Bulgaria ALDE

Stanimir Ilchev

Country: Bulgaria
Group: Alliance of Liberals and Democrats for Europe (ALDE)
Party: National Movement for Stability and Progress (НДСВ)

Member of Constitutional Affairs
Substitute of Civil Liberties, Justice and Home Affairs

Overview Stanimir Ilchev

Amendments: 51
...stronger: 17
...weaker: 16
...neutral: 18

Amendments by Stanimir Ilchev

(5) ‘controller’(5) 'controller' means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes, conditions and means of the processing of personal data; where the purposes, conditions and means of processing are determined by Union law or Member State law, the controller or the specific criteria for his nomination may be designated by Union law or by Member State law; controllers include in particular:
 
(5a) ‘direct controller’ means a person who collects personal data from the data subject or otherwise processes it;
 
(5b) ‘indirect controller’ means a person who does not collect personal data from the data subject or otherwise process it.
 
2. The controller shall provide any information and any communication relating to the processing of personal data to the data subject in an intelligible and permanent form, using clear and plain language, adapted to the data subject, in particular for any information addressed specifically to a child.
 
The controller shall communicate any rectification or erasure carried out in accordance with Articles 16 and 17 to each recipient to whom the data have been disclosed, unless this proves impossible or involves a disproportionate effort.
 
The data controller directly responsible for the operation shall notify all recipients to whom data from him or her have been passed on of any correction or erasure that has been made or any objection raised under Article 16, 17 or 19. Where recipients of personal data are unknown to the data controller directly responsible for the operation, and this is not due to his or her deliberate act or negligence, he or she shall be exempted from this requirement.
 
The data controller indirectly responsible for the operation shall notify all recipients to whom he or she has passed on data of any correction or erasure that has been made or any objection raised under Article 16, 17 or 19, except where they have already been notified in accordance with paragraph 1 above.
 
The burden of proof of compliance with the above obligations shall rest with the data controllers.
 
1. Where personal data relating to a data subject are collected, the controller shall provide the data subject with 1. The controller directly responsible for the operation and, if applicable, his representative, shall at least document the following information::
 
(f) the recipients or categories of recipients of the personal data;identity and contact details of all recipients who process the personal data received from the direct controller, and the purposes of the processing, irrespective of whether they have received the data directly from him or indirectly from another party. This shall not apply insofar as recipients are unknown, and this state of affairs has not arisen due to the deliberate intent or negligence of the direct controller.
 
(g) where applicable, that the controller intends to transfer to transfer of the data to a third country or international organisation and or the intention of the controller to make such a transfer and information on the level of protection afforded by that third country or international organisation by reference to an adequacy decision by the Commission;. In the cases referred to in Article 44(1)(h), the documentation should also include evidence that appropriate safeguards are in place;
 
(ha) communications pursuant to Article 13(1).
 
2. Where the personal data are collected from the data subject, the controller shall inform the data subject, in addition to 2. The indirect controller and, if applicable, his representative, shall at least document the following: (a) the information referred to in paragraph 1, whether the provision of Article 14(1)(a), (b), (c), (d), (e), (g) and (h); (b) the identity and the contact details of all recipients who process personal data is obligatory or voluntary, as well as the possible consequences of failure to provide such data.received from the indirect controller, and the purposes of the processing; (c) the identity and the contact details of the direct controller and, if any, of his representative; (d) communications pursuant to Article 13(2).
 
3. Where the personal data are not collected from the data subject, the (a) the direct controller shall , at the time when the data are collected or immediately thereafter, inform the data subject, in addition to the information referred to in paragraph 1, from which source thewhether the provision of personal data originate.is obligatory or voluntary, as well as the possible consequences of failure to provide such data; (b) the direct controller shall, after the first communication pursuant to paragraph 3(a), provide the information pursuant to paragraph 1 once a year, provided that changes have occurred in the information since it was last communicated.
  Comment: Intention unclear.
4. The controller shall provide the information referred to in paragraphs 1, 2 and 3: (a)4. If the personal data are not collected from the data subject, the indirect controller shall, at the time when the personal data are obtained from the data subject; or (b) where minimum, inform the direct controller of the purposes for which he is processing the personal data are not collected from the data subject, , stating his identity and contact details. This shall be done at the time of the recording when the personal data are collected or within a reasonable period after the collection, having regard tothereafter, taking into account the specific circumstances in which the data are collected or otherwise processed, or, if a disclosure to another recipient is envisaged, and at the latest when the data are first disclosed.. Article 20(4) shall apply in addition to this provision.
 
