DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data Members will find in annex the 4 column table on the Data Protection Directive which comprises the Commission proposal, the first reading Position of the European Parliament, the General Approach of the Council as well as the outcome of the inter-institutional negotiations. The markings in this table are to be read as follows: Second column with first reading Position of the European Parliament: new text is marked in bold italics; deleted parts of the text are marked in strikethrough, text identical with the Commission proposal is marked - with a diagonal line in the box. Third column with General Approach of the Council: new text is marked in bold italics; deleted parts of the text are marked in strikethrough, parts of the text that have been moved up or down are marked in bold. Fourth column is the outcome of the inter-institutional negotiations and is not marked up.
ANNEX COM (2012)0010 EP amendments 2012/0010(COD) Council general approach document 12555/14 Comments/compromise suggestions Proposal for a Proposal for a Proposal for a Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, or the safeguarding against and the prevention of threats to public security, and the free movement of such data on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data
national authorities in specific cases and in accordance with national law. A body/entity which processes personal data on behalf of such authorities within the scope of this Directive should be bound, by a contract or other legal act and the provisions applicable to processors pursuant to this Directive, while the application of Regulation EU/XXX remains unaffected for processing activities of the processor outside the scope of this Directive. Directive should be bound by a contract or other legal act and by the provisions applicable to processors pursuant to this Directive, while the application of Regulation EU/XXX remains unaffected for processing activities of the processor outside the scope of this Directive. (11a) The activities carried out by the police or other law enforcement authorities are mainly focused on the prevention, investigation, detection or prosecution of criminal offences including police activities without prior knowledge if an incident is a criminal offence or not. These can also include the exercise of authority by taking coercive measures such as police activities at demonstrations, major sporting events and riots. Those activities performed by the above-mentioned authorities also include maintaining law and order as a task conferred on the police or other law enforcement authorities (11a) The activities carried out by the police or other law enforcement authorities are mainly focused on the prevention, investigation, detection or prosecution of criminal offences including police activities without prior knowledge if an incident is a criminal offence or not. These can also include the exercise of authority by taking coercive measures such as police activities at demonstrations, major sporting events and riots. Those activities performed by the above-mentioned authorities also include maintaining law and order as a task conferred on the police or other law enforcement authorities
Amendment 9 (18) Any processing of personal data must be fair and lawful in relation to the individuals concerned. In particular, the specific purposes for which the data are processed should be explicit. deleted (18) Any processing of personal data must be lawful and fair in relation to the individuals concerned, and only processed for specific purposes laid down by law. The principle of fair processing does not in itself prevent the law enforcement authorities from carrying out activities such as covert investigations or video surveillance. Such activities can be done for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties or the safeguarding against and the prevention of threats to public security as long as they are laid down by law and constitute a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the individual concerned. The data protection principle of fair processing is a distinct notion from the right to a fair trial as defined by Article 6 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and Article 47 of the (18) Any processing of personal data must be lawful, fair and transparent in relation to the individuals concerned, and only processed for specific purposes laid down by law. This does not in itself prevent the law enforcement authorities from carrying out activities such as covert investigations or video surveillance. Such activities can be done for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security as long as they are laid down by law and constitute a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the individual concerned. The data protection principle of fair processing is a distinct notion from the right to a fair trial as defined by Article 6 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and Article 47 of the Charter of Fundamental
Charter of Fundamental Rights. Individuals should be made aware of risks, rules, safeguards and rights in relation to the processing of his/her personal data and how to exercise his or her rights in relation to the processing. In particular, the specific purposes for which the data are processed should be explicit and legitimate and determined at the time of the collection of the data. The data should be adequate and relevant for the purposes for which the data are processed; this requires, in particular, ensuring that the data collected are not excessive and not kept longer than is necessary for the purpose for which they are processed. Personal data should only be processed if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Member States should lay down appropriate safeguards for personal data stored for longer periods for archiving in the public interest, scientific, statistical or historical use Rights of the European Union. Individuals should be made aware of risks, rules, safeguards and rights in relation to the processing of their personal data and how to exercise their rights in relation to the processing. In particular, the specific purposes for which the data are processed should be explicit and legitimate and determined at the time of the collection of the data. The data should be adequate and relevant for the purposes for which the data are processed; this requires, in particular, ensuring that the data collected are not excessive and not kept longer than is necessary for the purpose for which they are processed. Personal data should only be processed if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Member States should lay down appropriate safeguards for personal data stored for longer periods for archiving in the public interest, scientific, statistical or historical use.
