluation study indicated that Regulation (EC) No 45/2001 could be better enforced through the use of sanctions by the EDPS. Increased use of its supervisory authority powers could lead to better implementation of data protection rules. Another conclusion was that data controllers should adopt a risk management approach and perform risk assessments before carrying out processing operations in order to better implement data retention and security requirements. The study also showed that existing rules in Chapter IV of Regulation (EC) No 45/2001 on the telecommunications sector are outdated and that there is a need to align this Chapter with the e-Privacy Directive. According to the evaluation study there is also a need to make some key definitions of Regulation (EC) No 45/2001 clearer. These include the identification of data controllers in the Union institutions, bodies, offices and agencies, the definition of recipients and extending the obligation on confidentiality to external processors. The evaluation study also pointed to the need to simplify the regime of notifications and prior checks in order to increase efficiency and reduce the administrative burden. The evaluator carried out an online survey in 64 Union institutions, agencies, offices and bodies. 422 responsible officials of data controllers, 73 DPOs, 118 DPCs and 109 IT respondents answered to the survey questions. The evaluator also carried out a series of stakeholder interviews. On 26 March 2015, the evaluator and the Commission organised a final workshop, attended by a number of data controllers, DPOs, DPCs, IT respondents and representatives of the EDPS. •Collection and use of expertise See reference to the evaluation study under the previous point. •Impact assessment The impact of the present proposal will fall mainly on the Union institutions, bodies, offices and agencies. This has been confirmed by the information gathered from the EDPS, other Union institutions, bodies, offices and agencies, Commission DG’s and the external contractor. Furthermore, the impact of the new obligations arising from Regulation (EU) 2016/679, with which the present regulation is to be aligned, has been assessed in the context of the preparatory works for the latter. This renders a specific impact assessment for this Regulation unnecessary. •Regulatory fitness and simplification Not applicable

•Fundamental rights The right to the protection of personal data is laid down in Article 8 of the Charter of Fundamental Rights of the European Union (Charter), Article 16 of the TFEU and Article 8 of the European Convention on Human Rights. As underlined by the Court of Justice of the European Union, the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society. Data protection is also closely linked to respect for private and family life protected by Article 7 of the Charter. The present proposal lays down rules on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and the free movement of such data. Other fundamental rights enshrined in the Charter that could potentially be affected are: the freedom of expression (Article 11); the right to property and in particular the protection of intellectual property (Article 17(2)); the prohibition of any discrimination on grounds such as race, ethnic origin, genetic features, religion or belief, political opinion or any other opinion, disability or sexual orientation (Article 21); the rights of the child (Article 24); the right to a high level of human health care (Article 35); the right of access to documents (Article 42); and the right to an effective remedy and a fair trial (Article 47). 4.BUDGETARY IMPLICATIONS See the financial statement in annex. 5.OTHER ELEMENTS •Implementation plans and monitoring, evaluation and reporting arrangements Not applicable •Explanatory documents (for directives) Not applicable CHAPTER I - GENERAL PROVISIONS Article 1 defines the subject matter of the Regulation, and, as in Article 1 of Regulation (EC) No 45/2001, sets out the two objectives of the Regulation: protection of the fundamental right to data protection and to guarantee the free flow of personal data throughout the Union. It also provides for the main tasks of the European Data Protection Supervisor. Article 2 determines the scope of the Regulation: it shall apply to the processing of personal data, by automated means or otherwise, by all Union institutions and bodies insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Union law. The material scope of this Regulation is technologically neutral. The protection of personal data applies to the processing of personal data by automated means, as well as to manual processing if the personal data are contained or are intended to be contained in a filing system. Article 3 contains definitions of terms used in the Regulation. Apart from the definitions of the ‘Union institutions and bodies’, ‘controller’, ‘user’ and ‘directory’, which are specific to this Regulation, the terms used in this Regulation are defined in Regulation (EU) 2016/679, Regulation (EU) 0000/00 [new ePrivacy Regulation], Directive 00/0000/EU [Directive establishing the European Electronic Communications Code] and Commission Directive 2008/63/EC. CHAPTER II - PRINCIPLES Article 4 sets out the principles relating to personal data processing, which correspond to those in Article 5 of Regulation (EU) 2016/679. Compared to Regulation (EC) No 45/2001 it adds the new principles of transparency and of integrity and confidentiality. Article 5 is based on Article 6 of Regulation (EU) 2016/679 and sets the criteria for lawful processing, with the sole exception of the criterion of the controller's legitimate interest which is not applicable to the public sector and thus should not apply to Unions institutions and bodies. Article 5 maintains the criteria already established under Article 5 of Regulation (EC) No 45/2001. Article 6 clarifies the conditions for processing for another compatible purpose in line with Article 6(4) of Regulation (EU) 2016/679. Compared to Article 6 of Regulation (EC) No 45/2001 this new provision provides more flexibility and legal certainty with regard to further processing for compatible purposes. Article 7 clarifies, in accordance with Article 7 of Regulation (EU) 2016/679, the conditions for consent to be valid as a legal ground for lawful processing.

