CELEX: 
Language: en
Date: 2018-07-09 00:00:00
Title: COMMISSION DELEGATED REGULATION (EU) …/... amending Annex III of Regulation (EU) No 211/2011 of the European Parliament and of the Council on the citizens' initiative

EXPLANATORY MEMORANDUM
            
            
               1.CONTEXT OF THE DELEGATED ACT
            
            
               Article 16 of the Regulation (EU) No 211/2011 empowers the Commission to adopt, by means of delegated acts, in accordance with Article 17 and subject to the conditions of Articles 18 and 19 of the Regulation, amendments to the Annexes to the Regulation within the scope of the relevant provisions of the Regulation.
            
            
               Article 5(1) of the Regulation provides that organisers of citizens' initiatives shall only use forms which comply with the models set out in Annex III of the Regulation for collecting statements of support from signatories. In accordance with these forms, signatories have to provide different data depending on the Member State they come from (Member State of residence or Member State of nationality of the signatory). 
            
            
               The forms include a privacy statement informing the signatories about how their personal data will be processed. This document refers to Directive 95/46/EC and the requirements which derive from this Directive.
            
            
               Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data repeals Directive 95/46/EC (General Data Protection Regulation). It entered into application on 25 May 2018.
            
            
               Article 94 of the General Data Protection Regulation stipulates that references to Directive 95/46/EC shall be construed as references to Regulation (EU) 2016/679. 
            
            
               Article 13 of the General Data Protection Regulation defines information to be provided where personal data are collected from the data subject.
            
            
               The Commission needs to adopt this Act to modify the privacy statement included in the statement of support form models in order to adapt them to the provisions of the General Data Protection Regulation. 
            
            
            
               The modifications aim to provide the data subjects with:
            
            
               (a) updated references to the applicable personal data protection legal framework, and
            
            
               (b) additional information which needs to be provided by the data controller when personal data are collected from the data subjects as stipulated in Article 13 of the General Data Protection Regulation. 
            
            
               This information includes the list of the rights of the data subject relating to the processing of their data, the information on the right to lodge a complaint with a supervisory authority, the reference to the contact details of the data controller (organisers) and their data protection officer (if any), contact details of the competent national authorities which will receive and process the personal data and the national data protection authorities.  
            
            
               2.CONSULTATIONS PRIOR TO THE ADOPTION OF THE ACT
            
            
               Public consultations, impact assessment and publication of the draft act for stakeholder feedback were not deemed necessary given the limited margin of discretion the Commission enjoys as regards the modifications concerned. The Commission has an obligation to amend Annex III to adapt the Regulation to the new data protection legal framework, and namely to the provisions of the General Data Protection Regulation which repealed and replaced Directive 95/46/EC as of 25 May 2018.
            
            
               Member States have been consulted via the Commission expert group on the citizens' initiative. Their views have been taken into account in this delegated act. European Parliament experts participated in the relevant meeting of the Commission expert group and have been provided with full information and documentation on the meeting, in line with the specific arrangements laid down in the Framework Agreement between the European Parliament and the Commission. 
            
            
               3.LEGAL ELEMENTS OF THE DELEGATED ACT
            
            
               This Act amends the privacy statement in Annex III, part A and part B of Regulation (EU) No 211/2011. 
            
         
         
            
               The Act provides that the personal data provided on the statements of support form to the organisers of the proposed initiative will only be used for the support of that initiative and made available to the competent national authorities and processed by them for the purpose of verification and certification of the number of valid statements of support received for this citizens’ initiative pursuant to Article 8 of Regulation (EU) No 211/2011. As provided for in Chapter III of the General Data Protection Regulation, it also provides that data subjects are entitled to request from the organisers access to, rectification of, erasure and restriction of processing of their personal data. 
            
            
               In accordance with Article 9 of Regulation (EU) No 211/2011, the Act also provides that statements of support and any copies thereof will be stored by the organisers for a maximum retention period of 18 months after the date of registration of the proposed citizens’ initiative, or one month after submitting that initiative to the Commission, whichever is the earlier. They might be retained beyond these time limits in the case of administrative or legal proceedings, for a maximum of one week after the date of conclusion of the said proceedings. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a data protection authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the General Data Protection Regulation.
            
            
               The Act also provides for the references to the contact details of the data controllers (organisers) which can be contacted using the details of the registered contact persons as provided in the statement of support form; the contact details of the data protection officer (if any) which are available at the web address of the initiative in the European Commission's register as provided in the statement of support form; and the contact details of the competent national authority which will receive and process the personal data and the national data protection authorities which are available at 
               
                  http://ec.europa.eu/citizens-initiative/public/data-protection
               
               .
            
            
               COMMISSION DELEGATED REGULATION (EU) …/...
            