(22) In the interpretation and application of the general principles relating to personal data processing by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, account should be taken of the specificities of the sector, including the specific objectives pursued. deleted (22) In the interpretation and application of the provisions of this Directive, by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties or the safeguarding against and the prevention of threats of public security, account should be taken of the specificities of the sector, including the specific objectives pursued. (…) Amendment 14 (23) It is inherent to the processing of personal data in the areas of judicial co-operation in criminal matters and police co-operation that personal data relating to different categories of data subjects are processed. Therefore a clear distinction should as far as possible be made between personal data of different categories of data subjects such as suspects, persons convicted of a criminal offence, victims and third parties, such as witnesses, persons possessing relevant information or contacts and associates of suspects and convicted criminals. (23) It is inherent to the processing of personal data in the areas of judicial co-operation in criminal matters and police co-operation that personal data relating to different categories of data subjects are processed. Therefore a clear distinction should as far as possible be made between personal data of different categories of data subjects such as suspects, persons convicted of a criminal offence, victims and third parties, such as witnesses, persons possessing relevant information or contacts and associates of suspects and convicted criminals. Specific rules on the consequences of this (23) deleted (23) It is inherent to the processing of personal data in the areas of judicial co-operation in criminal matters and police co-operation that personal data relating to different categories of data subjects are processed. Therefore a clear distinction should, where applicable and as far as possible, be made between personal data of different categories of data subjects such as suspects, persons convicted of a criminal offence, victims and third parties, such as witnesses, persons possessing relevant information or contacts and associates of suspects and convicted criminals. This should not prevent the application of the
categorisation should be provided by the Member States, taking into account the different purposes for which data are collected and providing specific safeguards for persons who are not suspected of having committed, or have not been convicted of, a criminal offence. right of presumption of innocence as guaranteed by the Charter of Fundamental Rights of the European Union and by the European Convention on Human Rights, as interpreted by the case law of the Court of Justice of the European Union and the European Court of Human Rights respectively. (24) As far as possible personal data should be distinguished according to the degree of their accuracy and reliability. Facts should be distinguished from personal assessments, in order to ensure both the protection of individuals and the quality and reliability of the information processed by the competent authorities. (24) As far as possible personal data should be distinguished according to the degree of their accuracy and reliability. Facts should be distinguished from personal assessments, in order to ensure both the protection of individuals and the quality and reliability of the information processed by the competent authorities. (24) (…) The competent authorities should ensure that personal data which are inaccurate, incomplete or no longer up to date are not transmitted or made available. In order to ensure both the protection of individuals and the accuracy, completeness or up-to-datedness and reliability of the personal data transmitted or made available (…) the competent authorities should, as far as possible, add necessary information in all transmissions of personal data. (24) The competent authorities should ensure that personal data which are inaccurate, incomplete or no longer up to date are not transmitted or made available. In order to ensure both the protection of individuals and the accuracy, completeness or the extent to which the personal data are up to date and reliability of the personal data transmitted or made available the competent authorities should, as far as possible, add necessary information in all transmissions of personal data. (24a) Wherever this Directive refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, without prejudice to requirements pursuant the constitutional order of the (24a) Wherever this Directive refers to Member State law, a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, without prejudice to requirements pursuant to the constitutional order of the
arbitrariness. (24b) The processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties or the safeguarding against and the prevention of threats to public security should cover any or set of operations which is performed upon personal data or sets of personal data for those purposes, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, alignment or combination, restriction, erasure or destruction. In particular, the rules of this Directive should apply to the transmission of personal data for the purposes of this Directive to a recipient not subject to this Directive. Such recipient should mean a natural or legal person, public authority, agency or any other body, to which the data are lawfully disclosed by the competent authority. Where data were initially collected by a (24b) The processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security should cover any or set of operations which are performed upon personal data or sets of personal data for those purposes, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, alignment or combination, restriction, erasure or destruction. In particular, the rules of this Directive should apply to the transmission of personal data for the purposes of this Directive to a recipient not subject to this Directive. Such recipient should mean a natural or legal person, public authority, agency or any other body, to which the data are lawfully disclosed by the competent authority. Where data were initially collected by a competent authority for one of the
compatible use is to be interpreted restrictively. transfers the transmitting competent to recipients in third countries or international organisations. Member States should provide that authority does not apply such conditions to recipients in other Member States or to agencies, offices and bodies established pursuant to Chapters IV and V of Title V of the Treaty on the Functioning of the European Union other than those applicable to similar data transmissions within the Member State of the transmitting competent authority. to recipients in third countries or international organisations. Member States should provide that that authority does not apply such conditions to recipients in other Member States or to agencies, offices and bodies established pursuant to Chapters IV and V of Title V of the Treaty on the Functioning of the European Union other than those applicable to similar data transmissions within the Member State of the transmitting competent authority. Amendment 17 (25b) Personal data processed in breach of the national provisions adopted pursuant to this Directive should not be further processed. (…) Amendment 18 (26) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights or privacy, including genetic data, deserve specific protection. Such data should not be processed, unless processing is specifically authorised by a law which provides for suitable measures to safeguard the data subject's legitimate (26) Personal data which are, by their nature, particularly sensitive and vulnerable in relation to fundamental rights or privacy, including genetic data, deserve specific protection. Such data should not be processed, unless processing is specifically authorised by a necessary for the performance of a task carried out in the public (26) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights (…) and freedoms, (…), deserve specific protection as the context of their processing may create important risks for the fundamental rights and freedoms. These data should also include personal data revealing racial or ethnic origin, (26) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms, deserve specific protection as the context of their processing may create important risks for the fundamental rights and freedoms. These data should also include personal data revealing racial or ethnic origin, whereby the
and to the competent authorities from which the inaccurate data originated. The controllers should also abstain from further dissemination of such data. (36a) Where the controller denies a data subject his or her right of access, rectification, erasure or restriction of processing, the data subject should have the right to request that the national supervisory authority checks the lawfulness of the processing. The data subject should be informed of this right. When the supervisory authority intervenes on behalf of the data subject, the data subject should be informed by the supervisory authority at least that all necessary verifications or reviews by the supervisory authority have taken place. (36a) Where the controller denies a data subject his or her right to information, access, rectification, erasure or restriction of processing, the data subject should have the right to request that the national supervisory authority verifies the lawfulness of the processing. The data subject should be informed of this right. When the supervisory authority acts on behalf of the data subject, the data subject should be informed by the supervisory authority at least that all necessary verifications or reviews by the supervisory authority have taken place. The supervisory authority should also inform the data subject of the right to seek a judicial remedy. (36aa) Where the personal data are processed in the course of a criminal investigation and court proceedings in criminal matters, the exercise of the rights of information, access, rectification, (36aa) Where the personal data are processed in the course of a criminal investigation and court proceedings in criminal matters, the exercise of the rights to information, access, rectification, erasure and restriction
