P7_TA(2014)0219

Processing of personal data for the purposes of crime prevention ***I

European Parliament legislative resolution of 12 March 2014 on the proposal for a directive of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data (COM(2012)0010 — C7-0024/2012 — 2012/0010(COD))

(Ordinary legislative procedure: first reading)

(2017/C 378/59)

The European Parliament,

having regard to Article 294(2) and Article 16(2) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C7-0024/2012),

having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

having regard to the reasoned opinions submitted, within the framework of Protocol No 2 on the application of the principles of subsidiarity and proportionality, by the German Bundesrat and the Swedish Parliament, asserting that the draft legislative act does not comply with the principle of subsidiarity,

having regard to the opinion of the European Union Agency for Fundamental Rights of 1 October 2012,

having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs and the opinion of the Committee on Legal Affairs (A7-0403/2013),

Calls on the Commission to refer the matter to Parliament again if it intends to amend its proposal substantially or replace it with another text;

Instructs its President to forward its position to the Council, the Commission and the national parliaments.

(1) OJ C 192, 30.6.2012, p. 7.

P7_TC1-COD(2012)0010

Position of the European Parliament adopted at first reading on 12 March 2014 with a view to the adoption of Directive 2014/…/EU of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Data Protection Supervisor (1),

Acting in accordance with the ordinary legislative procedure (2),

Whereas:

(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (‘Charter’) and Article 16(1) of the Treaty of the Functioning of the European Union lay down that everyone has the right to the protection of personal data concerning them. Article 8(2) of the Charter lays down that such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. [Am. 1]

(2) The processing of personal data is designed to serve man; the principles and rules on the protection of individuals with regard to the processing of their personal data should, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably their right to the protection of personal data. It should contribute to the accomplishment of an area of freedom, security and justice.

(3) Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of data collection and sharing has increased spectacularly. Technology allows competent authorities to make use of personal data on an unprecedented scale in order to pursue their activities.

(4) This requires facilitating the free flow of data , when necessary and proportionate, between competent authorities within the Union and the transfer to third countries and international organisations, while ensuring a high level of protection of personal data. These developments require building a strong and more coherent data protection framework in the Union, backed by strong enforcement. [Am. 2]

(5) Directive 95/46/EC of the European Parliament and of the Council (3) applies to all personal data processing activities in Member States in both the public and the private sectors. However, it does not apply to the processing of personal data in the course of an activity which falls outside the scope of Community law, such as activities in the areas of judicial co-operation in criminal matters and police co-operation.

(6) Council Framework Decision 2008/977/JHA (4) applies in the areas of judicial co-operation in criminal matters and police co-operation. The scope of application of this Framework Decision is limited to the processing of personal data transmitted or made available between Member States.

(7) Ensuring a consistent and high level of protection of the personal data of individuals and facilitating the exchange of personal data between competent authorities of Members States is crucial in order to ensure effective judicial co-operation in criminal matters and police cooperation. To that aim, the level of protection of the rights and freedoms of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties must be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. Effective protection of personal data throughout the Union requires strengthening the rights of data subjects and the obligations of those who process personal data, but also equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data in the Member States. [Am. 3]

(8) Article 16(2) of the Treaty on the Functioning of the European Union provides that the European Parliament and the Council should lay down the rules relating to the protection of individuals with regard to the processing of personal data and the rules relating to the free movement of their personal data. [Am. 4]

(9) On that basis, Regulation (EU) No …/2014 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) lays down general rules to protect of individuals in relation to the processing of personal data and to ensure the free movement of personal data within the Union.

(10) In Declaration 21 on the protection of personal data in the fields of judicial co-operation in criminal matters and police co-operation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the Conference acknowledged that specific rules on the protection of personal data and the free movement of such data in the fields of judicial co-operation in criminal matters and police co-operation based on Article 16 of the Treaty on the Functioning of the European Union may prove necessary because of the specific nature of these fields.

(11) Therefore a distinct specific Directive should meet the specific nature of these fields and lay down the rules relating to the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. [Am. 5]

(12) In order to ensure the same level of protection for individuals through legally enforceable rights throughout the Union and to prevent divergences hampering the exchange of personal data between competent authorities, this Directive should provide harmonised rules for the protection and the free movement of personal data in the areas of judicial co-operation in criminal matters and police co-operation.

(13) This Directive allows the principle of public access to official documents to be taken into account when applying the provisions set out in this Directive.

(14) The protection afforded by this Directive should concern natural persons, whatever their nationality or place of residence, in relation to the processing of personal data.

(15) The protection of individuals should be technological neutral and not depend on the techniques used; otherwise this would create a serious risk of circumvention. The protection of individuals should apply to processing of personal data by automated means, as well as to manual processing if the data are contained or are intended to be contained in a filing system. Files or sets of files as well as their cover pages, which are not structured according to specific criteria, should not fall within the scope of this Directive. This Directive should not apply to the processing of personal data in the course of an activity which falls outside the scope of Union law, in particular concerning national security, or to data processed by the Union institutions, bodies, offices and agencies, such as Europol or Eurojust. Regulation (EC) No 45/2001 of the European Parliament and of the Council (5) and specific legal instruments applicable to Union agencies, bodies or offices should be brought in line with this Directive and applied in accordance with this Directive.[Am. 6]

(16) The principles of protection should apply to any information concerning an identified or identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify or single out the individual. The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable. This Directive should not apply to anonymous data, meaning any data that cannot be related, directly or indirectly, alone or in combination with associated data, to a natural person. Given the importance of the developments under way in the framework of the information society, of the techniques used to capture, transmit, manipulate, record, store or communicate location data relating to natural persons, which may be used for different purposes including surveillance or creating profiles, this Directive should be applicable to processing involving such personal data. [Am. 7]

(16a) Any processing of personal data must be lawful, fair and transparent in relation to the individuals concerned. In particular, the specific purposes for which the data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to the minimum necessary for the purposes for which the personal data are processed. This requires in particular limiting the data collected and the period for which the data are stored to a strict minimum. Personal data should only be processed if the purpose of the processing could not be fulfilled by other means. Every reasonable step should be taken to ensure that personal data which are inaccurate should be rectified or deleted. In order to ensure that the data are kept no longer than necessary, time limits should be established by the controller for erasure or periodic review. [Am. 8]

(17) Personal data relating to health should include in particular all data pertaining to the health status of a data subject, information about the registration of the individual for the provision of health services; information about payments or eligibility for healthcare with respect to the individual; a number, symbol or particular assigned to an individual to uniquely identify the individual for health purposes; any information about the individual collected in the course of the provision of health services to the individual; information derived from the testing or examination of a body part or bodily substance, including biological samples; identification of a person as provider of healthcare to the individual; or any information on, for example; a disease, disability, disease risk, medical history, clinical treatment, or the actual physiological or biomedical state of the data subject independent of its source, e.g. from a physician or other health professional, a hospital, a medical device, or an in vitro diagnostic test.

