Germany ALDE

Alexander Alvaro

Country: Germany
Group: Alliance of Liberals and Democrats for Europe (ALDE)
Party: Freie Demokratische Partei (FDP)

Substitute of Civil Liberties, Justice and Home Affairs
Substitute of Budgets

Overview Alexander Alvaro

Amendments: 242
...stronger: 70
...weaker: 85
...neutral: 87

Amendments by Alexander Alvaro

(19) Any processing of personal data of data subjects residing in the Union in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union or not. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in this respect.
 
(23) The principles of protection should apply to any information concerning an identified or identifiable person. To determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual. It should be taken into account, whether personal identifiers have been removed and whether the link to these personal identifiers is still maintained so the data can be attributed to a data subject by anyone who has access to the linking codes. The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable.
 
(24) When using online or offline services, individuals may be associated with online identifiers provided by their devices, applications, tools and protocols or other consumer goods, such as Internet Protocol addresses or cookie identifiers, RFID tags and other unique identifiers. This may leave traces which, combined with unique identifiers and other information received by the servers, may be used to create profiles of the individuals and identify them. It follows that identification numbers, location data, online identifiers or other specific factors as such need not necessarily be considered as personal data in all circumstances.
  Comment: Intention unclear
(29a) The same personal data can have different significance depending on the context of and the risks represented by its processing. Controllers should therefore implement appropriate technical and organisational measures and procedures in respect to the contexts of and the risks represented by the data processing.
 
(37) The processing of personal data should equally be regarded as lawful where it is necessary to protect an interest which is essential for the data subject’s life. or processing is necessary for the purposes of ensuring the ability of a network or an information system to resist accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity or confidentiality of stored or transmitted data and the security of the related services offered by or accessible via these networks and systems.
 
(38) The legitimate interests of a controller may provide a legal basis for processing, provided that the interests or the legitimate expectations of the data subject based on his or her relationship with the controller or the fundamental rights and freedoms of the data subject which require protection of personal data are not overriding the interests of the controller or the rights and freedoms of the controller to conduct a business. This would need careful assessment in particular where the data subject is a child, given that children deserve specific protection. The data subject should have the right to object the processing, on grounds relating to their particular situation and free of charge. To ensure transparency, the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object, and also be obliged to document these legitimate interests. Given that it is for the legislator to provide by law the legal basis for public authorities to process data, this legal ground should not apply for the processing by public authorities in the performance of their tasks.
 
(46a) Data subjects should be informed about the data processing operations employed by the entity they are interacting with without being overwhelmed by the sheer amount of information they are provided with. A transparent and understandable information policy is therefore a pivotal element of every data processing framework. In order to allow a quicker understanding and better comparability of data protection policies, when providing information to the data subject, controllers should disclose short icon based information policies before laying down in detail their information policies. These icon based information policies should be standardized so that they can be provided in written and electronic form and be also easily readable on mobile devices. Detailed explanations or further remarks can follow as part of the more detailed information provisions to the data subjects. When provided electronically, the standardized information policies should be machine readable to allow for innovative implementation schemes.
 
(53) Any person should have the right to have personal data concerning them rectified and a ‘right to be forgotten’ where the retention of such data is not in compliance with this Regulation. In particular, data subjects should have the right that their personal data are erased and no longer processed, where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed, where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this Regulation. This right is particularly relevant, when the data subject has given their consent as a child, when not being fully aware of the risks involved by the processing, and later wants to remove such personal data especially on the Internet. However, the further retention of the data should be allowed where it is necessary for historical, statistical and scientific research purposes, for reasons of public interest in the area of public health, for exercising the right of freedom of expression, when required by law or where there is a reason to restrict the processing of the data instead of erasing them.
 
(54) To strengthen the ‘right to be forgotten’ in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform third parties which are processing such data that a data subject requests them to erase any links to, or copies or replications of that personal data. To ensure this information, the controller should take all reasonable steps, including technical measures, in relation to data for the publication of which the controller is responsible. In relation to a third party publication of personal data, the controller should be considered responsible for the publication, where the controller has authorised the publication by the third party.
 
(58) Every natural person should have the right not to be subject(58) A data subject should only be subjected to a measure which is based on profiling by means of automated processing. However, such measure should be allowed when expressly authorised by law, carried out in the course of entering or performance of a contract, or when , if the processing is based on the grounds of lawful processing and is accompanied by a Union or Member State law which also lays down suitable measures to safeguard the data subject has given his consent. In any case, such processing should be subject to suitable safeguards, including specific information of the data subject and the ’s legitimate interests. Every natural person should have the right to obtain human intervention and that such measure should not concern a child.object to being subject to measures based on profiling.
 
(61) The protection of the rights and freedoms of data subjects with regard to the processing of personal data require that appropriate technical and organisational measures are taken, both at the time of the design of the processing and at the time of the processing itself, to ensure that the requirements of this Regulation are met. In order to ensure and demonstrate compliance with this Regulation, the controller should persistently respect the autonomous choices of data subjects and adopt internal policies and implement appropriate measures, which meet in particular the principles of data protection by design and data protection by default.
 
(70) Directive 95/46/EC provided for a general obligation to notify processing of personal data to the supervisory authorities. While this obligation produces administrative and financial burdens, it did not in all cases contribute to improving the protection of personal data. Therefore such indiscriminate general notification obligation should be abolished, and replaced by effective procedures and mechanism which focus instead on those processing operations which are likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes. In such cases, a data protection impact assessment should be carried out by the controller or processor prior to the processing, which should include in particular the envisaged measures, safeguards and mechanisms for ensuring the protection of personal data and for demonstrating the compliance with this Regulation..
 
(71) This should in particular apply to newly established large scale filing systems, which aim at processing a considerable amount of personal data at regional, national or supranational level and which could affect a large number of data subjects.
 
(71a) Controllers should focus on the protection of personal data throughout the entire data lifecycle from collection to processing to deletion by investing from the outset in a sustainable data management framework and by following it up with a comprehensive compliance mechanism.
 
(71b) Every data controller should first conduct a risk analysis of data processing operations, analyzing the specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, assessing which obligations laid down in this Regulation need to be complied with. The risk analysis should be updated, if any of the mentioned criteria change and it should be documented, if its results do not require a data protection impact assessment to be carried out.
 
(71c) Impact assessments are the essential core of any sustainable data protection framework, making sure that businesses are aware from the outset of all possible consequences of their data processing operations. If impact assessments are thorough, the likelihood of any data breach or privacy-intrusive operation can be fundamentally limited. Data protection impact assessments should consequently have regard to the entire lifecycle management of personal data from collection to processing to deletion, describing in detail the envisaged processing operations, the risks to the rights and freedoms of data subjects, the measures envisaged to address the risks, safeguards, security measures and mechanisms to ensure compliance with the regulation.
 
(74a) Impact assessments can only be of help, if businesses make sure that they are complying with the promises originally laid down in them. Data controllers should therefore conduct periodic data protection compliance reviews demonstrating that the data processing mechanisms in place comply with assurances made in the data protection impact assessment. It should further demonstrate the ability of the data controller to comply with the autonomous choices of data subjects. In addition, in case the review finds compliance inconsistencies, it should highlight these and present recommendations on how to achieve full compliance.
 
(77) In order to enhance transparency and compliance with this Regulation, the establishment of certification mechanisms, supervisory authorities should award controllers and processors which properly apply this Regulation with the same standardised data protection seals and marks should be encouraged, allowing mark, the ‘European Data Protection Seal’. When certifying controllers, supervisory authorities should apply the same standards but decide freely on the fees for the certification. The European Data Protection Seal should create trust among data subjects to quickly assess the level of , legal certainty for controllers and at the same time export European data protection of relevant products and services.standards by allowing non-European companies to more easily enter European markets by being certified.
 