Article 8 sets out, in line with Article 8 of Regulation (EU) 2016/679, further conditions for the lawfulness of the processing of personal data of children in relation to information society services offered directly to them. It sets 13 years as the child's minimum age for valid consent. Article 9 sets out, in accordance with Article 8 of Regulation (EC) No 45/2001 rules providing for a specific level of protection on the transmission of personal data to recipients, other than Union institutions and bodies, established in the Union and subject to Regulation (EU) 2016/679 or Directive (EU) 2016/680. It clarifies that, where it is the controller initiating the transmission, it should demonstrate necessity and proportionality of the transmission. Article 10 sets out the general prohibition for processing special categories of personal data and the exceptions from this general rule, building on Article 9 of Regulation (EU) 2016/679 and further developing Article 10 of Regulation (EC) No 45/2001. Article 11 sets out, in accordance with Article 10 of Regulation (EU) 2016/679 and in line with Article 10(5) of Regulation (EC) No 45/2001, the conditions for processing of personal data relating to criminal convictions and offences. Article 12 clarifies the controller's information obligations towards the data subject, in accordance with Article 11 of Regulation (EU) 2016/679, providing that if the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. Article 13 sets out, based on Article 89(1) of Regulation (EU) 2016/679, the rules on safeguards relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. CHAPTER III - RIGHTS OF THE DATA SUBJECT Section 1 – Transparency and modalities Article 14 introduces, based on Article 12 of of Regulation (EU) 2016/679, the obligation on controllers to provide transparent, easily accessible and understandable information and procedures and mechanism for exercising the data subject's rights, including where appropriate, means for electronic requests, requiring response to the data subject's request within a defined deadline, and the motivation of refusals. As the Union institutions and bodies are not expected to charge, in any circumstance, fees related to the administrative costs for providing the information, this possibility was not taken over from Regulation (EU) 2016/679. Section 2 – Information and access to data Article 15 specifies the controller's information obligations towards the data subject where personal data are collected from the data subject, building on Article 13 of Regulation (EU) 2016/679 and further developing Article 11 of Regulation (EC) No 45/2001, providing information to the data subject, including on the storage period, the right to lodge a complaint and in relation to international transfers. Article 16 further specifies, building on Article 14 of Regulation (EU) 2016/679 and further developing Article 12 of Regulation (EC) No 45/2001, the controller's information obligations towards the data subject where personal data have not been obtained from the data subject providing information to the source from which the data are originating. It also maintains the possible derogations in Regulation (EU) 2016/679, e.g. there will be no such obligation if the data subject already has the information, the provision of such information proves impossible or would involve a disproportionate effort for the controller, where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union law or if the recording or disclosure are expressly provided by law. This could apply for example in proceedings by services competent for social security or health matters. Article 17 provides, in accordance with Article 15 of Regulation (EU) 2016/679 and further developing Article 13 of Regulation (EC) No 45/2001, on the data subject's right of access to their personal data, adding new elements, such as the obligation to inform the data subjects of the storage period, and of the rights to rectification and to erasure and to lodge a complaint. Section 3 – Rectification and erasure Article 18 sets out the data subject's right to rectification, based on Article 16 of Regulation (EU) 2016/679 and further developing Article 14 of Regulation (EC) No 45/2001. Article 19 lays down, in accordance with Article 17 of Regulation (EU) 2016/679 and further developing Article 16 of Regulation (EC) No 45/2001, the data subject's right to be forgotten and to erasure. It provides the conditions of the right to be forgotten, including the obligation of the controller which has made the personal data public to inform third parties on the data subject's request to erase any links to, or copy or replication of that personal data. Article 20 introduces the right to have the processing restricted in certain cases, avoiding the ambiguous terminology “blocking” used in Regulation (EC) No 45/2001 and ensuring consistency with the new terminology under Article 18 of Regulation (EU) 2016/679. Article 21 provides, in line with Article 19 of Regulation (EU) 2016/679 and further developing Article 17 of Regulation (EC) No 45/2001, for the controller's obligation to communicate to the recipients to whom the personal data have been disclosed any rectification or erasure of personal data or restriction unless it proves impossible or involves disproportionate effort. The controller shall also inform the data subject of those recipients if he or she requests it. Article 22 introduces, in accordance with Article 20 of Regulation (EU) 2016/679, the data subject's right to data portability, i.e. the right to receive the personal data concerning him or her, which he or she has provided to a controller or to have such personal data transmitted directly to another controller, where technically feasible. As a precondition and in order to further improve access of individuals to their personal data, it provides the right to obtain from the controller those data in a structured, commonly used and machine-readable format. This right only applies where the processing is based on the data subject's consent or on a contract concluded by him or her. Section 4 – Right to object and automated individual decision-making

Article 23 provides for the data subject's rights to object based on Article 21 of Regulation (EU) 2016/679 and further developing Article 18 of Regulation (EC) No 45/2001. Article 24 concerns the data subject's right not to be subject to a measure based solely on automated processing including profiling in line with Article 22 of Regulation (EU) 2016/679 and further developing Article 19 of Regulation (EC) No 45/2001. Section 5 – Restrictions Article 25 allows for restrictions of the data subject's rights laid down in Articles 14 to 22 and in Articles 34 and 38 and of principles laid down in Article 4 (in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22). Such restrictions should be laid down in legal acts adopted on the basis of the Treaties or the internal rules of Union institutions and bodies. In case a possibility of such a restriction is not provided for in the legal acts adopted on the basis of the Treaties or the internal rules of Union institutions and bodies, the latter could impose an ad hoc restriction if it respects the essence of the fundamental rights and freedoms, in relation to a specific processing operation, and is a necessary and proportionate measure in a democratic society to safeguard one or more of the objectives allowing the restrictions on data subject rights. This approach is in line with Article 23 of Regulation (EU) 2016/679. However, by contrast to Article 23 of Regulation (EU) 2016/679 and in line with Article 20 of Regulation (EC) No 45/2001 the provision does not provide for the possibility to restrict the right to object and the right not to be subject to decisions based solely on automated processing. The requirements for restrictions are in line with the Charter of Fundamental Rights and the European Convention on Human Rights, as interpreted by the