(18) Any processing of personal data must be fair and lawful in relation to the individuals concerned. In particular, the specific purposes for which the data are processed should be explicit. [Am. 9]

(19) For the prevention, investigation and prosecution of criminal offences, it is necessary for competent authorities to retain and process personal data, collected in the context of the prevention, investigation, detection or prosecution of specific criminal offences beyond that context to develop an understanding of criminal phenomena and trends, to gather intelligence about organised criminal networks, and to make links between different offences detected. [Am. 10]

(20) Personal data should not be processed for purposes incompatible with the purpose for which it was collected. Personal data should be adequate, relevant and not excessive for the purposes for which the personal data are processed. Every reasonable step should be taken to ensure that personal data which are inaccurate should be rectified or erased. [Am. 11]

(20a) The simple fact that two purposes both relate to the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties does not necessarily mean that they are compatible. However, there are cases in which further processing for incompatible purposes should be possible if necessary to comply with a legal obligation to which the controller is subject, in order to protect the vital interests of the data subject or another person, or for the prevention of an immediate and serious threat to public security. Member States should therefore be able to adopt national laws providing for such derogations to the extent strictly necessary. Such national laws should contain adequate safeguards. [Am. 12]

(21) The principle of accuracy of data should be applied taking account of the nature and purpose of the processing concerned. In particular in judicial proceedings, statements containing personal data are based on the subjective perception of individuals and are in some cases not always verifiable. Consequently, the requirement of accuracy should not appertain to the accuracy of a statement but merely to the fact that a specific statement has been made.

(22) In the interpretation and application of the general principles relating to personal data processing by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, account should be taken of the specificities of the sector, including the specific objectives pursued. [Am. 13]

(23) It is inherent to the processing of personal data in the areas of judicial co-operation in criminal matters and police co-operation that personal data relating to different categories of data subjects are processed. Therefore a clear distinction should as far as possible be made between personal data of different categories of data subjects such as suspects, persons convicted of a criminal offence, victims and third parties, such as witnesses, persons possessing relevant information or contacts and associates of suspects and convicted criminals. Specific rules on the consequences of this categorisation should be provided by the Member States, taking into account the different purposes for which data are collected and providing specific safeguards for persons who are not suspected of having committed, or have not been convicted of, a criminal offence. [Am. 14]

(24) As far as possible personal data should be distinguished according to the degree of their accuracy and reliability. Facts should be distinguished from personal assessments, in order to ensure both the protection of individuals and the quality and reliability of the information processed by the competent authorities.

(25) In order to be lawful, the processing of personal data should be only allowed when necessary for compliance with a legal obligation to which the controller is subject, for the performance of a task carried out in the public interest by a competent authority based on Union or Member State law or in order to protect the vital interests of the data subject or of another person, or for the prevention of an immediate and serious threat to public security which should contain explicit and detailed provisions at least as to the objectives, the personal data, the specific purposes and means, designate or allow to designate the controller, the procedures to be followed, the use and limitations of the scope of any discretion conferred to the competent authorities in relation to the processing activities . [Am. 15]

(25a) Personal data should not be processed for purposes incompatible with the purpose for which they were collected. Further processing by competent authorities for a purpose falling within the scope of this Directive which is not compatible with the initial purpose should only be authorised in specific cases where such processing is necessary for compliance with a legal obligation, based on Union or Member State law, to which the controller is subject, or in order to protect the vital interests of the data subject or of another person or for the prevention of an immediate and serious threat to public security. The fact that data are processed for a law enforcement purpose does not necessarily imply that this purpose is compatible with the initial purpose. The concept of compatible use is to be interpreted restrictively. [Am. 16]

(25b) Personal data processed in breach of the national provisions adopted pursuant to this Directive should not be further processed. [Am. 17]

(26) Personal data which are, by their nature, particularly sensitive and vulnerable in relation to fundamental rights or privacy, including genetic data, deserve specific protection. Such data should not be processed, unless processing is specifically authorised by a necessary for the performance of a task carried out in the public interest, on the basis of Union or Member State law which provides for suitable measures to safeguard the data subject's fundamental rights and legitimate interests; or processing is necessary to protect the vital interests of the data subject or of another person; or the processing relates to data which are manifestly made public by the data subject. Sensitive personal data should be processed only if they supplement other personal data already processed for law enforcement purposes. Any derogation to the prohibition of processing of sensitive data should be interpreted restrictively and not lead to frequent, massive or structural processing of sensitive personal data. [Am. 18]

(26a) The processing of genetic data should only be allowed if there is a genetic link which appears in the course of a criminal investigation or a judicial procedure. Genetic data should only be stored as long as strictly necessary for the purpose of such investigations and procedures, while Member States can provide for longer storage under the conditions set out in this Directive. [Am. 19]

(27) Every natural person should have the right not to be subject to a measure which is based solely on partially or fully profiling by means of automated processing if it . Such processing which produces an adverse a legal effect for that person, or significantly affects him or her should be prohibited, unless authorised by law and subject to suitable measures to safeguard the data subject’s fundamental rights and legitimate interests , including the right to be provided with meaningful information about the logic used in the profiling. Such processing should in no circumstances contain, generate, or discriminate based on special categories of data . [Am. 20]

(28) In order to exercise his or her rights, any information to the data subject should be easily accessible and easy to understand, including the use of clear and plain language. This information should be adapted to the needs of the data subject in particular when information is addressed specifically to a child. [Am. 21]

(29) Modalities should be provided for facilitating the data subject’s exercise of his or her rights under this Directive, including mechanisms to request, free of charge, in particular access to data, rectification and erasure. The controller should be obliged to respond to requests of the data subject without undue delay and within one month of receipt of the request. Where personal data are processed by automated means the controller should provide means for requests to be made electronically . [Am. 22]

(30) The principle of fair and transparent processing requires that the data subjects should be informed in particular of the existence of the processing operation and its purposes, its legal basis, how long the data will be stored, on the existence of the right of access, rectification or erasure and on the right to lodge a complaint. Furthermore the data subject should be informed if profiling takes place and its intended consequences. Where the data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the data and of the consequences, in cases he or she does not provide such data. [Am. 23]

(31) The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection, or, where the data are not obtained from the data subject, at the time of the recording or within a reasonable period after the collection having regard to the specific circumstances in which the data are processed.

(32) Any person should have the right of access to data which have been collected concerning them, and to exercise this right easily, in order to be aware of and verify the lawfulness of the processing. Every data subject should therefore have the right to know about, and obtain communication in particular of, the purposes for which the data are processed, the legal basis, for what period, which recipients receive the data, including in third countries , the intelligible information about the logic involved in any automated processing and its significant and envisaged consequences if applicable, and the right to lodge a complaint with the supervisory authority and its contact details. Data subjects should be allowed to receive a copy of their personal data which are being processed. [Am. 24]

(33) Member States should be allowed to adopt legislative measures delaying or restricting or omitting the information of data subjects or the access to their personal data to the extent that and as long as such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the person concerned, to avoid obstructing official or legal inquiries, investigations or procedures, to avoid prejudicing the prevention, detection, investigation and prosecution of criminal offences or for the execution of criminal penalties, to protect public security or national security, or, to protect the data subject or the rights and freedoms of others. The controller should assess by way of concrete and individual examination of each case if partial or complete restriction of the right of access should apply. [Am. 25]

(34) Any refusal or restriction of access should be set out in writing to the data subject including the factual or legal reasons on which the decision is based.