(120) In order to strengthen and harmonise administrative sanctions against infringements of this Regulation, each supervisory authority should have the power to sanction administrative offences. This Regulation should indicate these offences and the upper limit for the related administrative fines, which Administrative fines should be fixed in each individual case proportionate to the specific situation, with due regard in particular to the nature, gravity and duration of the breach, the procedures implemented in respect to the contexts of and risks represented by the data processing, the degree of responsibility of the natural or legal person and of previous breaches by this person, the degree of technical and organisational measures and procedures implemented, as well as the degree of co- operation with the supervisory authority. The consistency mechanism may also be used to cover divergences in the application of administrative sanctions.
 
(130) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission for: specifying standard forms in relation to the processing of personal data of a child; standard procedures and forms for exercising the rights of data subjects; standard forms for the information to the data subject; standard forms and procedures in relation to the right of access; the right to data portability; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation; specific requirements for the security of processing; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject; standards and procedures for a data protection impact assessment; forms and procedures for prior authorisation and prior consultation; technical standards and mechanisms for certification; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation; disclosures not authorized by Union law; mutual assistance; joint operations; decisions under the consistency mechanism. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers. In this context, the Commission should consider specific measures for micro, small and medium- sized enterprises.
  Comment: Result depends on other changes. Intention unclear.
(131) The examination procedure should be used for the adoption of specifying standard forms in relation to the consent of a child; standard procedures and forms for exercising the rights of data subjects; standard forms for the information to the data subject; standard forms and procedures in relation to the right of access;, the right to data portability; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation; specific requirements for the security of processing; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject; standards and procedures for a data protection impact assessment; forms and procedures for prior authorisation and prior consultation; technical standards and mechanisms for certification; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation; disclosures not authorized by Union law; mutual assistance; joint operations; decisions under the consistency mechanism, given that those acts are of general scope.
  Comment: Result depends on other changes. Intention unclear.
(b) by the Union institutions, bodies, offices and agencies;
 
(d) by a natural person without any gainful interest , who does not make the data accessible to an indefinite number of people in the course of its own exclusively personal or household activity;
 
(ea) that has been anonymised.
 
1. This Regulation applies to the processing of personal data of data subjects residing in the Union in the context of the activities of an establishment of a controller or a processor in the Union.
 
2. This Regulation applies to the processing of personal data of data subjects residing in the Union by a controller not established in the Union, where the processing activities are related to: (a) the offering of goods or services to such data subjects or a processor not established in the Union; or (b) the monitoring of their behaviour..
  Comment: May be in conflict with international law.
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where the national law of a Member State applies by virtue of public international law.
 
(1) ‘data subject’ means an identified natural person or a natural person who can be identified, directly or indirectly, by means reasonably likely to be used by the controller or by any other natural or legal person, in particular by reference to an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person;
  Comment: Depends on replacement.
(2) ‘personal data’ means shall mean any information relating to a an identified or identifiable natural person (‘data subject;’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to the person’s physical, physiological, genetic, mental, economic, cultural or social identity (‘personal identifiers’);
 
(2a) ‘pseudonymised data’ means personal data where personal identifiers have been removed, but where the link to these personal identifiers is still maintained so the data can be attributed to a data subject by anyone who has access to the linking codes;
  Comment: Dependent on the attached consequences, but exceptions for pseudonymous data are always leading to less protection.
(2b) ‘anonymised data’ means data, which is impossible to be attributed to a data subject in any manner because all references to personal identifiers have been removed permanently and completely; therefore anonymised data is not subject to this Regulation;
 
(2c) ‘encrypted data’ means personal data, which through technological protection measures is rendered unintelligible to any person who is not authorised to access it;
 
(2d) ‘profiling’ means the aggregation, classification and recording of information based on a data subject’s personal data or pseudonymised data aiming to analyse behavioural patterns of the individual data subject;
 
(5) ‘controller’ means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes, conditions and means of the processing of personal data; where the purposes, conditions and means of processing are determined by Union law or Member State law, the controller or the specific criteria for his nomination may be designated by Union law or by Member State law;
 
(7a) ‘third party’ means any natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorized to process the data;
  Comment: Depends on consequences.
(8) ‘the data subject’s consent’ means any freely given specific, informed and explicit indication of his or her wishes by which the data subject, either by a statement or by a clear affirmative action, signifies agreement to personal data relating to them being processed; by ‘clear affirmative action’ is meant any unequivocal action that is the result of choice and that implies, for its complete execution, a necessary data processing;
 
(9) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
 
(10) ‘genetic data’ means all data, of whatever type, concerning the personal data, relating to the genetic characteristics of an individual which are have been inherited or acquired during early prenatal development; as they result from an analysis of a biological sample from the individual in question, in particular by chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis or analysis of any other element enabling equivalent information to be obtained;
  Comment: Intention unclear.
(11) ‘biometric data’ means any personal data relating to the physical, physiological or behavioural characteristics of an individual which allow their unique identification, such as facial images, or dactyloscopic data;
 
(13) ‘main establishment’ means as regards the controller, the place of its establishment in the Union where the main decisions as to the purposes, conditions and means of the processing of personal data are taken; if no decisions as to the purposes, conditions and means of the processing of personal data are taken in the Union, the main establishment is the place where the main processing activities in the context of the activities of an establishment of a controller in the Union take place. As regards the processor, ‘main establishment’ means the place of its central administration in the Union;, and if it has no central administration in the Union the main establishment is the place where the main processing activities take place. As regard to any natural or legal person, public authority, agency or any other body which acts both as a controller and as a processor, ‘main establishment’ means the place where it is determined to have its main establishment in its capacity of controller;
 
(14) ‘representative’ means any natural or legal person established in the Union who, explicitly designated by the controller, acts and may be addressed by any supervisory authority and other bodies in the Union instead of the controller, with regard to the obligations of the controller under this Regulation;
 
(18) ‘child’ means any person below the age of 18 years;14 years;
 
Article 5a Respect to context Controllers in cooperation with processors shall implement appropriate technical and organisational measures and procedures in respect to the context of the data processing, in particular where: (a) processing of personal data is carried out in the context of product and service fulfilment; (b) processing of personal data is carried out solely in the context of fraud prevention or is strictly necessary to ensure network and information security and the security of related services; (c) processing of personal data is carried out in the context of legal, regulatory or law enforcement obligations which the controller is subject to in the Union; (d) processing of personal data is carried out in the context of internal processing operations such as accounting and controlling or business to business data transfers; (e) processing of personal data is carried out in the context of journalistic, artistic or literary expression; (f) processing of personal data is carried out in the context of historical, statistical and scientific research; (g) processing of personal data is carried out in the employment context. (h) processing of personal data is carried out in the health context.
  Comment: "Risk Based Approach" that does not seem to be more strict than the proposal.
Article 5b Respect to risk Controllers shall implement appropriate technical and organisational measures and procedures in respect to the risks represented by the data processing, in particular where: (a) personal data of more than 5000 data subjects during any consecutive 12-month period are processed; (b) special categories of data as laid down in Article 9.1 are processed; (c) personal data of children are processed; (d) not solely pseudonymised data are processed; (e) processing operations in case of a breach may adversely affect the personal data or privacy of the data subject causing identity theft, financial or physical harm or significant humiliation or damage to reputation; (f) a systematic and extensive evaluation is carried out as referred to under Article 4, paragraph 1, point 2 d (new); (g) information on sex life, health, race and ethnic origin or for the provision of health care, epidemiological researches, or surveys of mental or infectious diseases are processed and where the data are processed for taking measures or decisions regarding specific individuals on a large scale; (h) publicly accessible areas are monitored, especially when using optic- electronic devices (video surveillance) on a large scale; (i) personal data are processed in large scale filing systems on genetic data or biometric data; (j) processing operations require the consultation of the supervisory authority pursuant to point (b) of Article 34(2).
  Comment: "Risk Based Approach" that does not seem to be more strict than the proposal.
Article 5c Processing not allowing direct identification 1. If the data processed by a controller do not permit the controller to directly identify a natural person, the controller shall not be obliged to acquire additional information in order to directly identify the data subject for the sole purpose of complying with any provision of this Regulation. 2. Where the data controller is unable to comply with a provision of this Regulation because the data processed by the controller do not permit the controller to directly identify a natural person, the controller shall not be obliged to comply with that particular provision of this Regulation.
  Comment: "Risk Based Approach" that does not seem to be more strict than the proposal.
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;solely carried out in the context referred to under Article 5a(2), (3) or (6) in accordance with Article 83;
  Comment: "Risk Based Approach" that does not seem to be more strict than the proposal.
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or in the third party to which the data are transferred;
 