Court of Justice of the European Union and the European Court of Human Rights respectively. CHAPTER IV - CONTROLLER AND PROCESSOR Section 1 – General obligations Article 26 builds on Article 24 of Regulation (EU) 2016/679 and introduces the "principle of accountability" by describing the obligation of responsibility of the controller to comply with this Regulation and to demonstrate compliance, including by way of adoption of appropriate technical and organisational measures and, where appropriate, internal policies and mechanisms for ensuring such compliance. Article 24(3) of Regulation (EU) 2016/679 was not kept in this provision as the Union institutions and bodies should not adhere to codes of conduct or certification mechanisms. Article 27 sets out, in accordance with Article 25 of Regulation (EU) 2016/679, the obligations of the controller arising from the principles of data protection by design and by default. Article 28 on joint controllers builds on Article 26 of Regulation (EU) 2016/679 to clarify the responsibilities of joint controllers - either Union institutions or bodies or not - as regards their internal relationship and towards the data subject. This provision rules on the situation where all joint controllers are covered by the same legal regime (this Regulation) and the situation where some are covered by this Regulation and some by another legal instrument (Regulation (EU) 2016/679, Directive (EU) 2016/680, Directive (EU) 2016/681 and other specific data protection regimes concerning Union institutions or bodies). Article 29 builds on Article 28 of Regulation (EU) 2016/679 and further develops Article 23 of Regulation (EC) No 45/2001, to clarify the position and obligations of processors, including the determination that a processor who infringes the Regulation by determining the purposes and means of processing shall be considered to be a controller in respect of that processing. Article 30 on the processing under the authority of the controller and processor is based on Article 29 of Regulation (EU) 2016/679, laying down a prohibition for the processor or any person acting under the authority of the controller or of the processor, and having access to personal data to process those data except on instructions from the controller, unless required to do so by Union or Member State law. Article 31 builds on Article 30 of Regulation (EU) 2016/679, and introduces the obligation for controllers and processors to maintain documentation of the processing operations under their responsibility, instead of a prior notification to the EDPS as required by Article 25 of Regulation (EC) No 45/2001 and the DPO register. By contrast to Regulation (EU) 2016/679, this provision does not make reference to representatives, as Unions institutions will not have representatives and will always have DPOs. References to transfers based on derogations for specific situations as in Regulation (EU) 2016/679 were not kept as those types of transfers are not envisaged in the present Regulation. The obligation to keep a record of processing activities may be centralised at the level of a Union institution or body. In such case, Union institutions and bodies have the possibility to keep their records of processing activities in the form of a publicly accessible register. Article 32 clarifies, on the basis of Article 31 of Regulation (EU) 2016/679, the obligations of Union institutions and bodies for the co-operation with the EDPS. Section 2 – Security of personal data and confidentiality of electronic communications Article 33 obliges, in accordance with Article 32 of Regulation (EU) 2016/679 and further developing Article 22 of Regulation (EC) No 45/2001, the controller to implement appropriate measures for the security of processing extending that obligation to processors, irrespective of the contract with the controller. Article 34 builds on Article 36 of Regulation (EC) No 45/2001 and ensures the confidentiality of electronic communications within Union institutions and bodies. Article 35 builds on the existing practice of Union institutions and bodies and protects the information related to the terminal equipment of end-users who are accessing publicly available websites and mobile applications offered by Union institutions and bodies, in accordance with Regulation (EU) XXXX/XX [new ePrivacy Regulation], in particular Article 8 thereof. Article 36 is based on Article 38 of Regulation (EC) No 45/2001 and protects personal data held in public and private directories of Union institutions and bodies. Articles 37 and 38 introduce an obligation to notify personal data breaches, in accordance with Articles 33 and 34 Regulation (EU) 2016/679. Section 3 – Data protection impact assessment and prior consultation

Article 39 builds on Article 35 of Regulation (EU) 2016/679 and introduces the obligation of controllers and processors to carry out a data protection impact assessment prior to processing operations which are likely to result in a high risk to the rights and freedoms of natural persons. This obligation will apply in particular in case of systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, processing on a large scale of special categories of data or systematic monitoring of a publicly accessible area on a large scale. Article 40 is based on Article 36 of Regulation (EU) 2016/679 and concerns the cases where authorisation by, and consultation of, the EDPS is mandatory prior to the processing. However, the first paragraph of Article 40 reproduces recital 94 of Regulation (EU) 2016/679 and is aimed at clarifying the scope of the obligation to consult. Section 4 – Information and legislative consultation Article 41 provides for an obligation for Union institutions and bodies to inform the EDPS when drawing up administrative measures and internal rules relating to the processing of personal data. Article 42 provides for an obligation for the Commission to consult the EDPS following the adoption of proposals for a legislative act and of recommendations or proposals to the Council pursuant to Article 218 TFEU and when preparing delegated acts or implementing acts that have an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. Where those acts have a particular importance for the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission may also consult the European Data Protection Board. In such cases both entities should coordinate their work with a view to issue a joint opinion. A time limit of 8 weeks for the issue of the advice in aforementioned cases is established, with possible derogations for urgent cases and otherwise where appropriate, for example when the Commission is preparing delegated and implementing acts. Section 5 – Obligation to react to allegations Article 43 lays down the obligation of controllers and processor to react to allegations after the EDPS decided to refer a matter to them. Section 6 – Data protection officer Article 44 builds on Article 37 (1) (a) Regulation (EU) 2016/679 and Article 24 of Regulation (EC) No 45/2001 to provide a mandatory DPO for Unions institutions and bodies. Article 45 builds on 38 of Regulation (EU) 2016/679 and Article 24 of Regulation (EC) No 45/2001 to set out the position of the DPO. Article 46 builds on 39 of Regulation (EU) 2016/679 and Article 24 and on the second and third paragraphs of the Annex to Regulation (EC) No 45/2001 to provide the core tasks of the DPO. CHAPTER V - TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS Article 47 further builds on Article 9 of Regulation (EC) No 45/2001 and spells out the general principle, in accordance with Article 44 of Regulation (EU) 2016/679, that compliance with other provisions of this Regulation and the conditions laid down in Chapter V are mandatory for any transfers of personal data to third countries or international organisations, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. Article 48 sets that a transfer of personal data to a third country or international