Greece S&D

Dimitrios Droutsas

Country: Greece
Group: Progressive Alliance of Socialists and Democrats (S&D)
Party: Panhellenic Socialist Movement (PASOK)

Vice-Chair of Industry, Research and Energy
Substitute of Civil Liberties, Justice and Home Affairs
Substitute of Constitutional Affairs

Overview Dimitrios Droutsas

Amendments: 198
...stronger: 85
...weaker: 22
...neutral: 91

Amendments by Dimitrios Droutsas

(5) Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of data sharing and collectingcollection has increased spectacularly. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities. Individuals increasingly make personal information available publicly and globally. Technology has transformed both the economy and social life, and requires to further improved legal safeguards to facilitate the free flow of data within the Union , into the Union and the transfer to third countries and international organisations, while ensuring anensuring a high level of the protection of personal data.
(14) This Regulation does not address issues of protection of fundamental rights and freedoms or the free flow of data related to activities which fall outside the scope of Union law, nor does it cover the processing of personal data by the Union institutions, bodies, offices and agencies, which are subject to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, or the processing of personal data by the Member States when carrying out activities in relation to the common foreign and security policy of the Union. To ensure a coherent data protection framework throughout the Union, Regulation (EC) No 45/2001 should be brought into line with this Regulation.
(16) The protection of individuals with regard to the processing of personal data by competent public authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data, is subject of a specific legal instrument at Union level. Therefore, this Regulation should not apply to the processing activities for those purposes. However, data processed by public authorities under this Regulation when used for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties should be governed by the more specific legal instrument at Union level (Directive XX/YYY).
(38) The (38) In exceptional circumstances, the legitimate interests of a controller may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding. This would need careful assessment in particular where the data subject is a child, given that children deserve specific protection. The data subject should have the right to object the processing, on grounds relating to their particular situation and free of charge. To ensure transparency, the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object, and also be obliged to document these legitimate interests. Given that it is for the legislator to provide by law the legal basis for public authorities to process data, this legal ground should not apply for the processing by public authorities in the performance of their tasks.
(39a) The enforcement of legal claims against a data subject, such as debt collection or civil damages and remedies, should constitute a legitimate interest, provided the legal claim was established prior to the collection and processing of personal data. The same principle also applies to the prevention or limitation of damages by the data subject suffered by the controller, for example to prevent payment default.
(40a) Processing of personal data collected for another purpose should be made available for public scientific research when a scientific relevance of the processing of the collected data can be justified. Privacy by design should be taken into account when making data available for public scientific research.
(46a) Data subjects should be informed about the data processing operations employed by the entity they are interacting with without being overwhelmed by the sheer amount of information they are provided with. A transparent and understandable information policy is therefore a pivotal element of every data processing framework. In order to allow a quicker understanding and better comparability of data protection policies, when providing information to the data subject, controllers should disclose short icon based information policies before laying down in detail their information policies. These icon based information policies should be standardized so that they can be provided in written and electronic form and be also easily readable on mobile devices. Detailed explanations or further remarks can follow as part of the more detailed information provisions to the data subjects. When provided electronically, the standardized information policies should be machine readable to allow for innovative implementation schemes.
(57) Where personal data are processed for the purposes of direct marketingone or more specific purposes, the data subject should have the right to object to such processing in advance, free of charge and in a manner that can be easily and effectively invoked...
(67) A personal data breach may, if not addressed in an adequate and timely manner, result in substantial economic loss and social harm, including identity fraud, to the individual concerned. Therefore, as soon as the controller becomes aware that such a breach has occurred, the controller should notify the breach to the supervisory authority without undue delay and, where feasible, within 2472 hours. Where this cannot achieved within 2472 hours, an explanation of the reasons for the delay should accompany the notification. The individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions. A breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in, for example, identity theft or fraud, physical harm, significant humiliation or damage to reputation. The notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects. Notifications to data subjects should be made as soon as reasonably feasible, and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities (e.g. law enforcement authorities). For example, the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay.
(75) Where the processing is carried out in the public sector or where, in the private sector, processing is carried out by a large enterprise, it relates to more than 500 data subjects per year, or where its core activities, regardless of the size of the enterprise, involve processing operations on sensitive data, or processing operations which require regular and systematic monitoring, a person should assist the controller or processor to monitor internal compliance with this Regulation. When establishing whether data about a large number of data subjects are processed, archived data that is restricted in such a way that they are not subject to the normal data access and processing operations of the controller and can no longer be changed should not be taken into account. Such data protection officers, whether or not an employee of the controller and whether or not performing that task full time, should be in a position to perform their duties and tasks independently.
(77) In order to enhance transparency and compliance with this Regulation, the establishment of certification mechanisms, supervisory authorities should award controllers and processors which properly apply this Regulation with the same standardised data protection seals and marks should be encouraged, allowing mark, the ‘European Data Protection Seal’. When certifying controllers, supervisory authorities should apply the same standards; the fee for the certification should be the same in all Member States and should be elaborated by the European Data Protection Board. The European Data Protection Seal should create trust among data subjects to quickly assess the level of , legal certainty for controllers and at the same time export European data protection of relevant products and services.standards by allowing non-European companies to more easily enter European markets by being certified.
(87) These derogations should in particular apply to data transfers required and necessary for the protection of important grounds of public interest, for example in cases of international data transfers between competition authorities, tax or customs administrations, financial supervisory authorities, between services competent for social security matters, or to competent public authorities for the prevention, investigation, detection and prosecution of criminal offences.
(88) Transfers which cannot be qualified as frequent or massive, could also be possible for the purposes of the legitimate interests pursued by the controller or the processor, when they have assessed all the circumstances surrounding the data transfer. For the purposes of processing for historical, statistical and scientific research purposes, the legitimate expectations of society for an increase of knowledge should be taken into consideration.
(89) In any case, where the Commission has taken no decision on the adequate level of data protection in a third country, the controller or processor should make use of solutions that provide data subjects with a legally binding guarantee that they will continue to benefit from the fundamental rights and safeguards as regards processing of their data in the Union once this data has been transferred.
(97) Where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union takes place in more than one Member State, one single supervisory authority should be competent for monitoring the activities ofact as the single contact point for the controller or processor throughout the Union and taking the related decisions, in order to increase the consistent application, provide legal certainty and reduce administrative burden for such controllers and processors...
(98) The competentlead authority, providing such one-stop shop, should be the supervisory authority of the Member State in which the controller or processor has its main establishment.
(107) In order to ensure compliance with this Regulation, the Commission may adopt an opinion on this matter, or a decision, requiring the supervisory authority to suspend its draft measure.a reasoned recommendation on matters raised.