(f) processing is necessary for the purposes of the legitimate interests pursued by a controller, except where such interests are overridden by the the controller or by the third party or parties to whom the data are disclosed and of the legitimate expectations of the data subject based on his or her relationship with the controller, taking into account the interests or rights and freedoms of the controller to conduct a business as well as the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This shall not apply to processing carried out by public authorities in the performance of their tasks.
 
(fa) processing is necessary for the purposes of ensuring the ability of a network or an information system to resist accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity or confidentiality of stored or transmitted data and the security of the related services offered by or accessible via these networks and systems;
 
1a. Processing of pseudonymized data shall be lawful.
 
2. Processing of personal data which is necessary for the purposes of historical, statistical or scientific research shall be lawful subject to the conditions and safeguards referred to in Article 83.
 
3. The basis oflegal basis for the processing referred to in points (c) and (point (e) of paragraph 1 must be provided for in:
 
The law In these provisions the lawfulness of the Member State must meet an objective of public interest or processing can be further specified, particularly in relation to the controller, to the purpose of the processing and the limitation of such purpose, to the nature of the data and to the data subjects, to the processing operations and the processing procedures, and to the recipients of personal data as well as to the duration of storage. The provisions of Union law and of the law of the Member State must be necessary to protect the rights and freedoms of others, must respect the essence of fundamental rights and fundamental freedoms, in particular of the right to the protection of personal data and be proportionateappropriate to the legitimate aim pursued. by the processing.
 
3a. In case of processing based on point (f) of paragraph 1, the controller shall inform the data subject about this explicitly as well as the data subject's right to object pursuant to Article 19(2).
 
4. Where the purpose of further processing is not compatible with the one for which the personal data have been collected, the processing must have a legal basis at least in one of the grounds referred to in points (a) to (efa) of paragraph 1. This shall in particular apply to any change of terms and general conditions of a contract.
 
5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the conditions referred to in point (f) of paragraph 1 for various sectors and data processing situations, including as regards the processing of personal data related to a child.
 
1. The 1. Where data is processed pursuant to Article 6 paragraph 1(a) the controller shall bear the burden of proof for the data subject's consent to the processing of their personal data for specified purposes..
 
3. The 3. Without prejudice to the data subject 's existing contractual obligations, the data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. It is lawful that the withdrawal of consent might result in the termination of the relationship with the controller.
 
4. Consent shall not provide a legal basis for the processing, where there is a significant imbalance between the position of the data subject and the controller.
 
4a. The required form of consent shall reflect the principles laid down in Articles 5a, 5b and 5c as well as the result of the data protection risk analysis referred to in Article 33.
  Comment: The overall concept of a "risk based approach" seems to lead to less protection.
1. For the purposes of this Regulation, in relation to the offering of information societygoods or services directly to a child, the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child's parent or custodianlegal representative. The controller shall make reasonable efforts to obtain verifiable consent, taking into consideration available technology.
 
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for thelaying down standard forms for specific methods to obtain verifiable consent referred to in paragraph 1. In doing so, the Commission shall consider specific measures for micro, small and medium-sized enterprises.
 
4. The Commission may lay down standard forms for specific methods to obtain verifiable consent referred to in paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria, conditions and appropriate safeguards for the processing of the special categories of personal data referred to in paragraph 1 and the exemptions laid down in paragraph 2.
 
Processing not allowing identification If the data processed by a controller do not permit the controller to identify a natural person, the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation.Article 10 deleted
  Comment: Moved to another Article.
2. The controller shall provide any information and any communication relating to the processing of personal data to the data subject in an intelligible form, using clear and plain language, adapted to the data subject, in particular for any information addressed specifically to a child.
 
1. The controller shall establish procedures for providing the information referred to in Article 14 and for the exercise of the rights of data subjects referred to in Article 13 and Articles 15 to 19. The controller shall provide in particular mechanisms for facilitating the request for the actions referred to in Article 13 and Articles 15 to 19. Where personal data are processed by automated means, the controller shallmay also provide means for requests to be made electronically.
 
2. The controller shall inform the data subject without delay and, at the latest within one month of receipt of the request, whether or not any action has been taken pursuant to Article 13 and Articles 15 to 19 and shall provide the requested information. This period may be prolonged for a further month, if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller. The information shall be given in writing. Where the data subject makes the request in electronic form, the information shallmay be provided in electronic form, unless otherwise requested by the data subject.
 
4. The information and the actions taken on requests referred to in paragraph 1 shall be free of charge. Where requests are manifestly excessive, in particular because of their repetitive character or their complexity, the controller may charge a fee for providing the information or taking the action requested, or the controller may not take that reflects the administrative costs for providing the information or taking the action requested. In that case, the controller shall bear the burden of proving the manifestly excessive character of the request.
 
5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for the manifestly excessive requests and the fees referred to in paragraph 4.
 
6. The Commission may lay shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of laying down standard forms and specifying standard procedures for the communication referred to in paragraph 2, including the electronic format. In doing so, the Commission shall take the appropriate measures for micro, small and medium-sized enterprises. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
(a) whether personal data are collected beyond the minimum necessary for each specific purpose Article 13a Standardized information policies 1. Where at least one of the processing; (b) whether personal data are retained beyond the minimum necessary for each specific purpose of the processing; (c) whether personal data are processed for purposes other than the purposes for which they were collected; (d) whether personal data are disseminated to non-public third parties for purposes other than the purposes for which they were collected; (e) whether personal data are sold; (f) whether risk factors referred to under Article 5b(1) to (10) exists and where personal data are retained in encrypted form. 2. The particulars referred to in paragraph 1 shall be presented pursuant to Annex X in an aligned tabular format, using text and symbols, in the following three columns: (a) the first column depicts graphical forms symbolising those particulars; (b) the second column contains essential information describing those particulars; (c) the third column depicts graphical forms indicating whether a specific particular is met. 3relating to a data subject are collected, the controller shall provide the data subject with the following particulars before providing information pursuant to Article 14: Article 14. 5. The information referred to in paragraphs 1 and 2 Commission shall be presented in an easily visible and clearly legible way and shall appear in a language easily understood by the consumers of the Member States to whom the information is provided. Where the particulars are presented electronically, they shall be machine readable. 4. Additional particulars shall not be provided. Detailed explanations or further remarks regarding the particulars empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the particulars referred to in paragraph 1 and their presentation as referred to in paragraph 1 may be provided together with the other information requirements pursuant to2 and in Annex X.
  Comment: Initial grading was "weaker" because of a technical problem. Grading was changed following an intervention by a user. Thank you!
1. Where none of the risk factors referred to under Article 5b(1) to (10) exist and where personal data relating to a data subject are collected, the controller shall provide the data subject with , on request, with the following information. Where at least the two of the risk factors referred to under Article 5b(1) to (10) exist and where personal data relating to a data subject are collected, the controller shall provide the data subject with at least the following information:.
 