organisation may take place where the Commission has decided pursuant to Article 45(3) of Regulation (EU) 2016/679 that an adequate level of protection is ensured in the third country, a territory or one or more specified sectors within that third country, or within the international organisation and the personal data are transferred solely to allow tasks covered by the competence of the controller to be carried out. Paragraphs 2 and 3 of this Article have been taken over from Article 9 of Regulation (EC) No 45/2001 as they are useful elements for monitoring of the level of protection in third countries and international organisations. Article 49 builds on Article 46 of Regulation (EU) 2016/679 and requires for transfers to third countries, where no adequacy decision has been adopted by the Commission, to adduce appropriate safeguards, in particular standard data protection clauses and contractual clauses. Binding corporate rules, codes of conduct and certification mechanisms could be used, in accordance with Regulation (EU) 2016/679, by processors other than Union institutions and bodies. The fourth paragraph of this Article on the obligation of Union institutions and bodies to inform the EDPS of categories of cases where they have applied this Article corresponds to Article 9(8) of Regulation (EC) No 45/2001 and is kept due to its specificity. The fifth paragraph builds on the grandfathering of existing authorisations laid down in Article 46(5) of Regulation (EU) 2016/679. Article 50 clarifies in accordance with Article 48 of Regulation (EU) 2016/679, that judgment of courts or decisions of administrative authorities of third countries requiring a transfer or disclosure of personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, without prejudice to other grounds for transfer pursuant to this Chapter. Article 51 builds on Article 49 of Regulation (EU) 2016/679 and spells out and clarifies the derogations for a data transfer. This applies in particular to data transfers required and necessary for the protection of important grounds of public interest, for example in cases of international data transfers involving competition authorities, tax or customs administrations, or between services competent for social security matters or for fisheries management. The fifth paragraph on the obligation to inform the EDPS of categories of cases where derogations have been relied upon for a transfer corresponds to the current Article 9(8) of Regulation (EC) No 45/2001. Article 52 is based on Article 50 Regulation (EU) 2016/679 and explicitly provides for international co-operation mechanisms for the protection of personal data between the EDPS, in cooperation with the Commission and the European Data Protection Board, and the supervisory authorities of third countries. CHAPTER VI - THE EUROPEAN DATA PROTECTION SUPERVISOR Article 53 builds up on Article 41 of Regulation (EC) No 45/2001 and concerns the establishment of the EDPS.

Article 54 builds on Article 42 of Regulation (EC) No 45/2001 and on Article 3 of Decision 1247/2002/EC and sets out the rules for the appointment of the EDPS by the European Parliament and the Council. It also specifies the duration of its term of office: five years. Article 55 builds on Article 43 of Regulation (EC) No 45/2001 and on Article 1 of Decision 1247/2002/EC and provides for regulations and general conditions governing the performance of duties of the EDPS and his or her staff and the financial resources. Article 56 builds on Article 52 Regulation (EU) 2016/679 and Article 44 of Regulation (EC) No 45/2001 and clarifies the conditions for the independence of the EDPS, taking into account the case law of the Court of Justice of the European Union. Article 57 sets, based on Article 45 of Regulation (EC) No 45/2001, the duties of secrecy of the EDPS during and after the term of office with regard to confidential information which has come to his or her knowledge in the course of the performance of the official duties. Article 58 builds on Article 57 Regulation (EU) 2016/679 and Article 46 of Regulation (EC) No 45/2001 and sets the tasks of the EDPS, including hearing and investigating complaints and promoting the awareness of the public of risks, rules, safeguards and rights. Article 59 is based on Article 58 of Regulation (EU) 2016/679 and Article 47 of Regulation (EC) No 45/2001 and sets out the powers of the EDPS. Article 60 builds on Article 59 of Regulation (EU) 2016/679 and Article 48 Regulation (EC) 45/2001 and lays down the obligation for the EDPS to draw up an annual activity report. CHAPTER VII - COOPERATION AND CONSISTENCY Article 61 builds on Article 61 Regulation (EU) 2016/679 and Article 46(f) of Regulation (EC) No 45/2001 and introduces explicit rules on cooperation of EDPS with national supervisory authorities. Article 62 provides for the obligations of the EDPS where other Union acts refer to this Article in the framework of coordinated supervision with national supervisory authorities. It seeks to implement a single model of coordinated supervision. This model could be used for coordinated supervision of large IT systems such as Eurodac, Schengen Information System II, Visa Information System, Customs Information System or Internal Market Information System, but also for supervision of some Union agencies where a specific model of cooperation between EDPS and national authorities is established, such as Europol. The European Data Protection Board should serve as a single forum for ensuring the effective coordinated supervision across the board. CHAPTER VIII - REMEDIES, LIABILITY AND PENALTIES Article 63 is based on Article 77 of Regulation (EU) 2016/679 and Article 32 of Regulation (EC) No 45/2001 and provides the right of any data subject to lodge a complaint with the EDPS. It lays down also the obligation of the EDPS to handle and inform the data subject of the progress and the outcome of the complaint within a deadline of three months after which the complaint shall be deemed to have been rejected. Article 64 maintains Article 32 (1) of Regulation (EC) No 45/2001, setting out the jurisdiction of the Court of Justice of the European Union to hear all disputes which relate to the provisions of this Regulation, including claims for damages. Article 65 sets out the right to compensation, for both material and non-material damage, subject to the conditions, including on liability, provided for in the Treaties. Article 66 builds on Article 83 of Regulation (EU) 2016/679 and provides the EDPS with the power to impose administrative fines on Union institutions and bodies, as a sanction of last resort and only where Union institution or bodies failed to comply with an order by the EDPS referred to in Article 59(2)(a) to (h) and (j). The article also specifies the criteria for deciding on the amount of the administrative fine in each individual case, while the maximum yearly ceilings are inspired by amounts of fines applicable in some Member States. Article 67 allows, in accordance with Article 80(1) of Regulation (EU) 2016/679, certain bodies, organisations or associations to lodge a complaint on behalf of the data subject. Article 68 provides, in line with Article 33 of Regulation (EC) No 45/2001, for specific rules aimed at protecting Union's staff, which lodge a complaint with the EDPS regarding an alleged infringement of the provisions of this Regulation, without acting through official channels. Article 69 builds on Article 49 of Regulation (EC) No 45/2001 and provides on sanctions applicable to failures to comply with the obligations of this Regulation by officials or other civil servants of the European Union. CHAPTER IX - IMPLEMENTING ACTS Article 70 contains the provision for the Committee procedure needed for conferring implementing powers on the Commission in the cases where in accordance with Article 291 TFEU uniform conditions for implementing legally binding acts of the Union are needed. The examination procedure applies.

