BETA

38 Amendments of Sophia IN 'T VELD related to 2022/0047(COD)

Sophia IN 'T VELD

Proposal for a regulation
Article 1 – paragraph 3

3. Union law on the protection of personal data, privacy and confidentiality of communications and integrity of terminal equipment shall apply to any personal data processed in connection with the rights and obligations laid down in this Regulation. This Regulation ~~shall not affect the applicability of~~is without prejudice to Union law on the protection of personal data or privacy, in particular Regulation (EU) 2016/679, Regulation (EU) 2018/1725 and Directive 2002/58/EC, including the powers and competences of supervisory authorities. In the event of a conflict between this Regulation and Union law on the protection of personal data or privacy or national law adopted in accordance with such Union law, the relevant Union or national law on the protection of personal data or privacy shall prevail. Insofar as the rights laid down in Chapter II of this Regulation are concerned, and where users are the data subjects of personal data subject to the rights and obligations under that Chapter, the provisions of this Regulation shall complement the right of data portability under Article 20 of Regulation (EU) 2016/679. This Regulation does not create a legal basis for the processing of personal data, nor does it affect any of the rights and obligations set out in Regulations (EU) 2016/679 or (EU) 2018/1725 or Directives 2002/58/EC or (EU) 2016/680.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 1 – paragraph 3 a (new)

3 a. In the case of a data set composed of both personal and non-personal data, especially when they are inextricably linked, the obligations of Regulation (EU) 2016/679 for controllers and processors shall apply.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 2 – paragraph 1 – point 1 a (new)

(1 a) ‘personal data’ means personal data as defined in Article 4, point (1), of Regulation (EU) 2016/679;

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 2 – paragraph 1 – point 1 b (new)

(1 b) ‘non-personal data’ means data other than personal data;

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 2 – paragraph 1 – point 1 c (new)

(1 c) ‘consent’ means consent as defined in Article 4, point (11), of Regulation (EU) 2016/679;

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 2 – paragraph 1 – point 1 d (new)

(1 d) ‘data subject’ means data subject as referred to in Article 4, point (1), of Regulation (EU) 2016/679;

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 2 – paragraph 1 – point 2

(2) ‘product’ means a tangible, movable item, including where incorporated in an immovable item, that obtains, generates or collects, data concerning its use or environment, and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data, with the exception of personal computers, servers, tablets and smart phones, cameras, webcams, sound recording systems and text scanners;

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 2 – paragraph 1 – point 5

(5) ‘user’ means a natural or legal person that owns, rents or leases a product or receives a services, and the data subject;

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 3 – paragraph 1

1. Products shall be designed and manufactured, and related services shall be provided, in such a manner that data generated by their use are, by default, easily, securely and, where relevant and appropriate, directly accessible to the user. Data subjects shall be offered the possibility to use the products covered by this Regulation anonymously.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

5. Where the user is not a data subject, any personal data generated by the use of a product or related service shall only be made available by the data holder to the user where there is a valid legal basis under Article 6~~(1)~~ of Regulation (EU) 2016/679 and, where relevant, the conditions of Article 9 of Regulation (EU) 2016/679 and Article 5(3) of Directive 2002/58/EC are fulfilled.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 5 – paragraph 6

6. Where the user is not a data subject, any personal data generated by the use of a product or related service shall only be made available by the data holder to the third party where there is a valid legal basis under Article 6(1) of Regulation (EU) 2016/679 and where relevant, the conditions of Article 9 of Regulation (EU) 2016/679 and Article 5(3) of Directive 2002/58/EC are fulfilled.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 5 – paragraph 9

9. The right referred to in paragraph 1 shall not adversely affect data ~~protection~~subject rights of others pursuant to applicable data protection legislation.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 6 – paragraph 1

1. A third party shall process the data made available to it pursuant to Article 5 only for the purposes and under the conditions agreed with the user, and where all conditions and rules provided by data protection legislation are complied with, notably where there is a valid legal basis under Article 6 and where relevant, the conditions of Article 9 of the GDPR and Article 5(3) of ePrivacy Directive are fulfilled and subject to the rights of the data subject insofar as personal data are concerned, and shall delete the data when they are no longer necessary for the agreed purpose.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 6 – paragraph 2 – point a

(a) coerce, deceive or manipulate the user or data subject in any way, by subverting or impairing the autonomy, decision-making or choices of the user or data subject, including by means of a digital interface with the user or data subject;