(b) the specific purposes of the processing for which the personal data are intended as well as information regarding the security of the processing of personal data, including the contract terms and general conditions where the processing is based on point (b) of Article 6(1) and the legitimate interests pursued by the controller where the processing is based on point (f) of Article 6(1);
 
(c) the estimated period for which the personal data will be stored;
 
(f) the recipients or categories of recipients of the personal data;, in particular in the cases referred to in Article 20;
 
(ga) where applicable, information whether data was provided to law enforcement authorities during the last consecutive 12-month period, notwithstanding of Member States' law enforcement legislation;
 
3. Where the personal data are not collected from the data subject, the controller shall inform the data subject, in addition to the information referred to in paragraph 1, from which source the personal data originate., except where the data originate from a publicly available source or where the transfer is provided for by law.
 
(b) the data meant to serve solely the purposes of Article 83, are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort; or
 
(da) the data are processed by, are entrusted or become known to a person subject to legal professional privilege, professional secrecy regulated by the Member State, a statutory obligation of secrecy in the exercise of his profession or any like obligation not to reveal such data.
 
7. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria for categories of recipients referred to in point (f) of paragraph 1, the requirements for the notice of potential access referred to in point (g) of paragraph 1, the criteria for the further information necessary referred to in point (h) of paragraph 1 for specific sectors and situations, and the conditions and appropriate safeguards for the exceptions laid down in point (b) of paragraph 5. In doing so, the Commission shall take the appropriate measures for micro, small and medium-sized- enterprises.
 
8. The Commission may lay shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of laying down standard forms for providing the information referred to in paragraphs 1 to 3, taking into account the specific characteristics and needs of various sectors and data processing situations where necessary. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
(d) the estimated period for which the personal data will be stored;
 
(ha) a proof of the lawfulness of processing.
 
2. The data subject shall have the right to obtain from the controller communication of the personal data undergoing processing. Where the data subject makes the request in electronic form, the information shall be provided in electronic form, unless otherwise requested by the data subject. Without prejudice to Article 5c, the controller shall take all reasonable steps to verify the identity of a data subject requesting access to data.
 
2a. There shall be no right of access in accordance with paragraphs 1 and 2 when data within the meaning of Article 14(5)(da) are concerned, except if the data subject is empowered to lift the secrecy in question and acts accordingly.
 
2b. Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, it is not obliged to comply with the request, unless: (a) the other individual has explicitly consented to the disclosure of the information to the person making the request; or (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.
 
4. The Commission may specify shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying standard forms and procedures for requesting and granting access to the information referred to in paragraph 1, including for verification of the identity of the data subject and communicating the personal data to the data subject, taking into account the specific features and necessities of various sectors and data processing situations. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
Right to be forgotten and to erasureerasure
 
1. The data subject shall have the right to obtain from the controller the and the processor the erasure of personal data relating to them and the abstention from further dissemination of such data, especially in relation to personal data which are made available by the data subject while he or she was a child and, where applicable, from third parties the erasure of any links to, or copy or replication of that personal data, where one of the following grounds applies:
 
(a) the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; and are not required to pursue legal claims or when the legally mandatory minimum retention period has expired;
 
(ca) a court based in the Union has ruled as final and absolute that the data concerned must be erased;
 
1a. The application of paragraph 1 shall be dependent upon the ability of the data controller to verify the identity of the data subject requesting the erasure.
 
2. Where the controller 2. The controller or processor referred to in paragraph 1 has made the personal data public, it shall take all reasonable steps, including technical measures, in relation to data for the publication of which to have the data erased, where the controller is responsible, to inform third parties which are processing such data, that a data subject requests them to erase any links to, or copy or replication of that or the processor have authorized unlawfully according to Article 6: (a) the processing of personal data; (b) a transfer of personal data. Where the controller has authorised a third party to a third party; or (c) a publication of personal data, the controller shall be considered responsible for that publication. by a third party.
 
3. The controller or processor and, where applicable, the third party shall carry out the erasure without delay, except to the extent that the retention of the personal data is necessary:
 
(a) for exercising the right of freedom of expression (a) in the contexts referred to under Article 5a(3), (5), (6) and (8), in accordance with Article 80;Articles 80, 81 and 83 of this Regulation and Article 10 of the European Convention on Human Rights;
 
(b) for reasons of public interest in the area of public health in accordance with Article 81;
 
(c) for historical, statistical and scientific research purposes in accordance with Article 83;
 
(d) for compliance with a legal obligation to retain the personal data by Union or Member State law to which the controller is subject; Member State laws shall meet an objective of public interest, respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued;
 
4. Instead of erasure, the controller or processor shall restrict processing of personal data where:
 
6. Where processing of personal data is restricted pursuant to paragraph 4, the controller or processor shall inform the data subject before lifting the restriction on processing.
 
7. The controller or processor shall implement mechanisms to ensure that the time limits established for the erasure of personal data and/or for a periodic review of the need for the storage of the data are observed.
 
8. Where the erasure is carried out, the controller shall not otherwise process such personal data.
 
8a. Where pseudonymized data according to Article 4(2a) are processed, it is sufficient to erase all relating links to the data subject by removing these permanently and completely and therefore anonymizing the remaining data according to Article 4(2b) in order to comply with this Article.
 
9. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying: (a) the criteria and requirements for the application of paragraph 1 for specific sectors and in specific data processing situations; (b) the conditions for deleting links, copies or replications of personal data from publicly available communication services as referred to in paragraph 2; (c) the criteria and conditions for restricting the processing of personal data referred to in paragraph 4.
 
Right to data portabilityobtain data
 
1. The 1. Where the data subject shall have the right, has provided the personal data and where personal data are processed by electronic means and in a structured and commonly used format, , the data subject shall have the right to obtain from the controller a copy of data undergoing processing the provided personal data in an electronic and structured format which is commonly used and allows for further use by the data subject., without hindrance from the controller from whom the personal data are withdrawn.
 
2. Where the data subject has provided the personal data and the processing is based on consent or on a contract, the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system, into another one, in an electronic format which is commonly used, without hindrance from the controller from whom the personal data are withdrawn.
 
3. The Commission may specify the shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying the electronic format referred to in paragraph 1 and the technical standards, modalities and procedures for the transmission of personal data pursuant to paragraph 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
1. The data subject shall have the right to object, on grounds relating to their particular situation, at any time to the processing of personal data which is based on points (d), (e) and (f) of Article 6(1), unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject.).
 
1. Every natural person shall have the right not to beto object to being subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person, and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person's performance at work, economic situation, location, health, personal preferences, reliability or behaviour.measures based on profiling as defined under Article 4(2).
 
2. Subject to the other provisions of this Regulation, a person may be subjected to a measure of the kind referred to in paragraph 1 based on profiling only if the processing:
 
(a) is carried out in the course of the entering into, or performance of, a contract, where the request for the entering into or the performance of the contract, lodged by the data subject, has been satisfied or where suitable measures to safeguard the data subject's legitimate interests have been adduced, such as the right to obtain human intervention; or
 
(b) is expressly authorized by a Union or Member State law which also lays down suitable measures to safeguard the data subject's legitimate interests; or
 
(c) is based on the data subject's consent, subject to the conditions laid down in Article 7 and to suitable safeguards.grounds of Article 6 of this Regulation and is accompanied by a Union or Member State law which also lays down suitable measures to safeguard the data subject's legitimate interests.
 
4. In the cases referred to in paragraph 2, the 4. The information to be provided by the controller under Article 14 shall include information as to the existence of processing for a measure of the kind referred to in paragraph 1 and the envisaged effects of such processing on the data subject. as well as the result of the data protection risk analysis referred to in Article 33 as far as it concerns the data subject.
 
