Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (first reading) - Preparation of trilogue - Chapters II, III, IV and V - Hoofdinhoud

Council of the European Union

Brussels, 16 November 2015

PUBLIC

(OR. en)

14076/15

Interinstitutional File:

2012/0011 (COD) i LIMITE

DATAPROTECT 200 JAI 852 MI 722 DIGIT 91 DAPIX 208 FREMP 260 COMIX 582 CODEC 1512

NOTE

From: Presidency

To: Permanent Representatives Committee

No. prev. doc.: 10391/15, 13914/15

Subject: Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection

Regulation) (first reading)

• - 

  Preparation of trilogue - Chapters II, III, IV and V

DOCUMENT PARTIALLY ACCESSIBLE TO THE PUBLIC (27.11.2015)

Delegations will find in Annex a comparative table which compares in 4 columns the Commission

proposal, the position of the European Parliament in 1 st reading, the Council’s General Approach

and compromises tentatively agreed at previous trilogues as well as compromise suggestions by the

Presidency. Text marked in brackets will be discussed by the Permanent Representatives

Committee at a later stage in relation to other provisions of the text.

ANNEX

COM (2012)0011 i EP Position / First Reading Council General Approach Tentative agreement in trilogue (15/06/2015)

(19) Any processing of personal (19) Any processing of personal (19) Any processing of personal DELETED FROM THIS POINT data in the context of the activities data in the context of the activities data in the context of the activities UNTIL THE END OF THE of an establishment of a controller of an establishment of a controller of an establishment of a controller COLUMN or a processor in the Union should or a processor in the Union should or a processor in the Union should be carried out in accordance with be carried out in accordance with be carried out in accordance with this Regulation, regardless of this Regulation, regardless of this Regulation, regardless of whether the processing itself takes whether the processing itself takes whether the processing itself takes place within the Union or not. place within the Union or not. place within the Union or not. Establishment implies the effective Establishment implies the effective Establishment implies the effective and real exercise of activity and real exercise of activity and real exercise of activity through stable arrangements. The through stable arrangements. The through stable arrangements. The legal form of such arrangements, legal form of such arrangements, legal form of such arrangements, whether through a branch or a whether through a branch or a whether through a branch or a subsidiary with a legal personality, subsidiary with a legal personality, subsidiary with a legal personality, is not the determining factor in this is not the determining factor in this is not the determining factor in this respect. respect. respect.

ANNEX DGD 2C LIMITE EN

• 20) 

  In order to ensure that (20) In order to ensure that (20) In order to ensure that individuals are not deprived of the individuals are not deprived of the individuals are not deprived of the protection to which they are protection to which they are protection to which they are entitled under this Regulation, the entitled under this Regulation, the entitled under this Regulation, the processing of personal data of data processing of personal data of data processing of personal data of data subjects residing in the Union by a subjects residing in the Union by a subjects residing in the Union by a controller not established in the controller not established in the controller not established in the Union should be subject to this Union should be subject to this Union should be subject to this Regulation where the processing Regulation where the processing Regulation where the processing activities are related to the offering activities are related to the offering activities are related to the offering of goods or services to such data of goods or services, irrespective of of goods or services to such data subjects, or to the monitoring of the whether connected to a payment subjects, or to the monitoring of the behaviour of such data subjects. or not, to such data subjects, or to behaviour of such data subjects the monitoring of the behaviour of irrespective of whether connected such data subjects. In order to to a payment or not, which takes determine whether such a place in the Union. In order to controller is offering goods or determine whether such a services to such data subjects in controller is offering goods or the Union, it should be ascertained services to such data subjects in whether it is apparent that the the Union, it should be ascertained controller is envisaging the whether it is apparent that the offering of services to data controller is envisaging doing subjects in one or more Member business with data subjects States in the Union. residing in one or more Member States in the Union. Whereas the mere accessibility of the controller’s or an intermediary’s website in the Union or of an email address and of other contact details or the use of a language generally used in the third country where the controller is established,

ANNEX DGD 2C LIMITE EN

is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, and/or the mentioning of customers or users residing in the Union, may make it apparent that the controller envisages offering goods or services to such data subjects in the Union.