processing personal data in processing systems should have in place effective methods of demonstrating the lawfulness of the data processing, of enabling self-monitoring and of ensuring data integrity and data security, such as logs or other forms of records. Amendment 31 (40a) Every processing operation of personal data should be recorded in order to enable the verification of the lawfulness of the data processing, and ensuring proper data integrity and security. This record should be made available upon request to the supervisory authority for the purpose of monitoring compliance with the rules laid down in this Directive. (40a) Logs should be kept at least for operations in automated processing systems such as collection, alteration, consultation, disclosure, combination or erasure. The logs should be used for verification of the lawfulness of the data processing, self-monitoring and for ensuring data integrity and data security. This does not preclude the use of the logs in accordance with Member State law for operational matters in the course of criminal investigations and proceedings. (40a) Logs should be kept at least for operations in automated processing systems such as collection, alteration, consultation, disclosure including transfers, combination or erasure. The identification of the person who consulted or disclosed personal data should be logged and from this identification it could be possible to establish the justification of the processing operations. The logs should solely be used for the verification of the lawfulness of the data processing, self-monitoring, for ensuring data integrity and data security and criminal proceedings. Self-monitoring also includes internal disciplinary proceedings of competent authorities. Amendment 32
supervisory authority should be in a position to prevent, prior to the start of operations, a risky processing which is not in compliance with this Directive, and to make proposals to remedy such situation. Such consultation may equally take place in the course of the preparation either of a measure of the national parliament or of a measure based on such legislative measure which defines the nature of the processing and lays down appropriate safeguards. Amendment 34 (41a) In order to maintain security and to prevent processing in breach of this Directive, the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks. Those measures should ensure an appropriate level of security, taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected. When establishing technical standards and organisational measures to ensure security of (41a) In order to maintain security and to prevent processing in breach of this Directive, the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks, such as encryption. These measures should ensure an appropriate level of security including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risk and the nature of the personal data to be protected. In assessing data security risks, consideration should be given to the risks that are presented by data
unnecessarily hamper the investigation of the circumstances of a breach. investigation of the circumstances of a breach. the controller has taken subsequent measures which ensure that the high risk for the rights and freedoms of affected data subjects is no longer likely to materialise. respecting guidance provided by it or other relevant authorities. For example, the need to mitigate an immediate risk of damage would call for a prompt notification of data subjects, whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay. Where avoiding obstruction of official or legal inquiries, investigations or procedures, avoiding prejudice to the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, protecting public security, protecting national security or protecting the rights and freedoms of others cannot be achieved by delaying or restricting the communication of a personal data breach to the individual concerned, such communication could, in exceptional circumstances, be omitted. Amendment 36 (44) The controller or the processor should designate a person who would assist the controller or processor to monitor compliance with the provisions adopted (44) The controller or the processor should designate a person who would assist the controller or processor to monitor and demonstrate compliance with the provisions (44) (…) A person with expert knowledge of data protection law and practices may assist the controller or processor to monitor internal compliance with the (44) The controller should designate a person who would assist the controller to monitor internal compliance with the provisions adopted pursuant to this Directive,
to transfer the relevant personal data to the third country or international organisation concerned without such prior authorisation. Member States should provide that any specific conditions concerning the transfer should be communicated to third countries and/or international organisations. to transfer the relevant personal data to the third country or international organisation concerned without such a prior authorisation. Member States should provide that any specific conditions concerning the transfer should be communicated to third countries and/or international organisations. Onward transfers of personal data should be subject to the prior authorisation of the competent authority that carried out the original transfer. When deciding on a request for authorisation of an onward transfer, the competent authority that carried out the original transfer should take due account of all relevant factors, including the seriousness of the offence, the specific conditions attached and the purpose for which the data was originally transferred, the nature and conditions of the execution of the criminal penalty, and the level of personal data protection in the third country or an international organisation to which personal data are onward transferred. The competent authority that carried out the original transfer may also subject the onward transfer to specific conditions. Such specific
available to the supervisory authority on request in order to monitor the lawfulness of the transfer. (49b) Competent authorities of Member States are applying bilateral or multilateral international agreements in force, concluded with third countries in the field of judicial co-operation in criminal matters and police for the exchange of relevant information to allow them to perform their legally assigned tasks. In principle, this takes place through or at least with the cooperation of the competent authorities of the concerned third countries. However, in specific individual cases, it may occur that the procedures provided for by the international agreements applicable do not allow to exchange the relevant information in a timely manner, so that competent authorities of Member States have to transfer personal data directly to recipients established in third countries. This may be the case when criminal offences have been committed by means of electronic communication technology like (49b) Competent authorities of Member States are applying bilateral or multilateral international agreements in force, concluded with third countries in the field of judicial co-operation in criminal matters and police co-operation, for the exchange of relevant information to allow them to perform their legally assigned tasks. In principle, this takes place through, or at least with, the cooperation of the competent authorities of the concerned third countries, sometimes even in the absence of a bilateral or multilateral international agreement. However, in specific cases, it may occur that the regular procedures requiring contacting the competent authority in the third country would be ineffective or inappropriate, in particular, because the third State does not itself require prior authorisation or does not wish to be notified, or because the competent authority in the third country does not respect the rule of law or international human rights norms
taking into account the circumstances of each individual case, respect the right of every person to be heard before any individual measure which would affect him or her adversely is taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigative powers as regards access to premises should be exercised in accordance with specific requirements in national law, such as the requirement to obtain a prior judicial authorisation. The adoption of a legally binding decision should be subject to judicial review in the Member State of the supervisory authority that adopted the decision reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of ensuring compliance with this Directive, taking into account the circumstances of each individual case, respect the right of every person to be heard before any individual measure that would affect him or her adversely is taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigative powers as regards access to premises should be exercised in accordance with specific requirements in national law, such as the requirement to obtain a prior judicial authorisation. The adoption of a legally binding decision should be subject to judicial review in the Member State of the supervisory authority that adopted the decision. Amendment 46 (58) The supervisory authorities should assist one another in performing their duties and provide mutual assistance, so as to ensure the consistent application and enforcement of the provisions adopted pursuant to this Directive. (58) The supervisory authorities should assist one another in performing their duties and provide mutual assistance, so as to ensure the consistent application and enforcement of the provisions adopted pursuant to this Directive. (58) The supervisory authorities should assist one another in performing their tasks and provide mutual assistance, so as to ensure the consistent application and enforcement of the provisions adopted pursuant to this Directive. (58) The supervisory authorities should assist one another in performing their tasks and provide mutual assistance, so as to ensure the consistent application and enforcement of the provisions adopted pursuant to this Directive.