5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for suitable measures to safeguard the data subject's legitimate interests referred to in paragraph 2.
 
1. Union or Member State law may restrict or extend by way of a legislative measure the scope of the obligations and rights provided for in points (a) to (e) of Article 5 and Articles 11 to 2019 and Article 32, when such a restriction or extension constitutes a necessary and proportionate measure in a democratic society to safeguard:
 
(c) other public interests of the Union or of a Member State, in particular (c) an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters and the protection of market stability and integrity;
 
2. In particular, any legislative measure referred to in paragraph 1 shall comply with the standards of necessity and proportionality in accordance with Article 1 and shall contain specific provisions at least as to the objectivespurposes to be pursued by the processing and the determination of the controller.
 
1. The controller shall adopt policies and implement appropriate measures to having regard to state of the art technologies to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this Regulation.
 
2. The measures provided for in paragraph 1 shall in particular include: (a) keeping the documentation pursuant to Article 28; (b) implementing the data security requirements laid down in Article 30; (c) performing a data protection impact assessment pursuant to Article 33; (d) complying with the requirements for prior authorisation or prior consultation of the supervisory authority pursuant to Article 34(1) and (2); (e) designating a data protection officer pursuant to Article 35(1).
 
3. The controller shall implement mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2paragraph 1. If proportionate, this verification shallmay be carried out by independent internal or external auditors.
 
4. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying any further criteria and requirements for appropriate measures referred to in paragraph 1 other than those already referred to in paragraph 2, the conditions for the verification and auditing mechanisms referred to in paragraph 3 and as regards the criteria for proportionality under paragraph 3, and considering specific measures for micro, small and medium-sized-enterprises.
 
Article 22a Compliance Having regard to the state of the art and the cost of implementation, the controller shall take all reasonable steps to implement compliance policies and procedures that persistently respect the autonomous choices of data subjects. These compliance policies shall be reviewed at least every two years and updated where necessary.
 
1. Having regard to the contexts of and the risks represented by the data processing as laid down under Articles 5a and 5b, as well as having regard to the state of the art and the cost of implementation, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. Data protection by design shall have particular regard to the entire lifecycle management of personal data from collection to processing to deletion, systematically focusing on comprehensive procedural safeguards regarding the accuracy, confidentiality, integrity, physical security and deletion of personal data.
 
1a. In order to foster its widespread implementation in different economic sectors, data protection by design shall be a prerequisite for public procurement tenders according to the Directive of the European Parliament and of the Council on public procurement as well as according to the Directive of the European Parliament and of the Council on procurement by entities operating in the water, energy, transport and postal services sector (Utilities Directive).
 
2. The 2. Having regard to the contexts of and the risks represented by the data processing as laid down under Articles 5a and 5b, as well as having regard to the state of the art and the cost of implementation, the controller shall implement mechanisms for ensuring that, by default, only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected , disseminated or retained beyond the minimum necessary for those purposes, both in terms of the amount of the data and the time of their storage. In particular, those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals.
 
2a. Having regard to the contexts of and the risks represented by the data processing as laid down under Articles 5a and 5b, as well as having regard to the state of the art and the cost of implementation, the controller shall endeavour to implement by default data protection enhancing technologies.
 
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying any further criteria and requirements for appropriate measures and mechanisms referred to in paragraph 1 and 2, in particular for data protection by design requirements applicable across sectors, products and services.
 
4. The Commission may lay down technical standards for the requirements laid down in paragraph 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
Where a controller determines Where several controllers share personal data by determining the purposes, conditions and means of the processing of personal data jointly with others, the joint controllers shall determine their respective equally fulfil their responsibilities for compliance with the obligations under this Regulation, in particular as regards the procedures and mechanisms for exercising the rights of the data subject, by means of an arrangement between them.
 
(b) an enterprise employing fewer than 250 persons; or
 
(d) a controller offering only occasionally goods or services to data subjects residing in the Union., providing it processes personal data of less than 5000 data subjects during any consecutive 12-month period.
 
3. The representative shall be established in one of those Member States where the data subjects whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, reside.reside.
 
1. Where a processing operation processing is to be carried out on behalf of a controller, the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject, in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures.
  Comment: Initial grading was "weaker" due to a misunderstanding. Grading was changed following an intervention by a user. Thank you!
(b) employ only staff who have committed themselves to confidentiality or are under a statutory obligation of confidentiality;
 
(e) insofar as this is possible given the nature of the processing, create in agreement (e) supply the controller on request with the controller the necessary technical and organisational requirements for the fulfilment of the controller's obligation necessary information it needs to respond to requests for exercising the data subject's rights laid down in Chapter III;
 
(g) hand over all results to the controller after the end of the processing and , not process the personal data otherwise; and delete existing copies without prejudice to Union or Member State laws;
 
(h) make available to the controller and the supervisory authority all information necessary to control compliance with the obligations laid down in this Article.
 
4. If a processor processes personal data other than as instructed by the controller, the processor shall be considered to be a controller in respect of that processing and shall be subject to the rules on joint controllers laid down in Article 24..
 
4a. Where a processor processes pseudonymized data, it is of no difference to the rights and obligations of the processor, whether the controller or the processor holds the link to the personal identifiers which allow the data to be attributed to a data subject.
 
5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the responsibilities, duties and tasks in relation to a processor in line with paragraph 1, and conditions which allow facilitating the processing of personal data within a group of undertakings, in particular for the purposes of control and reporting.
 
1. Each controller and processor and, if any, the controller's representative, shall maintain documentation of all processing operations under its responsibility. 2. The documentation shall contain at least the following information: (a) the name and contact details of the controller, or any joint controller or processor, and of the representative, if any; (b) the name and contact details of the data protection officer, if any; (c) the purposes of the processing, including the legitimate interests pursued by the controller where the processing is based on point (f) of Article 6(1); (d) a description of categories of data subjects and of the categories of personal data relating to them; (e) the recipients or categories of recipients of the personal data, including the controllers to whom personal data are disclosed for the legitimate interest pursued by them; (f) where applicable, transfers of data to a third country or an international organisation, including the identification of that third country or international organisation and, in case of transfers referred to in point (h) of Article 44(1), the documentation of appropriate safeguards; (g) a general indication of the time limits for erasure of the different categories of data; (h) the description of the mechanisms referred to in Article 22(3). 3. The controller and the processor and, if any, the controller's representative, shall make the documentation available, on request, to the supervisory authority. 4. The obligations referred to in paragraphs 1 and 2 shall not apply to the following controllers and processors: (a) a natural person processing personal data without a commercial interest; or (b) an enterprise or an organisation employing fewer than 250 persons that is processing personal data only as an activity ancillary to its main activities. 5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the documentation referred to in paragraph 1, to take account of in particular the responsibilities of the controller and the processor and, if any, the controller's representative. 6. The Commission may lay down standard forms for the documentation referred to in paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).Documentation deleted
 
1. The controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected, having regard to the state of the art and the costs of their implementation.
 
1a. Having regard to the state of the art and the cost of implementation, such a security policy shall include: (a) the ability to ensure that the integrity of the personal data is validated; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services processing personal data; (c) the ability to restore the availability and access to data in a timely manner in the event of a physical or technical incident that impacts the availability, integrity and confidentiality of information systems and services; (d) in the case of sensitive personal data processing according to Articles 8 and 9, additional security measures to ensure situational awareness of risks and the ability to take preventive, corrective and mitigating action in near real time against vulnerabilities or incidents detected that could pose a risk to the data; (e) a process for regularly testing, assessing and evaluating the effectiveness of security policies, procedures and plans put in place to ensure ongoing effectiveness.
 