(34a) Any restriction of the data subject's rights must be in compliance with the Charter and with the European Convention on Human Rights, as clarified by the case law of the Court of Justice of the European Union and the European Court of Human Rights, and in particular respect the essence of the rights and freedoms. [Am. 26]

(35) Where Member States have adopted legislative measures restricting wholly or partly the right to access, the data subject should have the right to request that the competent national supervisory authority checks the lawfulness of the processing. The data subject should be informed of this right. When access is exercised by the supervisory authority on behalf of the data subject, the data subject should be informed by the supervisory authority at least that all necessary verifications by the supervisory authority have taken place and of the result as regards to the lawfulness of the processing in question. The supervisory authority should also inform the data subject of the right to seek a judicial remedy. [Am. 27]

(36) Any person should have the right to have inaccurate or unlawfully processed personal data concerning them rectified and the right of erasure where the processing of such data is not in compliance with the main principles provisions laid down in this Directive. Such rectification, completion or erasure should be communicated to recipients to whom the data have been disclosed and to the third parties from which the inaccurate data originated. The controllers should also abstain from further dissemination of such data. Where the personal data are processed in the course of a criminal investigation and proceedings, rectification, the rights of information, access, erasure and restriction of processing may be carried out in accordance with national rules on judicial proceedings. [Am. 28]

(37) Comprehensive responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller's behalf should be established. In particular, the controller should ensure the and be obliged to be able to demonstrate compliance of each processing operations operation with the rules adopted pursuant to this Directive. [Am. 29]

(38) The protection of the rights and freedoms of data subjects with regard to the processing of personal data requires that appropriate technical and organisational measures be taken to ensure that the requirements of this Directive are met. In order to ensure compliance with the provisions adopted pursuant to this Directive, the controller should adopt policies and implement appropriate measures, which meet in particular the principles of data protection by design and data protection by default.

(39) The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors requires a clear attribution of the responsibilities under this Directive, including where a controller determines the purposes, conditions and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller. The data subject should have the right to exercise his or her rights under this Directive in respect of and against each of the joint controllers. [Am. 30]

(40) Processing activities should be documented by the controller or processor, in order to monitor compliance with this Directive. Each controller and processor should be obliged to co-operate with the supervisory authority and make this documentation available upon request, so that it might serve for monitoring processing operations.

(40a) Every processing operation of personal data should be recorded in order to enable the verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security. This record should be made available upon request to the supervisory authority for the purpose of monitoring compliance with the rules laid down in this Directive. [Am. 31]

(40b) A data protection impact assessment should be carried out by the controller or processor, where the processing operations are likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, which should include in particular the envisaged measures, safeguards and mechanisms to ensure the protection of personal data and for demonstrating compliance with this Directive. Impact assessments should concern relevant systems and processes of personal data processing operations, but not individual cases. [Am. 32]

(41) In order to ensure effective protection of the rights and freedoms of data subjects by way of preventive actions, the controller or processor should consult with the supervisory authority in certain cases prior to the processing. Moreover, where a data protection impact assessment indicates that processing operations are likely to present a high degree of specific risks to the rights and freedoms of data subjects, the supervisory authority should be in a position to prevent, prior to the start of operations, a risky processing which is not in compliance with this Directive, and to make proposals to remedy such situation. Such consultation may equally take place in the course of the preparation either of a measure of the national parliament or of a measure based on such legislative measure which defines the nature of the processing and lays down appropriate safeguards. [Am. 33]

(41a) In order to maintain security and to prevent processing in breach of this Directive, the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks. Those measures should ensure an appropriate level of security, taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected. When establishing technical standards and organisational measures to ensure security of processing, technological neutrality should be promoted. [Am. 34]

(42) A personal data breach may, if not addressed in an adequate and timely manner, result in a substantial economic loss and social harm, including reputational damage identity fraud, to the individual concerned. Therefore, as soon as the controller becomes aware that such a breach has occurred, it should notify the breach to the competent national authority. The individuals whose personal data or privacy could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions. A breach should be considered as adversely affecting the personal data or privacy of an individual where it could result in, for example, identity theft or fraud, physical harm, significant humiliation or damage to reputation in connection with the processing of personal data. The notification should include information about measures taken by the provider to address the breach, as well as recommendations for the subscriber or individual concerned. Notifications to data subjects should be made as soon as feasible and in close cooperation with the supervisory authority and respecting guidance provided by it. [Am. 35]

(43) In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of the breach, including whether or not personal data had been protected by appropriate technical protection measures, effectively limiting the likelihood of misuse. Moreover, such rules and procedures should take into account the legitimate interests of competent authorities in cases where early disclosure could unnecessarily hamper the investigation of the circumstances of a breach.

(44) The controller or the processor should designate a person who would assist the controller or processor to monitor and demonstrate compliance with the provisions adopted pursuant to this Directive. A data protection officer may be appointed jointly by Where several entities of the competent authority. competent authorities are acting under the supervision of a central authority, at least this central authority should designate such data protection officer. The data protection officers must be in a position to perform their duties and tasks independently and effectively , in particular by establishing rules that avoid conflicts of interests with other tasks performed by the data protection officer . [Am. 36]

(45) Member States should ensure that a transfer to a third country only takes place if it that specific transfer is necessary for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the controller in the third country or international organisation is an a public authority competent within the meaning of this Directive. A transfer may take place in cases where the Commission has decided that the third country or international organisation in question ensures an adequate level or protection, or when appropriate safeguards have been adduced , or where appropriate safeguards have been adduced by way of a legally binding instrument . Data transferred to competent public authorities in third countries should not be further processed for purposes other than the one they were transferred for . [Am. 37]

(45a) Further onward transfers from competent authorities in third countries or international organisations to which personal data have been transferred should only be allowed if the onward transfer is necessary for the same specific purpose as the original transfer and the second recipient is also a competent public authority. Further onward transfers should not be allowed for general law-enforcement purposes. The competent authority that carried out the original transfer should have agreed to the onward transfer. [Am. 38]

(46) The Commission may decide with effect for the entire Union that certain third countries, or a territory or a processing sector within a third country, or an international organisation, offer an adequate level of data protection, thus providing legal certainty and uniformity throughout the Union as regards the third countries or international organisations which are considered to provide such level of protection. In these cases, transfers of personal data to these countries may take place without needing to obtain any further authorisation.

(47) In line with the fundamental values on which the Union is founded, in particular the protection of human rights, the Commission should take into account how the rule of law, access to justice, as well as international human rights norms and standards, in that third country are respected.

(48) The Commission should equally be able to recognise that a third country, or a territory or a processing sector within a third country, or an international organisation, does not offer an adequate level of data protection. Consequently the transfer of personal data to that third country should be prohibited except when they are based on an international agreement, appropriate safeguards or a derogation. Provision should be made for procedures for consultations between the Commission and such third countries or international organisations. However, such a Commission decision shall be without prejudice to the possibility to undertake transfers on the basis of appropriate safeguards by means of legally binding instruments or on the basis of a derogation laid down in this Directive. [Am. 39]

(49) Transfers not based on such an adequacy decision should only be allowed where appropriate safeguards have been adduced in a legally binding instrument, which ensure the protection of the personal data or where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and, based on this assessment, considers that appropriate safeguards with respect to the protection of personal data exist. In cases where no grounds for allowing a transfer exist, derogations should be allowed if necessary in order to protect the vital interests of the data subject or another person, or to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides, or where it is essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country, or in individual cases for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, or in individual cases for the establishment, exercise or defence of legal claims. [Am. 40]

(49a) In cases where no grounds for allowing a transfer exist, derogations should be allowed if necessary in order to protect the vital interests of the data subject or another person, or to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides, or where it is essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country, or in individual cases for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, or in individual cases for the establishment, exercise or defence of legal claims. Those derogations should be interpreted restrictively and should not allow frequent, massive and structural transfer of personal data and should not allow wholesale transfer of data which should be limited to data strictly necessary. Moreover, the decision for transfer should be made by a duly authorised person and that transfer must be documented and should be made available to the supervisory authority on request in order to monitor the lawfulness of the transfer. [Am. 41]

(50) When personal data move across borders it may put at increased risk the ability of individuals to exercise data protection rights to protect themselves from the unlawful use or disclosure of that data. At the same time, supervisory authorities may find that they are unable to pursue complaints or conduct investigations relating to the activities outside their borders. Their efforts to work together in the cross-border context may also be hampered by insufficient preventative or remedial powers, inconsistent legal regimes. Therefore, there is a need to promote closer co-operation among data protection supervisory authorities to help them exchange information with their foreign counterparts.