(66) In order to fulfil the objectives of this Directive, namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free exchange of personal data by competent authorities within the Union, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission. In particular, delegated acts should be adopted in respect of notifications of a personal data breach to the supervisory authority. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level. The Commission, when preparing and drawing-up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and Council (66) In order to fulfil the objectives of this Directive, namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free exchange of personal data by competent authorities within the Union, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission. In particular, delegated acts should be adopted in respect of notifications of to further specify the criteria and conditions for processing operations requiring a data protection impact assessment; the regards the adequate level of protection afforded by a third criteria and requirements of a personal data breach to the supervisory authority and as country, or a territory or a processing sector within that third country, or an international organisation. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, in particular with the European Data (66) deleted (…)
alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (3a) 'profiling' means any form of automated processing of personal data intended to evaluate certain personal aspects relating to a natural person or to analyse or predict in particular that natural person’s performance at work, economic situation, location, health, personal preferences, reliability or behaviour; (…) (4) 'restriction of processing' means the marking of stored personal data with the aim of limiting their processing in the future; (4) 'restriction of processing' means the marking of stored personal data with the aim of limiting their processing in the future; (4) 'restriction of processing' means the marking of stored personal data with the aim of limiting their processing in the future; (4) 'restriction of processing' means the marking of stored personal data with the aim of limiting their processing in the future; (4a) 'pseudonymisation' means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organisational measures to (4a) 'pseudonymisation' means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organisational measures to
(11) 'biometric data' means any data relating to the physical, physiological or behavioural characteristics of an individual which allow their unique identification, such as facial images, or dactyloscopic data; (11) 'biometric data' means any personal data relating to the physical, physiological or behavioural characteristics of an individual which allow his or her unique identification, such as facial images, or dactyloscopic data; (11) deleted (11) 'biometric data' means any personal data resulting from specific technical processing relating to the physical physiological or behavioural characteristics of an individual which allows or confirms the unique identification of that individual, such as facial images, or dactyloscopic data; (12) ‘data concerning health’ means any information which relates to the physical or mental health of an individual, or to the provision of health services to the individual; (12) ‘data concerning health’ means any information personal data which relate to the physical or mental health of an individual, or to the provision of health services to the individual; (12) 'data concerning health’ means (…) data related to the physical or mental health of an individual, (…) which reveal information about his or her health status; (12) 'data concerning health’ means data related to the physical or mental health of an individual, including the provision of health care services, which reveal information about his or her health status; (12a) 'profiling' means any form of automated processing of personal data consisting of using those data to evaluate personal aspects relating to an natural person, in particular to analyse and predict aspects concerning performance at work, economic situation, health, personal preferences, or interests, reliability or behaviour, location or movements; (12a) 'profiling' means any form of automated processing of personal data consisting of using those data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. (13) 'child' means any person (13) 'child' means any person below (13) deleted (…)
organisational measures. (fc) processed by only those duly authorised staff of the competent authorities who need them for the performance of their tasks. (…) 2. Processing by the same or another controller for other purposes set out in Article 1 (1) than the one for which the data are collected shall be permitted in so far as: 2. Processing by the same or another controller for other purposes set out in Article 1 (1) than the one for which the data are collected shall be permitted in so far as: (a) the controller is authorised to process such personal data for such purpose in accordance with the applicable legal provisions; and (b) processing is necessary and proportionate to that other purpose. (a) the controller is authorised to process such personal data for such a purpose in accordance with Union or Member State law; and (b) processing is necessary and proportionate to that other purpose in accordance with Union or Member State law. 3. Processing by the same or another controller may include archiving in the public interest, scientific, statistical or historical use for the purposes set out in Article 1 (1), subject to appropriate safeguards for the rights and freedoms of data subjects. 3. Processing by the same or another controller may include archiving in the public interest, scientific, statistical or historical use for the purposes set out in Article 1 (1), subject to appropriate safeguards for the rights and freedoms of data subjects.