2. The controller and the processor shall, following an evaluation of the risks, take the measures referred to in paragraph 1 to measures referred to in paragraph 1 shall at least: (a) ensure that personal data can be accessed only by authorised personnel for legally authorised purposes; (b) protect personal data stored or transmitted against accidental or unlawful destruction or , accidental loss and to prevent any unlawful forms of processing, in particular any unauthorised disclosure, dissemination or access, or alteration or alteration, and unauthorised or unlawful storage, processing, access or disclosure; and (c) ensure the implementation of a security policy with respect to the processing of personal data.
 
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for the technical and organisational measures referred to in paragraphs 1 and 2, including the determinations of what constitutes the state of the art, for specific sectors and in specific data processing situations, in particular taking account of developments in technology and solutions for privacy by design and data protection by default, unless paragraph 4 applies.
 
The Commission may adopt, where necessary, implementing acts for shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying the requirements laid down in paragraphs 1 and 2 to various situations, in particular to:
 
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 24 hours after having become aware of it, notify the personal data breach to the supervisory authority. The notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours.
 
6. The Commission may lay shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of laying down the standard format of such notification to the supervisory authority, the procedures applicable to the notification requirement and the form and the modalities for the documentation referred to in paragraph 4, including the time limits for erasure of the information contained therein. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
6. The Commission may lay shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of laying down the format of the communication to the data subject referred to in paragraph 1 and the procedures applicable to that communication. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
LIFECYCLE DATA PROTECTION IMPACT ASSESSMENT AND PRIOR AUTHORISATIONMANAGEMENT
 
Article 32a Data protection risk analysis 1. The controller shall carry out a risk analysis with regard to data processing operations, assessing whether at least two of the risk factors referred to under Article 5b(1) to (10) exist. 2. Where at least two of the risk factors referred to under Article 5b(1) to (10) exist, the controller or the processor acting on the controller's behalf shall carry out a data protection impact assessment pursuant to Article 33. 3. Where less than two of the risk factors referred to under Article 5b(1) to (10) exist, the risk analysis and its findings shall be documented. 4. The risk analysis shall be reviewed at the latest after one year, or immediately, if the nature, the scope or the purposes of the data processing operations change significantly.
  Comment: Initial grading was "weaker" due to a misunderstanding. Grading was changed following an intervention by a user. Thank you!
1. Where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, required pursuant to Article 32a (2), the controller or the processor acting on the controller's behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
  Comment: The overall concept seems to be vague and less strict.
2. The following processing operations in particular present specific risks referred to in paragraph 1: (a) a systematic and extensive evaluation of personal aspects relating to a natural person or for analysing or predicting in particular the natural person's economic situation, location, health, personal preferences, reliability or behaviour, which is based on automated processing and on which measures are based that produce legal effects concerning the individual or significantly affect the individual; (b) information on sex life, health, race and ethnic origin or for the provision of health care, epidemiological researches, or surveys of mental or infectious diseases, where the data are processed for taking measures or decisions regarding specific individuals on a large scale; (c) monitoring publicly accessible areas, especially when using optic-electronic devices (video surveillance) on a large scale; (d) personal data in large scale filing systems on children, genetic data or biometric data; (e) other processing operations for which the consultation of the supervisory authority is required pursuant to point (b) of Article 34(2).
 
3. The assessment shall contain at least a general description of the envisaged processing operations, an assessment of the risks have regard to the rights and freedoms of data subjects, the measures envisaged to address the risks, safeguards, security measures and mechanisms to ensure the protection of entire lifecycle management of personal data and to demonstrate compliance with this Regulation, taking into account the rights and legitimate interests of data subjects and other persons concerned. (b) a detailed breakdown of the contexts of the processing pursuant to Article 5a(1) to (8); (c) a list of the purposes of the processing and the legitimate interests pursued by the controller; (d) an assessment of the risks to the rights and freedoms of data subjects pursuant to Article 5b(1) to (10); (e) from collection to processing to deletion. It shall contain: (a) a description of categories of data subjects and of the categories of personal data relating to them; (f) a general indication of the time limits for erasure of the different categories of data; (g) a comprehensive data inventory, describing which category of data is stored where and how, and why the storage of the data is crucial to the end- user feature; (h) an explanation which data protection by design and default practices pursuant to Article 23 have been implemented; (i) a list of the recipients or categories of recipients of the personal data, including the controllers to whom personal data are disclosed for the legitimate interest pursued by them; (j) where applicable, a list of the foreseen transfers of data to a third country or an international organisation, including the identification of that third country or international organisation and, in case of transfers referred to in point (h) of Article 44(1), the documentation of appropriate safeguards; (k) the measures envisaged to address the risks, safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation, taking into account the rights and legitimate interests of data subjects and other personsthe envisaged processing operations; concerned.
  Comment: Initial grading was "weaker" because of a technical problem. Grading was changed following an intervention by a user. Thank you!
4. The controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of the processing operations.
 
5. Where the controller is a public authority or body and where the processing results from a legal obligation pursuant to point (c) of Article 6(1) providing for rules and procedures pertaining to the processing operations and regulated by Union law, paragraphs 1 to 4 shall not apply, unless Member States deem it necessary to carry out such assessment prior to the processing activities.
 
5a. The assessment shall be documented and lay down a schedule for regular periodic data protection compliance reviews pursuant to Article 33a(1).
 
5b. The assessment shall be updated without undue delay, if the results of the data protection compliance review referred to in Article 33a show compliance inconsistencies.
 
5c. The controller and the processor and, if any, the controller's representative, shall make the assessment available, on request, to the supervisory authority.
 
6. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for the processing operations likely to present specific risks referred to in paragraphs 1 and 2 and the requirements for the assessment referred to in paragraph 3, including conditions for scalability, verification and auditability. In doing so, the Commission shall consider specific measures for micro, small and medium- sized enterprises.
 
7. The Commission may specify standards and procedures for carrying out and verifying and auditing the assessment referred to in paragraph 3. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
Article 33a Data protection compliance review 1. At the latest two years after the carrying out of an impact assessment pursuant to Article 33(1), the controller or the processor acting on the controller's behalf shall carry out a compliance review. This compliance review shall demonstrate that the processing of personal data is performed in compliance with the data protection impact assessment. It shall further demonstrate the ability of the data controller to comply with the autonomous choices of data subjects in accordance with Article 23a. 2. The compliance review shall be carried out periodically at least once every two years, or immediately when there is a change in the specific risks presented by the processing operations. 3. Where the compliance review results show compliance inconsistencies, the compliance review shall include recommendations on how to achieve full compliance. 4. The compliance review and its recommendations shall be documented. The controller and the processor and, if any, the controller's representative, shall make the compliance review available, on request, to the supervisory authority.
 
Prior authorisation and prior consultationPrior consultation
 
1. The controller or the processor as the case may be shall obtain an authorisation from the supervisory authority prior to the processing of personal data, in order to ensure the compliance of the intended processing with this Regulation and in particular to mitigate the risks involved for the data subjects where a controller or processor adopts contractual clauses as provided for in point (d) of Article 42(2) or does not provide for the appropriate safeguards in a legally binding instrument as referred to in Article 42(5) for the transfer of personal data to a third country or an international organisation.
 
2. The controller or processor acting on the controller's behalf shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this Regulation and in particular to mitigate the risks involved for the data subjects where:where:
 
(a) a data protection impact assessment as provided for in Article 33 indicates that processing operations are by virtue of their nature, their scope or their purposes, likely to present a high degree of specific risks; or
 
(b) the supervisory authority deems it necessary to carry out a prior consultation on processing operations that are likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope and/or their purposes, and specified according to paragraph 4.; or
 
(ba) a controller adopts contractual clauses as provided for in point (d) of Article 42(2) or does not provide for the appropriate safeguards in a legally binding instrument as referred to in Article 42(5) for the transfer of personal data to a third country or an international organisation.
 