(51) The establishment of supervisory authorities in Member States, exercising their functions with complete independence, is an essential component of the protection of individuals with regard to the processing of their personal data. The supervisory authorities should monitor the application of the provisions pursuant to this Directive and contribute to its consistent application throughout the Union, in order to protect natural persons in relation to the processing of their personal data. For that purpose, the supervisory authorities should co-operate with each other and the Commission. [Am. 42]

(52) Member States may entrust a supervisory authority already established in Member States under Regulation (EU) …/2014 with the responsibility for the tasks to be performed by the national supervisory authorities to be established under this Directive.

(53) Member States should be allowed to establish more than one supervisory authority to reflect their constitutional, organisational and administrative structure. Each supervisory authority should be provided with adequate financial and human resources, premises and infrastructure, including technical capabilities, experience and skills, which are necessary for the effective performance of their tasks, including for the tasks related to mutual assistance and co-operation with other supervisory authorities throughout the Union. [Am. 43]

(54) The general conditions for the members of the supervisory authority should be laid down by law in each Member State and should in particular provide that those members should be either appointed by the parliament or the government , on the basis of the consultation of the parliament, of the Member State, and include rules on the personal qualification of the members and the position of those members. [Am. 44]

(55) While this Directive applies also to the activities of national courts, the competence of the supervisory authorities should not cover the processing of personal data when they are acting in their judicial capacity, in order to safeguard the independence of judges in the performance of their judicial tasks. However, this exemption should be limited to genuine judicial activities in court cases and not apply to other activities where judges might be involved in accordance with national law.

(56) In order to ensure consistent monitoring and enforcement of this Directive throughout the Union, the supervisory authorities should have the same duties and effective powers in each Member State, including effective powers of investigation, power to access all personal data and all information necessary for the performance of each supervisory function, power to access any of the premises of the data controller or the processor including data processing equipment, and legally binding intervention, decisions and sanctions, particularly in cases of complaints from individuals, and to engage in legal proceedings. [Am. 45]

(57) Each supervisory authority should hear complaints lodged by any data subject and should investigate the matter. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject.

(58) The supervisory authorities should assist one another in performing their duties and provide mutual assistance, so as to ensure the consistent application and enforcement of the provisions adopted pursuant to this Directive. Each supervisory authority should be ready to participate in joint operations. The requested supervisory authority should be obliged to respond in a defined time period to the request. [Am. 46]

(59) The European Data Protection Board established by Regulation (EU) …/2012 2014 should contribute to the consistent application of this Directive throughout the Union, including advising the Commission and Union institutions, promoting the co-operation of the supervisory authorities throughout the Union , and give its opinion to the Commission in the preparation of delegated and implementing acts based on this Directive . [Am. 47]

(60) Every data subject should have the right to lodge a complaint with a supervisory authority in any Member State and have the right to a judicial remedy if they consider that their rights under this Directive are infringed or where the supervisory authority does not act on a complaint or does not act where such action is necessary to protect the rights of the data subject.

(61) Any body, organisation or association which aims to protects the rights and interests of data subjects in relation to the protection of their data which acts in the public interest and is constituted according to the law of a Member State should have the right to lodge a complaint or exercise the right to a judicial remedy on behalf of data subjects if duly mandated by them, or to lodge, independently of a data subject's complaint, its own complaint where it considers that a personal data breach has occurred. [Am. 48]

(62) Each natural or legal person should have the right to a judicial remedy against decisions of a supervisory authority concerning them. Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established.

(63) Member States should ensure that court actions, in order to be effective, allow the rapid adoption of measures to remedy or prevent an infringement of this Directive.

(64) Any damage , including non pecuniary damage, which a person may suffer as a result of unlawful processing should be compensated by the controller or processor, who may be exempted from liability if they prove that they are not responsible for the damage, in particular where they establish fault on the part of the data subject or in case of force majeure. [Am. 49]

(65) Penalties should be imposed on any natural or legal person, whether governed by private or public law, that fails to comply with this Directive. Member States should ensure that the penalties are effective, proportionate and dissuasive and must take all measures to implement the penalties.

(65a) Transmission of personal data to other authorities or private parties in the Union is prohibited unless the transmission is in compliance with law, and the recipient is established in a Member State, and no legitimate specific interests of the data subject prevent transmission, and the transmission is necessary in a specific case for the controller transmitting the data for either the performance of a task lawfully assigned to it, or the prevention of an immediate and serious danger to public security, or the prevention of serious harm to the rights of individuals. The controller should inform the recipient of the purpose of the processing and the supervisory authority of the transmission. The recipient should also be informed of processing restrictions and ensure that they are met. [Am. 50]

(66) In order to fulfil the objectives of this Directive, namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free exchange of personal data by competent authorities within the Union, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission. In particular, delegated acts should be adopted in respect of notifications of to further specify the criteria and conditions for processing operations requiring a data protection impact assessment; the criteria and requirements of a personal data breach to the supervisory authority and as regards the adequate level of protection afforded by a third country, or a territory or a processing sector within that third country, or an international organisation . It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level , in particular with the European Data Protection Board . The Commission, when preparing and drawing-up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council. [Am. 51]

(67) In order to ensure uniform conditions for the implementation of this Directive as regards documentation by controllers and processors, security of processing, notably in relation to encryption standards, and notification of a personal data breach to the supervisory authority, and the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission's exercise of implementing powers (6). [Am. 52]

(68) The examination procedure should be used for the adoption of measures as regards documentation by controllers and processors, security of processing, and notification of a personal data breach to the supervisory authority, and the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation, given that those acts are of general scope. [Am. 53]

(69) The Commission should adopt immediately applicable implementing acts where, in duly justified cases relating to a third country or a territory or a processing sector within that third country or an international organisation which does not ensure an adequate level of protection, imperative grounds of urgency so require. [Am. 54]

(70) Since the objectives of this Directive, namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of their personal data and to ensure the free exchange of personal data by competent authorities within the Union, cannot be sufficiently achieved by the Member States and can therefore but can rather , by reason of the scale or effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve that objective those objectives. Member States may provide for higher standards than those established in this Directive . [Am. 55]

(71) Framework Decision 2008/977/JHA should be repealed by this Directive.

(72) Specific provisions with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in acts of the Union which were adopted prior to the date of the adoption of this Directive, regulating the processing of personal data between Member States or the access of designated authorities of Member States to information systems established pursuant to the Treaties, should remain unaffected. Since Article 8 of the Charter and Article 16 TFEU imply that the fundamental right to the protection of personal data should be ensured in a consistent and homogeneous manner through the Union, The the Commission should , within two years after the entry into force of this Directive, evaluate the situation with regard to the relation between this Directive and the acts adopted prior to the date of adoption of this Directive regulating the processing of personal data between Member States or the access of designated authorities of Member States to information systems established pursuant to the Treaties, in order to assess the need for alignment of these specific provisions with and should present appropriate proposals with a view to ensuring consistent and homogeneous legal rules relating to the processing of personal data by competent authorities or the access of designated authorities of Member States to information systems established pursuant to the Treaties as well as the processing of personal data by Union institutions, bodies, offices and agencies for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties within the scope of this Directive. [Am. 56]

(73) In order to ensure a comprehensive and coherent protection of personal data in the Union, international agreements concluded by the Union or by the Member States prior to the entry force of this Directive should be amended in line with this Directive. [Am. 57]

(74) This Directive is without prejudice to the rules on combating the sexual abuse and sexual exploitation of children and child pornography as laid down in Directive 2011/93/EU of the European Parliament and of the Council (7).