5. Paragraphs 1 to 4and 2 shall not apply, where: (a) the data subject has already the information referred to in paragraphs 1, 2 and 3; or (b) the data are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort; or (c) the data are not collected from the data subject and recording or disclosure is expressly laid down by law; or (d) the data are not collected from the data subject and the provision of such information will impair the rights and freedoms of others, as defined in Union law or Member State law in accordance with Article 21. to natural persons who process personal data without a commercial interest.
 
6. In the case referred to in point (b) of paragraph 5, the controller shall provide appropriate measures to protect 6. Paragraph 3 shall not apply where: (a) it proves impossible to provide the information or providing it would involve a disproportionate effort; or (b) the data subject's legitimate interests. already has the information referred to in paragraph 1.
 
7. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria for categories of recipients referred to in point (f) of paragraph 1, the requirements for the notice of potential access referred to in point (g) of paragraph 1, the criteria for the further information necessary referred to in point (h) of paragraph 1 for specific sectors and situations, and the conditions and appropriate safeguards for the exceptions laid down in point (b) of paragraph 5. In doing so, the Commission shall take the appropriate measures for micro, small and medium-sized- enterprises.7. Paragraph 4 shall not apply where: (a) collection or disclosure of the data is expressly laid down by law; or (b) the provision of such information will impair the rights and freedoms of others, as defined in Union law or Member State law in accordance with Article 21; (c) it proves impossible to provide the information or providing it would involve a disproportionate effort.
 
8. The Commission may lay down standard forms for providing the information8. In the cases referred to in paragraphs 1 to 3, taking into account the specific characteristics and needs of various sectors and data processing situations where necessary. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).6(a) and 7(c), the controller shall take appropriate measures to protect the data subject's legitimate interests.
  Comment: Moved? Intention unclear.
8a. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of regulating the requirements applicable to information referred to in paragraph 1(g), the criteria for the provision of further information referred to in paragraph 1(h) for specific sectors and situations, and the conditions and appropriate safeguards for the exceptions laid down in paragraphs 6(a) and 7(c). In doing so, the Commission shall take the appropriate measures for micro, small and medium- sized-enterprises.
 
8b. The Commission may lay down standard forms for providing the information referred to in paragraphs 3 and 4, taking into account the specific characteristics and needs of various sectors and data processing situations where necessary. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2).
 
1. The data subject shall have the right to obtain from theevery controller at any time, on request, confirmation as to whether or not personal data relating to the data subject are being processed. Where such personal data are being processed, the controller shall provide The confirmation shall, at the minimum, include the following information:
 
(c) the recipients or categories of recipients to whom the personal data are to be or have been disclosed, in particular to recipients in third countries;of the personal data pursuant to Article 14(1)(f), if the direct controller provides the confirmation. If the confirmation is provided by the indirect controller, the recipients shall receive it pursuant to Article 14(2)(b);
 
3. The controller 3. Where the controller learns of a request for erasure pursuant to this article or Article 13, he shall carry out the erasure without delay, except to the extent that the retention of the personal data is necessary:
 
4. In the cases referred to in paragraph 2, the information to be provided by the controller under Article 14 shall include information as to each controller shall notify the data subject separately without delay of the existence of processing for a measure measures of the kind referred to in paragraph 1 and the envisaged effects of such processing on the data subject.
 