(121) The processing of personal data solely for journalistic purposes, or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this Regulation(121) Whenever necessary, exemptions or derogations from the requirements of certain provisions of this Regulation for the processing of personal data should be possible in order to reconcile the right to the protection of personal data with the right to freedom of expression, and notably the right to receive and impart information, as guaranteed in particular by Article 11 of the Charter of Fundamental Rights of the European Union. This should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries. Therefore, Member States should adopt legislative measures, which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights. Such exemptions and derogations should be adopted by the Member States on general principles, on the rights of the data subject, on controller and processor, on the transfer of data to third countries or international organisations, on the independent supervisory authorities and on co-operation and consistency. This should not, however, lead Member States to lay down exemptions from the other provisions of this Regulation. In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly. Therefore, Member States should classify activities as ‘journalistic’ for the purpose of the exemptions and derogations to be laid down under this Regulation if the object of these activities is the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them. They should not be limited to media undertakings and may be undertaken for profit-making or for non- profit making purposes.
(124a) In Member States where it has been left to the parties on the labour market to regulate wages and other work conditions through collective agreements, social partners´ obligations and rights under collective agreements should be taken into specific consideration when applying Article 6(1)f.
  Comment: Intention unclear Discuss this Rating
(132) The Commission should adopt immediately applicable implementing acts where, in duly justified cases relating to a third country or a territory or a processing sector within that third country or an international organisation which does not ensure an adequate level of protection and relating to matters communicated by supervisory authorities under the consistency mechanism, imperative grounds of urgency so require.
  Comment: Intention unclear. Discuss this Rating
(134) Directive 95/46/EC should be repealed by this Regulation. However, Commission decisions adopted and authorisations by supervisory authorities based on Directive 95/46/EC should remain in force. Commission decisions and authorisations by supervisory authorities relating to transfers of personal data to third countries should remain in force for a transition period of two years.
(e) by competent public authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.
(2a) ‘pseudonym’ means a unique identifier which is specific to one given context and which does not permit the direct identification of a natural person, but allows the singling out of a data subject;
  Comment: Dependent on the attached consequences, but exceptions for pseudonymous data are always leading to less protection. Discuss this Rating
(3a) ‘profiling’ means any form of automated processing of personal data intended to evaluate certain personal aspects relating to a natural person or to analyse or predict in particular that natural person’s performance at work, economic situation, location, health, personal preferences, reliability or behaviour;
Personal data must be:shall be:
(e) kept in a form which permits identification or singling out of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the data will be processed solely for historical, statistical or scientific research purposes in accordance with the rules and conditions of Article 83 and if a periodic review is carried out to assess the necessity to continue the storage;
(f) processed under the responsibility and liability of the controller, who shall ensure and be able to demonstrate for each processing operation the compliance with the provisions of this Regulation.;
1a. Processing of personal data shall be organised and carried out in a way that ensures compliance with the principles referred to in paragraph 1.
(a) the data subject has given explicit and informed consent to the processing of their personal data for one or more specific purposes;
(f) processing is necessary for the purposes of the legitimate interests pursued by a controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This shall not apply to processing carried out by public authorities in the performance of their tasks.
1a. Only if none of the legal grounds for the processing of personal data referred to in paragraph 1 apply, processing of personal data for specific purposes can be based on the legitimate interests of the controller. The data controller shall in that case inform the data subject about the data processing explicitly and separately. The controller shall publish the reasons for believing that its interests override the interests or fundamental rights and freedoms of the data subject. This paragraph shall not apply to processing carried out by public authorities in the performance of their tasks.
1b. The following interests of the controller are presumed to be legitimate: (a) processing of personal data is necessary for the prevention or limitation of damages suffered by the controller, or, in exceptional cases, by a third party; (b) the data subject has provided the personal data to the data controller on the legal ground referred to in point (b) of paragraph 1, the personal data are used for direct marketing for its own similar products and services and are not transferred, and the data controller is clearly identified towards the data subject.
  Comment: Tending to be at least not weaker than most other definitions if read together with AM914. Discuss this Rating
1c. Any legitimate interests pursued by the controller, must be balanced against the interests or fundamental rights and freedoms of the data subject. This fundamental rights and interests are presumed to override the legitimate interest of the controller, if: (a) the processing causes a serious risk of damage to the data subject; (b) the processing leads to a serious risk of infringement of any of the fundamental rights of the data subjects involved, as laid down in the Charter of Fundamental Rights of the European Union; (c) the processing involves location data or biometric data; (d) the processing entails the processing of personal data that are the result of profiling of the data subject; (e) there is a significant risk of processing of personal data without legal ground, in particular if personal data is made accessible for a large number of persons or if large amounts of personal data about the data subject are processed or combined with other data; or (f) the data subject is a child.
  Comment: Tending to be at least not weaker than most other definitions if read together with AM909. Discuss this Rating
1d. Processing is necessary due to national practices for the social partners concerning collective agreements.
(ba) collective agreements in the employment context.
4. Where the purpose of further processing is not compatible with the one for which the personal data have been collected, the processing must have a legal basis at least in one of the grounds referred to in points (a) to (e) of paragraph 1. This shall in particular apply to any change of terms and general conditions of a contract.
5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the conditions referred to in point (f) of paragraph 1 for various sectors and data processing situations, including as regards the processing of personal data related to a child.
4a. The Commission shall be empowered to adopt, after requesting an opinion from the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the requirements and conditions for technical standards referred to in paragraph 2a, and for declaring that a technical standard is in line with this Regulation and has general validity within the Union.
1. For the purposes of this Regulation, in relation to the offering of information societygoods or services directly to a child, the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child's parent or custodianlegal guardian. The controller shall make reasonable efforts to obtain verifiable consent, taking into consideration available technology. The methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary.
3. The Commission shall , after requesting an opinion from the European Data Protection Board, be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the methods to obtain verifiable consent referred to in paragraph 1. In doing so, the Commission shall consider specific measures for micro, small and medium- sized enterprises.
1. The processing of personal data, revealing race or ethnic origin, political opinions, religion or beliefs, sexual orientation or gender identity, trade-union membership and activities, and the processing of genetic or biometric data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited.
(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment law in so far as it is authorised by Union law or Member State law or collective agreements providing for adequate safeguards; or
(j) processing of data relating to criminal administrative sanctions, judgments, criminal offences, convictions or related security measures, is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject, or for the performance of a task carried out for important public interest reasons, and in so far as authorised by Union law or Member State law providing for adequate safeguards. A complete register of criminal convictions shall be kept only under the control of official authority.
3. The Commission shall be empowered to adopt , after requesting an opinion from the European Data Protection Board, delegated acts in accordance with Article 86, for the purpose of further specifying the criteria, conditions and appropriate safeguards for the processing of the special categories of personal data referred to in paragraph 1 and the exemptions laid down in paragraph 2.