(21) In order to determine whether (21) In order to determine whether (21) The processing of personal a processing activity can be a processing activity can be data of data subjects residing in considered to ‘monitor the considered to ‘monitor the the Union by a controller not behaviour’ of data subjects, it behaviour’ of data subjects, it established in the Union should should be ascertained whether should be ascertained whether also be subject to this Regulation individuals are tracked on the individuals are tracked on the when it is related to the internet with data processing internet with, regardless of the monitoring of their behaviour techniques which consist of origins of the data, or if other data taking place within the European applying a ‘profile’ to an about them are collected, Union. In order to determine individual, particularly in order to including from public registers whether a processing activity can take decisions concerning her or and announcements in the Union be considered to ‘monitor the him or for analysing or predicting that are accessible from outside of behaviour’ of data subjects, it her or his personal preferences, the Union, including with the should be ascertained whether behaviours and attitudes. intention to use, or potential of individuals are tracked on the subsequent use of data processing internet with data processing techniques which consist of techniques which consist of applying a ‘profile’ to an applying a ‘profile’ to profiling an individual, particularly in order to individual, particularly in order to take decisions concerning her or take decisions concerning her or

ANNEX DGD 2C LIMITE EN

him or for analysing or predicting him or for analysing or predicting her or his personal preferences, her or his personal preferences, behaviours and attitudes. behaviours and attitudes.

(22) Where the national law of a (22) Where the national law of a (22) Where the national law of a Member State applies by virtue of Member State applies by virtue of Member State applies by virtue of public international law, this public international law, this public international law, this Regulation should also apply to a Regulation should also apply to a Regulation should also apply to a controller not established in the controller not established in the controller not established in the Union, such as in a Member State's Union, such as in a Member State's Union, such as in a Member State's diplomatic mission or consular diplomatic mission or consular diplomatic mission or consular post. post. post.

(23a) The application of pseudonymisation to personal data can reduce the risks for the data subjects concerned and help controllers and processors meet their data protection obligations. The explicit introduction of ‘pseudonymisation’ through the articles of this Regulation is thus not intended to preclude any other measures of data protection. 23b) (…) (23c) In order to create incentives for applying pseudonymisation when processing personal data, measures of pseudonymisation whilst allowing general analysis should be possible within the same

ANNEX DGD 2C LIMITE EN

controller when the controller has taken technical and organisational measures necessary to ensure that the provisions of this Regulation are implemented, taking into account the respective data processing and ensuring that additional information for attributing the personal data to a specific data subject is kept separately. The controller who processes the data shall also refer to authorised persons within the same controller. In such case however the controller shall make sure that the individual(s) performing the pseudonymisation are not referenced in the metadata.

ANNEX DGD 2C LIMITE EN

Amendment 8

(25) Consent should be given (25) Consent should be given (25) Consent should be given explicitly by any appropriate explicitly by any appropriate explicitly unambiguously by any method enabling a freely given method enabling a freely given appropriate method enabling a specific and informed indication of specific and informed indication of freely given specific and informed the data subject's wishes, either by the data subject's wishes, either by indication of the data subject's a statement or by a clear a statement or by a clear wishes, either by a written, affirmative action by the data affirmative action that is the result including electronic, oral or other subject, ensuring that individuals of choice by the data subject, statement or, if required by specific are aware that they give their ensuring that individuals are aware circumstances, by any other clear consent to the processing of that they give their consent to the affirmative action by the data personal data, including by ticking processing of personal data, subject, signifying his or her a box when visiting an Internet including by. Clear affirmative agreement to ensuring that website or by any other statement action could include ticking a box individuals are aware that they give or conduct which clearly indicates when visiting an Internet website or their consent to the processing in this context the data subject's by any other statement or conduct ofpersonal data relating to him or acceptance of the proposed which clearly indicates in this her being processed., This could processing of their personal data. context the data subject's including include by ticking a box Silence or inactivity should acceptance of the proposed when visiting an Internet website or therefore not constitute consent. processing of his or her personal by any other statement or conduct Consent should cover all data. Silence, mere use of a service which clearly indicates in this processing activities carried out for or inactivity should therefore not context the data subject's the same purpose or purposes. If constitute consent. Consent should acceptance of the proposed the data subject's consent is to be cover all processing activities processing of their personal data. given following an electronic carried out for the same purpose or Silence or inactivity should request, the request must be clear, purposes. If the data subject's therefore not constitute consent. concise and not unnecessarily consent is to be given following an Where it is technically feasible disruptive to the use of the service electronic request, the request must and effective, the data subject's for which it is provided. be clear, concise and not consent to processing may be unnecessarily disruptive to the use given by using the appropriate of the service for which it is settings of a browser or other provided. application. In such cases it is