(a) the objectives of the processing; (…) (b) the personal data to be processed; (…) (c) the specific purposes and means of processing; (…) (d) the appointment of the controller, or of the specific criteria for the appointment of the controller; (…) (e) the categories of duly authorised staff of the competent authorities for the processing of personal data; (…) (f) the procedure to be followed for the processing; (…) (g) the use that may be made of the personal data obtained; (…) (h) limitations on the scope of any discretion conferred on the competent authorities in relation to the processing activities. (…) Article 7a (new) (…) Further processing for incompatible purposes (…)
or historical use, unless the processing is carried out in an activity which falls outside the scope of Union law. scientific, statistical or historical use, unless the processing is carried out in an activity which falls outside the scope of Union law. 1b. Member States shall provide that where Union law or the national law applicable to the transmitting competent authority provides specific conditions to the processing of personal data, the transmitting competent authority shall inform the recipient to whom the data are transmitted about such conditions and the requirement to respect them. 1b. Member States shall provide that where Union or Member State law applicable to the transmitting competent authority provides specific conditions for the processing of personal data, the transmitting competent authority shall inform the recipient to whom the data are transmitted about such conditions and the requirement to respect them. 2. Member States shall provide that the transmitting competent authority does not apply conditions pursuant to paragraph 1b to recipients in other Member States or to agencies, offices and bodies established pursuant to Chapters IV and V of Title V of the Treaty on the Functioning of the European Union other than those applicable to similar transmissions of data within the Member State of the transmitting competent authority. 2. Member States shall provide that the transmitting competent authority does not apply conditions pursuant to paragraph 1b to recipients in other Member States or to agencies, offices and bodies established pursuant to Chapters IV and V of Title V of the Treaty on the Functioning of the European Union other than those applicable to similar transmissions of data within the Member State of the transmitting competent authority. Article 8 Article 8 Article 8 Article 8 Processing of special categories of personal data Processing of special categories of personal data Processing of special categories of personal data Processing of special categories of personal data
national law; or (b) the processing is necessary to protect the vital interests of the data subject or of another person; or (b) the processing is necessary to protect the vital interests of the data subject or of another person; or (b) (…) to protect the vital interests of the data subject or of another person; or (b) to protect the vital interests of the data subject or of another person; or (c) the processing relates to data which are manifestly made public by the data subject. (c) the processing relates to data which are manifestly made public by the data subject, provided that they are relevant and strictly necessary for the purpose pursued in a specific case. (c) the processing relates to data which are manifestly made public by the data subject. (c) the processing relates to data which are manifestly made public by the data subject. Amendment 70 Article 8a (new) (…) Processing of genetic data for the purpose of a criminal investigation or a judicial procedure (…) 1. Member States shall ensure that genetic data may only be used to establish a genetic link within the framework of adducing evidence, preventing a threat to public security or preventing the commission of a specific criminal offence. Genetic data may not be used to determine other characteristics which may be linked genetically. (…) 2. Member States shall provide that (…)
data subject shall be prohibited unless authorised by a law which also lays down measures to safeguard the data subject’s legitimate interests. the data subject shall be prohibited unless authorised by a law which also lays down measures to safeguard the data subject’s legitimate interests. Member State law to which the controller is subject and which provides appropriate safeguards for the rights and freedoms of the data subject, at least the right to obtain human intervention on the part of the controller. State law to which the controller is subject and which provides appropriate safeguards for the rights and freedoms of the data subject, at least the right to obtain human intervention on the part of the controller. 2. Automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall not be based solely on special categories of personal data referred to in Article 8. 2. Automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall not be based solely on special categories of personal data referred to in Article 8. 2. deleted 2. Decisions referred to in paragraph 1 shall not be based on special categories of personal data referred to in Article 8, unless suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place. 2a. Automated processing of personal data intended to single out a data subject without an initial suspicion that the data subject might have committed or will be committing a criminal offence shall only be lawful if and to the extent that it is strictly necessary for the investigation of a serious criminal offence or the prevention of a clear and imminent danger, established on factual indications, to public security, the existence of the State, or the life of persons. (…) 2b. Profiling that, whether intentionally or otherwise, has the 2b. Profiling that results in discrimination against individuals
effect of discriminating against individuals on the basis of race or ethnic origin, political opinions, religion or beliefs, trade union membership, gender or sexual orientation, or that, whether intentionally or otherwise, results in measures which have such effect, shall be prohibited in all cases. on the basis of special categories of personal data referred to in Article 8 shall be prohibited, in accordance with Union law. Amendment 72 Article 9a (…) General principles for the rights of the data subject (…) 1. Member States shall ensure that the basis of data protection is clear and with unambiguous rights for the data subject which shall be respected by the data controller. The provisions of this Directive aim to strengthen, clarify, guarantee and where appropriate, codify those rights. (…) 2. Member States shall ensure that such rights include, inter alia, the provision of clear and easily understandable information regarding the processing of the data subject’s personal data, the right of access, rectification and (…)
refusal and on the possibilities of lodging a complaint to the supervisory authority and seeking a judicial remedy. The information on factual or legal reasons on which the decision is based may be omitted where the provision of such information would undermine a purpose under paragraph 1. reasoned justification for the refusal and on the possibilities of lodging a complaint with the supervisory authority and seeking a judicial remedy. The information on factual or legal reasons on which the decision is based may be omitted where the provision of such information would undermine a purpose under paragraph 1. restriction. This shall not apply where the provision of such information would undermine a purpose under paragraph 1. Member States shall provide that the controller informs the data subject of the possibilities of lodging a complaint with a supervisory authority or seeking a judicial remedy. reasons for the refusal or the restriction. This information may be omitted where the provision of such information would undermine a purpose under paragraph 1. Member States shall provide that the controller informs the data subject of the possibilities of lodging a complaint with a supervisory authority or seeking a judicial remedy. 4. Member States shall ensure that the controller documents the grounds for omitting the communication of the factual or legal reasons on which the decision is based. 4. Member States shall ensure that the controller documents the assessment referred to in paragraph 2 as well as the grounds for omitting restricting the communication of the factual or legal reasons on which the decision is based. That information shall be made available to the national supervisory authorities. 4. Member States shall ensure that the controller documents (…) the factual or legal reasons on which the decision is based. 4. Member States shall ensure that the controller documents the factual or legal reasons on which the decision is based. That information shall be made available to the supervisory authorities. Article 14 Article 14 Article 14 (…) Modalities for exercising the right of access Modalities for exercising the right of access Additional modalities for exercising the right of access (…) Amendment 77 1. Member States shall provide for the right of the data subject to request, in particular in cases referred to in Article 13, that the supervisory authority checks the lawfulness of the processing. 1. Member States shall provide for the right of the data subject to request, at all times, in particular in cases referred to in Article 13Articles 12 and 13, that the supervisory authority checks the 1. deleted (…)
