United Kingdom S&D

Claude Moraes

Country: United Kingdom
Group: Progressive Alliance of Socialists and Democrats (S&D)
Party: Labour Party (LAB)

Member of Civil Liberties, Justice and Home Affairs
Substitute of Internal Market and Consumer Protection

Overview Claude Moraes

Amendments: 40
...stronger: 11
...weaker: 21
...neutral: 8

Amendments by Claude Moraes

(23) The principles of data protection should apply to any information concerning an identified or identifiable person. To determine whether a person is identifiable, account should be taken of all the means likely reasonably reasonably likely to be used either by the controller or by any other person to identify the individual. For historical, statistical and scientific purposes, identification should not be deemed ‘reasonably likely’ where the data being used is kept separately from the information enabling identification of the data subject. The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable.
 
(26) Personal data relating to health should include in particular all data personal information pertaining to the health status of a data subject; information about the registration of the individual for the provision of health services; information about payments or eligibility for healthcare with respect to the individual; a number, symbol or particular assigned to an individual to uniquely identify the individual for health purposes; any information about the individual collected in the course of the provision of health services to the individual; personal information derived from the testing or examination of a body part or bodily substance, including biological samplesor biological sample; identification of a person as provider of healthcare to the individual; or any information on e.g. a disease, disability, disease risk, medical history, clinical treatment, or the actual physiological or biomedical state of the data subject independent of its source, such as e.g. from a physician or other health professional, a hospital, a medical device, or an in vitro diagnostic test.
 
(30 a) Workers’ personal data, especially sensitive data such as political orientation and trade union membership and activities, should be protected in accordance with Articles 8, 12, 27 and 28 of the Charter of Fundamental Rights of the European Union and Articles 8 and 11 of the European Convention on Human Rights. Safeguards should be implemented to avoid instances where workers’ personal data is used in the practice of blacklisting where it is passed on to other enterprises or individuals with the aim of discriminating against particular workers.
 
(40) The processing of personal data for other purposes should be only allowed where the processing is compatible with those purposes for which the data have been initially collected, in particular such as where the processing is necessary for historical, statistical or scientific research purposes. Where the other purpose is not compatible with the initial one for which the data are collected, the controller should obtain the consent of the data subject for this other purpose or should base the processing on another legitimate ground for lawful processing, in particular where provided by Union law or the law of the Member State to which the controller is subject. In any case, the application of the principles set out by this Regulation and in particular the information of the data subject on those other purposes should be ensured.
 
(53) Any person should have the right to have personal data concerning them rectified and a ‘right to be forgotten’ where the retention of such data is not in compliance with this Regulation. In particular, data subjects should have the right that their personal data are erased and no longer processed, where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed, where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this Regulation. This right is particularly relevant, when the data subject has given their consent as a child, when not being fully aware of the risks involved by the processing, and later wants to remove such personal data especially on the Internet. However, the further retention of the data should be allowed where it is necessary for historical, statistical and scientific research purposes, for reasons of public interest in the area of public health, for the purposes of processing health data for health purposes, for exercising the right of freedom of expression, when required by law or where there is a reason to restrict the processing of the data instead of erasing them.
 
(116) For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority acting in the exercise of its public powers. or another body which has been entrusted with a mission of public interest.
 
(124) The general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment and the social security context. Therefore, in order to regulate the processing of employees’ personal data in the employment context, Member States should be able, within the limits of in accordance with this Regulation, to adopt by law specific rules for the processing of personal data in the employment sector.and the social security sector.
  Comment: Intention unclear.
(125) The processing of personal data for the purposes of historical, statistical or scientific research should, in order to be lawful, also respect other relevant legislation such as on clinical trials. A research ethics committee as mentioned in Article 83 should be consistent with the principles in the World Medical Association’s Declaration of Helsinki and any national requirements in Member States and in accordance Union law.
  Comment: Intention unclear.
(10) ‘genetic data’ means all data, of whatever type, concerning the characteristicsinformation on the hereditary characteristics, or alteration thereof, of an individual which are inherited or acquired during early prenatal development;identified or identifiable person;
  Comment: Intention unclear.
(12) ‘data concerning health’ means any personal information which relates to the physical or mental health of an individual, or to the provision of health services to the individual;
 
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the data will be processed solely for health purposes in accordance with Article 81 or for historical, statistical or scientific research purposes in accordance with the rules and conditions of Article 83 and if a periodic review is carried out to assess the necessity to continue the storage;
 
4a. For the purpose of scientific research activities (including public health, medical and social science) consent should comply with the relevant provisions in Directive 2001/20/EC.
 
3a. Paragraphs 1, 2, and 3 shall not apply where the processing of personal data of a child concerns health data and where the Member State law in the field of health and social care prioritises the maturity and competence of an individual over physical age.
 
1. The processing of personal data, revealing race or ethnic origin, political opinions, religion or beliefs, philosophical beliefs, sexual orientation, trade-union membership and activities, and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited.
 