If the data processed by a controller do not permit the controller to identify or single out a natural person, or consist only of data relating to pseudonyms, the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation.
4. The information and the actions taken on requests referred to in paragraph 1 shall be free of charge. Where requests are manifestly excessive, in particular because of their repetitive character, the controller may charge a fee for providing the information or taking the action requested, or the controller may not take reasonable fee taking into account the administrative costs for providing the information or taking the action requested. In that case, the controller shall bear the burden of proving the manifestly excessive character of the request.
5. The Commission shall be empowered to adopt , after requesting an opinion the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for the manifestly excessive requests and the fees referred to in paragraph 4.
6. The Commission may lay down standard forms and specifying standard procedures for the communication referred to in paragraph 2, including the electronic format. In doing so, the Commission shall take the appropriate measures for micro, small and medium-sized enterprises. Those implementing acts shall be adopted after adopting an opinion of the European Data Protection Board in accordance with the examination procedure referred to in Article 87(2).
which they were collected; (d) whether Article 13a Standardised information policies 1. Where personal data are disseminated to non-public third parties for purposes other than the purposes for which they were collected; (e) whether personal data are sold; (f) whether personal data are retained in encrypted form. 2. The particulars referred to in paragraph 1 shall be presented relating to a data subject are collected, the controller shall provide the data subject with the following particulars before providing information pursuant to Annex X in an aligned tabular format, using text and symbols, in the following three columnsArticle 14: (a) the first column depicts graphical forms symbolising those particulars; (b) the second column contains essential information describing those particularswhether personal data are collected beyond the minimum necessary for each specific purpose of the processing; (c) the third column depicts graphical forms indicating whether a specific particular is met. 3. The information referred to in paragraphs 1 and 2 shall be presented in an easily visible and clearly legible way and shall appear in a language easily understood by the consumers b) whether personal data are retained beyond the minimum necessary for each specific purpose of the Member States to whom the information is provided. Where the particulars are presented electronically, they shall be machine readable. 4. Additional particulars shall not be provided. Detailed explanations or further remarks regarding the particulars referred to in paragraph 1 may be provided together with the other information requirements pursuant to Article 14. 5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the particulars referred to in paragraph 1 and their presentation as referred to in paragraph 2 and in Annex X.processing; (c) whether personal data are processed for purposes other than the purposes for
7. The Commission shall be empowered to adopt , after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria for categories of recipients referred to in point (f) of paragraph 1, the requirements for the notice of potential access referred to in point (g) of paragraph 1, the criteria for the further information necessary referred to in point (h) of paragraph 1 for specific sectors and situations, and the conditions and appropriate safeguards for the exceptions laid down in point (b) of paragraph 5. In doing so, the Commission shall take the appropriate measures for micro, small and medium-sized-enterprises.
8. The Commission mayshall lay down standard forms for providing the information referred to in paragraphs 1 to 3, taking into account the specific characteristics and needs of various sectors and data processing situations where necessary as well as the needs of the relevant stakeholders. Those implementing acts shall be adopted , after requesting an opinion of the European Protection Board, in accordance with the examination procedure referred to in Article 87(2).
1. The data subject shall have the right to obtain from the controller at any time, on request, in clear and plain language, confirmation as to whether or not personal data relating to the data subject are being processed. Where such personal data are being processed, the , and as to the existence of profiling and measures based on profiling in respect of the data subject the controller shall provide the following information:
(c) the recipients or categories of recipients to whom the personal data are to be or have been disclosed, in particular including to recipients in third countries;
(h) the significance and envisaged consequences of such processing, at least in the case profiling and of measures referred to in Article 20.based on profiling.
(ha) intelligible information about the logic involved in any automated processing;
(hb) in the event of disclosure of personal data to a public authority as a result of a public authority request, confirmation of the fact that such a request has been made, information about whether or not the request has been fully or partly complied with and an overview of the data that were requested or disclosed.
2. The data subject shall have the right to obtain from the controller communication of the personal data undergoing processing. Where the data subject makes the request in electronic form, the information shall be provided in electronic forman electronic format which allows for further use by the data subject, unless otherwise requested by the data subject.
2a. Where the data subject has provided the personal data and the processing is based on consent or on a contract, the data subject shall have the right to transmit those personal data, where technically feasible and appropriate, and retained by an automated processing system, into another one, in an electronic format which is commonly used, without hindrance from the controller from whom the personal data are withdrawn.
2b. This Article shall be without prejudice to the obligation to delete data when no longer necessary under Article 5(1)(e).
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the communication to the data subject of the content of the personal data referred to in point (g) of paragraph 1.
4. The Commission may specify standard forms and procedures for requesting and granting access to the information referred to in paragraph 1, including for verification of the identity of the data subject and communicating the personal data to the data subject, taking into account the specific features and necessities of various sectors and data processing situations. Those implementing acts shall be adopted , after requesting an opinion of the European Protection Board, in accordance with the examination procedure referred to in Article 87(2).
4a. Subject to the necessary legal safeguards, especially in order to ensure that information are not used to take measures or decisions regarding specific persons, Member States can, in cases with no risk of violation of privacy, by law limit the rights following Article 15 only if these rights are processed as part of scientific research in compliance with Article 83 of this Regulation or only if these personal data are stored in the specific time frame it takes to make statistics.
(d) for compliance with a legal obligation to retain the personal data by Union or Member State law to which the controller is subject; Member State laws shall meet an objective of public interest, respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued;
9. The Commission shall be empowered to adopt , after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying:
Article 18 Right to data portability 1. The data subject shall have the right, where personal data are processed by electronic means and in a structured and commonly used format, to obtain from the controller a copy of data undergoing processing in an electronic and structured format which is commonly used and allows for further use by the data subject. 2. Where the data subject has provided the personal data and the processing is based on consent or on a contract, the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system, into another one, in an electronic format which is commonly used, without hindrance from the controller from whom the personal data are withdrawn. 3. The Commission may specify the electronic format referred to in paragraph 1 and the technical standards, modalities and procedures for the transmission of personal data pursuant to paragraph 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
1. The data subject shall have the right, where personal data are processed by electronic means and in a structured and commonly used format, to obtain from the controller a copy of data undergoing processing in an electronic and structured format which is commonly used and allows for further use by the data subject.
2. Where the data subject has provided the personal data and the processing is based on consent or on a contract, the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system, into another one, in an electronic format which is commonly used, without hindrance from the controller from whom the personal data are withdrawn.
3. The Commission may specify the electronic format referred to in paragraph 1 and the technical standards, modalities and procedures for the transmission of personal data pursuant to paragraph 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
1. The data subject shall have the right to object, on grounds relating to their particular situation, at any time to the processing of personal data which is based on points (d), (e) and (fe) of Article 6(1), unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject.).