            
               of 9.7.2018
            
            
               amending Annex III of Regulation (EU) No 211/2011 of the European Parliament and of the Council on the citizens' initiative 
            
            
               THE EUROPEAN COMMISSION,
            
            
               Having regard to the Treaty on the Functioning of the European Union,
            
            
               Having regard to Regulation (EU) No 211/2011 of the European Parliament and of the Council of 16 February 2011 on the citizens' initiative
                  1
                and in particular Article 16 thereof, 
            
            
               Whereas:
            
            
               (1)Article 5(1) of Regulation (EU) No 211/2011 provides that organisers of citizens' initiatives are to use only forms which comply with the models set out in Annex III to that Regulation for collecting statements of support from signatories.
            
            
               (2)The statement of support forms contain a privacy statement providing information on how signatories' personal data may be processed and what are the rights of signatories as data subjects. The privacy statement refers to the repealed Directive 95/46/EC of the European Parliament and of the Council
                  2
               . 
            
            
               (3)Directive 95/46/EC was repealed by Regulation (EU) 2016/679
                  3
               . Regulation (EU) 2016/679 started to apply from 25 May 2018.
            
            
               (4)Article 13 of Regulation (EU) 2016/679 sets out the information which needs to be provided, at the time when personal data are obtained, by the data controller to the data subject where personal data are collected from the data subject. Such information should be provided henceforth in the privacy statement of the statement of support form model.
            
            
               (5)According to Article 94 of Regulation (EU) 2016/679, references to the repealed Directive 95/46/EC are to be construed as references to Regulation (EU) 2016/679. For reasons of clarity, legal certainty and transparency, the reference in the privacy statement should be updated. 
            
            
               (6)Annex III to Regulation (EU) No 211/2011 should therefore be amended accordingly.
            
            
               (7)The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 of the European Parliament and of the Council
                  4
               ,
            
            
               HAS ADOPTED THIS REGULATION:
            
            
               Article 1
            
            
               Annex III to Regulation (EU) No 211/2011 is amended as follows:
            
         
         
            
               (1)the text of the privacy statement set out in the model for statement of support form at the end of part A is replaced by the following:
            
            
               “Privacy statement: In accordance with the General Data Protection Regulation, your personal data provided on this form will only be used for the support of the initiative and made available to the competent national authorities for the purpose of verification and certification. You are entitled to request from the organisers of this initiative access to, rectification of, erasure and restriction of processing of your personal data. 
            
            
               Your data will be stored by the organisers for a maximum retention period of 18 months after the date of registration of the proposed citizens’ initiative, or one month after submitting that initiative to the Commission, whichever is the earlier. It might be retained beyond these time limits in the case of administrative or legal proceedings, for a maximum of one week after the date of conclusion of these proceedings.
            
            
               Without prejudice to any other administrative or judicial remedy, you have the right to lodge at any time a complaint with a data protection authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that your data is unlawfully processed.
            
            
               The organisers of the citizens’ initiative are the controllers in the meaning of the General Data Protection Regulation and they can be contacted using the details provided on this form. 
            
            
               The contact details of the data protection officer (if any) are available at the web address of this initiative in the European Commission’s register, as provided on this form.
            
            
               The contact details of the national authority which will receive and process your personal data and the contact details of the national data protection authorities can be consulted at: 
               
                  http://ec.europa.eu/citizens-initiative/public/data-protection
               
               .”;
            
            
               (2)the text of the privacy statement set out in the model for statement of support form at the end of part B is replaced by the following:
            
            
               “Privacy statement: In accordance with the General Data Protection Regulation, your personal data provided on this form will only be used for the support of the initiative and made available to the competent national authorities for the purpose of verification and certification. You are entitled to request from the organisers of this initiative access to, rectification of, erasure and restriction of processing of your personal data. 
            
            
               Your data will be stored by the organisers for a maximum retention period of 18 months after the date of registration of the proposed citizens’ initiative, or one month after submitting that initiative to the Commission, whichever is the earlier. It might be retained beyond these time limits in the case of administrative or legal proceedings, for a maximum of one week after the date of conclusion of these proceedings.
            
            
               Without prejudice to any other administrative or judicial remedy, you have the right to lodge at any time a complaint with a data protection authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that your data is unlawfully processed.
            
            
               The organisers of the citizens’ initiative are the controllers in the meaning of the General Data Protection Regulation and they can be contacted using the details provided on this form. 
            
            
               The contact details of the data protection officer (if any) are available at the web address of this initiative in the European Commission’s register, as provided on this form.
            
            
               The contact details of the national authority which will receive and process your personal data and the contact details of the national data protection authorities can be consulted at: 
               
                  http://ec.europa.eu/citizens-initiative/public/data-protection
               
               .”.
            
            
               Article 2
            
            
               This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
            
            
               This Regulation shall be binding in its entirety and directly applicable in all Member States.
            
            
               Done at Brussels, 9.7.2018
            
            
               
                     For the Commission
               
               
                     The President
                     Jean-Claude JUNCKER
               
            
         
         
            
                  
                     (1)
                  
                        OJ L 65, 11.3.2011, p. 1. 
               
               
                  
                     (2)
                  
                        Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p.31).
               
               
                  
                     (3)
                  
                        Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119 4.5.2016, p. 1).
               
               
                  
                     (4)
                  
                        Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 008, 12.1.2001, p.1).