CHAPTER X - FINAL PROVISIONS Article 71 repeals Regulation (EC) No 45/2001 and Decision No 1247/2002/EC and provides that references to the two repealed instruments are to be read as references to the present Regulation. Article 72 clarifies that the current terms of office of the European Data Protection Supervisor and the Assistant Supervisor shall not be affected by this Regulation. and that Articles 54(4), (5) and (7), and Articles 56 and 57 of the Regulation apply to the current Assistant Supervisor until the end of his term, i.e. until 5 December 2019. Article 73 sets out 25 May 2018 as the date of entry into force of this Regulation in order to ensure consistency with the date of application of Regulation (EU) 2016/679. 2017/0002 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Economic and Social Committee, Acting in accordance with the ordinary legislative procedure, Whereas: (1)The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning them. (2)Regulation (EC) No 45/2001 of the European Parliament and of the Council provides natural persons with legally enforceable rights, specifies the data processing obligations of controllers within the Community institutions and bodies, and creates an independent supervisory authority, the European Data Protection Supervisor, responsible for monitoring the processing of personal data by the Union institutions and bodies. However, it does not apply to the processing of personal data in the course of an activity of Union institutions and bodies which fall outside the scope of Union law. (3)Regulation (EU) 2016/679 of the European Parliament and of the Council and Directive (EU) 2016/680 of the European Parliament and of the Council were adopted on 27 April 2016. While the Regulation lays down general rules to protect natural persons in relation to the processing of personal data and to ensure the free movement of personal data within the Union, the Directive lays down the specific rules to protect natural persons in relation to the processing of personal data and to ensure the free movement of personal data within the Union in the fields of judicial cooperation in criminal matters and police cooperation. (4)Regulation (EU) 2016/679 stresses the need for the necessary adaptations of Regulation (EC) No 45/2001 in order to provide a strong and coherent data protection framework in the Union and to allow application at the same time as Regulation (EU) 2016/679. (5)It is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align as far as possible the data protection rules for Union institutions and bodies with the data protection rules adopted for the public sector in the Member States. Whenever the provisions of this Regulation are based on the same concept as the provisions of Regulation (EU) 2016/679, those two provisions should be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of Regulation (EU) 2016/679.

(6)Persons whose personal data are processed by Union institutions and bodies in any context whatsoever, for example, because they are employed by those institutions and bodies should be protected. This Regulation should not apply to the processing of personal data of deceased persons. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. (7)In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used. The protection of natural persons should apply to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system. Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation. (8)In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection of personal data and the free movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU could prove necessary because of the specific nature of those fields. This Regulation should therefore apply to Union agencies carrying out activities in the fields of judicial cooperation in criminal matters and police cooperation only to the extent that Union law applicable to such agencies does not contain specific rules on the processing of personal data. (9)Directive (EU) 2016/680 provides harmonised rules for the protection and the free movement of personal data processed for the purposes of the prevention, investigation, detection or prosecution of criminal offences or execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. In order to foster the same level of protection for natural persons through legally enforceable rights throughout the Union and to prevent divergences hampering the exchange of personal data between Union agencies carrying out activities in the fields of judicial cooperation in criminal matters and police cooperation and competent authorities in Member States, the rules for the protection and the free movement of operational personal data processed by such Union agencies should draw on the principles underpinning this Regulation and be consistent with Directive (EU) 2016/680. (10)Where the founding act of a Union agency carrying out activities which fall within the scope of Chapters 4 and 5 of Title V of the Treaty lays down a standalone data protection regime for the processing of operational personal data such regimes should be unaffected by this Regulation. However, the Commission should, in accordance with Article 62 of Directive (EU) 2016/680, by 6 May 2019 review Union acts which regulate processing by the competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and, where appropriate, make the necessary proposals to amend those acts to ensure a consistent approach to the protection of personal data in the area of judicial cooperation in criminal matters and police cooperation. (11)The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. (12)The application of pseudonymisation to personal data can reduce the risks to the data subjects concerned and help controllers and processors to meet their data protection obligations. The explicit introduction of ‘pseudonymisation’ in this Regulation is not intended to preclude any other measures of data protection. (13)Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. (14)Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. (15)Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing. In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing. (16)In accordance with the principle of accountability, where Union institutions and bodies transmit personal data within or to other Union institutions or bodies, they should verify whether such personal data is required for the legitimate performance of tasks covered by the competence of the recipient where the recipient is not part of the controller. In particular, following a recipient’s request for transmission of personal data, the controller should verify the existence of a relevant ground of its lawful processing of personal data, the competence of the recipient and should make a provisional evaluation of the necessity for the transmission of the data. If doubts arise as to this necessity, the controller should seek further information from the recipient. The recipient should ensure that the necessity for the transmission of the data can be subsequently verified. (17)In order for processing to be lawful, personal data should be processed on the basis of the necessity of performance of a task carried out in the public interest by Union institutions and bodies or in the exercise of their official authority, the necessity for compliance with the legal obligation to which the controller is subject or some other legitimate basis as referred to in this Regulation, including the consent of the data subject concerned or the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Processing of personal data for the performance of tasks carried out in the public interest by the Union institutions and bodies includes the processing of personal data necessary for the management and functioning of those institutions and bodies. The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis. Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters. (18)The Union law including the internal rules referred to in this Regulation should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union and the European Court of Human Rights. (19)The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. In such a case, no legal basis separate from that which allowed the collection of the personal data is required. If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations. (20)Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. (21)Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to creating personality profiles and the collection of personal data with regard to children when using services offered directly to a child on websites of Union institutions and bodies, such as interpersonal communication services or online selling of tickets and when the processing of personal data is based on consent. (22)When recipients established in the Union and subject to Regulation (EU) 2016/679 or Directive (EU) 2016/680, would like to have personal data transmitted to them by Union institutions and bodies, those recipients should demonstrate that the transmission is necessary for the attainment of their objective, is proportionate and does not go beyond what is necessary to attain that objective. Union institutions and bodies should demonstrate such necessity when they themselves initiate the transmission, in compliance with the principle of transparency. (23)Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races. The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. In addition to the specific requirements for processing of sensitive data, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms. (24)The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subject to suitable and specific measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council, namely all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not result in personal data being processed for other purposes by third parties. (25)If the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller.

(26)The processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be subject to appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. Those safeguards should ensure that technical and organisational measures are in place in order to ensure, in particular, the principle of data minimisation. The further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist (such as, for instance, pseudonymisation of the data). Union institutions and bodies should provide for appropriate safeguards for the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in Union law, which may include internal rules. (27)Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means. The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month and to give reasons where the controller does not intend to comply with any such requests. (28)The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed. Furthermore, the data subject should be informed of the existence of profiling and the consequences of such profiling. Where the personal data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the personal data and of the consequences, where he or she does not provide such data. That information may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing. Where the icons are presented electronically, they should be machine-readable. (29)The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data are obtained from another source, within a reasonable period, depending on the circumstances of the case. Where personal data can be legitimately disclosed to another recipient, the data subject should be informed when the personal data are first disclosed to the recipient. Where the controller intends to process the personal data for a purpose other than that for which they were collected, the controller should provide the data subject prior to that further processing with information on that other purpose and other necessary information. Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided. (30)A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates. (31)A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union law to which the controller is subject. A data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims. (32)To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data. In doing so, that controller should take reasonable steps, taking into account available technology and the means available to the controller, including technical measures, to inform the controllers which are processing the personal data of the data subject's request. (33)Methods by which to restrict the processing of personal data could include, inter alia, temporarily moving the selected data to another processing system, making the selected personal data unavailable to users, or temporarily removing published data from a website. In automated filing systems, the restriction of processing should in principle be ensured by technical means in such a manner that the personal data are not subject to further processing operations and cannot be changed. The fact that the processing of personal data is restricted should be clearly indicated in the system. (34)To further strengthen the control over his or her own data, where the processing of personal data is carried out by automated means, the data subject should also be allowed to receive personal data concerning him or her which he or she has provided to a controller in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another controller. Data controllers should be encouraged to develop interoperable formats that enable data portability. That right should apply where the data subject provided the personal data on the basis of his or her consent or the processing is necessary for the performance of a contract. It should therefore not apply where the processing of the personal data is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller. The data subject's right to transmit or receive personal data concerning him or her should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible. Where, in a certain set of personal data, more than one data subject is concerned, the right to receive the personal data should be without prejudice to the rights and freedoms of other data subjects in accordance with this Regulation. Furthermore, that right should not prejudice the right of the data subject to obtain the erasure of personal data and the limitations of that right as set out in this Regulation and should, in particular, not imply the erasure of personal data concerning the data subject which have been provided by him or her for the performance of a contract to the extent that and for as long as the personal data are necessary for the performance of that contract. Where technically feasible, the data subject should have the right to have the personal data transmitted directly from one controller to another. (35)Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject. (36)The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her, such as e-recruiting practices without any human intervention. Such processing includes ‘profiling’ that consists of any form of automated processing of personal data evaluating the personal aspects relating to a natural person, in particular to analyse or predict aspects concerning the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, where it produces legal effects concerning him or her or similarly significantly affects him or her. However, decision-making based on such processing, including profiling, should be allowed where expressly authorised by Union law. In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. Such measure should not concern a child. In order to ensure fair and transparent processing in respect of the data subject, taking into account the specific circumstances and context in which the personal data are processed, the controller should use appropriate mathematical or statistical procedures for the profiling, implement technical and organisational measures appropriate to ensure, in particular, that factors which result in inaccuracies in personal data are corrected and the risk of errors is minimised, secure personal data in a manner that takes account of the potential risks involved for the interests and rights of the data subject and that prevents, inter alia, discriminatory effects on natural persons on the basis of racial or ethnic origin, political opinion, religion or beliefs, trade union membership, genetic or health status or sexual orientation, or that result in measures having such an effect. Automated decision-making and profiling based on special categories of personal data should be allowed only under specific conditions. (37)Legal acts adopted on the basis of the Treaties or internal rules of Union institutions and bodies may impose restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, confidentiality of electronic communications as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers, as far as necessary and proportionate in a democratic society to safeguard public security, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, including the protection of human life especially in response to natural or manmade disasters, internal security of Union institutions and bodies, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes. Where