ANNEX DGD 2C LIMITE EN

sufficient that the data subject receives the information needed to give freely specific and informed consent when starting to use the service. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, unambiguous consent should be granted for all of the processing purposes. If the data subject's consent is to be given following an electronic request, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

ANNEX DGD 2C LIMITE EN

(25a) Genetic data should be defined as personal data relating to the genetic characteristics of an individual which have been inherited or acquired as they result from an analysis of a biological sample from the individual in question, in particular by chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis or analysis of any other element enabling equivalent information to be obtained.

ANNEX DGD 2C LIMITE EN

(26) Personal data relating to (26) Personal data relating to health (26) Personal data relating to

health should include in particular should include in particular all data concerning health should include in all data pertaining to the health pertaining to the health status of a particular all data pertaining to the status of a data subject; data subject; information about the health status of a data subject which information about the registration registration of the individual for the reveal information relating to the of the individual for the provision provision of health services; past, current or future physical or of health services; information information about payments or mental health of the data subject; about payments or eligibility for eligibility for healthcare with including information about the healthcare with respect to the respect to the individual; a number, registration of the individual for the individual; a number, symbol or symbol or particular assigned to an provision of health services; particular assigned to an individual individual to uniquely identify the information about payments or to uniquely identify the individual individual for health purposes; any eligibility for healthcare with respect for health purposes; any information about the individual to the individual; a number, symbol information about the individual collected in the course of the or particular assigned to an collected in the course of the provision of health services to the individual to uniquely identify the provision of health services to the individual; information derived individual for health purposes; any individual; information derived from the testing or examination of a information about the individual

from the testing or examination of body part or bodily substance, collected in the course of the provision of health services to the

a body part or bodily substance, including biological samples; individual; information derived from including biological samples; identification of a person as the testing or examination of a body identification of a person as provider of healthcare to the part or bodily substance, including provider of healthcare to the individual; or any information on genetic data and biological individual; or any information on e.g. a disease, disability, disease samples; identification of a person e.g. a disease, disability, disease risk, medical history, clinical as provider of healthcare to the risk, medical history, clinical treatment, or the actual individual; or any information on treatment, or the actual physiological or biomedical state of e.g. for example a disease, physiological or biomedical state the data subject independent of its disability, disease risk, medical of the data subject independent of source, such as e.g. from a history, clinical treatment, or the its source, such as e.g. from a physician or other health actual physiological or biomedical physician or other health professional, a hospital, a medical state of the data subject professional, a hospital, a medical device, or an in vitro diagnostic independent of its source, such as device, or an in vitro diagnostic test. e.g. for example from a physician test. or other health professional, a

hospital, a medical device, or an in vitro diagnostic test.

ANNEX DGD 2C LIMITE EN

(28) A group of undertakings (28) A group of undertakings (28) A group of undertakings should cover a controlling should cover a controlling should cover a controlling undertaking and its controlled undertaking and its controlled undertaking and its controlled undertakings, whereby the undertakings, whereby the undertakings, whereby the controlling undertaking should be controlling undertaking should be controlling undertaking should be the undertaking which can exercise the undertaking which can exercise the undertaking which can exercise a dominant influence over the other a dominant influence over the other a dominant influence over the other undertakings by virtue, for undertakings by virtue, for undertakings by virtue, for example, of ownership, financial example, of ownership, financial example, of ownership, financial participation or the rules which participation or the rules which participation or the rules which govern it or the power to have govern it or the power to have govern it or the power to have personal data protection rules personal data protection rules personal data protection rules implemented. implemented. implemented. A central

undertaking which controls the processing of personal data in undertakings affiliated to it forms together with these undertakings an entity which may be treated as “group of undertakings”.