(75) In accordance with Article 6a of the Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, the United Kingdom and Ireland shall not be bound by the rules laid down in this Directive where the United Kingdom and Ireland are not bound by the rules governing the forms of judicial co-operation in criminal matters or police co-operation which require compliance with the provisions laid down on the basis of Article 16 of the Treaty on the Functioning of the European Union.

(76) In accordance with Articles 2 and 2a of the Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not bound by this Directive or subject to its application. Given that this Directive builds upon the Schengen acquis, under Title V of Part Three of the Treaty on the Functioning of the European Union, Denmark shall, in accordance with Article 4 of that Protocol, decide within six months after adoption of this Directive whether it will implement it in its national law. [Am. 58]

(77) As regards Iceland and Norway, this Directive constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters’ association with the implementation, application and development of the Schengen acquis (8).

(78) As regards Switzerland, this Directive constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (9).

(79) As regards Liechtenstein, this Directive constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (10).

(80) This Directive respects the fundamental rights and observes the principles recognised in the Charter as enshrined in the Treaty, notably the right to respect for private and family life, the right to the protection of personal data, the right to an effective remedy and to a fair trial. Limitations placed on these rights are in accordance with Article 52(1) of the Charter as they are necessary to meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.

(81) In accordance with the Joint Political Declaration of 28 September 2011 of Member States and the Commission on explanatory documents (11), Member States have undertaken to accompany, in justified cases, the notification of their transposition measures with one or more documents explaining the relationship between the components of a directive and the corresponding parts of national transposition instruments. With regard to this Directive, the legislator considers the transmission of such documents to be justified.

(82) This Directive should not preclude Member States from implementing the exercise of the rights of data subjects on information, access, rectification, erasure and restriction of their personal data processed in the course of criminal proceedings, and their possible restrictions thereto, in national rules on criminal procedure,

HAVE ADOPTED THIS DIRECTIVE:

CHAPTER I

GENERAL PROVISIONS

Article 1

Subject matter and objectives

1. This Directive lays down the rules relating to the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or and the execution of criminal penalties and conditions for the free movement of such personal data .

2. In accordance with this Directive, Member States shall:

(a) protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of their personal data and privacy ; and

(b) ensure that the exchange of personal data by competent authorities within the Union is neither restricted nor prohibited for reasons connected with the protection of individuals with regard to the processing of personal data.

2a. This Directive shall not preclude Member States from providing higher safeguards than those established in this Directive. [Am. 59]

Article 2

Scope

1. This Directive applies to the processing of personal data by competent authorities for the purposes referred to in Article 1(1).

2. This Directive applies to the processing of personal data wholly or partly by automated means, and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

3. This Directive shall not apply to the processing of personal data:

(a) in the course of an activity which falls outside the scope of Union law, in particular concerning national security;

(b) by the Union institutions, bodies, offices and agencies. [Am. 60]

Article 3

Definitions

For the purposes of this Directive:

(1) ‘data subject’ means an identified natural person or a natural person who can be identified, directly or indirectly, by means reasonably likely to be used by the controller or by any other natural or legal person, in particular by reference to an identification number, location data, online identifiers or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person;

(2) ‘personal data’ means any information relating to a an identified or identifiable natural person (‘ data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, unique identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or gender identity of that person;

(2a) ‘pseudonymous data’ means personal data that cannot be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organisational measures to ensure non-attribution;

(3) ‘processing’ means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

(3a) ‘ profiling’ means any form of automated processing of personal data intended to evaluate certain personal aspects relating to a natural person or to analyse or predict in particular that natural person’s performance at work, economic situation, location, health, personal preferences, reliability or behaviour;

(4) ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;

(5) ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis;

(6) ‘controller’ means the competent public authority which alone or jointly with others determines the purposes, conditions and means of the processing of personal data; where the purposes, conditions and means of processing are determined by Union law or Member State law, the controller or the specific criteria for his nomination may be designated by Union law or by Member State law;

(7) ‘processor’ means a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;

(8) ‘recipient’ means a natural or legal person, public authority, agency or any other body to which the personal data are disclosed;

(9) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

(10) ‘genetic data’ means all data, of whatever type, concerning the characteristics of an individual which are inherited or acquired during early prenatal development;

(11) ‘biometric data’ means any personal data relating to the physical, physiological or behavioural characteristics of an individual which allow his or her unique identification, such as facial images, or dactyloscopic data;

(12) ‘data concerning health’ means any information personal data which relate to the physical or mental health of an individual, or to the provision of health services to the individual;

(13) ‘child’ means any person below the age of 18 years;

(14) ‘competent authorities’ means any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;

(15) ‘supervisory authority’ means a public authority which is established by a Member State in accordance with Article 39. [Am. 61]

CHAPTER II

PRINCIPLES

Article 4

Principles relating to personal data processing

Member States shall provide that personal data must be:

(a) processed fairly and lawfully , fairly and in a transparent and verifiable manner in relation to the data subject ;

(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes;

(c) adequate, relevant, and not excessive limited to the minimum necessary in relation to the purposes for which they are processed; they shall only be processed if, and as long as, the purposes could not be fulfilled by processing information that does not involve personal data;

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

(e) kept in a form which permits identification of data subjects for no longer than it is necessary for the purposes for which the personal data are processed;

(f) processed under the responsibility and liability of the controller, who shall ensure and be able to demonstrate compliance with the provisions adopted pursuant to this Directive;

(fa) processed in a way that effectively allows the data subject to exercise his or her rights as described in Articles 10 to 17;

(fb) processed in a way that protects against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures;

(fc) processed by only those duly authorised staff of the competent authorities who need them for the performance of their tasks.[Am. 62]

Article 4a

Access to data initially processed for purposes other than those referred to in Article 1(1)

1. Member States shall provide that competent authorities may only have access to personal data initially processed for purposes other than those referred to in Article 1(1) if they are specifically authorised by Union or Member State law which must meet the requirements set out in Article 7(1a) and must provide that:

(a) access is allowed only to duly authorised staff of the competent authorities in the performance of their tasks where, in a specific case, reasonable grounds give reason to believe that the processing of the personal data will substantially contribute to the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;

(b) requests for access must be in writing and refer to the legal ground for the request;

(c) the written request must be documented; and

(d) appropriate safeguards are implemented to ensure the protection of fundamental rights and freedoms in relation to the processing of personal data. Those safeguards shall be without prejudice to and complementary to specific conditions of access to personal data such as judicial authorisation in accordance with Member State law.

2. Personal data held by private parties or other public authorities shall only be accessed to investigate or prosecute criminal offences in accordance with necessity and proportionality requirements to be defined by Union law or Member State law, in full compliance with Article 7a. [Am. 63]

Article 4b

Time limits of storage and review

1. Member States shall provide that personal data processed pursuant to this Directive shall be deleted by the competent authorities where they are no longer necessary for the purposes for which they were processed.

2. Member States shall provide that the competent authorities put mechanisms in place to ensure that time-limits, pursuant to Article 4, are established for the erasure of personal data and for a periodic review of the need for the storage of the data, including fixing storage periods for the different categories of personal data. Procedural measures shall be established to ensure that those time-limits or the periodic review intervals are observed. [Am. 64]

Article 5

Distinction between different Different categories of data subjects

1. Member States shall provide that, as far as possible, the controller makes the competent authorities, for the purposes referred to in Article 1(1), may process personal data of the following different categories of data subjects, and the controller shall make a clear distinction between personal data of different categories of data subjects, such as such categories :

(a) persons with regard to whom there are serious reasonable grounds for believing that they have committed or are about to commit a criminal offence;

(b) persons convicted of a criminal offence crime ;

(c) victims of a criminal offence, or persons with regard to whom certain facts give reasons for believing that he or she could be the victim of a criminal offence; and

(d) third parties to the criminal offence, such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings, or a person who can provide information on criminal offences, or a contact or associate to one of the persons mentioned in (a) and (b); and.