  Comment: Two sided. "Legitimate Interrests" are removed, but conditions are better. Discuss this Rating
2. Where 2. Processing of personal data are processed for direct marketing purposes, the shall require the explicit consent of the data subject shall have the right to object free of charge to the processing of their personal data for such marketing. The data shall not be given to third parties. A withdrawal of consent shall be possible at all times and free of charge. This right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information.
(a) is carried out in the course of the entering into, or performance of, a contract, where the request for the entering into or the performance of the contract, lodged by the data subject, has been satisfied or where suitable measures to safeguard the data subject's legitimate interests have been adduced, such as the including the right to be provided with meaningful information about the logic used in the profiling and the right to obtain human intervention; or
(ab) Profiling shall not be used to identify or single out children;
(c) is based on the data subject's consent, subject to the conditions laid down in Article 7 and to suitable safeguards., including the possibility to withdraw consent at any time and effective protection against possible discrimination resulting from measures described in paragraph 1.
3. Automated processing of personal data intended to evaluate certain personal aspects 3. Profiling activities relating to a natural person shall not be based solely on the special categories of personal data referred to in Article 9.
1. Union or Member State law may restrict by way of a legislative measure the scope of the obligations and rights provided for in points (a) to (e) of Article 5 and in Articles 11 to 20 and Article 32, when such a restriction constitutes a necessary and proportionate measure in a democratic society to safeguard:
(c) other public interests of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters and the protection of market stability and integrity;;
2. In particular, any legislative measure referred to in paragraph 1 must be necessary and proportionate in a democratic society and shall contain specific provisions at least as to : (a) the objectives to be pursued by the processing and; (b) the determination of the controller.; (c) the specific purposes and means of processing; (d) the categories of persons authorised to process the data; (e) the procedure to be followed for the processing; (f) the safeguards to prevent abuse; (g) the right of data subjects to be informed about the restriction.
3. The controller shall implement mechanisms to ensure the verification of the be able to demonstrate the effectiveness of the measures referred to in paragraphs 1 and 2. If proportionate, this verification shall be carried out verified by independent internal or external auditors.
4. The Commission shall be empowered to adopt , after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of specifying any further criteria and requirements for appropriate measures referred to in paragraph 1 other than those already referred to in paragraph 2, the conditions for the verification and auditing mechanisms referred to in paragraph 3 and as regards the criteria for proportionality under paragraph 3, and considering specific measures for micro, small and medium-sized-enterprises.
2. The controller shall implement mechanisms for ensuring ensure that, by default, only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes, both in terms of the amount of the data and the time of their storage. In particular, those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals. and that data subjects are able to control the distribution of their personal data; pseudonymisation shall be used where possible.
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purposeEuropean Data Protection Board shall be entrusted with the task of specifying any further criteria and requirements for appropriate measures and mechanisms referred to in paragraph 1 and 2paragraphs 1, 2, and 2a, in particular for data protection by design requirements applicable across sectors, products and services., in accordance with Article 66.
4. The Commission may lay down technical standards for the requirements laid down in paragraph 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
(b) an enterprise processing personal data relating to fewer than 500 data subject per year, or by an enterprise employing fewer than 250 persons; or
3. The representative shall be established in one of those Member States where the data subjects whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, reside.reside.
5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the responsibilities, duties and tasks in relation to a processor in line with paragraph 1, and conditions which allow facilitating the processing of personal data within a group of undertakings, in particular for the purposes of control and reporting.
2. The documentation shall contain at least the following information: (a) the name and contact details of the controller, or any joint controller or processor, and of the representative, if any; (b) the name and contact details of the data protection officer, if any; (c) the purposes of the processing, including the legitimate interests pursued by the controller where the processing is based on point (f) of Article 6(1); (d) a description of categories of data subjects and of the categories of personal data relating to them; (e) the recipients or categories of recipients of the personal data, including the controllers to whom personal data are disclosed for the legitimate interest pursued by them; (f) where applicable, transfers of data to a third country or an international organisation, including the identification of that third country or international organisation and, in case of transfers referred to in point (h) of Article 44(1), the documentation of appropriate safeguards; (g) a general indication of the time limits for erasure of the different categories of data; (h) the description of the mechanisms referred to in Article 22(3).information listed in Article 14.
4. The obligations referred to in paragraphs 1 and 2 shall not apply to the following controllers and processors: (a) a a natural person processing personal data without a commercial interest; or (b) an enterprise or an organisation employing fewer than 250 persons that is processing personal data only as an activity ancillary to its main activities..
5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the documentation referred to in paragraph 1, to take account of in particular the responsibilities of the controller and the processor and, if any, the controller's representative.
6. The Commission may lay down standard forms for the documentation referred to in paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
2. The controller and the processor shall, following an evaluation of the risks, take the measures referred to in paragraph 1 to protect personal data against accidental or unlawful destruction or accidental loss and to prevent any unlawful forms of processing, in particular any unauthorised disclosure, dissemination or access, or alteration of personal data. implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected, such as pseudonymisation, having regard to the state of the art and the costs of their implementation.
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purposeEuropean Data Protection Board shall be entrusted with the task of further specifying the criteria and conditions for the technical and organisational measures referred to in paragraphs 1 and 2, including the determinations of what constitutes the state of the art, for specific sectors and in specific data processing situations, in particular taking account of developments in technology and solutions for privacy by design and data protection by default, unless paragraph 4 applies., in accordance with Article 66.
4. The Commission may adopt, where necessary, implementing acts for specifying the requirements laid down in paragraphs 1 and 2 to various situations, in particular to: (a) prevent any unauthorised access to personal data; (b) prevent any unauthorised disclosure, reading, copying, modification, erasure or removal of personal data; (c) ensure the verification of the lawfulness of processing operations.
1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 2472 hours after having become aware of it, notify the personal data breach to the supervisory authority. The notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours.72 hours.
5. The Commission shall be empowered to adopt , after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach.
6. The Commission may lay down the standard format of such notification to the supervisory authority, the procedures applicable to the notification requirement and the form and the modalities for the documentation referred to in paragraph 4, including the time limits for erasure of the information contained therein. Those implementing acts shall be adopted , after requesting an opinion of the European Data Protection Board, in accordance with the examination procedure referred to in Article 87(2).
5. The Commission shall be empowered to adopt , after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements as to the circumstances in which a personal data breach is likely to adversely affect the personal data referred to in paragraph 1.
6. The Commission may lay down the format of the communication to the data subject referred to in paragraph 1 and the procedures applicable to that communication. Those implementing acts shall be adopted , after requesting an opinion of the European Data Protection Board, in accordance with the examination procedure referred to in Article 87(2).