6. The controller or processor shall provide the supervisory authority , on request, with the data protection impact assessment provided for in pursuant to Article 33 and, on request, with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards.
 
8. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for determining the high degree of specific risk referred to in point (a) of paragraph 2.
 
9. The Commission may set shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of setting out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and paragraph 2, and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
(b) the processing is carried out by an enterprise employing 250 persons or more; or(b) at least two of the risk factors referred to under Article 5b(1) to (10) exist.
  Comment: Initial grading was "weaker" because of weak research. Grading was changed following an intervention by a user. Thank you!
(c) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects.
 
2. In the case referred to in point (b) of paragraph 1, a 2. A group of undertakings may appoint a single data protection officer.
 
2. The controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function. The data protection officer shall directly report to the executive management of the controller or the processor.
 
3. The controller or the processor shall support the data protection officer in performing the tasks and shall provide staff, premises, equipment , continuous education and any other resources necessary to carry out the duties and tasks referred to in Article 37.
 
(f) to monitor the performance of the data protection impact assessment by the controller or processor and the application for prior authorisation or prior consultation, if required pursuant Articles 33 and 34;
 
2. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for tasks, certification, status, powers and resources of the data protection officer referred to in paragraph 1.
 
2. Associations and other bodies representing categories of controllers or processors in one Member State which intend to draw up codes of conduct or to amend or extend existing codes of conduct may submit them to an opinion of the supervisory authority in that Member State. The supervisory authority may shall without undue delay give an opinion whether the draft code of conduct or the amendment is in compliance with this Regulation. The supervisory authority shall seek the views of data subjects or their representatives on these drafts.
 
3. Associations and other bodies representing categories of controllers or processors in several Member States may submit draft codes of conduct and amendments or extensions to existing codes of conduct to the Commission.
 
4. The Commission may adopt implementing acts for shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of deciding that the codes of conduct and amendments or extensions to existing codes of conduct submitted to it pursuant to paragraph 3 have general validity within the Union. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).
 
1. The Member States and the Commission shall encourage, in particular at European level, the establishment of data protection certification mechanisms and of data protection seals and marks, allowing data subjects to quickly assess the level of data protection provided by controllers and processors. The data protection certifications mechanisms shall contribute to the proper application of 1. Any controller or processor may request any supervisory authority in the Union, for a fee fixed by this authority, to certify that the processing of personal data is performed in compliance with this Regulation, taking account of the specific features of the various sectors and different as well as the contexts of and risks represented by the data processing operations.
 
1a. During this certification procedure, the supervisory authority may request specialised third parties to carry out the auditing of the controller or the processor on their behalf. The final certification shall be provided by the supervisory authority.
 
1b. The supervisory authorities shall co- operate with each other in accordance with Articles 46 and 57 to guarantee a harmonized level of data protection certification mechanisms within the Union. In this regard, supervisory authorities shall grant controllers and processors which comply with this Regulation the standardised data protection mark, the "European Data Protection Seal".
 
1c. The "European Data Protection Seal" shall be valid for as long as the data protection level of the certified controller or processor fully complies with this Regulation.
 
1d. Notwithstanding paragraph 1c, the "European Data Protection Seal" shall be valid for maximum five years.
 
3. The Commission may lay down technical shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of laying down standards for certification mechanisms and data protection seals and marks and mechanisms to promote and recognize certification mechanisms and data protection seals and marks. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).
 
(a) the rule of law, relevant legislation in force, both general and sectoral, including concerning public security, defence, national security and criminal law, the professional rules and security measures which are complied with in that country or by that international organisation, jurisprudential precedents as well as effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred;
 
3. The Commission may decide shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of deciding that a third country, or a territory or a processing sector within that third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
4. The implementingdelegated act shall specify its geographical and sectoral application, and, where applicable, identify the supervisory authority mentioned in point (b) of paragraph 2.
 
5. The Commission may decide shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of deciding that a third country, or a territory or a processing sector within that third country, or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, in particular in cases where the relevant legislation, both general and sectoral, in force in the third country or international organisation, does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2), or, in cases of extreme urgency for individuals with respect to their right to personal data protection, in accordance with the procedure referred to in Article 87(3).
 
7. The Commission shall publish in the Official Journal of the European Union and on its website a list of those third countries, territories and processing sectors within a third country and international organisations where it has decided that an adequate level of protection is or is not ensured.
 
1. Where the Commission has taken no decision pursuant to Article 41, a or decides that a third country, or a territory or a processing sector within that third country, or an international organisation does not ensure an adequate level of protection in accordance with Article 41 (5), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument.
 
(aa) a valid "European Data Protection Seal" pursuant to Article 39;
 
(b) standard data protection clauses adopted by the Commission. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2); or
 
3. A transfer based on standard data protection clauses or binding corporate rules as referred to in points (a), (b) or (c) of paragraph 2 shall not require any further authorisation.
 
(a) are legally binding and apply to and are enforced by every member within the controller's or processor's group of undertakings and their external subcontractors, and include their employees;
 
(a) the structure and contact details of the group of undertakings and its members; and their external subcontractors;
 
4. The Commission may specify the shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying the format and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules within the meaning of this Article. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).
 
3a. Each supervisory authority shall have the power to sanction administrative offences. Supervisory authorities may only issue sanctions for controllers or processors with their main establishment within the same Member State or, in coordination with Articles 56 and 57 if the supervisory authority of the main establishment fails to take action.
 
1. The supervisory authority shall act with complete independence in exercising the duties and powers entrusted to it., notwithstanding co-operative and consistency arrangements related to Chapter VII.
 
1a. Insofar as competent professional supervisory bodies for persons subject to legal professional privilege or professional secrecy exist at the time of the entry into force of the present Regulation, these bodies may establish the supervisory authority in respect of data processing by those over whom they exercise professional supervision.
 
2. Each supervisory authority shall promote the awareness of the public on risks, rules, safeguards and rights in relation to the processing of personal data and on appropriate measures for personal protection. Activities addressed specifically to children shall receive specific attention.
 
(ia) to certify controllers and processors pursuant to Article 39;
 
Each supervisory authority shall have the investigative power to obtain from the controller or the processor: without prior notice:
 
1. Supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective co- operation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and prompt information on the opening of cases and ensuing developments where data subjects in several Member States are likely to be affected by processing operations.
 
10. The Commission may specify the shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of specifying the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the European Data Protection Board, in particular the standardised format referred to in paragraph 6. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
4. Where the supervisory authority concerned intends not to follow the opinion of the Commission, it shall inform the Commission and the European Data Protection Board thereof within the period referred to in paragraph 1 and provide a justification. In this case the draft measure shall not be adopted for one further month.
 
1. In exceptional circumstances, where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects, in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages or for other reasons, by way of derogation from the procedure referred to in Article 58, it may immediately adopt provisional measures with a specified period of validity. The supervisory authority shall, without delay, communicate those measures, with full reasons, to the European Data Protection Board , the controller or processor concerned and to the Commission.
  Comment: No equal rights for data subjects.
Implementing actsDelegated acts
 
1. The Commission may adopt implementing acts for:shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of:
 
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
2. On duly justified imperative grounds of urgency relating to the interests of data subjects in the cases referred to in point (a) of paragraph 1, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 87(3). Those acts shall remain in force for a period not exceeding 12 months.
 
Article 63a Appealing procedures Without prejudice to the competences of the judiciary system of the Member States and of the Union, the European Data Protection Board can issue binding opinions if: (a) a data subject or a data controller appeals on ground of inconsistent application of this Regulation across the Member States; and (b) the consistency mechanism described in Articles 58 to 63 has failed to ensure that a simple majority of the members of the European Data Protection Board agrees on a measure. Before issuing such opinion, the European Data Protection Board shall take into consideration every relevant information the competent Data Protection Authority can provide, including the point of view of the interested parties.
 