ANNEX DGD 2C LIMITE EN

(29) Children deserve specific (29) Children deserve specific (29) Children deserve specific protection of their personal data, as protection of their personal data, as protection of their personal data, as they may be less aware of risks, they may be less aware of risks, they may be less aware of risks, consequences, safeguards and their consequences, safeguards and their consequences, safeguards and their rights in relation to the processing rights in relation to the processing rights in relation to the processing of personal data. To determine of personal data. To determine of personal data. To determine when an individual is a child, this when an individual is a child, this when an individual is a child, this Regulation should take over the Regulation should take over the Regulation should take over the definition laid down by the UN definition laid down by the UN definition laid down by the UN Convention on the Rights of the Convention on the Rights of the Convention on the Rights of the Child. Child. Where data processing is Child. This concerns especially the based on the data subject’s use of personal data of children consent in relation to the offering for the purposes of marketing or of goods or services directly to a creating personality or user child, consent should be given or profiles and the collection of child authorised by the child’s parent or data when using services offered legal guardian in cases where the directly to a child. child is below the age of 13. Ageappropriate language should be used where the intended audience is children. Other grounds of lawful processing such as grounds of public interest should remain applicable, such as for processing in the context of preventive or counselling services offered directly to a child.

ANNEX DGD 2C LIMITE EN

(30) Any processing of personal (30) Any processing of personal (30) Any processing of personal data should be lawful, fair and data should be lawful, fair and data should be lawful and, fair. and transparent in relation to the transparent in relation to the It should be transparent in relation individuals concerned. In individuals concerned. In to for the individuals concerned. In particular, the specific purposes for particular, the specific purposes for particular, the specific purposes for which the data are processed which the data are processed which the data are processed should be explicit and legitimate should be explicit and legitimate should be explicit and legitimate and determined at the time of the and determined at the time of the and determined at the time of the collection of the data. The data collection of the data. The data collection of the data. The data should be adequate, relevant and should be adequate, relevant and should be adequate, relevant and limited to the minimum necessary limited to the minimum necessary limited to the minimum necessary for the purposes for which the data for the purposes for which the data for the purposes for which the data are processed; this requires in are processed; this requires in are processed; this requires in particular ensuring that the data particular ensuring that the data particular ensuring that the data collected are not excessive and that collected are not excessive and that collected are not excessive and that the period for which the data are the period for which the data are the period for which the data are stored is limited to a strict stored is limited to a strict stored is limited to a strict minimum. Personal data should minimum. Personal data should minimum. Personal data should only be processed if the purpose of only be processed if the purpose of only be processed if the purpose of the processing could not be the processing could not be the processing could not be fulfilled by other means. Every fulfilled by other means. Every fulfilled by other means. that reasonable step should be taken to reasonable step should be taken to personal data concerning them are ensure that personal data which are ensure that personal data which are collected, used, consulted or inaccurate are rectified or deleted. inaccurate are rectified or deleted. otherwise processed and to which In order to ensure that the data are In order to ensure that the data are extent the data are processed or not kept longer than necessary, not kept longer than necessary, will be processed. The principle of time limits should be established time limits should be established by transparency requires that any by the controller for erasure or for the controller for erasure or for a information and communication a periodic review. periodic review. relating to the processing of those

ANNEX DGD 2C LIMITE EN

data should be easily accessible and easy to understand, and that clear and plain language is used. This concerns in particular the information of the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the individuals concerned and their right to get confirmation and communication of personal data being processed concerning them. Individuals should be made aware on risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise his or her rights in relation to the processing. In particular, the specific purposes for which the data are processed should be explicit and legitimate and determined at the time of the collection of the data. The data should be adequate and relevant

ANNEX DGD 2C LIMITE EN

for the purposes for which the data are processed; this requires in particular ensuring that the data collected are not excessive and that the period for which the data are stored is limited to a strict minimum. Personal data should only be processed if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. In order to ensure that the data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or the use of personal data and the equipment used for the processing.