(f) keeping the documentation pursuant to Article 28;14;
 
Where a controller determines the purposes, conditions and means of the processing of personal data jointly with others, the he and they shall be joint data controllers. Where this regulation does not impose any particular obligations on the data controllers who are directly and indirectly responsible for the operation, the joint controllers shall determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the procedures and mechanisms for exercising the rights of the data subject, by means of an arrangement between them.
 
(b) an enterprise employing fewer than 250 persons; or
 
DocumentationDocumentation requirement: processor
 
1. Each controller and processor and, if any, the controller's representative, processor shall maintain documentation of all processing operations under its responsibility.
 
(a) the name and contact details of the controller, or any joint controller or processor, and of the representative, if any;processor;
 
(c) the purposes of the processing, including the legitimate interests pursued by the controller where the processing is based on point (f) of Article 6(1);information pursuant to Article 14(1) if the processor is acting on behalf of a controller directly responsible for the operation;
  Comment: Intention unclear.
(d) a description of categories of data subjects and of the categories of personal data relating to them;(d) the information pursuant to Article 14(2) if the processor is acting for a controller indirectly responsible for the operation;
  Comment: Intention unclear.
(e) the recipients or categories of recipients of the personal data, including the controllers to whom personal data are disclosed for the legitimate interest pursued by them;
 
(f) where applicable, transfers of data to a third country or an international organisation, including the identification of that third country or international organisation and, in case of transfers referred to in point (h) of Article 44(1), the documentation of appropriate safeguards;
 
(g) a general indication of the time limits for erasure of the different categories of data;
 
(h) the description of the mechanisms referred to in Article 22(3).
 
3. The controller and the processor and, if any, the controller's representative, shall make the documentation available, on request, to the supervisory authority.
 
4. The obligations referred to in paragraphs 1 and 2 shall not apply to the following controllers and processors: (a) a a natural person processing personal data without a commercial interest; or (b) an enterprise or an organisation employing fewer than 250 persons that is processing personal data only as an activity ancillary to its main activities..
 
5. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the documentation referred to in paragraph 1, to take account of in particular the responsibilities of the controller and the processor and, if any, the controller's representative.
 
6. The Commission may lay down standard forms for the documentation referred to in paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
 
2a. The controller, his representative and the processor shall make available to the supervisory authority, on request, the documentation referred to in Article 14 or 28 as the case may be.
 
(b) the processing is carried out by an enterprise employing 250 persons or more;
 
2. In the case referred to in point (b) of paragraph 1, a group of undertakings may appoint a single data protection officer.
 
1. Any person who has suffered damage as a result of an unlawful processing operation or of an action incompatible with this Regulation shall have the right to receive compensation from the controller or the processor for the damage suffered. unless the controller or processor proves that they are not responsible for the damage either by intent or negligence.
 
3. The controller or the processor may be exempted from this liability, in whole or in part, if the controller or the processor proves that they are not responsible for the event giving rise to the damage.
 
(f) does not or not sufficiently maintain the documentation pursuant to Article 14, Article 28, Article 31(4), and Article 44(3);
 
2. The delegation of power referred to in Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(79), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 336), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3) shall be conferred on the Commission for an indeterminate period of time from the date of entry into force of this Regulation.
 
3. The delegation of power referred to in Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(79), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 33(6336), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3) may be revoked at any time by the European Parliament or by the Councilshall be conferred on the Commission for an indeterminate period of time from the date of entry into force of this Regulation. A decision of revocation shall put an end to the delegation of power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
 
5.5. A delegated act adopted pursuant to Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(79), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 33(6), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or the Council.
 
5. A delegated act adopted pursuant to Article 6(5), Article 8(3), Article 9(3), Article 12(5), Article 14(79), Article 15(3), Article 17(9), Article 20(6), Article 22(4), Article 23(3), Article 26(5), Article 28(5), Article 30(3), Article 31(5), Article 32(5), Article 33(6), Article 34(8), Article 35(11), Article 37(2), Article 39(2), Article 43(3), Article 44(7), Article 79(6), Article 81(3), Article 82(3) and Article 83(3) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or the Council.