(d) issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in Article 57; and Article 63a;
 
4a. Where appropriate, the European Data Protection Board shall, in its execution of the tasks as outlined in this Article, consult interested parties and give them the opportunity to comment within a reasonable period. The European Data Protection Board shall, without prejudice to Article 72, make the results of the consultation procedure publicly available.
 
1. Each 1. Without prejudice to the procedure described in Article 63a, each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them.or affecting them.
 
1. Any body, organisation or association referred to in Article 73(2) shall have the right to exercise the rights referred to in Articles 74 and 75 on behalf of one or more data subjects.
 
1. Any person who has suffered damage as a result of an unlawful processing operation or of an action incompatible with this Regulation shall have the right to receive compensation from the controller or the processor for the damage suffered.
 
2. Where more than one controller or processor is involved in the processing, each controller or processor shall be jointly and severally liable for the entire amount of the damage., to the extent that liability has not been already established in the determination of responsibilities as referred to in Article 24.
 
3. The controller or the processor may be exempted from this liabilitythe liability under paragraph 2, in whole or in part, if the controller or the processor proves that they are not respective controller proves not to be responsible for the event giving rise to the damage.
 
1. Each supervisory authority shall be empowered to impose administrative sanctions in accordance with this Article. The supervisory authorities shall co- operate with each other in accordance with Articles 46 and 57 to guarantee a harmonized level of sanctions within the Union.
 
1a. To anyone who does not comply with the obligations laid down in this Regulation, the supervisory authority shall impose at least one of the following sanctions: (a) a warning in writing; (b) regular periodic data protection audits; (c) a fine up to 100 000 000 EUR.
 
1b. If the controller or the processor is in possession of a valid "European Data Protection Seal" pursuant to Article 39, a fine pursuant to paragraph 2c) shall only be imposed in cases of intentional or negligent incompliance.
 
2. The administrative sanction shall be in each individual case effective, proportionate and dissuasive. The amount of the administrative fine shall be fixed with due regard to the nature, gravity and duration of the breach, the intentional or negligent character of the infringement, the degree of responsibility of the natural or legal person and of previous breaches by this person, the technical and organisational measures and procedures implemented pursuant to Article 23 and the degree of co-operation with the supervisory authority in order to remedy the breach.
 
2a. The administrative sanction shall take into account the following factors: (a) the nature, gravity and duration of the incompliance; (b) the procedures implemented in respect to the contexts of and risks represented by the data processing referred to under Articles 5a and 5b; (c) the degree of responsibility of the natural or legal person and of previous breaches by this person; (d) the degree of technical and organisational measures and procedures implemented pursuant to: (i) Article 23 - Data protection by design and by default; (ii) Article 23a - Compliance; (iii) Article 30 - Security of processing; (iv) Article 33 - Data protection impact assessment; (v) Article 33a - Data protection compliance review; (vi) Article 35 - Designation of the data protection officer; (e) the degree of co-operation with the supervisory authority.
 
3. In case of a first and non-intentional non-compliance with this Regulation, a warning in writing may be given and no sanction imposed, where: (a) a natural person is processing personal data without a commercial interest; or (b) an enterprise or an organisation employing fewer than 250 persons is processing personal data only as an activity ancillary to its main activities.
 
4. The supervisory authority shall impose a fine up to 250 000 EUR, or in case of an enterprise up to 0,5 % of its annual worldwide turnover, to anyone who, intentionally or negligently: (a) does not provide the mechanisms for requests by data subjects or does not respond promptly or not in the required format to data subjects pursuant to Articles 12(1) and (2); (b) charges a fee for the information or for responses to the requests of data subjects in violation of Article 12(4).
 
5. The supervisory authority shall impose a fine up to 500 000 EUR, or in case of an enterprise up to 1 % of its annual worldwide turnover, to anyone who, intentionally or negligently: (a) does not provide the information, or does provide incomplete information, or does not provide the information in a sufficiently transparent manner, to the data subject pursuant to Article 11, Article 12(3) and Article 14; (b) does not provide access for the data subject or does not rectify personal data pursuant to Articles 15 and 16 or does not communicate the relevant information to a recipient pursuant to Article 13; (c) does not comply with the right to be forgotten or to erasure, or fails to put mechanisms in place to ensure that the time limits are observed or does not take all necessary steps to inform third parties that a data subjects requests to erase any links to, or copy or replication of the personal data pursuant Article 17; (d) does not provide a copy of the personal data in electronic format or hinders the data subject to transmit the personal data to another application in violation of Article 18; (e) does not or not sufficiently determine the respective responsibilities with co- controllers pursuant to Article 24; (f) does not or not sufficiently maintain the documentation pursuant to Article 28, Article 31(4), and Article 44(3); (g) does not comply, in cases where special categories of data are not involved, pursuant to Articles 80, 82 and 83 with rules in relation to freedom of expression or with rules on the processing in the employment context or with the conditions for processing for historical, statistical and scientific research purposes.
 
6. The supervisory authority shall impose a fine up to 1 000 000 EUR or, in case of an enterprise up to 2 % of its annual worldwide turnover, to anyone who, intentionally or negligently: (a) processes personal data without any or sufficient legal basis for the processing or deleted does not comply with the conditions for consent pursuant to Articles 6, 7 and 8; (b) processes special categories of data in violation of Articles 9 and 81; (c) designate a data does not comply with an objection or the requirement pursuant to Article 19; (d) does not comply with the conditions in relation to measures based on profiling pursuant to Article 20; (e) does not adopt internal policies or does not implement appropriate measures for ensuring and demonstrating compliance pursuant to Articles 22, 23 and 30; (f) does not designate a representative pursuant to Article 25; (g) processes or instructs the processing of personal data in violation of the obligations in relation to processing on behalf of a controller pursuant to Articles 26 and 27; (h) does not alert on or notify a personal data breach or does not timely or completely notify the data breach to the supervisory authority or to the data subject pursuant to Articles 31 and 32; (i) does not carry out a data protection impact assessment pursuant or processes personal data without prior authorisation or prior consultation of the supervisory authority pursuant to Articles 33 and 34; (j) protection officer or does not ensure the conditions for fulfilling the tasks pursuant to Articles 35, 36 and 37; (k) misuses a data protection seal or mark in the meaning of Article 39; (l) carries out or instructs a data transfer to a third country or an international organisation that is not allowed by an adequacy decision or by appropriate safeguards or by a derogation pursuant to Articles 40 to 44; (m) temporary or definite ban on processing or the suspension of data flows by the supervisory authority pursuant to Article 53(1); (n) does not comply with the obligations to assist or respond or provide relevant information to, or access to premises by, the supervisory authority pursuant to Article 28(3), Article 29, Article 34(6) and Article 53(2); (o) does not comply with the rules for safeguarding professional secrecy pursuant to Article 84.order or a
 
1a. The European Data Protection Board shall issue guidance on when exemptions or derogations in accordance with paragraph 1 may be necessary, after consultation with representatives of the press, authors and artists, data subjects and civil society organisations.
 
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point (b) of paragraph 1, as well as criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1.
 
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1.
 
3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the processing of personal data for the purposes referred to in paragraph 1 and 2 as well as any necessary limitations on the rights of information to and access by the data subject and detailing the conditions and safeguards for the rights of the data subject under these circumstances.
 
DELEGATED ACTS AND IMPLEMENTING ACTS
 
5. A delegated act adopted pursuant to Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(7), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 33(6), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3) [Articles XXX] shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of twotwelve months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by twosix months at the initiative of the European Parliament or the Council.
 
Article 87 Committee procedure 1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. 3. Where reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply.
 
2. Article 1(2) 2. Articles 1(2), 4 and 15 of Directive 2002/58/EC shall be deleted.
  Comment: Intention unclear.