ANNEX DGD 2C LIMITE EN

Amendment 10 (31) In order for processing to be (31) In order for processing to be (31) In order for processing to be lawful, personal data should be lawful, personal data should be lawful, personal data should be processed on the basis of the processed on the basis of the processed on the basis of the consent of the person concerned or consent of the person concerned or consent of the person concerned or some other legitimate basis, laid some other legitimate basis, laid some other legitimate basis, laid down by law, either in this down by law, either in this down by law, either in this Regulation or in other Union or Regulation or in other Union or Regulation or in other Union or Member State law as referred to in Member State law as referred to in Member State law as referred to in this Regulation. this Regulation. In case of a child this Regulation, including the

or a person lacking legal capacity, necessity for compliance with the relevant Union or Member State legal obligation to which the law should determine the controller is subject or the conditions under which consent is necessity for the performance of a given or authorised by that person. contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

ANNEX DGD 2C LIMITE EN

Amendment 11 (32) Where processing is based on (32) Where processing is based on (32) Where processing is based on the data subject's consent, the the data subject’s consent, the the data subject's consent, the controller should have the burden controller should have the burden controller should have the burden of proving that the data subject has of proving that the data subject has of proving be able to demonstrate given the consent to the processing given the consent to the processing that the data subject has given the operation. In particular in the operation. In particular in the consent to the processing operation. context of a written declaration on context of a written declaration on In particular in the context of a another matter, safeguards should another matter, safeguards should written declaration on another ensure that the data subject is ensure that the data subject is aware matter, safeguards should ensure aware that and to what extent that and to what extent consent is that the data subject is aware that consent is given. given. To comply with the and to what the extent to which

principle of data minimisation, the consent is given. A declaration of burden of proof should not be consent pre-formulated by the understood as requiring the controller should be provided in positive identification of data an intelligible and easily subjects unless necessary. Similar accessible form, using clear and to civil law terms (e.g. Council plain language and its content

Directive 93/13/EEC i 1 ), data should not be unusual within the

protection policies should be as overall context. For consent to be clear and transparent as possible. informed, the data subject should They should not contain hidden or be aware at least of the identity of disadvantageous clauses. Consent the controller and the purposes of cannot be given for the processing the processing for which the of personal data of third persons. personal data are intended; ______________________ consent should not be regarded as

1 Council Directive 93/13/EEC i of 5 freely-given if the data subject has

April 1993 on unfair terms in no genuine and free choice and is consumer contracts (OJ L 95, unable to refuse or withdraw 21.4.1993, p. 29). consent without detriment.

ANNEX DGD 2C LIMITE EN

Amendment 12 (33) In order to ensure free (33) In order to ensure free consent, (33) deleted

consent, it should be clarified that it should be clarified that consent consent does not provide a valid does not provide a valid legal legal ground where the individual ground where the individual has no

has no genuine and free choice and genuine and free choice and is

is subsequently not able to refuse subsequently not able to refuse or or withdraw consent without withdraw consent without

detriment. detriment. This is especially the case if the controller is a public

authority that can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given. The use of default options which the data subject is required to modify to object to the processing, such as pre-ticked boxes, does not express free consent. Consent for the processing of additional personal data that are not necessary for the provision of a service should not be required for using the service. When consent is withdrawn, this may allow the termination or non-execution of a service which is dependent on the data. Where the conclusion of the intended purpose is unclear, the controller should in regular intervals provide the data subject with information about the processing and request a reaffirmation of their his or her consent.