(e) persons who do not fall within any of the categories referred to above.

2. Personal data of data subjects other than those referred to under paragraph 1 may only be processed:

(a) as long as necessary for the investigation or prosecution of a specific criminal offence in order to assess the relevance of the data for one of the categories indicated in paragraph 1; or

(b) when such processing is indispensable for targeted, preventive purposes or for the purposes of criminal analysis, if and as long as this purpose is legitimate, well-defined and specific and the processing is strictly limited to assess the relevance of the data for one of the categories indicated in paragraph 1. This is subject to regular review at least every six months. Any further use is prohibited.

3. Member States shall provide that additional limitations and safeguards, according to Member State law, apply to the further processing of personal data relating to data subjects referred to in points (c) and (d) of paragraph 1. [Am. 65]

Article 6

Different degrees of accuracy and reliability of personal data

1. Member States shall ensure provide that, as far as possible, the different categories accuracy and reliability of personal data undergoing processing are distinguished in accordance with their degree of accuracy and reliability ensured .

2. Member States shall ensure that, as far as possible, personal data based on facts are distinguished from personal data based on personal assessments , in accordance with their degree of accuracy and reliability .

2a. Member States shall ensure that personal data which are inaccurate, incomplete or no longer up to date are not transmitted or made available. To this end, the competent authorities shall assess the quality of personal data before they are transmitted or made available. As far as possible, in all transmissions of data, available information shall be added which enables the receiving Member State to assess the degree of accuracy, completeness, and reliability of the data, and the extent to which they are up-to-date. Personal data shall not be transmitted without request from a competent authority, in particular data originally held by private parties.

2b. If it emerges that incorrect data have been transmitted or data have been transmitted unlawfully, the recipient must be notified without delay. The recipient shall be obliged to rectify the data without delay in accordance with paragraph 1 and Article 15 or to erase them in accordance with Article 16. [Am. 66]

Article 7

Lawfulness of processing

1. Member States shall provide that the processing of personal data is lawful only if and to the extent that processing is based on Union or Member State law for the purposes set out in Article 1(1) and it is necessary:

(a) for the performance of a task carried out by a competent authority, based on law for the purposes set out in Article 1(1); or

(b) for compliance with a legal obligation to which the controller is subject; or

(c) in order to protect the vital interests of the data subject or of another person; or

(d) for the prevention of an immediate and serious threat to public security.

1a. Member State law regulating the processing of personal data within the scope of this Directive shall contain explicit and detailed provisions specifying at least:

(a) the objectives of the processing;

(b) the personal data to be processed;

(c) the specific purposes and means of processing;

(d) the appointment of the controller, or of the specific criteria for the appointment of the controller;

(e) the categories of duly authorised staff of the competent authorities for the processing of personal data;

(f) the procedure to be followed for the processing;

(g) the use that may be made of the personal data obtained;

(h) limitations on the scope of any discretion conferred on the competent authorities in relation to the processing activities. [Am. 67]

Article 7a

Further processing for incompatible purposes

1. Member States shall provide that personal data may only be further processed for another purpose set out in Article 1(1) which is not compatible with the purposes for which the data were initially collected if and to the extent that:

(a) the purpose is strictly necessary and proportionate in a democratic society and required by Union or Member State law for a legitimate, well-defined and specific purpose;

(b) the processing is strictly limited to a period not exceeding the time needed for the specific data processing operation;

(c) any further use for other purposes is prohibited.

Prior to any processing, the Member State shall consult the competent national supervisory authority and conduct a data protection impact assessment.

2. In addition to the requirements set out in Article 7(1a), Member State law authorising further processing as referred to in paragraph 1 shall contain explicit and detailed provisions specifying at least:

(a) the specific purposes and means of that particular processing;

(b) that access is allowed only by the duly authorised staff of the competent authorities in the performance of their tasks where in a specific case there are reasonable grounds for believing that the processing of the personal data will contribute substantially to the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties; and

(c) that appropriate safeguards are established to ensure the protection of fundamental rights and freedoms in relation to the processing of personal data.

Member States may require that access to the personal data is subject to additional conditions such as judicial authorisation, in accordance with their national law.

3. Member States may also allow further processing of personal data for historical, statistical or scientific purposes provided that they establish appropriate safeguards, such as making the data anonymous. [Am. 68]

Article 8

Processing of special categories of personal data

1. Member States shall prohibit the processing of personal data revealing race or ethnic origin, political opinions, religion or philosophical beliefs, sexual orientation or gender identity, trade-union membership, of genetic and activities, and the processing of biometric data or of data concerning health or sex life.

2. Paragraph 1 shall not apply where:

(a) the processing is authorised by a law providing appropriate safeguards strictly necessary and proportionate for the performance of a task carried out by the competent authorities for the purposes set out in Article 1(1), on the basis of Union or Member State law which shall provide for specific and suitable measures to safeguard the data subject's legitimate interests, including specific authorisation from a judicial authority, if required by national law ; or

(b) the processing is necessary to protect the vital interests of the data subject or of another person; or

(c) the processing relates to data which are manifestly made public by the data subject , provided that they are relevant and strictly necessary for the purpose pursued in a specific case . [Am. 69]

Article 8a

Processing of genetic data for the purpose of a criminal investigation or a judicial procedure

1. Member States shall ensure that genetic data may only be used to establish a genetic link within the framework of adducing evidence, preventing a threat to public security or preventing the commission of a specific criminal offence. Genetic data may not be used to determine other characteristics which may be linked genetically.

2. Member States shall provide that genetic data or information derived from their analysis may only be retained as long as necessary for the purposes for which data are processed and where the individual concerned has been convicted of serious offences against the life, integrity or security of persons, subject to strict storage periods to be determined by Member State law.

3. Member States shall ensure that genetic data or information derived from their analysis is only stored for longer periods when the genetic data cannot be attributed to an individual, in particular when it is found at the scene of a crime. [Am. 70]

Article 9

Measures based on profiling and automated processing

1. Member States shall provide that measures which produce an adverse a legal effect for the data subject or significantly affect him or her and which are partially or fully based solely on automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall be prohibited unless authorised by a law which also lays down measures to safeguard the data subject’s legitimate interests.

2. Automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall not be based solely on special categories of personal data referred to in Article 8.

2a. Automated processing of personal data intended to single out a data subject without an initial suspicion that the data subject might have committed or will be committing a criminal offence shall only be lawful if and to the extent that it is strictly necessary for the investigation of a serious criminal offence or the prevention of a clear and imminent danger, established on factual indications, to public security, the existence of the State, or the life of persons.

2b. Profiling that, whether intentionally or otherwise, has the effect of discriminating against individuals on the basis of race or ethnic origin, political opinions, religion or beliefs, trade union membership, gender or sexual orientation, or that, whether intentionally or otherwise, results in measures which have such effect, shall be prohibited in all cases. [Am. 71]

Article 9a

General principles for the rights of the data subject

1. Member States shall ensure that the basis of data protection is clear and with unambiguous rights for the data subject which shall be respected by the data controller. The provisions of this Directive aim to strengthen, clarify, guarantee and where appropriate, codify those rights.