(d) personal data in large scale filing systems on children, genetic data or biometric data;(d) processing of special categories of data as referred to in Article 9(1), location data, biometric data, or data on children;
3. The assessment shall contain at least a general description of (a) the envisaged processing operations, and their necessity and proportionality in relation to the purpose; (b) an assessment of the risks to the rights and freedoms of data subjects, ; (c) the measures envisaged to address the risks, and minimise the volume of personal data which is processed; (d) safeguards, security measures and mechanisms to ensure the protection of personal data , such as pseydonymisation, and to demonstrate compliance with this Regulation, taking into account the rights and legitimate interests of data subjects and other persons concerned.
6. The Commission shall be empowered to adopt , after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for the processing operations likely to present specific risks referred to in paragraphs 1 and 2 and the requirements for the assessment, referred to in paragraph 3, including conditions and procedures for scalability, verification and auditability. In doing so, the Commission shall consider specific measures for micro, small and medium- sized enterprises.
7. The Commission may specify standards and procedures for carrying out and verifying and auditing the assessment referred to in paragraph 3. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
1. The controller or the processor as the case may be shall obtain an authorisation from the supervisory authority prior to the processing of personal data, in order to ensure the compliance of the intended processing with this Regulation and in particular to mitigate the risks involved for the data subjects where a controller or processor adopts contractual clauses as provided for in point (d) of Article 42(2) or does not provide for the appropriate safeguards in a legally binding instrument as referred to in Article 42(5) for the transfer of where it transfers personal data to a third country or an international organisation. based on the derogations in Article 44.
  Comment: Intention unclear. Discuss this Rating
5. Where the list provided for in paragraph 4 involves processing activities which are related to the offering of goods or services to data subjects in several Member States, or to the monitoring of their behaviour, or may substantially affect the free movement of personal data within the Union, the supervisory authority shall apply the consistency mechanism referred to in Article 57 prior to the adoption of the list.
8. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for determining the high degree of specific risk referred to in point (a) of paragraph 2.
9. The Commission may set out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and 2, and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6. Those implementing acts shall be adopted , after requesting an opinion of the European Data Protection Board, in accordance with the examination procedure referred to in Article 87(2).
(b) the processing is carried out by a legal person and relates to more than 500 data subjects per year, or by an enterprise employing 250 persons or more; or, or processing is carried out on special categories of personal data as referred to in Article 9(1); or
7. The controller or the processor shall designate a data protection officer for a period of at least twofour years. The data protection officer may be reappointed for further terms. During their term of office, the data protection officer may only be dismissed, if the data protection officer no longer fulfils the conditions required for the performance of their duties.
2. The controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function. The data protection officer shall directly report to the executive management of the controller or the processor.
3. The controller or the processor shall support the data protection officer in performing the tasks and shall provide staff, premises, equipment , continuous professional training and any other resources necessary to carry out the duties and tasks referred to in Article 37.
3a. Data protection officers shall be bound by professional secrecy concerning the identity of data subjects and concerning circumstances enabling data subjects to be identified, unless they are released from that obligation by the data subject.
(ha) to inform the workers representatives on data processing of the workers.
2. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for tasks, certification, status, powers and resources of the data protection officer referred to in paragraph 1.
4. The Commission may adopt implementing acts shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for deciding that the codes of conduct and amendments or extensions to existing codes of conduct submitted to it pursuant to paragraph 3 are in line with this Regulation and have general validity within the Union. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).This delegated act shall confer enforceable rights on data subjects.
1. The Member States and the Commission shall encourage, in particular at European level, the establishment of data protection certification mechanisms and of data protection seals and marks, allowing data subjects to quickly assess the level of data protection provided by controllers and processors. The data protection certifications mechanisms shall contribute to the proper application of 1. Any controller or processor may request any supervisory authority in the Union, for a fixed fee, to certify that the processing of personal data is performed in compliance with this Regulation, taking account of the specific features of the various sectors and different as well as the contexts of and risks represented by the data processing operations.
1a. During this certification procedure, the supervisory authority may request specialised third parties to carry out the auditing of the controller or the processor on their behalf. The final certification shall be provided by the supervisory authority.
1a. The supervisory authorities shall co- operate with each other in accordance with Articles 46 and 57. In this regard, supervisory authorities shall grant controllers and processors which comply with this Regulation the standardised data protection mark, the "European Data Protection Seal".
1c. The "European Data Protection Seal" shall be valid for as long as the data protection level of the certified controller or processor fully complies with this Regulation.
1d. Notwithstanding paragraph 1c, the "European Data Protection Seal" shall be valid for maximum five years.
2. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1, including conditions for granting and withdrawal, and requirements for recognition within the Union and in third countries. These delegated acts shall confer enforceable rights on data subjects.
3. The Commission may lay down technical shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of laying down standards for certification mechanisms and data protection seals and marks and mechanisms to promote and recognize certification mechanisms and data protection seals and marks. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).
1a. All transfers of data from a Cloud in European Union jurisdiction to a Cloud under the jurisdiction of a third country shall be accompanied with a notification to the data subject of such transfer and its legal effects.
(a) the rule of law, relevant legislation in force, both general and sectoral, including concerning public security, defence, national security and criminal law, the case law of the Courts, the professional rules and security measures which are complied with in that country or by that international organisation, as well as effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred;
3. The Commission may decide shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of deciding that a third country, or a territory or a processing sector within that third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
4. The implementingdelegated act shall specify its geographical and sectoral territorial application, and, where applicable, identify the supervisory authority mentioned in point (b) of paragraph 2.
5. The Commission may decide shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of deciding that a third country, or a territory or a processing sector within that third country, or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, in particular in cases where the relevant legislation, both general and sectoral, in force in the third country or international organisation, does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2), or, in cases of extreme urgency for individuals with respect to their right to personal data protection, in accordance with the procedure referred to in Article 87(3).
7. The Commission shall publish in the Official Journal of the European Union , and on its website, a list of those third countries, territories and processing sectors within a third country and international organisations where it has decided that an adequate level of protection is or is not ensured.
8. Decisions adopted by the Commission on the basis of Article 25(6) or Article 26(4) of Directive 95/46/EC shall remain in force, until amended, replaced or repealed by the Commission. until two years after the entry into force of this Regulation.
(aa) a valid "European Data Protection Seal" pursuant to Article 39;
(b) standard data protection clauses adopted by the Commission. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2); or
3. A transfer based on standard data protection clauses or binding corporate rules as referred to in points (a), (b) or (c) of paragraph 2 shall not require any further authorisation.
5. Where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument, the controller or processor shall obtain prior authorisation for the transfer, or a set of transfers, or for provisions to be inserted into administrative arrangements providing the basis for such transfer. Such authorisation by the supervisory authority shall be in accordance with point (a) of Article 34(1). If the transfer is related to processing activities which concern data subjects in another Member State or other Member States, or substantially affect the free movement of personal data within the Union, the supervisory authority shall apply the consistency mechanism referred to in Article 57. Authorisations by a supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid, until amended, replaced or repealed by that supervisory authority.
