Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse
Date: 2023-11-30
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: child pornography, child protection, data protection, derogation from EU law, paedophilia, personal data, protection of communications, regulation of telecommunications, sexual violence, social media

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 30.11.2023  COM(2023) 777 final 2023/0452 (COD)  Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse (Text with EEA relevance)  
 
EXPLANATORY MEMORANDUM 

1. 

CONTEXT OF THE PROPOSAL 

Reasons for and objectives of the proposal 

• 
Regulation (EU) 2021/1232 (“Interim Regulation”)1 lays down temporary and strictly limited 
rules  derogating  from  certain  obligations  laid  down  in  Directive  2002/58/EC  (“the  ePrivacy 
Directive”),  with  the  sole  objective  of  enabling  providers  of  certain  number-independent 
interpersonal  communications  services  to  use  specific  technologies  for  the  processing  of 
personal and other data to the extent strictly necessary to detect online child sexual abuse on 
their  services  and  report  it  and  to  remove  online  child  sexual  abuse  material  from  their 
services.  

As  explained  in  its  Recital  10,  the  Interim  Regulation  is  intended  to  provide  a  temporary 
solution pending the adoption of a long-term legal framework to tackle child sexual abuse at 
Union  level.  According  to  its  Article  10,  second  subparagraph,  the  Interim  Regulation  will 
expire on 3 August 2024.  

The  proposal  for  a  Regulation  of  the  European  Parliament  and  of  the  Council  laying  down 
rules to prevent and combat child sexual abuse,2 which the Commission adopted on 11 May 
2022, aims to provide that long-term legal framework. 

The inter-institutional negotiations on the proposed long-term Regulation have not concluded 
and it is uncertain that they will conclude for the long-term Regulation to enter into force and 
to apply before the Interim Regulation is set to expire. Therefore, it is necessary to introduce 
through  this  proposal  a  limited  time  extension  to  the  Interim  Regulation,  to  enable  the 
continuation of the above voluntary activities during a sufficient period of time to allow the 
inter-institutional negotiations of the long-term Regulation to conclude. This will ensure that 
child sexual abuse online can be effectively and lawfully combated without interruptions until 
the long-term regime created by the proposed Regulation is agreed.  

• 

Consistency with existing policy provisions in the policy area 

This proposal delivers on commitments made in the EU Strategy for a More Effective Fight 
Against Child Sexual Abuse, notably to propose legislation to tackle child sexual abuse online 
effectively. The current EU legal framework in this area consists of Union legislation relating 
to child sexual abuse, such as the Child Sexual Abuse Directive, and the Interim Regulation, 
which applies until 3 August 2024.  

The  proposed  legislation  complements  the  European  Strategy  for  a  Better  Internet  for 
Children3,  which  aims  to  create  safe  digital  experiences  for  children  and  to  promote  digital 
empowerment.    

1 

2 

3 

Regulation  2021/1232/EU  of  the  European  Parliament  and  of  the  Council  of  14  July  2021  on  a 
temporary  derogation  from  certain  provisions  of  Directive  2002/58/EC  as  regards  the  use  of 
technologies  by  providers  of  number-independent  interpersonal  communications  services  for  the 
processing of personal and other data for the purpose of combating online child sexual abuse (Text with 
EEA relevance). 
Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent 
and combat child sexual abuse, COM/2022/209 final. 
COM(2022) 212, 11 May 2022. 

EN 

1 

  EN 

 
• 

Consistency with other Union policies 

The proposal extends the period of application of the Interim Regulation, for a limited period 
of time, without otherwise amending that Regulation in any way.  

Consequently, as is the case with the Interim Regulation as it stands prior to the amendment 
now  proposed,  the  approach  embodied  therein  builds  on  the  General  Data  Protection 
Regulation4 (GDPR). As explained in Recitals 12 and 15 as well as Article 1(1) of the Interim 
Regulation, the GDPR applies and is left unaffected by the Interim Regulation. Therefore, the 
rules set out in the GDPR must continue to be respected, including those on the lawfulness of 
processing  (Article  6).  In  practice,  providers  tend  to  invoke  various  grounds  for  processing 
provided for in the GDPR to carry out the processing of personal data inherent in voluntary 
detection and reporting of child sexual abuse online.  

The proposal, as is the case for the Interim Regulation as it stands, covers providers that offer 
number independent interpersonal communications services and hence are subject to national 
provisions  implementing  the  ePrivacy  Directive5  and  its  proposed  revision  currently  in 
negotiations6, with both of which the proposal is coherent.  
The proposal is also coherent with the Digital Services Act (DSA)7. The Interim Regulation, 
as  to  be  extended,  complements  the  horizontal  framework  of  the  DSA,  setting  out  specific 
rules where needed for the particular case of combating online child sexual abuse. 