2. Member States shall ensure that such rights include, inter alia, the provision of clear and easily understandable information regarding the processing of the data subject’s personal data, the right of access, rectification and erasure of his or her data, the right to obtain data, the right to lodge a complaint with the competent data protection authority and to bring legal proceedings as well as the right to compensation and damages resulting from an unlawful processing operation. Such rights shall in general be exercised free of charge. The data controller shall respond to requests from the data subject within a reasonable period of time. [Am. 72]

CHAPTER III

RIGHTS OF THE DATA SUBJECT

Article 10

Modalities for exercising the rights of the data subject

1. Member States shall provide that the controller takes all reasonable steps to have has concise, transparent , clear and easily accessible policies with regard to the processing of personal data and for the exercise of the data subjects' subject's rights.

2. Member States shall provide that any information and any communication relating to the processing of personal data are to be provided by the controller to the data subject in an intelligible form, using clear and plain language , in particular where that information is addressed specifically to a child .

3. Member States shall provide that the controller takes all reasonable steps to establish establishes procedures for providing the information referred to in Article 11 and for the exercise of the rights of the data subjects subject referred to in Articles 12 to 17. Where personal data are processed by automated means, the controller shall provide means for requests to be made electronically.

4. Member States shall provide that the controller informs the data subject about the follow-up given to their his or her request without undue delay , and in any event at the latest within one month of receipt of the request . The information shall be given in writing. Where the data subject makes the request in electronic form, the information shall be provided in electronic form .

5. Member States shall provide that the information and any action taken by the controller following a request referred to in paragraphs 3 and 4 are free of charge. Where requests are vexatious manifestly excessive , in particular because of their repetitive character, or the size or volume of the request, the controller may charge a reasonable fee , taking into account the administrative costs, for providing the information or taking the action requested, or the controller may not take the action requested. In that case, the controller shall bear the burden of proving the vexatious manifestly excessive character of the request.

5a. Member States may provide that the data subject may assert his or her rights directly against the controller or through the intermediary of the competent national supervisory authority. Where the supervisory authority has acted at the request of the data subject, the supervisory authority shall inform the data subject of the verifications carried out. [Am. 73]

Article 11

Information to the data subject

1. Where personal data relating to a data subject are collected, Member States shall ensure that the controller takes all appropriate measures to provide provides the data subject with at least the following information:

(a) the identity and the contact details of the controller and of the data protection officer;

(b) the legal basis and the purposes of the processing for which the personal data are intended;

(c) the period for which the personal data will be stored;

(d) the existence of the right to request from the controller access to and rectification, erasure or restriction of processing of the personal data concerning the data subject;

(e) the right to lodge a complaint with the supervisory authority referred to in Article 39 and its contact details;

(f) the recipients or categories of recipients of the personal data, including in third countries or international organisations, and who is authorised to access this data under the laws of that third country or the rules of that international organisation, the existence or absence of an adequacy decision by the Commission or in case of transfers referred to in Article 35 or 36, the means to obtain a copy of the appropriate safeguards used for the transfer ;

(fa) where the controller processes personal data as described in Article 9(1), information about the existence of processing for a measure of the kind referred to in Article 9(1) and the intended effects of such processing on the data subject, information about the logic used in the profiling and the right to obtain human assessment;

(fb) information regarding security measures taken to protect personal data;

(g) any further information in so far as such further information is necessary to guarantee fair processing in respect of the data subject, having regard to the specific circumstances in which the personal data are processed.

2. Where the personal data are collected from the data subject, the controller shall inform the data subject, in addition to the information referred to in paragraph 1, whether the provision of personal data is mandatory or optional, as well as the possible consequences of failure to provide such data.

3. The controller shall provide the information referred to in paragraph 1:

(a) at the time when the personal data are obtained from the data subject, or

(b) where the personal data are not collected from the data subject, at the time of the recording or within a reasonable period after the collection having regard to the specific circumstances in which the data are processed.

4. Member States may adopt legislative measures delaying, or restricting or omitting the provision of the information to the data subject , in a specific case, to the extent that, and as long as, such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the person concerned:

(a) to avoid obstructing official or legal inquiries, investigations or procedures;

(b) to avoid prejudicing the prevention, detection, investigation and prosecution of criminal offences or for the execution of criminal penalties;

(c) to protect public security;

(d) to protect national security;

(e) to protect the rights and freedoms of others.

5. Member States shall provide that the controller shall assess, in each specific case, by means of a concrete and individual examination, whether a partial or complete restriction for one of the reasons referred to in paragraph 4 applies. Member States may by law also determine categories of data processing which may wholly or partly fall under the exemptions under points (a), (b), (c) and (d) of paragraph 4. [Am. 74]

Article 12

Right of access for the data subject

1. Member States shall provide for the right of the data subject to obtain from the controller confirmation as to whether or not personal data relating to them him or her are being processed. Where such personal data are being processed, the controller shall provide the following information , if it has not already been provided :

(- a) communication of the personal data undergoing processing and of any available information as to their source, and if applicable, intelligible information about the logic involved in any automated processing;

(- aa) the significance and envisaged consequences of such processing, at least in the case of the measures referred to in Article 9;

(a) the purposes of the processing as well as the legal basis for the processing ;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipients to whom the personal data have been disclosed, in particular the recipients in third countries;

(d) the period for which the personal data will be stored;

(e) the existence of the right to request from the controller rectification, erasure or restriction of processing of personal data concerning the data subject;

(f) the right to lodge a complaint with the supervisory authority and the contact details of the supervisory authority;

(g) communication of the personal data undergoing processing and of any available information as to their source.

2. Member States shall provide for the right of the data subject to obtain from the controller a copy of the personal data undergoing processing. Where the data subject makes the request in electronic form, the information shall be provided in electronic form, unless otherwise requested by the data subject. [Am. 75]

Article 13

Limitations to the right of access

1. Member States may adopt legislative measures restricting, wholly or partly, depending on the specific case, the data subject's right of access to the extent and for the period that such partial or complete restriction constitutes a strictly necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the person concerned:

(a) to avoid obstructing official or legal inquiries, investigations or procedures;

(b) to avoid prejudicing the prevention, detection, investigation and prosecution of criminal offences or the execution of criminal penalties;

(c) to protect public security;

(d) to protect national security;

(e) to protect the rights and freedoms of others.

2. Member States shall provide that the controller assesses, in each specific case by means of a concrete and individual examination whether a partial or complete restriction for one of the reasons referred to in paragraph 1 applies. Member States may also determine by law categories of data processing which may wholly or partly fall under the exemptions under points (a) to (d) of paragraph 1.

3. In cases referred to in paragraphs 1 and 2, Member States shall provide that the controller informs the data subject , without undue delay, in writing on any refusal or restriction of access, on the reasons reasoned justification for the refusal and on the possibilities of lodging a complaint with the supervisory authority and seeking a judicial remedy. The information on factual or legal reasons on which the decision is based may be omitted where the provision of such information would undermine a purpose under paragraph 1.

4. Member States shall ensure that the controller documents the assessment referred to in paragraph 2 as well as the grounds for omitting restricting the communication of the factual or legal reasons on which the decision is based. That information shall be made available to the national supervisory authorities. [Am. 76]

Article 14

Modalities for exercising the right of access

1. Member States shall provide for the right of the data subject to request, at all times, in particular in cases referred to in Article 13 Articles 12 and 13 , that the supervisory authority checks the lawfulness of the processing.

2. Member State States shall provide that the controller informs the data subject of the right to request the intervention of the supervisory authority pursuant to paragraph 1.