a restriction is not provided for in legal acts adopted on the basis of the Treaties or their internal rules, Union institutions and bodies may in a specific case impose an ad hoc restriction concerning specific principles and the rights of data subject if such a restriction respects the essence of the fundamental rights and freedoms and, in relation to a specific processing operation, is necessary and proportionate in a democratic society to safeguard one or more of the objectives mentioned in paragraph 1. The restriction should be notified to the data protection officer. All restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms. (38)The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller's behalf should be established. In particular, the controller should be obliged to implement appropriate and effective measures and be able to demonstrate the compliance of processing activities with this Regulation, including the effectiveness of the measures. Those measures should take into account the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons. The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects. The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing. Risk should be evaluated on the basis of an objective assessment, by which it is established whether data processing operations involve a risk or a high risk. (39)The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features. The principles of data protection by design and by default should also be taken into consideration in the context of public tenders. (40)The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller. (41)To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which meet the requirements of this Regulation, including for the security of processing. The adherence of processors other than Union institutions and bodies to an approved code of conduct or an approved certification mechanism can be used as an element to demonstrate compliance with the obligations of the controller. The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller, setting out the subject-matter and duration of the processing, the nature and purposes of the processing, the type of personal data and categories of data subjects, taking into account the specific tasks and responsibilities of the processor in the context of the processing to be carried out and the risk to the rights and freedoms of the data subject. The controller and processor should be able to choose to use an individual contract or standard contractual clauses which are adopted either directly by the Commission or by the European Data Protection Supervisor and then adopted by the Commission. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store that personal data under Union or Member State law to which the processor is subject. (42)In order to demonstrate compliance with this Regulation, controllers should maintain records of processing activities under their responsibility and processors should maintain records of categories of processing activities under their responsibility. Union institutions and bodies should be obliged to cooperate with the European Data Protection Supervisor and make their records, on request, available to it, so that they might serve for monitoring those processing operations. Union institutions and bodies should be able to establish a central register of records of their processing activities. For reasons of transparency, they should also be able to make such a register public. (43)In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to mitigate those risks, such as encryption. Those measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected. In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage. (44)Union institutions and bodies should ensure the confidentiality of electronic communications as provided for by Article 7 of the Charter. In particular, Union institutions and bodies should ensure the security of their electronic communication networks, protect the information related to end-users’ terminal equipment accessing their publicly available websites and mobile applications in accordance with Regulation (EU) XXXX/XX [new ePrivacy Regulation] and protect the personal data in directories of users.

(45) A personal data breach could, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify that personal data breach to the European Data Protection Supervisor without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, it should be accompanied by the reasons for the delay and information can be provided in phases without further undue delay. Where such delay is justified, less sensitive or less specific information on the breach should be released as early as possible, rather than fully resolving the underlying incident before notifying. (46)The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions. The communication should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the European Data Protection Supervisor, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities. (47)Regulation (EC) No 45/2001 provides for a general obligation of the controller to notify the processing of personal data to the data protection officer, who would in turn keep a register of processing operations notified. While that obligation produces administrative and financial burdens, it did not in all cases contribute to improving the protection of personal data. Such indiscriminate general notification obligations should therefore be abolished, and replaced by effective procedures and mechanisms which focus instead on those types of processing operations which are likely to result in a high risk to the rights and freedoms of natural persons by virtue of their nature, scope, context and purposes. Such types of processing operations could be those which in, particular, involve using new technologies, or are of a new kind and where no data protection impact assessment has been carried out before by the controller, or where they become necessary in the light of the time that has elapsed since the initial processing. In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation. (48)Where a data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons and the controller is of the opinion that the risk cannot be mitigated by reasonable means in terms of available technologies and costs of implementation, the European Data Protection Supervisor should be consulted prior to the start of processing activities. Such high risk is likely to result from certain types of processing and the extent and frequency of processing, which could result also in a realisation of damage or interference with the rights and freedoms of the natural person. The European Data Protection Supervisor should respond to the request for consultation within a specified period. However, the absence of a reaction of the European Data Protection Supervisor within that period should be without prejudice to any intervention of the European Data Protection Supervisor in accordance with its tasks and powers laid down in this Regulation, including the power to prohibit processing operations. As part of that consultation process, it should be possible to submit the outcome of a data protection impact assessment carried out with regard to the processing at issue to the European Data Protection Supervisor, in particular the measures envisaged to mitigate the risk to the rights and freedoms of natural persons. (49)The European Data Protection Supervisor should be informed about administrative measures and internal rules of Union institutions and bodies which provide for the processing of personal data, lay down conditions for restrictions of data subject rights or provide appropriate safeguards for data subject rights, in order to ensure compliance of the intended processing with this Regulation and in particular to mitigate the risk involved for the data subject. (50)Regulation (EU) 2016/679 established the European Data Protection Board as an independent body of the Union with legal personality. The Board should contribute to the consistent application of Regulation (EU) 2016/679 and Directive 2016/680 throughout the Union, including by advising the Commission. At the same time, the European Data Protection Supervisor should continue to exercise its supervisory and advisory functions in respect of all Union institutions and bodies, including on its own initiative or upon request. In order to ensure consistency of data protection rules throughout the Union, a consultation by the Commission should be obligatory following the adoption of legislative acts or during the