(a) the data subject has given consent to the processing of those personal data, subject to the conditions laid down in Articles 7 and 8, except where Union law or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject. This includes safeguards to prevent the blacklisting of workers, for example in relation to their trade union activities; or
 
(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other non-profit-seeking body with a political, philosophical, religious or trade- union aim or advocating for fundamental human rights and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects; or
 
2. The controller shall inform the data subject without delay and, at the latest within one month of receipt of the request, whether or not any action has been taken pursuant to Article 13 and Articles 15 to 19 and shall provide the requested information. This period may be prolonged for a further month, if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller, or if the nature of the data requested requires them to be reviewed before they are made available so as to protect data relating to any third party contained within the record. The information shall be given in writing. Where the data subject makes the request in electronic form, the information shall be provided in electronic form, unless otherwise requested by the data subject.
 
(da) the data are processed for historical, statistical or scientific purposes subject to the conditions and safeguards referred to in Article 83 and the provision of such information proves impossible or would involve a disproportionate effort.
 
(db) the data consists of information in connection with which a claim to professional secrecy provisions, such as legal professional privilege, could be established under national law or rules established by competent authorities.
 
(c) the recipients or categories of recipients to whom the personal data are to be or have been disclosed, in particular including to recipients in third countries;
 
(ha) the trustee shall be able to exercise the right of access in case of death of the data subject. Except if the data subject asked specifically not to give access to some data.
  Comment: More rights, but also a possible invasion of privacy of a dead person. Overall consequence unclear.
(hb) the trustee shall be able to exercise the right of rectification in case of death of the data subject. Except if the data subject asked specifically not to give access to some data.
  Comment: More rights, but also a possible invasion of privacy of a dead person. Overall consequence unclear.
The data subject shall have the right to obtain from the controller the rectification of personal data relating to them which are inaccurate. The data subject shall have the right to obtain completion of incomplete personal data, including by way of supplementing a corrective statement. Where personal data is processed for the purposes set out in Article 81(1)(a) and/or Article 83 the data subject shall acknowledge that the processing of personal data for such purposes may be speculative in nature and cannot always be guaranteed to be accurate. The controller may retain such data for the purposes of further processing.
 
(b) for health purposes or for reasons of public interest in the area of public health in accordance with Article 81;
 
(c) for historical, statistical and scientific research purposes in accordance with Article 83;, including for clinical trials, patient and disease registries and other health research and medical innovation purposes;
 
2a. Where paragraphs 1 and 2 refer to data concerning health or data processed for historical, statistical or scientific purposes, and in accordance with the conditions and safeguards set out under Articles 81 and 83, the controller may reserve the right to guarantee the validity of the data by including a form of official verification.
 
(aa) Profiling that has the effect of discriminating against individuals on the basis of race or ethnic origin, political opinions, religion or beliefs, trade union membership, sexual orientation or gender identity, or that results in measures which have such effect, shall be prohibited. Profiling in the employment context shall be prohibited including in the practice of blacklisting of particular employees;
 
(b) an enterprise or an organisation employing fewer than 250 persons that is processing personal data only as an activity ancillary to its main activities., unless the enterprise or organisation is processing certain categories of sensitive personal data, as defined under Article 9(1).
 
5. Where the controller is a public authority or body another body which has been entrusted with a mission of public interest and where the processing results from a legal obligation pursuant to point (c) of Article 6(1) providing for rules and procedures pertaining to the processing operations and regulated by Union law, paragraphs 1 to 4 shall not apply, unless Member States deem it necessary to carry out such assessment prior to the processing activities.
 
4. Points (b), (c) and (h) of paragraph 1 shall not apply to activities carried out by public authorities in the exercise of their public powers. or another body which has been entrusted with a mission of public interest.
 
2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has its habitual residence, unless the controller is a public authority acting in the exercise of its public powers. or another body which has been entrusted with a mission of public interest.
 
1. Any person who has suffered damage as a result of an unlawful processing operation , including blacklisting, or of an action incompatible with this Regulation shall have the right to receive compensation from the controller or the processor for the damage suffered.
 
(c) other reasons of public interest in areas such as social protection, especially in order to ensure the quality and cost- effectiveness of the procedures used for settling claims for benefits and services in the health insurance system. and the provision of health services. Such processing of personal data concerning health for reasons of public interest should not result in data being processed for other purposes by third parties such as employers, insurance and banking companies.
 
(c) other reasons of public interest in areas such as social protection, especially in order to ensure its mission as defined in Member States' national legislation, including the quality and cost- effectiveness of the procedures used for settling claims for benefits and services in the health insurance system.
 
1. Within the limits of 1. In accordance with the rules set out in this Regulation, Member States may adopt by law specific rules regulatingin accordance with national law and practices regulate the processing of employees‘ personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.
 
1a. The following data processing by the employer in the employment context is prohibited: (a) data processed without information provided to the worker in advance as set out in Article 14; (b) genetic data; (c) medical data; (d) monitoring of trade union and worker representatives in their function including the blacklisting of workers.
 
1b. Processing in the social security context Member States may, in accordance with the rules set out in this Regulation, adopt specific legislative rules particularising the conditions for the processing of personal data by their public and private institutions and departments in the social security context if carried out in the public interest. Each Member State shall notify to the Commission those provisions which it adopts pursuant to subparagraph 1, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.
 
(ba) where data are to be processed for scientific research purposes, the proposed scientific research project has received a favourable opinion from an independent research ethics committee.
 
2. Bodies conducting using personal data for historical, statistical or scientific researchpurposes may publish or otherwise publicly disclose personal data only if:
 
(ca) Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible with Article 5(1)(b) provided that the processing: (i) is subject to the conditions and safeguards of this Article; and (ii) complies with all other relevant legislation.