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 6 – paragraph 2 – point b

(b) use the data it receives for the profiling of natural persons within the meaning of Article 4(4) of Regulation (EU) 2016/679~~, unless it is necessary to provide the service requested by the user~~;

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 8 – paragraph 3

3. A data holder shall not discriminate between comparable categories of data recipients, including partner enterprises or linked enterprises, as defined in Article 3 of the Annex to Recommendation 2003/361/EC, of the data holder, when making data available. Where a data recipient considers the conditions under which data has been made available to it to be discriminatory, it shall be for the data holder to demonstrate that there has been no discrimination. These obligations are without prejudice to Regulation (EU) 2016/679.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 9 – paragraph 1

1. Any compensation agreed between a data holder and a data recipient for ~~making~~the costs incurred and investment required for making non-personal data available shall be reasonable.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 9 – paragraph 2

2. Where the data recipient is a micro, small or medium enterprise, as defined in Article 2 of the Annex to Recommendation 2003/361/EC, any compensation agreed shall not exceed the costs directly related to making the non-personal data available to the data recipient and which are attributable to the request. Article 8(3) shall apply accordingly.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 10 – paragraph 1

1. Data holders and data recipients shall have access to dispute settlement bodies, certified in accordance with paragraph 2 of this Article, to settle disputes in relation to the determination of fair, reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with Articles 8 and 9. This is without prejudice to the data subject’s rights and controllers’ processor obligations, including the data subject's right to seek redress before a supervisory authority, established under Regulation (EU) 2016/679.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 11 – paragraph 2 – introductory part

2. A data recipient that has, for the purposes of obtaining data, provided inaccurate or false information to the data holder, deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect the data, has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation or in the case of personal data, an appropriate legal basis under Regulation (EU) 2016/679, shall without undue delay, unless the data holder or the user instruct otherwise:

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 11 – paragraph 2 – point a

(a) destroy the data made available by the data holder and any copies thereof, without prejudice to to the data subject’s right to restriction of processing under Article 18 of Regulation (EU) 2016/679;

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 12 – paragraph 2

2. Any contractual term in a data sharing agreement which, to the detriment of one party, or, where applicable, to the detriment of the user, excludes the application of this Chapter, derogates from it, or varies its effect, shall not be binding on that party. Any contractual term in a data sharing agreement between data holders and data recipients which, to the detriment of the data subjects, undermines the application of their rights to privacy and data protection, derogates from it, or varies its effect, shall not be binding on that party.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 14

Obligation to make data available based 1. Upon request, a data holder shall make data available to a public sector body or to a Union institution, agency or body demonstrating an exceptional need to use the data requested. 2. This Chapter shall not apply to small and micro enterprises as defined in Article 2 of the Annex to Recommendation 2003/361/EC.Article 14 deleted on exceptional need

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 15

Exceptional need to use data An exceptional need to use data within the meaning of this Chapter shall be deemed to exist in any of the following circumstances: (a) where the data requested is necessary to respond to a public emergency; (b) where the data request is limited in time and scope and necessary to prevent a public emergency or to assist the recovery from a public emergency; (c) where the lack of available data prevents the public sector body or Union institution, agency or body from fulfilling a specific task in the public interest that has been explicitly provided by law; and (1) the public sector body or Union institution, agency or body has been unable to obtain such data by alternative means, including by purchasing the data on the market at market rates or by relying on existing obligations to make data available, and the adoption of new legislative measures cannot ensure the timely availability of the data; or (2) obtaining the data in line with the procedure laid down in this Chapter would substantively reduce the administrative burden for data holders or other enterprises.Article 15 deleted

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 16

Relationship with other obligations to make data available to public sector bodies and Union institutions, agencies 1. This Chapter shall not affect obligations laid down in Union or national law for the purposes of reporting, complying with information requests or demonstrating or verifying compliance with legal obligations. 2. The rights from this Chapter shall not be exercised by public sector bodies and Union institutions, agencies and bodies in order to carry out activities for the prevention, investigation, detection or prosecution of criminal or administrative offences or the execution of criminal penalties, or for customs or taxation administration. This Chapter does not affect the applicable Union and national law on the prevention, investigation, detection or prosecution of criminal or administrative offences or the execution of criminal or administrative penalties, or for customs or taxation administration.Article 16 deleted and bodies