ANNEX DGD 2C LIMITE EN

Amendment 13 (34) Consent should not provide a deleted (34) In order to safeguard that valid legal ground for the Consent consent has been freelyprocessing of personal data, where given, consent should not provide a there is a clear imbalance between valid legal ground for the the data subject and the controller. processing of personal data in a This is especially the case where specific case, where there is a clear the data subject is in a situation of imbalance between the data subject dependence from the controller, and the controller and This this is among others, where personal data especially the case where the data are processed by the employer of subject is in a situation of employees' personal data in the dependence from the controller, employment context. Where the among others, where personal data controller is a public authority, are processed by the employer of there would be an imbalance only employees' personal data in the in the specific data processing employment context. Where the operations where the public controller is a public authority, authority can impose an obligation there would be an imbalance only by virtue of its relevant public in the specific data processing powers and the consent cannot be operations where the public deemed as freely given, taking into authority can impose an obligation account the interest of the data by virtue of its relevant public subject. powers and makes it unlikely that

the consent cannot be deemed was given as freely- given, taking into account the interest of the data subject in all the circumstances of that specific situation. Consent is presumed not to be freely given, if it does not allow separate consent to be given to different data processing operations despite it is

ANNEX DGD 2C LIMITE EN

appropriate in the individual case, or if the performance of a contract is made dependent on the consent despite this is not necessary for such performance and the data subject cannot reasonably obtain equivalent services from another source without consent.

(35) Processing should be lawful (35) Processing should be lawful (35) Processing should be lawful where it is necessary in the context where it is necessary in the context where it is necessary in the context of a contract or the intended of a contract or the intended of a contract or the intended entering into a contract. entering into a contract. entering into a contract. (37) The processing of personal (37) The processing of personal (37) The processing of personal data should equally be regarded as data should equally be regarded as data should equally be regarded as lawful where it is necessary to lawful where it is necessary to lawful where it is necessary to protect an interest which is protect an interest which is protect an interest which is essential for the data subject's life. essential for the data subject's life. essential for the data subject's life or that of another person. Some types of data processing may serve both important grounds of public interest and the vital interests of the data subject as, for instance when processing is necessary for humanitarian purposes, including for monitoring epidemic and its spread or in situations of humanitarian emergencies, in particular in situations of natural disasters.

ANNEX DGD 2C LIMITE EN

Amendment 15 (38) The legitimate interests of a (38) The legitimate interests of a (38) The legitimate interests of a controller may provide a legal the controller, or in case of controller including of a controller basis for processing, provided that disclosure, of the third party to to which the data may be disclosed the interests or the fundamental whom the data is are disclosed, or of a third party may provide a rights and freedoms of the data may provide a legal basis for legal basis for processing, provided subject are not overriding. This processing, provided that they meet that the interests or the would need careful assessment in the reasonable expectations of the fundamental rights and freedoms particular where the data subject is data subject based on his or her of the data subject are not a child, given that children deserve relationship with the controller overriding. This would need specific protection. The data and that the interests or the careful assessment including subject should have the right to fundamental rights and freedoms of whether a data subject can expect object the processing, on grounds the data subject are not overriding. at the time and in the context of relating to their particular situation This would need careful assessment the collection of the data that and free of charge. To ensure in particular where the data subject processing for this purpose may transparency, the controller should is a child, given that children take place. Legitimate interest be obliged to explicitly inform the deserve specific protection. could exist for example when data subject on the legitimate Provided that the interests or the there is a relevant and appropriate interests pursued and on the right fundamental rights and freedoms connection between the data to object, and also be obliged to of the data subject are not subject and the controller in document these legitimate overriding, processing limited to situations such as the data subject interests. Given that it is for the pseudonymous data should be being a client or in the service of legislator to provide by law the presumed to meet the reasonable the controller. At any rate the legal basis for public authorities to expectations of the data subject existence of a legitimate interest process data, this legal ground based on his or her relationship would need careful assessment should not apply for the processing with the controller. The data including whether a data subject by public authorities in the subject should have the right to can expect at the time and in the performance of their tasks. object the processing, on grounds context of the collection of the

relating to their particular situation data that processing for this and free of charge. To ensure purpose may take place. iIn transparency, the controller should particular where such assessment be obliged to explicitly inform the must take into account whether

ANNEX DGD 2C LIMITE EN

data subject on the legitimate the data subject is a child, given interests pursued and on the right to that children deserve specific object, and also be obliged to protection. The data subject should document these legitimate interests. have the right to object to the The interests and fundamental processing, on grounds relating to rights of the data subject could in their particular situation and free of particular override the interest of charge. To ensure transparency, the the data controller where personal controller should be obliged to data are processed in explicitly inform the data subject circumstances where data subjects on the legitimate interests pursued do not reasonably expect further and on the right to object, and also processing. Given that it is for the be obliged to document these legislator to provide by law the legitimate interests. Given that it is legal basis for public authorities to for Union or national law the process data, this legal ground legislator to provide by law the should not apply for the processing legal basis for public authorities to by public authorities in the process data, this legal ground performance of their tasks. should not apply for the processing by public authorities in the exercise performance of their tasksduties.