3. When the right referred to in paragraph 1 is exercised, the supervisory authority shall inform the data subject at least that all necessary verifications by the supervisory authority have taken place, and of the result as regards the lawfulness of the processing in question. The supervisory authority shall also inform the data subject of his or her right to seek a judicial remedy.

3a. Member States may provide that the data subject may assert this right directly against the controller or through the intermediary of the competent national supervisory authority.

3b. Member States shall ensure that there are reasonable time limits for the controller to respond to requests of the data subject regarding the exercise of his or her right of access. [Am. 77]

Article 15

Right to rectification and completion

1. Member States shall provide for the right of the data subject to obtain from the controller the rectification or the completion of personal data relating to them him or her which are inaccurate. The data subject shall have the right to obtain completion of incomplete personal data or incomplete , in particular by way of a completing or corrective statement.

2. Member States shall provide that the controller informs the data subject in writing, on , with a reasoned justification, of any refusal of rectification or completion , on the reasons for the refusal and on the possibilities of lodging a complaint with the supervisory authority and seeking a judicial remedy.

2a. Member States shall provide that the controller shall communicate any rectification carried out to each recipient to whom the data have been disclosed, unless to do so proves impossible or involves a disproportionate effort.

2b. Member States shall provide that the controller communicates the rectification of inaccurate personal data to the third party from which the inaccurate personal data originate.

2c. Member States shall provide that the data subject may assert this right also through the intermediary of the competent national supervisory authority. [Am. 78]

Article 16

Right to erasure

1. Member States shall provide for the right of the data subject to obtain from the controller the erasure of personal data relating to them him or her where the processing does not comply with the provisions adopted pursuant to Articles 4 (a) to (e), 7 and 8 , 6 and 7 to 8 of this Directive.

2. The controller shall carry out the erasure without delay. The controller shall also abstain from further dissemination of such data.

3. Instead of erasure, the controller shall mark restrict the processing of the personal data where:

(a) their accuracy is contested by the data subject, for a period enabling the controller to verify the accuracy of the data;

(b) the personal data have to be maintained for purposes of proof; or for the protection of vital interests of the data subject or another person.

(c) the data subject opposes their erasure and requests the restriction of their use instead.

3a. Where processing of personal data is restricted pursuant to paragraph 3, the controller shall inform the data subject before lifting the restriction on processing.

4. Member States shall provide that the controller informs the data subject in writing, with a reasoned justification, of any refusal of erasure or marking restriction of the processing, the on reasons for the refusal and on the possibilities of lodging a complaint with the supervisory authority and seeking a judicial remedy.

4a. Member States shall provide that the controller notifies recipients to whom those data have been sent of any erasure or restriction made pursuant to paragraph 1, unless to do so proves impossible or involves a disproportionate effort. The controller shall inform the data subject about those third parties.

4b. Member States may provide that the data subject may assert this right directly against the controller or through the intermediary of the competent national supervisory authority. [Am. 79]

Article 17

Rights of the data subject in criminal investigations and proceedings

Member States may provide that the rights of information, access, rectification, erasure and restriction of processing referred to in Articles 11 to 16 are carried out in accordance with national rules on judicial proceedings where the personal data are contained in a judicial decision or record processed in the course of criminal investigations and proceedings.

CHAPTER IV

CONTROLLER AND PROCESSOR

SECTION 1

GENERAL OBLIGATIONS

Article 18

Responsibility of the controller

1. Member States shall provide that the controller adopts policies and implements appropriate measures to ensure and be able to demonstrate, in a transparent manner, for each processing operation, that the processing of personal data is performed in compliance with the provisions adopted pursuant to this Directive , both at the time of the determination of the means for processing and at the time of the processing itself .

2. The measures referred to in paragraph 1 shall in particular include:

(a) keeping the documentation referred to in Article 23;

(aa) performing a data protection impact assessment pursuant to Article 25a;

(b) complying with the requirements for prior consultation pursuant to Article 26;

(c) implementing the data security requirements laid down in Article 27;

(d) designating a data protection officer pursuant to Article 30.;

(da) drawing up and implementing specific safeguards in respect of the treatment of personal data relating to children, where appropriate.

3. The controller shall implement mechanisms to ensure the verification of the adequacy and effectiveness of the measures referred to in paragraph 1 of this Article. If proportionate, this verification shall be carried out by independent internal or external auditors. [Am. 80]

Article 19

Data protection by design and by default

1. Member States shall provide that, having regard to the state of the art and the cost of implementation, current technical knowledge, international best practices and the risks represented by the data processing, the controller and the processor if any shall , both at the time of the determination of the purposes and means for processing and at the time of the processing itself, implement appropriate and proportionate technical and organisational measures and procedures in such a way that the processing will meet the requirements of provisions adopted pursuant to this Directive and ensure the protection of the rights of the data subject , in particular with regard to the principles laid down in Article 4. Data protection by design shall have particular regard to the entire lifecycle management of personal data from collection to processing to deletion, systematically focusing on comprehensive procedural safeguards regarding the accuracy, confidentiality, integrity, physical security and deletion of personal data. Where the controller has carried out a data protection impact assessment pursuant to Article 25a, the results shall be taken into account when developing those measures and procedures .

2. The controller shall implement mechanisms for ensuring ensure that, by default, only those personal data which are necessary for the purposes of the processing are processed for each specific purpose of the processing and are especially not collected, retained or disseminated beyond the minimum necessary for those purposes, both in terms of the amount of the data and the time of their storage. In particular, those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals and that data subjects are able to control the distribution of their personal data . [Am. 81]

Article 20

Joint controllers

1. Member States shall provide that where a controller determines the purposes, conditions and means of the processing of personal data jointly with others, the joint controllers shall determine the respective responsibilities for compliance with the provisions adopted pursuant to this Directive, in particular as regards the procedures and mechanisms for exercising the rights of the data subject, by means of an a legally binding arrangement between them.

2. Unless the data subject has been informed which of the joint controllers is responsible pursuant to paragraph 1, the data subject may exercise his or her rights under this Directive in respect of and against each of any two or more joint controllers. [Am. 82]

Article 21

Processor

1. Member States shall provide that where a processing is carried out on behalf of a controller, the controller must shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of the provisions adopted pursuant to this Directive and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organisational measures governing the processing to be carried out and to ensure compliance with those measures .

2. Member States shall provide that the carrying out of processing by means of a processor must be governed by a contract or legal act binding the processor to the controller and stipulating in particular that the processor shall act only on instructions from the controller, in particular, where the transfer of the personal data used is prohibited.:

(a) act only on instructions from the controller;

(b) employ only staff who have agreed to be bound by an obligation of confidentiality or are under a statutory obligation of confidentiality;

(c) take all required measures pursuant to Article 27;

(d) engage another processor only with the permission of the controller and therefore inform the controller of the intention to engage another processor in such a timely fashion that the controller has the possibility to object;

(e) insofar as it is possible given the nature of the processing, adopt in agreement with controller the necessary technical and organisational requirements for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III;

(f) assist the controller in ensuring compliance with the obligations pursuant to Articles 25a to 29;

(g) return all results to the controller after the end of the processing and not otherwise process the personal data and delete existing copies unless Union or Member State law requires its storage;

(h) make available to the controller and the supervisory authority all the information necessary to verify compliance with the obligations laid down in this Article;

(i) take into account the principle of data protection by design and default.

2a. The controller and the processor shall document in writing the controller's instructions and the processor's obligation referred to in paragraph 2.

3. If a processor processes personal data other than as instructed by the controller, the processor shall be considered to be a controller in respect of that processing and shall be subject to the rules on joint