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 17

Requests for data to be made available 1. Where requesting data pursuant to Article 14(1), a public sector body or a Union institution, agency or body shall: (a) specify what data are required; (b) demonstrate the exceptional need for which the data are requested; (c) explain the purpose of the request, the intended use of the data requested, and the duration of that use; (d) state the legal basis for requesting the data; (e) specify the deadline by which the data are to be made available or within which the data holder may request the public sector body, Union institution, agency or body to modify or withdraw the request. 2. A request for data made pursuant to paragraph 1 of this Article shall: (a) be expressed in clear, concise and plain language understandable to the data holder; (b) be proportionate to the exceptional need, in terms of the granularity and volume of the data requested and frequency of access of the data requested; (c) respect the legitimate aims of the data holder, taking into account the protection of trade secrets and the cost and effort required to make the data available; (d) concern, insofar as possible, non- personal data; (e) inform the data holder of the penalties that shall be imposed pursuant to Article 33 by a competent authority referred to in Article 31 in the event of non-compliance with the request; (f) be made publicly available online without undue delay. 3. A public sector body or a Union institution, agency or body shall not make data obtained pursuant to this Chapter available for reuse within the meaning of Directive (EU) 2019/1024. Directive (EU) 2019/1024 shall not apply to the data held by public sector bodies obtained pursuant to this Chapter. 4. Paragraph 3 does not preclude a public sector body or a Union institution, agency or body to exchange data obtained pursuant to this Chapter with another public sector body, Union institution, agency or body, in view of completing the tasks in Article 15 or to make the data available to a third party in cases where it has outsourced, by means of a publicly available agreement, technical inspections or other functions to this third party. The obligations on public sector bodies, Union institutions, agencies or bodies pursuant to Article 19 apply. Where a public sector body or a Union institution, agency or body transmits or makes data available under this paragraph, it shall notify the data holder from whom the data was received.Article 17 deleted

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 18

Compliance with requests for data 1. A data holder receiving a request for access to data under this Chapter shall make the data available to the requesting public sector body or a Union institution, agency or body without undue delay. 2. Without prejudice to specific needs regarding the availability of data defined in sectoral legislation, the data holder may decline or seek the modification of the request within 5 working days following the receipt of a request for the data necessary to respond to a public emergency and within 15 working days in other cases of exceptional need, on either of the following grounds: (a) the data is unavailable; (b) the request does not meet the conditions laid down in Article 17(1) and (2). 3. In case of a request for data necessary to respond to a public emergency, the data holder may also decline or seek modification of the request if the data holder already provided the requested data in response to previously submitted request for the same purpose by another public sector body or Union institution agency or body and the data holder has not been notified of the destruction of the data pursuant to Article 19(1), point (c). 4. If the data holder decides to decline the request or to seek its modification in accordance with paragraph 3, it shall indicate the identity of the public sector body or Union institution agency or body that previously submitted a request for the same purpose. 5. Where compliance with the request to make data available to a public sector body or a Union institution, agency or body requires the disclosure of personal data, the data holder shall take reasonable efforts to pseudonymise the data, insofar as the request can be fulfilled with pseudonymised data. 6. Where the public sector body or the Union institution, agency or body wishes to challenge a data holder’s refusal to provide the data requested, or to seek modification of the request, or where the data holder wishes to challenge the request, the matter shall be brought to the competent authority referred to in Article 31.Article 18 deleted

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 19

Obligations of public sector bodies and Union institutions, agencies and bodies 1. A public sector body or a Union institution, agency or body having received data pursuant to a request made under Article 14 shall: (a) not use the data in a manner incompatible with the purpose for which they were requested; (b) implement, insofar as the processing of personal data is necessary, technical and organisational measures that safeguard the rights and freedoms of data subjects; (c) destroy the data as soon as they are no longer necessary for the stated purpose and inform the data holder that the data have been destroyed. 2. Disclosure of trade secrets or alleged trade secrets to a public sector body or to a Union institution, agency or body shall only be required to the extent that it is strictly necessary to achieve the purpose of the request. In such a case, the public sector body or the Union institution, agency or body shall take appropriate measures to preserve the confidentiality of those trade secrets.Article 19 deleted

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 20

Compensation in cases of exceptional 1. Data made available to respond to a public emergency pursuant to Article 15, point (a), shall be provided free of charge. 2. Where the data holder claims compensation for making data available in compliance with a request made pursuant to Article 15, points (b) or (c), such compensation shall not exceed the technical and organisational costs incurred to comply with the request including, where necessary, the costs of anonymisation and of technical adaptation, plus a reasonable margin. Upon request of the public sector body or the Union institution, agency or body requesting the data, the data holder shall provide information on the basis for the calculation of the costs and the reasonable margin.Article 20 deleted need

