France S&D

Françoise Castex

Country: France
Group: Progressive Alliance of Socialists and Democrats (S&D)
Party: Parti socialiste (PS)

Vice-Chair of Legal Affairs
Substitute of Employment and Social Affairs

Overview Françoise Castex

Amendments: 21
...stronger: 15
...weaker: 2
...neutral: 4

Amendments by Françoise Castex

(15) This Regulation should not apply to processing of personal data by a natural person, which are exclusively personal or domestic, such as correspondence and the holding of addresses, and without any gainful interest and thus without any connection with a professional or commercial activity. This exemption should not apply to such personal or domestic activities, where the natural person makes personal data of other natural persons accessible to an indefinite number of individuals. The exemption should also not apply to controllers or processors which provide the means for processing personal data for such personal or domestic activities.
 
(23) The principles of protection should apply to any information concerning an identified or identifiable person, including after their death. To determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual. The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable.
 
(39a) The prevention or limitation of damages on the side of the data controller, such as civil damages and remedies, should constitute a legitimate interest. Direct marketing should not constitute a legitimate interest.
 
(53) Any person should have the right to have personal data concerning them rectified and a ‘right to be forgottenerasure’ where the retention of such data is not in compliance with this Regulation. In particular, data subjects should have the right that their personal data are erased and no longer processed, where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed, where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this Regulation. This right is particularly relevant, when the data subject has given their consent as a child, when not being fully aware of the risks involved by the processing, and later wants to remove such personal data especially on the Internet. However, the further retention of the data should be allowed where it is necessary for historical, statistical and scientific research purposes, for reasons of public interest in the area of public health, for exercising the right of freedom of expression, when required by law or where there is a reason to restrict the processing of the data instead of erasing them.
  Comment: Intention unclear
(54) To strengthen the ‘right to be forgottenerasure’ in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform third parties which are processing such data that a data subject requests them to erase any links to, or copies or replications of that personal data. To ensure this information, the controller should take all reasonable steps, including technical measures, in relation to data for the publication of which the controller is responsible. In relation to a third party publication of personal data, the controller should be considered responsible for the publication, where the controller has authorised the publication by the third party.
  Comment: Intention unclear
(56) In cases where personal data might lawfully be processed to protect the vital interests of the data subject, or on grounds of public interest, or official authority or the legitimate interests of a controller, any data subject should nevertheless be entitled to object to the processing of any data relating to them. The burden of proof should be on the controller to demonstrate that their legitimate interests may override the interests or the fundamental rights and freedoms of the data subject.
 
(57) Where personal data are processed for the purposes of direct marketingbased on the legitimate interests of the data controller, the data subject should have the right to object to such processing in advance, free of charge and in a manner that can be easily and effectively invoked...
 
(d) by a natural person without any gainful interest in the course of its own exclusively personal or household activity;, unless personal data of other natural persons is made accessible to an indefinite number of individuals;
 
Article 7a Consent should only be obtainable for processing which is lawful and, therefore, not disproportionate to its purpose. Consent shall not constitute a valid legal basis when it is intended to enable the controller to scan the list of contacts of the person concerned for the purpose of collecting the personal data of third persons.
  Comment: Uncertain if this would be in any way allowed under the other provisions.
(b) the data are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort; or
 
Right to be forgotten and to erasureerasure
 
1a. The heirs of a deceased person are entitled to have the data processor putting an end to the publication of their data.
  Comment: Two sided.
1. The data subject shall have the right, where personal data are processed by electronic means and in a structured and commonly used format, to obtain from the controller a copy of data undergoing processing in an electronic , interoperable and structured format which is commonly used and allows for further use by the data subject.
 
2a. In exercising his or her right to portability, the data subject must inform the controller from whom the data are withdrawn that he or she also wants the data to be erased, in accordance with the provisions of Article 17.
 
(a) is carried out in the course of the necessary for entering into, or performance of, a contract, where the request for the entering into or the performance of the contract, lodged by the data subject, has been satisfied or where suitable measures to safeguard the data subject's legitimate interests have been adduced, such as the right to obtain human intervention; or
 
2a. In the employment sphere, the processing or use of data for the purposes of the permanent surveillance or profiling of employees, the drawing-up and dissemination of black lists of employees, the monitoring of performance or conduct or the preparation of a dismissal on grounds of illness shall be prohibited; job applicants’ data shall enjoy the same protection.
 
(b) an enterprise employing fewer than 250 persons; or50 persons that is processing personal data only as an activity ancillary to its main activities and if processing is not carried out on special categories of personal data as referred to in Article 9(1); or
 
1. When the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject, the controller shall, after the notification referred to in Article 31, communicate the personal data breach to the data subject without undue delay.within 24 hours.
 
(b) the processing is carried out by an enterprise employing 25050 persons or more; or, or an enterprise processes personal data as its main activity or processing is carried out on special categories of personal data as referred to in Article 9 (1);
 
2a. Member States shall lay down rules on penalties that are effective and dissuasive in preventing any abuse of the fundamental right to the protection of personal data as enshrined in the Charter of Fundamental Rights, including legal provisions outlawing as a criminal offence the use of personal data to blacklist workers, vet them or bar them from future employment.
 
2b. Member States shall ensure that persons or companies found to be taking part in blacklisting will be excluded from receiving EU grants and funding and from taking part in calls for tender for other public procurement contracts at EU, national or public authority level until all legal proceedings are proven to be completed, all compensation has been paid in full to any victims and there is reliable proof that this criminal culture has been removed from the organisation.