2. 

• 

LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY 

Legal basis 

The relevant legal bases are Article 16 and Article 114 of the Treaty on the Functioning of the 
European  Union  (‘TFEU’).  These  provisions  are  also  the  legal  bases  of  the  Interim 
Regulation.  

• 

Subsidiarity (for non-exclusive competence)  

According to the principle of subsidiarity, EU action may only be taken if the envisaged aims 
cannot be achieved by Member States alone. EU intervention is needed to maintain the ability 
of  providers  of  number-independent  interpersonal  communications  services  to  voluntarily 
detect and report child sexual abuse online and remove child sexual abuse material, as well as 
to  continue  ensuring  a  uniform  and  coherent  legal  framework  for  the  activities  in  question 
throughout  the  internal  market,  as  provided  for  in  the  Interim  Regulation.  The  limited  time 
extension of the Interim Regulation can only be adopted by Union legislation.  

• 

Proportionality 

The  proposal  complies  with  the  principle  of  proportionality  as  set  out  in  Article  5  of  the 
Treaty on European Union as it will not go beyond what is necessary for the achievement of 
the  set  objectives.  It  introduces  a  limited  time  extension  to  the  targeted  and  temporary 

4 

5 

6 

7 

Regulation  (EU)  2016/679  of  the  European  Parliament  and  of  the  Council  of  27  April  2016  on  the 
protection of natural persons with regard to the processing of personal data and on the free movement of 
such data, and repealing Directive 95/46/EC (General Data Protection Regulation). 
Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal 
aspects of information society services, in particular electronic commerce, in the Internal Market. 
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the 
processing  of  personal  data  and  the  protection  of  privacy  in  the  electronic  communications  sector 
(Directive on privacy and electronic communications). 
Regulation  (EU)  2022/2065  of  the  European  Parliament  and  of  the  Council  of  19  October  2022  on a 
Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act). 

EN 

2 

  EN 

 
derogation as regards certain aspects of changes to the current framework in order to ensure 
that certain measures remain permissible to the extent that they currently comply with Union 
law.  

The duration of the extension is limited to a time period strictly necessary to adopt the long-
term  legislation,  as  can  reasonably  be  assessed  at  present  having  regard  in  particular  to  the 
current state of the negotiations and the upcoming elections of the European Parliament. 

• 

Choice of the instrument 

The objectives of the present proposal can best be pursued through a Regulation, given that 
the act that is amended, namely the Interim Regulation, is also a Regulation.  

3. 

• 

RESULTS 
CONSULTATIONS AND IMPACT ASSESSMENTS 

EX-POST 

EVALUATIONS, 

OF 

STAKEHOLDER 

Ex-post evaluations/fitness checks of existing legislation 

Not applicable 

• 

Stakeholder consultations 

Not applicable 

• 

Collection and use of expertise 

Not applicable 

• 

Impact assessment 

In view of the policy objective and the time-sensitive nature of the issue, there are no other 
materially different policy options available, and thus no impact assessment  is necessary. In 
particular, the measure intends to introduce a limited time extension of the interim and strictly 
limited derogation from  the applicability of Articles 5(1) and 6 of the ePrivacy Directive to 
ensure that number-independent interpersonal communications service providers can continue 
to voluntarily using specific technologies to detect and report child sexual abuse online and to 
remove  child  sexual  abuse  material  on  their  services  after  3  August  2024,  pending  the 
adoption of long-term legislation.  

• 

Fundamental rights 

The  proposal  takes  full  account  of  the  fundamental  rights  and  principles  recognised  by  the 
Charter of Fundamental Rights of the European Union (“the Charter”).  

The proposed measures comply with Article 7 of the Charter, which protects the fundamental 
right  of  everyone  to  the  respect  for  his  or  her  private  and  family  life,  home  and 
communications, and includes the confidentiality of communications. Moreover, to the extent 
that  the  processing  of  electronic  communications  by  number-independent  interpersonal 
communications  services  for  the  sole  purpose  of  detecting  and  reporting  child  sexual  abuse 
online and removing child sexual abuse material falls into the scope of the derogation created 
by  this  proposal,  the  GDPR,  which  implements  in  secondary  legislation  Article  8(1)  of  the 
Charter,  which  provides  that  everyone  enjoys  the  right  to  the  protection  of  personal  data, 
continues to apply to such processing.  