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 21

Contribution of research organisations or 1. A public sector body or a Union institution, agency or body shall be entitled to share data received under this Chapter with individuals or organisations in view of carrying out scientific research or analytics compatible with the purpose for which the data was requested, or to national statistical institutes and Eurostat for the compilation of official statistics. 2. Individuals or organisations receiving the data pursuant to paragraph 1 shall act on a not-for-profit basis or in the context of a public-interest mission recognised in Union or Member State law. They shall not include organisations upon which commercial undertakings have a decisive influence or which could result in preferential access to the results of the research. 3. Individuals or organisations receiving the data pursuant to paragraph 1 shall comply with the provisions of Article 17(3) and Article 19. 4. Where a public sector body or a Union institution, agency or body transmits or makes data available under paragraph 1, it shall notify the data holder from whom the data was received.Article 21 deleted statistical bodies in the context of exceptional needs

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 22

1. Public sector bodies and Union institutions, agencies and bodies shall cooperate and assist one another, to implement this Chapter in a consistent manner. 2. Any data exchanged in the context of assistance requested and provided pursuant to paragraph 1 shall not be used in a manner incompatible with the purpose for which they were requested. 3. Where a public sector body intends to request data from a data holder established in another Member State, it shall first notify the competent authority of that Member State as referred to in Article 31, of that intention. This requirement shArticle 22 deleted Mutuall also apply to requests by Union institutions, agencies and bodies. 4. After having been notified in accordance with paragraph 3, the relevant competent authority shall advise the requesting public sector body of the need, if any, to cooperate with public sector bodies of the Member State in which the data holder is established, with the aim of reducing the administrative burden on the data holder in complying with the request. The requesting public sector body shall take the advice of the relevant competent authority into account.ssistance and cross-border cooperation

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 27 – paragraph 3 – subparagraph 2

The addressee of the decision may ask the opinion of the relevant competent bodies or authorities, pursuant to this Regulation, in order to determine whether these conditions are met, notably when it considers that the decision may relate to commercially sensitive data, or may impinge on national security or defence interests of the Union or its Member States. If the opinion of the competent authorities concludes that the conditions are not met, in particular because the decision concerns commercially sensitive data or affects the interests of the Union or its Member States in matters of national security or defence, then the recipient shall not provide access to the data.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 31 – paragraph 1 a (new)

1 a. The independent supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 shall be responsible for monitoring the application of this Regulation insofar as the protection of personal data is concerned. Chapters VI and VII of Regulation (EU) 2016/679 shall apply mutatis mutandis. The tasks and powers of the supervisory authorities shall be exercised with regard to the processing of personal data.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 31 – paragraph 2 – point a

(a) the independent supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 shall be responsible for monitoring the application of this Regulation insofar as the protection of personal data is concerned. Chapters VI and VII of Regulation (EU) 2016/679 shall apply mutatis mutandis. The tasks and powers of the supervisory authorities shall be exercised with regard to the processing of personal data;deleted

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 31 – paragraph 4

4. Where a Member State designates more than one competent authority, the competent authorities shall, in the exercise of the tasks and powers assigned to them under paragraph 3 of this Article, cooperate with each other, including, as appropriate, with the supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679, to ensure the consistent application of this Regulation. In such cases, ~~relevant Member States~~the supervisory authorities under Regulation (EU) 2016/679 shall be designated as coordinating competent authority.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 31 – paragraph 6

6. When carrying out their tasks and exercising their powers in accordance with this Regulation, the competent authorities shall remain independent and impartial, free from any external influence, whether direct or indirect, and shall neither seek nor take instructions from any other public authority or any private party.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 31 – paragraph 7

7. Member States shall ensure that the designated competent authorities are provided with the ~~necessary resour~~human, technical and financial resources, premises and infrastructure necessary for the effective performances to adequately carry out their tasks in accordance with this Regulation.

2022/11/17
Committee: LIBE

Sophia IN 'T VELD

Proposal for a regulation
Article 32 – paragraph 3 a (new)

3 a. This Article is without prejudice to Chapter VIII of Regulation (EU) 2016/679.

2022/11/17
Committee: LIBE