(a) the structure and contact details of the group of undertakings and its members; and their external subcontractors;
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purposeEuropean Data Protection Board shall be entrusted with the task of further specifying the criteria and requirements for binding corporate rules within the meaning of this Article, in particular as regards the criteria for their approval, the application of points (b), (d), (e) and (f) of paragraph 2 to binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned., in accordance with Article 66.
4. The Commission may specify the shall, after requesting an opinion of the European Data Protection Board, be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying the format and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules within the meaning of this Article. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).
(h) the transfer is necessary for the purposes of the legitimate interests pursued by the controller or the processor, which cannot be qualified as frequent or massive, and where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and based on this assessment adduced appropriate safeguards with respect to the protection of personal data, where necessary.
3. Where the processing is based on point (h) of paragraph 1, the controller or processor shall give particular consideration to the nature of the data, the purpose and duration of the proposed processing operation or operations, as well as the situation in the country of origin, the third country and the country of final destination, and adduced appropriate safeguards with respect to the protection of personal data, where necessary.
  Comment: Has to be read together with AM2500. Discuss this Rating
4. Points (b), (c) and (hc) of paragraph 1 shall not apply to activities carried out by public authorities in the exercise of their public powers.
6. The controller or processor shall document the assessment as well as the appropriate safeguards adduced referred to in point (h) of paragraph 1 of this Article in the documentation referred to in Article 28 and shall inform the supervisory authority of the transfer.
7. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying 'important grounds of public interest' within the meaning of point (d) of paragraph 1 as well as the criteria and requirements for appropriate safeguards referred to in point (h) of paragraph 1..
Article 44a Disclosures not authorized by Union law 1. No judgment of a court or tribunal and no decision of an administrative authority of a third country requiring a controller or processor to disclose personal data shall be recognized or be enforceable in any manner, without prejudice to a mutual assistance treaty or an international agreement in force between the requesting third country and the Union or a Member State. 2. Where a judgment of a court or tribunal or a decision of an administrative authority of a third country requests a controller or processor to disclose personal data, the controller or processor and, if any, the controller's representative, shall notify the supervisory authority of the request without undue delay and must obtain prior authorisation for the transfer by the supervisory authority. 3. The supervisory authority shall assess the compliance of the requested disclosure with the Regulation and in particular whether the disclosure is necessary and legally required in accordance with points (d) and (e) of paragraph 1 and paragraph 5 of Article 44. 4. The supervisory authority shall inform the competent national authority of the request. The controller or processor shall also inform the data subject of the request and of the authorisation by the supervisory authority. 5. The Commission may lay down the standard format of the notifications to the supervisory authority referred to in paragraph 2 and the information of the data subject referred to in paragraph 4 as well as the procedures applicable to the notification and information. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
3. The supervisory authority shall not may be competent to supervise processing operations of courts acting in their judicial capacity.
(ia) to certify controllers and processors pursuant to Article 39;
Each supervisory authority must draw up an annual a report on its activities at least every two years. The report shall be presented to the national parliament and shall be made be available to the public, the Commission and the European Data Protection Board.
Article 54a Lead Authority 1. Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union, and the controller or processor is established in more than one Member State, or where personal data of the residents in several Member States are processed, the supervisory authority of the main establishment of the controller or processor shall act as a single contact point for the controller or processor. 2. The lead authority shall ensure coordination with the authorities involved at any stage of supervisory proceedings against a controller or a processor within the meaning of paragraph 1. For that purpose it shall in particular submit any relevant information and consult the other authorities before it adopts a measure intended to produce legal effects vis-à-vis a controller or a processor within the meaning of paragraph 1. 3. Where the controller is not established in the Union, and residents in different Member States are affected by processing operations within the scope of this Regulation, the supervisory authorities of the Member States concerned shall designate the supervisory authority that will act as a single contact point for the controller or processor.
  Comment: Alternative Concept. Consequences unclear. Discuss this Rating
1. Supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective co- operation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and prompt information on the opening of cases and ensuing developments where the controller or processor has establishments in several Member States or where data subjects in several Member States are likely to be affected by processing operations. The lead authority as defined in Article 54a shall ensure the coordination with involved supervisory authorities and shall act as the single contact point for the controller or processor.
10. The Commission European Data Protection Board may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the European Data Protection Board, in particular the standardised format referred to in paragraph 6. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
2. In cases where the controller or processor has establishments in several Member States or where data subjects in several Member States are likely to be affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in the joint investigative tasks or joint operations, as appropriate. The competent supervisory authority lead authority as defined in Article 54a shall invite the supervisory authority of each of those Member States to take part in the respective joint investigative tasks or joint operations and respond to the request of a supervisory authority to participate in the operations without delay. The lead authority shall act as the single contact point for the controller or processor.
3. Any supervisory authority or the European Data Protection Board may request that any matter shall be dealt with in the consistency mechanism, in particular where a supervisory authority does not submit a draft measure referred to in paragraph 2 or does not comply with the obligations for mutual assistance in accordance with Article 55 or for joint operations in accordance with Article 56., or where a competent supervisory authority does not agree with the draft measure proposed by the lead authority.
7. The European Data Protection Board shall issue an opinion on the matter, if the European Data Protection Board so decides by simple majority of its members or any supervisory authority or the Commission so requests within one weektwo weeks after the relevant information has been provided according to paragraph 5. The opinion shall be adopted within one monthsix weeks by simple majority of the members of the European Data Protection Board. The chair of the European Data Protection Board shall inform, without undue delay, the supervisory authority referred to, as the case may be, in paragraphs 1 and 3, the Commission and the supervisory authority competent under Article 51 of the opinion and make it public.
8. The supervisory authority referred to in paragraph 1 and the supervisory authority competent under Article 51 shall take the utmost account of the opinionopinions of the European Data Protection Board and shall within two weeks after the information on the opinion by the chair of the European Data Protection Board, electronically communicate to the chair of the European Data Protection Board and to the Commission whether it maintains or amends its draft measure and, if any, the amended draft measure, using a standardised format.
8a. Where the lead authority pursuant to Article 54a intends not to follow the opinion of the European Data Protection Board, it shall inform the European Data Protection Board thereof in writing within one month and provide a reasoned justification.
8b. In a case where the European Data Protection Board still objects to the measure of the supervisory authority as referred to in paragraph 9, it may inform the Commission and invite it to submit a reasoned recommendation to the lead authority.
1. Within ten weeks after a matter has been raised under Article 58, or at the latest within six weeks in the case of Article 61, the Commission may adopt, in order to ensure correct and consistent application of this Regulation, an opinion in relation to matters raised pursuant to Articles 58 or 61.