EN 

3 

  EN 

In addition, the proposal complies with Article 24(2) of the Charter, which provides that, in 
all actions relating to children, whether taken by public authorities or private institutions, the 
child’s best interests must be a primary consideration. It also complies with Articles 1, 3 and 4 
of the Charter, on the rights to human dignity, the right to the integrity of the person and the 
prohibition  of  inhuman  or  degrading  treatment,  respectively,  considering  that  child  sexual 
abuse can (gravely) interfere with these fundamental rights of the children involved. 

Finally, by making it possible, subject to certain appropriate conditions, for providers to take 
voluntary measures to tackle possible misuse of their services, the proposal also takes account 
of their freedom to conduct a business, guaranteed under Article 16 of the Charter.  

4. 

BUDGETARY IMPLICATIONS 

This proposal has no implications for the EU budget. 

5. 

• 

OTHER ELEMENTS 

Implementation plans and monitoring, evaluation and reporting arrangements 

Not applicable 

• 

Detailed explanation of the specific provisions of the proposal 

Article  1  sets  out  the  amendment  to  the  Interim  Regulation  brought  about  by  the  present 
Regulation,  consisting  of  a  limited  extension  of  the  period  of  application  of  the  Interim 
Regulation. That is the sole amendment made to the Interim Regulation. 

Article 2 sets the date for entering into force of the present Regulation. 

EN 

4 

  EN 

2023/0452 (COD) 

Proposal for a 

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 

amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on 
a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose 
of combating online child sexual abuse 

(Text with EEA relevance) 

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, 

Having  regard  to  the  Treaty  on  the  Functioning  of  the  European  Union,  and  in  particular 
Article 16(2), in conjunction with Article 114(1), thereof, 

Having regard to the proposal from the European Commission, 

After transmission of the draft legislative act to the national parliaments, 
Having regard to the opinion of the European Economic and Social Committee8,  

Acting in accordance with the ordinary legislative procedure, 

Whereas: 

(1) 

(2) 

(3) 

8 
9 

10 

Regulation (EU) 2021/1232 of the European Parliament and of the Council9 provides 
for  a  temporary  regime  in  respect  of  the  use  of  technologies  by  certain  providers  of 
publicly available interpersonal communications services for the purpose of combating 
online child sexual  abuse, pending  the preparation and adoption of a long-term  legal 
framework. That Regulation applies until 3 August 2024. 

The proposal for a Regulation of the European Parliament and of the Council laying 
down rules to prevent and combat child sexual abuse10 aims to provide that long-term 
legal  framework.  However,  the  inter-institutional  negotiations  on  that  proposal  have 
not yet been concluded and it is uncertain whether they will be concluded on time for 
the  long-term  legal  framework,  including  any  amendments  to  Regulation  (EU) 
2021/1232 that it may contain, to be adopted, to enter into force and to apply before 3 
August 2024.  

It  is  important  that  child  sexual  abuse  online  can  be  effectively  combated,  in 
accordance with the applicable rules of Union law, including the conditions set out in 
Regulation  (EU)  2021/1232,  without  interruptions  pending  the  conclusion  of  those 
inter-institutional negotiations and the adoption entry into force and application of the 
long-term legal framework.  

OJ C , , p. . 
Regulation  (EU)  2021/1232  of  the  European  Parliament  and  of  the  Council  of  14  July  2021  on  a 
temporary  derogation  from  certain  provisions  of  Directive  2002/58/EC  as  regards  the  use  of 
technologies  by  providers  of  number-independent  interpersonal  communications  services  for  the 
processing of personal and other data for the purpose of combating online child sexual abuse (OJ L 274, 
30.7.2021, p. 41, ELI: http://data.europa.eu/eli/reg/2021/1232/oj). 
Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent 
and combat child sexual abuse, COM/2022/209 final. 

EN 

5 

  EN 

 
(4) 

(5) 

Therefore,  Regulation  (EU)  2021/1232  should  be  amended  to  extend  its  period  of 
application  for  an  additional  period  of  time  strictly  necessary  to  adopt  the  long-term 
legislation.  

Considering  the  need  to  ensure,  in  a  timely  manner,  legal  certainty,  as  well  as  the 
limited nature of the amendment, namely the extension of the period of application of 
the existing regime, it is appropriate to provide that this Regulation enters into force as 
soon as possible, 

HAVE ADOPTED THIS REGULATION: 

Article 1 

In  Article  10  of  Regulation  (EU)  2021/1232,  the  second  subparagraph  is  replaced  by  the 
following: 

“It shall apply until 3 August 2026”.  

This  Regulation  shall  enter  into  force  on  the  day  following  that  of  its  publication  in  the 
Official Journal of the European Union. 

Article 2 

This Regulation shall be binding in its entirety and directly applicable in all Member States. 

Done at Brussels, 

For the European Parliament 
The President 

For the Council 
The President 

EN 

6 

  EN