preparation of delegated acts and implementing acts as defined in Article 289, 290 and 291 TFEU and following the adoption of recommendations and proposals relating to agreements with third countries and international organisations as provided for in Article 218 TFEU, which have an impact on the right to personal data protection. In such cases, the Commission should be obliged to consult the European Data Protection Supervisor, except when the Regulation (EU) 2016/679 provides for mandatory consultation of the European Data Protection Board, for example on adequacy decisions or delegated acts on standardised icons and requirements for certification mechanisms. Where the act in question is of particular importance for the protection of individuals' rights and freedoms with regard to the processing of personal data, the Commission should be able, in addition, to consult the European Data Protection Board. In those cases, the European Data Protection Supervisor should, as a member of the European Data Protection Board, coordinate its work with the latter with a view to issue a joint opinion. The European Data Protection Supervisor, and where applicable, the European Data Protection Board should provide its written advice within eight weeks. That time-frame should be shorter in case of urgency or otherwise appropriate, for example when the Commission is preparing delegated and implementing acts. (51)In each Union institution or body a data protection officer should ensure that the provisions of this Regulation are applied and should advise controllers and processors on fulfilling their obligations. That officer should be a person with expert knowledge of data protection law and practices, which should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor. Such data protection officers should be in a position to perform their duties and tasks in an independent manner. (52)When personal data are transferred from the Union institutions and bodies to controllers, processors or other recipients in third countries or to international organisations, the level of protection of natural persons ensured in the Union by this Regulation should not be undermined, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. In any event, transfers to third countries and international organisations may only be carried out in full compliance with this Regulation. A transfer could take place only if, subject to the other provisions of this Regulation, the conditions laid down in the provisions of this Regulation relating to the transfer of personal data to third countries or international organisations are complied with by the controller or processor. (53)The Commission can decide, under Article 45 of Regulation (EU) 2016/679, that a third country, a territory or specified sector within a third country, or an international organisation, offers an adequate level of data protection. In such cases, transfers of personal data to that third country or international organisation by a Union institution or body can take place without the need to obtain any further authorisation. (54)In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject. Such appropriate safeguards can consist of making use of standard data protection clauses adopted by the Commission, standard data protection clauses adopted by the European Data Protection Supervisor or contractual clauses authorised by the European Data Protection Supervisor. Where the processor is not a Union Institution or body those appropriate safeguards can also consist of binding corporate rules, codes of conduct and certification mechanisms used for international transfers under Regulation (EU) 2016/679. Those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default. Transfers may also be carried out by Union institutions and bodies to public authorities or bodies in third countries or to international organisations with corresponding duties or functions, including on the basis of provisions to be inserted into administrative arrangements, such as a memorandum of understanding, providing for enforceable and effective rights for data subjects. Authorisation by the European Data Protection Supervisor should be obtained when the safeguards are provided for in administrative arrangements that are not legally binding. (55)The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by the European Data Protection Supervisor should prevent controllers or processors neither from including the standard data-protection clauses in a wider contract, such as a contract between the processor and another processor, nor from adding other clauses or additional safeguards provided that they do not contradict, directly or indirectly, the standard contractual clauses adopted by the Commission or by the European Data Protection Supervisor or prejudice the fundamental rights or freedoms of the data subjects. Controllers and processors should be encouraged to provide additional safeguards via contractual commitments that supplement standard data-protection clauses. (56)Some third countries adopt laws, regulations and other legal acts which purport to directly regulate the processing activities of Union institutions and bodies. This may include judgments of courts or tribunals or decisions of administrative authorities in third countries requiring a controller or processor to transfer or disclose personal data, and which are not based on an international agreement in force between the requesting third country and the Union. The extraterritorial application of those laws, regulations and other legal acts may be in breach of international law and may impede the attainment of the protection of natural persons ensured in the Union by this Regulation. Transfers should only be allowed where the conditions of this Regulation for a transfer to third countries are met. This may be the case, inter alia, where disclosure is necessary for an important ground of public interest recognised in Union law. (57)Provision should be made in specific situations for the possibility for transfers in certain circumstances where the data subject has given his or her explicit consent, where the transfer is occasional and necessary in relation to a contract or a legal claim, regardless of whether in a judicial procedure or whether in an administrative or any out-of-court procedure, including procedures before regulatory bodies. Provision should also be made for the possibility for transfers where important grounds of public interest laid down by Union law so require or where the transfer is made from a register established by law and intended for consultation by the public or persons having a legitimate interest. In the latter case, such a transfer should not involve the entirety of the personal data or entire categories of the data contained in the register, unless authorised by Union law, and, when the register is intended for consultation by persons having a legitimate interest, the transfer should be made only at the request of those persons or, if they are to be the recipients, taking into full account the interests and fundamental rights of the data subject. (58)Those derogations should in particular apply to data transfers required and necessary for important reasons of public interest, for example in cases of international data exchange between Union institutions and bodies and competition authorities, tax or customs administrations, financial supervisory authorities and services competent for social security matters or for public health, for example in the case of contact tracing for contagious diseases or in order to reduce and/or eliminate doping in sport. A transfer of personal data should also be regarded as lawful where it is necessary to protect an interest which is essential for the data subject's or another person's vital interests, including physical integrity or life, if the data subject is incapable of giving consent. In the absence of an adequacy decision, Union law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of data to a third country or an international organisation. Any transfer to an international humanitarian organisation of personal data of a data subject who is physically or legally incapable of giving consent, with a view to accomplishing a task incumbent under the Geneva Conventions or to complying with international humanitarian law applicable in armed conflicts, could be considered to be necessary for an important reason of public interest or because it is in the vital interest of the data subject. (59)In any case, where the Commission has taken no decision on the adequate level of data protection in a third