2. Where the Commission has adopted an opinion in accordance with paragraph 1, the supervisory authority concerned shall take utmost account of the Commission's opinion and inform the Commission and the European Data Protection Board whether it intends to maintain or amend its draft measure.
3. During the period referred to in paragraph 1, the draft measure shall not be adopted by the supervisory authority.
4. Where the supervisory authority concerned intends not to follow the opinion of the Commission, it shall inform the Commission and the European Data Protection Board thereof within the period referred to in paragraph 1 and provide a justification. In this case the draft measure shall not be adopted for one further month.
Article 60 Suspension of a draft measure 1. Within one month after the communication referred to in Article 59(4), and where the Commission has serious doubts as to whether the draft measure would ensure the correct application of this Regulation or would otherwise result in its inconsistent application, the Commission may adopt a reasoned decision requiring the supervisory authority to suspend the adoption of the draft measure, taking into account the opinion issued by the European Data Protection Board pursuant to Article 58(7) or Article 61(2), where it appears necessary in order to: (a) reconcile the diverging positions of the supervisory authority and the European Data Protection Board, if this still appears to be possible; or (b) adopt a measure pursuant to point (a) of Article 62(1). 2. The Commission shall specify the duration of the suspension which shall not exceed 12 months. 3. During the period referred to in paragraph 2, the supervisory authority may not adopt the draft measure.
Article 61a Intervention by the Commission 1. Within ten weeks after a matter has been raised under Article 58, or at the latest within six weeks in the case of Article 61, the Commission may adopt, in order to ensure correct and consistent application of this Regulation, a reasoned recommendation in relation to matters raised pursuant to Articles 58 or 61. 2. Where the Commission has adopted a reasoned recommendation, in accordance with paragraph 1, the supervisory authority concerned shall take the utmost account of the Commission's recommendation and inform the Commission and the European Data Protection Board whether it intends to maintain or amend its draft measure 3. Where the supervisory authority concerned intends not to follow the opinion of the Commission, it shall inform the Commission and the European Data Protection Board thereof within one month and provide a reasoned justification. This reasoned justification shall be made publicly available. The supervisory authority may withdraw the draft measure at any stage of the procedure.
1. The Commission may adopt implementing acts for:, after requesting an opinion of the European Data Protection Board, for:
(a) deciding on the correct application of this Regulation in accordance with its objectives and requirements in relation to matters communicated by supervisory authorities pursuant to Article 58 or 61, concerning a matter in relation to which a reasoned decision has been adopted pursuant to Article 60(1), or concerning a matter in relation to which a supervisory authority does not submit a draft measure and that supervisory authority has indicated that it does not intend to follow the opinion of the Commission adopted pursuant to Article 59;
(b) deciding, within the period referred to in Article 59(1), whether it declares draft standard data protection clauses referred to in point (d) of Article 58(2), as having general validity;
(c) specifying the format and procedures for the application of the consistency mechanism referred to in this section;
2. On duly justified imperative grounds of urgency relating to the interests of data subjects in the cases referred to in point (a) of paragraph 1, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 87(3). Those acts shall remain in force for a period not exceeding 12 months.
1. The European Data Protection Board shall ensure the consistent application of this Regulation. To this effect, the European Data Protection Board shall, on its own initiative or at the request of the European Parliament, Council and the Commission, in particular:
(a) advise the Commission European Institutions on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Regulation;
(b) examine, on its own initiative or on request of one of its members or on request of the European Parliament, the Council or the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this Regulation;, including on the use of enforcement powers;
(da) provide an opinion on which authority should be the lead authority pursuant to Article 54a(3);
(ga) give its opinion to the Commission in the preparation of delegated and implementing acts based on this Regulation;
(gb) give an opinion on codes of conduct drawn up at Union level;
(gc) elaborate with the supervisory authorities the fixed fee for the granting of the standardised data protection mark, the "European Data Protection Seal".
2. Where the Commission requestsEuropean Parliament, the Council or the Commission request advice from the European Data Protection Board, it may lay out a time limit within which the European Data Protection Board shall provide such advice, taking into account the urgency of the matter.
1. The European Data Protection Board shall take decisions by a simple majority of its members., unless otherwise provided in its rules of procedure.
1. Any person who has suffered material or immaterial damage as a result of an unlawful processing operation or of an action incompatible with this Regulation shall have the right to receive compensation from the controller or the processor for the damage suffered. It is in the responsibility of the processor to prove that the damage was not caused by him.
2a. In applying the penalties referred to in paragraph 1 Member States shall show full respect for the principle of ne bis in idem, meaning that penalties may not be imposed twice regarding the same infringement of this Regulation.
1. Each supervisory authority shall be empowered to impose administrative sanctions in accordance with this Article. The supervisory authorities shall cooperate with each other in accordance with Articles 46 and 57 to guarantee a consistent level of sanctions within the Union.
2. The administrative sanction shall be in each individual case effective, proportionate and dissuasive. The amount of the administrative fine shall be fixed with due regard to the nature, gravity and duration of the breach, the intentional or negligent character of the infringement, the degree of responsibility of the natural or legal person and of previous breaches by this person, the technical and organisational measures and procedures implemented pursuant to Article 23 and the degree of co-operation with the supervisory authority in order to remedy the breach.
2a. In order to determine the type, the level and the amount of the administrative sanction, the supervisory authority shall take into account all relevant circumstances, with due regard to the following criteria: (a) the possession of a valid "European Data Protection Seal" pursuant to Article 39, by the controller or the processor; (b) the nature, gravity and duration of the infringement; (c) the intentional or negligent character of the infringement; (d) the degree of responsibility of the natural or legal person and of previous infringements by this person; (e) the technical and organisational measures and procedures implemented pursuant to Articles 23 and 30, such as pseudonymisation; (f) the specific categories of personal data affected by the infringement; (g) the repetitive nature of the infringement; (h) the degree of harm suffered by data subjects, (i) the pecuniary interest leading to the infringement by the person responsible and the level of the profits gained or losses avoided by the person responsible, insofar as they can be determined; (j) the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate the possible adverse effects of the infringement; and (k) the refusal to cooperate with or obstruction of inspections, audits and controls carried out by the supervisory authority pursuant to Article 53.
4. The supervisory authority shall impose a fine up to that shall not exceed 250 000 EUR, or in case of an enterprise up to 0,5 1 % of its annual worldwide turnover, to anyone who, intentionally or negligently: (a) does not provide the mechanisms for requests by data subjects or does not respond promptly or not in the required format to data subjects pursuant to Articles infringes Article 12(1) and (2); (b) charges a fee for the information or for responses to the requests of data subjects in violation of Article 12(4).).