in paragraphs 1a and 2 for enlisting another processor (a) act only on instructions from the controller; (…) (b) employ only staff who have agreed to be bound by an obligation of confidentiality or are under a statutory obligation of confidentiality; (…) (c) take all required measures pursuant to Article 27; (…) (d) engage another processor only with the permission of the controller and therefore inform the controller of the intention to engage another processor in such a timely fashion that the controller has the possibility to object; (…) (e) insofar as it is possible given the nature of the processing, adopt in agreement with controller the necessary technical and organisational requirements for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III; (…)
subject to prior consultation pursuant to point (b) of paragraph 1. 2a. Member States shall provide that the controller or processor shall provide the supervisory authority with the data protection impact assessment pursuant to Article 25a and, on request, with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards. 2a. Member States shall provide that the controller shall provide the supervisory authority with the data protection impact assessment pursuant to Article 25a and, on request, with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards. 2b. If the supervisory authority is of the opinion that the intended processing does not comply with the provisions adopted pursuant to this Directive or that the risks are insufficiently identified or mitigated, it shall make appropriate proposals to remedy such (…) 2c. Member States may consult the supervisory authority in the preparation of a legislative measure to be adopted by the national parliament or of a measure based on such a legislative measure, (…)
SECTION 2 DATA SECURITY SECTION 2 DATA SECURITY SECTION 2 DATA SECURITY SECTION 2 DATA SECURITY Article 27 Article 27 Article 27 Article 27 Security of processing Security of processing Security of processing Security of processing Amendment 90 1. Member States shall provide that the controller and the processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected, having regard to the state of the art and the cost of their implementation. 1. Member States shall provide that the controller and the processor implementsimplement appropriate technical and organisational measures and procedures to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected, having regard to the state of the art and the cost of their implementation. 1. Having regard to available technology and the costs of implementation and taking into account the nature, scope, context and purposes of the processing as well as the likelihood and severity of the risk for the rights and freedoms of individuals, Member States shall provide that the controller and the processor implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (…). 1. Member States shall provide that, having regard to the state of the art and the costs of implementation and taking into account the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of individuals, the controller and the processor shall implement appropriate technical and organisational measures, to ensure a level of security appropriate to the risk, in particular as regards the processing of special categories of data referred to in Article 8. 2. In respect of automated data processing, each Member State shall provide that the controller or processor, following an evaluation of the risks, implements measures designed to: 2. In respect of automated data processing, each Member State shall provide that the controller or processor, following an evaluation of the risks, implements measures designed to: 2. In respect of automated data processing, each Member State shall provide that the controller or processor, following an evaluation of the risks, implements measures designed to: 2. In respect of automated data processing, each Member State shall provide that the controller or processor, following an evaluation of the risks, implements measures designed to: (a) deny unauthorised persons (a) deny unauthorised persons access (a) deny unauthorised persons (a) deny unauthorised persons
personal data processing according to Article 8, additional security measures have to be in place, in order to guarantee situation awareness of risks and the ability to take preventive, corrective and mitigating action in near real time against vulnerabilities or incidents detected that could pose a risk to the data. 2a. Member States shall provide that processors may be appointed only if they guarantee that they observe the requisite technical and organisational measures under paragraph 1 and comply with the instructions under point (a) of Article 21(2). The competent authority shall monitor the processor in those respects. (…) 3. The Commission may adopt, where necessary, implementing acts for specifying the requirements laid down in paragraphs 1 and 2 to various situations, notably encryption standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 57(2). 3. The Commission may adopt, where necessary, implementing acts for specifying the requirements laid down in paragraphs 1 and 2 to various situations, notably encryption standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 57(2). 3. deleted (…) Article 28 Article 28 Article 28 Article 28
3. The notification referred to in paragraph 1 shall at least: 3. The notification referred to in paragraph 1 shall at least: 3. The notification referred to in paragraph 1 shall at least: 3. The notification referred to in paragraph 1 shall at least: (a) describe the nature of the personal data breach including the categories and number of data subjects concerned and the categories and number of data records concerned; (a) describe the nature of the personal data breach including the categories and number of data subjects concerned and the categories and number of data records concerned; (a) describe the nature of the personal data breach (…); (a) describe the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of data records concerned; (b) communicate the identity and contact details of the data protection officer referred to in Article 30 or other contact point where more information can be obtained; (b) communicate the identity and contact details of the data protection officer referred to in Article 30 or other contact point where more information can be obtained; (b) communicate the identity and contact details of the data protection officer (…) or other contact point where more information can be obtained; (b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; (c) recommend measures to mitigate the possible adverse effects of the personal data breach; (c) recommend measures to mitigate the possible adverse effects of the personal data breach; (c) deleted (…) (d) describe the possible consequences of the personal data breach; (d) describe the possible consequences of the personal data breach; (d) describe the likely consequences of the personal data breach identified by the controller, (d) describe the likely consequences of the personal data breach; (e) describe the measures proposed or taken by the controller to address the personal data breach. (e) describe the measures proposed or taken by the controller to address the personal data breach and mitigate its effects. (e) describe the measures taken or proposed to be taken by the controller to address the personal data breach; and (e) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, to mitigate its possible adverse effects.