5. The supervisory authority shall impose a fine up to that shall not exceed 500 000 EUR, or in case of an enterprise up to 1 2 % of its annual worldwide turnover, to anyone who, intentionally or negligently: (a) does not provide the information, or does provide incomplete information, or does not provide the information in a sufficiently transparent manner, to the data subject pursuant to Article 11, Article infringes Articles 11, 12(3) and Article 14; (b) does not provide access for the data subject or does not rectify personal data pursuant to Articles 15 and 16 or does not communicate the relevant information to a recipient pursuant to Article 13; (c) does not comply with the right to be forgotten or to erasure, or fails to put mechanisms in place to ensure that the time limits are observed or does not take all necessary steps to inform third parties that a data subjects requests to erase any links to, or copy or replication of the personal data pursuant Article 17; (d) does not provide a copy of the personal data in electronic format or hinders the data subject to transmit the personal data to another application in violation of Article 18; (e) does not or not sufficiently determine the respective responsibilities with co- controllers pursuant to Article 24; (f) does not or not sufficiently maintain the documentation pursuant to Article 28, Article 31(4), and Article 44(3); (g) does not comply, in cases where special categories of data are not involved, pursuant to Articles (4), 13, 14, 15, 16, 17, 18, 24, 28, 31(4), 44(3), 80, 82 and 83 with rules in relation to freedom of expression or with rules on the processing in the employment context or with the conditions for processing for historical, statistical and scientific research purposes., 83.
6. The supervisory authority shall impose a fine up to that shall not exceed 1 000 000 EUR or, in case of an enterprise up to 2 5 % of its annual worldwide turnover, to anyone who, intentionally or negligently: (a) processes personal data without any or sufficient legal basis for the processing or does not comply with the conditions for consent pursuant to Articles 6, 7 and 8; (b) processes special categories of data in violation of Articles 9 and 81; (c) does not comply with an objection or the requirement pursuant to Article 19; (d) does not comply with the conditions in relation to measures based on profiling pursuant to Article 20; (e) does not adopt internal policies or does not implement appropriate measures for ensuring and demonstrating compliance pursuant to Articles 22, 23 and 30; (f) does not designate a representative pursuant to Article 25; (g) processes or instructs the processing of personal data in violation of the obligations in relation to processing on behalf of a controller pursuant to Articles 26 and 27; (h) does not alert on or notify a personal data breach or does not timely or completely notify the data breach to the supervisory authority or to the data subject pursuant to Articles 31 and 32; (i) does not carry out a data protection impact assessment pursuant or processes personal data without prior authorisation or prior consultation of the supervisory authority pursuant to Articles 33 and 34; (j) does not designate a data protection officer or does not ensure the conditions for fulfilling the tasks pursuant to Articles 35, 36 and 37; (k) misuses a data protection seal or mark in the meaning of Article 39; (l) carries out or instructs a data transfer to a third country or an international organisation that is not allowed by an adequacy decision or by appropriate safeguards or by a derogation pursuant to Articles 40 to 44; (m) does not comply with an order or a temporary or definite ban on processing or the suspension of data flows by the supervisory authority pursuant to Article 53(1); (n) does not comply with the obligations to assist or respond or provide relevant information to, or access to premises by, the supervisory authority pursuant to Article 28(3), Article 29, Article 34(6) and Article 53(2); (o) does not comply with the rules for safeguarding professional secrecy pursuant to Article 84. infringes the provisions of this Regulation other than those referred to in paragraphs 4 and 5.
7. The Commission shall be empowered to adopt , after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of updating the absolute amounts of the administrative fines referred to in paragraphs 4, 5 and 6, taking into account the criteria referred to in paragraph 2. and the development of standard costs of living.
1. Member States shall provide for exemptions or derogations from the provisions on the general principles in Chapter II, the rights of the data subject in Chapter III, on controller and processor in Chapter IV, on the transfer of personal data to third countries and international organisations in Chapter V, the independent supervisory authorities in Chapter VI and on co-operation and consistency in Chapter VII for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression whenever it is necessary in order to reconcile the right to the protection of personal data with the rules governing freedom of expression. in accordance with the Charter of Fundamental Rights of the European Union.
3. The Commission shall be empowered to adopt , after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point (b) of paragraph 1, as well as criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1.
1. Within the limits of 1. In accordance with the rules set out in this Regulation, Member States may adopt by law , in accordance with national law and practices, adopt specific rules regulating the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. This is without prejudice to the Member States right to promote or permit collective agreements concluded between social partners which are more favourable to workers. The level of protection of this Regulation is to be the minimum standard by law or collective agreements.
2a. In case of obligatory medical examinations and qualifying tests of applicants the data subject must be informed before the data is collected.
2b. Open optical - electronic control or biometric devices are only allowed in exceptional cases and only with the consent of the workers representatives. The conditions for control are to be laid down through law or collective agreements.
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1.
3a. Trade unions have the right to represent the workers concerned when taking a complaint to the supervisory authority, or when seeking a judicial remedy.
3b. On a proposal from the Commission, the European Parliament and the Council shall review this Article no later than 2 years after the date referred to in Article 91(2).
2a. Member States can adopt specific measures to regulate the processing of personal data for historical, statistical or scientific purposes while respecting the provisions of paragraphs 1 and 2 of this Article as well as respecting fundamental rights as enshrined in the Charter of fundamental rights of the European Union.
2b. Each Member State shall notify to the Commission those provisions which it adopts pursuant to paragraph 1b, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the processing of personal data for the purposes referred to in paragraph 1 and 2 as well as any necessary limitations on the rights of information to and access by the data subject and detailing the conditions and safeguards for the rights of the data subject under these circumstances.
Article 85a General provision on Fundamental Rights The provisions of this Regulation shall guarantee the consistent application of the Charter of Fundamental Rights of the European Union and fundamental legal principles as enshrined in Article 6 of the Treaty on European Union.
2. The delegation of power referred to in Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(7), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 336), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3) [Articles XXX] shall be conferred on the Commission for an indeterminate period of time from the date of entry into force of this Regulation.
3. The delegation of power referred to in Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(7), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 33(6), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3) [Articles XXX] may be revoked at any time by the European Parliament or by the Council. A decision of revocation shall put an end to the delegation of power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
5. A delegated act adopted pursuant to Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(7), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 33(6), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3) [Articles XXX] shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of twofour months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or the Council.
3. Where reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply.
Article 89a Data processing by EU Institutions, bodies, offices and agencies The Commission shall present by the date specified in Article 91(2) at the latest and, without delay a proposal for the revision of the legal framework applicable to the processing of personal data by the Union institutions, bodies, offices and agencies, to bring them in line with this Regulation with a view to ensuring consistent and homogeneous legal rules relating to the fundamental right to the protection of personal data in the European Union.