(a) to inform and advise the controller or the processor of their obligations in accordance with the provisions adopted pursuant to this Directive and to document this activity and the responses received; (a) to raise awareness, to inform and advise the controller or the processor of their obligations in accordance with the provisions adopted pursuant to this Directive, in particular with regard to technical and organisational measures and procedures, and to document this activity and the responses received; (a) to inform and advise the controller or the processor of their obligations in accordance with the provisions adopted pursuant to this Directive and other Union or Member State data protection provisions (…); (a) to inform and advise the controller and the employees who are processing personal data of their obligations pursuant to this Directive and to other Union or Member State data protection provisions; (b) to monitor the implementation and application of the policies in relation to the protection of personal data, including the assignment of responsibilities, the training of staff involved in the processing operations and the related audits; (b) to monitor the implementation and application of the policies in relation to the protection of personal data, including the assignment of responsibilities, the training of staff involved in the processing operations and the related audits; (b) to monitor compliance with provisions adopted pursuant to this Directive, with other Union or Member State data protection provisions and with (…) the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in the processing operations and the related audits; (b) to monitor compliance with this Directive, with other Union or Member State data protection provisions and with the policies of the controller in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in the processing operations, and the related audits; (c) to monitor the implementation and application of the provisions adopted pursuant to this Directive, in particular as to the requirements related to data protection by design, data protection by default and data security and to the information of data subjects and their requests in (c) to monitor the implementation and application of the provisions adopted pursuant to this Directive, in particular as to the requirements related to data protection by design, data protection by default and data security and to the information of data subjects and their requests in (c) deleted (…)
exercising their rights under the provisions adopted pursuant to this Directive; exercising their rights under the provisions adopted pursuant to this Directive; (d) to ensure that the documentation referred to in Article 23 is maintained; (d) to ensure that the documentation referred to in Article 23 is maintained; (d) deleted (…) (e) to monitor the documentation, notification and communication of personal data breaches pursuant to Articles 28 and 29; (e) to monitor the documentation, notification and communication of personal data breaches pursuant to Articles 28 and 29; (e) deleted (…) (f) to monitor the application for prior consultation to the supervisory authority, if required pursuant to Article 26; (f) to monitor the application of the data protection impact assessment by the controller or processor and the application for prior consultation to the supervisory authority, if required pursuant to Article 26(1) ; (f) deleted (f) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 25a; (g) to monitor the response to requests from the supervisory authority, and, within the sphere of the data protection officer's competence, co-operating with the supervisory authority at the latter's request or on his own initiative; (g) to monitor the response to requests from the supervisory authority, and, within the sphere of the data protection officer's competence, co-operating with the supervisory authority at the latter's request or on his own initiative; (g) to monitor the responses to requests from the supervisory authority, and, within the sphere of the data protection officer's competence, to co-operate with the supervisory authority at the latter's request or on the data protection officer's own initiative; (g) to cooperate with the supervisory authority; (h) to act as the contact point for the supervisory authority on issues (h) to act as the contact point for the supervisory authority on issues related to the processing and consult (h) to act as the contact point for the supervisory authority on issues related to the processing of (h) to act as the contact point for the supervisory authority on issues related to the processing of
related to the processing and consult with the supervisory authority, if appropriate, on the data protection officer's own initiative; with the supervisory authority, if appropriate, on the data protection officer's own initiative. personal data, including the prior consultation referred to in Article 26, and consult, (…) as appropriate, on any other matter. personal data, including the prior consultation referred to in Article 26, and consult, as appropriate, on any other matter.
CHAPTER V TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS CHAPTER V TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS CHAPTER V TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS CHAPTER V TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS Article 33 Article 33 Article 33 Article 33 General principles for transfers of personal data General principles for transfers of personal data General principles for transfers of personal data General principles for transfers of personal data Amendment 96 Member States shall provide that any transfer of personal data by competent authorities that is undergoing processing or is intended for processing after transfer to a third country, or to an international organisation, including further onward transfer to another third country or international organisation, may take place only if: Member States shall provide that any transfer of personal data by competent authorities that are undergoing processing or are intended for processing after transfer to a third country, or to an international organisation, including further onward transfer to another third country or international organisation, may take place only if: 1. Member States shall provide that any transfer of personal data by competent authorities (…) to a third country, or to an international organisation, including further onward transfer to another third country or international organisation, may take place only if: 1. Member States shall provide that any transfer by competent authorities of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation including for onward transfers to another third country or international organisation, may only take place, subject to compliance with the national provisions adopted pursuant to other provisions of this Directive, if the conditions laid down in this Chapter are complied with, namely: (a) the transfer is necessary for the prevention, investigation, detection or prosecution of criminal offences (a) the specific transfer is necessary for the prevention, investigation, detection or prosecution of criminal (a) the transfer is necessary for the purposes set out in Article 1 (1); and, (a) the transfer is necessary for the purposes set out in Article 1 (1); and,
(b) the controller or processor has assessed all the circumstances surrounding the transfer of personal data and concludes that appropriate safeguards exist with respect to the protection of personal data. deleted (b) the controller (…) has assessed all the circumstances surrounding the transfer of personal data and concludes that appropriate safeguards exist with respect to the protection of personal data. Such an assessment may take into account the existing cooperation agreements between Europol and/or Eurojust and third countries which allow for the exchange of personal data. (b) the controller has assessed all the circumstances surrounding the transfer of personal data and concludes that appropriate safeguards exist with respect to the protection of personal data. 1a. The controller shall inform the supervisory authority about categories of transfers under point (b) of paragraph (1). 2. The decision for transfers under paragraph 1 (b) must be made by duly authorised staff. These transfers must be documented and the documentation must be made available to the supervisory authority on request. 2.The decision for transfers under paragraph 1 (b) must be made by duly authorised staff. Those transfers must be documented and the documentation must be made available to the supervisory authority on request authorised by the supervisory authority prior to the transfer. deleted 2. When a transfer is based on point (b) of paragraph 1, such a transfer must be documented and the documentation must be made available to the supervisory authority on request, including the date and time of the transfer, information about the receiving competent authority, the justification for the transfer and the data transferred. Article 36 Article 36 Article 36 Article 36 Derogations Derogations Derogations for specific situations Derogations for specific situations Amendment 99
international organisations, the Commission and Member States shall take appropriate steps to: international organisations, the Commission and Member States shall take appropriate steps to: international organisations, the Commission and Member States shall take appropriate steps to: (a) develop effective international co-operation mechanisms to facilitate the enforcement of legislation for the protection of personal data; (a) develop effective international co-operation mechanisms to facilitateensure the enforcement of legislation for the protection of personal data; deleted (a) develop international mechanisms to facilitate the effective enforcement of legislation for the protection of personal data; (b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and information exchange, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms; (b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and information exchange, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms; deleted (b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and information exchange, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms; (c) engage relevant stakeholders in discussion and activities aimed at furthering international in the enforcement of legislation for the protection of personal data; (c) engage relevant stakeholders in discussion and activities aimed at furthering international in the enforcement of legislation for the protection of personal data; deleted (c) engage relevant stakeholders in discussion and activities aimed at furthering international in the enforcement of legislation for the protection of personal data; (d) promote the exchange and documentation of personal data protection legislation and practice. (d) promote the exchange and documentation of personal data protection legislation and practice.; deleted (d) promote the exchange and documentation of personal data protection legislation and practice, including on jurisdictional conflicts
Duties Duties Tasks Tasks Amendment 108 1. Member States shall provide that the supervisory authority: 1. Member States shall provide that the supervisory authority: 1. Member States shall provide that each supervisory authority shall on its territory: 1. Member States shall provide that each supervisory authority shall on its territory: (a) monitors and ensures the application of the provisions adopted pursuant to this Directive and its implementing measures; (a) monitors and ensures the application of the provisions adopted pursuant to this Directive and its implementing measures; (a) monitor and (…) enforce the application of the provisions adopted pursuant to this Directive and its implementing measures; (a) monitor and enforce the application of the provisions adopted pursuant to this Directive and its implementing measures; (aa) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to the processing of personal data; (aa) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to the processing of personal data; (ab) advise, in accordance with national law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of data subjects’ rights and freedoms with regard to the processing of personal data; (ab) advise, in accordance with national law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data; (ac) promote the awareness of controllers and processors of their obligations under the provisions adopted pursuant to this Directive; (ac) promote the awareness of controllers and processors of their obligations under this Directive;
or of one of its members, any question covering the application of the provisions adopted pursuant to this Directive and issue guidelines, recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of those provisions; Parliament or the Council or on its own initiative or of one of its members, any question covering the application of the provisions adopted pursuant to this Directive and issue guidelines, recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of those provisions, including on the use of enforcement powers; on request of the Commission, any question covering the application of the provisions adopted pursuant to this Directive and issue guidelines, recommendations and best practices (…) in order to encourage consistent application of those provisions; on request of the Commission, any question covering the application of this Directive and issue guidelines, recommendations and best practices in order to encourage consistent application of this Directive; (ba) draw up guidelines for supervisory authorities concerning the application of measures referred to in paragraph 1 and 1b of Article 46; (ba) draw up guidelines for supervisory authorities concerning the application of measures referred to in paragraph 1 and 1b of Article 46; (bb) issue guidelines, recommendations and best practices in accordance with point (b) for establishing the data breaches and determining the undue delay referred to in paragraphs 1 and 2 of Article 28 and for the particular circumstances in which a controller or a processor is required to notify the personal data breach; (bc) issue guidelines, recommendations and best practices in accordance with point (b) as to
transmission. transmission. (1b) Member States shall provide that the supervisory authority with which the complaint has been lodged provides further assistance upon the request of the data subject. (1b) Member States shall provide that the supervisory authority with which the complaint has been lodged provides further assistance upon request of the data subject. 2. Member States shall provide for the right of any body, organisation or association which aims to protect data subjects’ rights and interests concerning the protection of their personal data and is being properly constituted according to the law of a Member State to lodge a complaint with a supervisory authority in any Member State on behalf of one or more data subjects, if it considers that a data subject’s rights under this Directive have been infringed as a result of the processing of personal data. The organisation or association must be duly mandated by the data subject(s). 2. Member States shall provide for the right of any body, organisation or association acting in the public interest which aims to protect data subjects’ rights and interests concerning the protection of their personal data and is being which has been properly constituted according to the law of a Member State to lodge a complaint with a supervisory authority in any Member State on behalf of one or more data subjects, if it considers that a data subject’s rights under this Directive have been infringed as a result of the processing of personal data. The organisation or association must be duly mandated by the data subject(s). 2. Moved to Article 53. (…) (2a) The data subject shall be informed by the competent supervisory authority of the progress and the outcome of the complaint including the possibility (2a) The data subject shall be informed by the competent supervisory authority of the progress and the outcome of the complaint, including of the
adopted pursuant to this Directive shall have the right to receive compensation from the controller or the processor for the damage suffered. incompatible with the provisions adopted pursuant to this Directive shall have the right to receive claim compensation from the controller or the processor for the damage suffered. provisions adopted pursuant to this Directive shall be entitled to receive compensation for the damage suffered from the controller or any other authority competent under national law. incompatible with the national provisions adopted pursuant to this Directive shall have the right to receive compensation for the damage suffered from the controller or any other authority competent under national law. 2. Where more than one controller or processor is involved in the processing, each controller or processor shall be jointly and severally liable for the entire amount of the damage. 2. Where more than one controller or processor is involved in the processing, each controller or processor shall be jointly and severally liable for the entire amount of the damage. 2. deleted (…) 3. The controller or the processor may be exempted from this liability, in whole or in part, if the controller or processor proves that they are not responsible for the event giving rise to the damage. 3. The controller or the processor may be exempted from this liability, in whole or in part, if the controller or processor proves that he or she is not responsible for the event giving rise to the damage. 3. deleted (…) Article 55 Article 55 Article 55 Article 55 Penalties Penalties Penalties Penalties Member States shall lay down the rules on penalties, applicable to infringements of the provisions adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for must be effective, proportionate and dissuasive. Member States shall lay down the rules on penalties, applicable to infringements of the provisions adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for must be effective, proportionate and dissuasive. Member States shall lay down the rules on penalties, applicable to infringements of the provisions adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for must be effective, proportionate and dissuasive. Member States shall lay down the rules on penalties, applicable to infringements of the provisions adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for must be effective, proportionate and dissuasive.
When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made. When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made. When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made. When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made. 1a. By way of derogation from paragraph 1, Member States may provide that exceptionally, where it involves disproportionate effort, the automated processing systems set up before the date of entry into force of this Directive shall be brought into conformity with Article 24 (1) within 7 years of the date of entry into force of this Directive. 1b. In exceptional circumstances, a Member State may bring a particular automated processing system set up before the date of entry into force of this Directive into conformity with Article 24(1) within a specified period after the period referred to in paragraph 1a, if it would otherwise cause serious difficulties for the of that particular automated processing system. It shall notify the