ANNEX DGD 2C LIMITE EN

(38a) Controllers that are part of a group of undertakings or institution affiliated to a central body may have a legitimate interest to transmit personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected.

ANNEX DGD 2C LIMITE EN

Amendment 16 (39) The processing of data to the (39) The processing of data to the (39) The processing of data to the extent strictly necessary for the extent strictly necessary and extent strictly necessary for the purposes of ensuring network and proportionate for the purposes of purposes of ensuring network and information security, i.e. the ability ensuring network and information information security, i.e. the ability of a network or an information security, i.e. the ability of a of a network or an information system to resist, at a given level of network or an information system system to resist, at a given level of confidence, accidental events or to resist, at a given level of confidence, accidental events or unlawful or malicious actions that confidence, accidental events or unlawful or malicious actions that compromise the availability, unlawful or malicious actions that compromise the availability, authenticity, integrity and compromise the availability, authenticity, integrity and confidentiality of stored or authenticity, integrity and confidentiality of stored or transmitted data, and the security confidentiality of stored or transmitted data, and the security of of the related services offered by, transmitted data, and the security of the related services offered by, or or accessible via, these networks the related services offered by, or accessible via, these networks and and systems, by public authorities, accessible via, these networks and systems, by public authorities, Computer Emergency Response systems, by public authorities, Computer Emergency Response Teams – CERTs, Computer Computer Emergency Response Teams – CERTs, Computer Security Incident Response Teams Teams – CERTs, Computer Security Incident Response Teams – CSIRTs, providers of electronic Security Incident Response Teams – CSIRTs, providers of electronic communications networks and – CSIRTs, providers of electronic communications networks and services and by providers of communications networks and services and by providers of security technologies and services, services and by providers of security technologies and services, constitutes a legitimate interest of security technologies and services constitutes a legitimate interest of the concerned data controller. This constitutes a legitimate interest of the concerned data controller could, for example, include the concerned data controller. This concerned. This could, for preventing unauthorised access to could, for example, include example, include preventing electronic communications preventing unauthorised access to unauthorised access to electronic networks and malicious code electronic communications communications networks and distribution and stopping ‘denial of networks and malicious code malicious code distribution and service’ attacks and damage to distribution and stopping ‘denial of stopping ‘denial of service’ attacks computer and electronic service’ attacks and damage to and damage to computer and

ANNEX DGD 2C LIMITE EN

communication systems. computer and electronic electronic communication systems. communication systems. This The processing of personal data

principle also applies to processing strictly necessary for the purposes of personal data to restrict abusive of preventing fraud also access to and use of publicly constitutes a legitimate interest of available network or information the data controller concerned. The systems, such as the blacklisting of processing of personal data for electronic identifiers. direct marketing purposes may be regarded as carried out for a legitimate interest.

ANNEX DGD 2C LIMITE EN

Amendment 17 (39a) Provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, the prevention or limitation of damages on the side of the data controller should be presumed as carried out for the legitimate interest of the data controller or, in case of disclosure, of the third party to whom the data is are disclosed, and as meeting the reasonable expectations of the data subject based on his or her relationship with the controller. The same principle also applies to the enforcement of legal claims against a data subject, such as debt collection or civil damages and remedies.

ANNEX DGD 2C LIMITE EN

Amendment 18 (39b) Provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, the processing of personal data for the purpose of direct marketing for own or similar products and services or for the purpose of postal direct marketing should be presumed as carried out for the legitimate interest of the controller, or in case of disclosure, of the third party to whom the data are disclosed, and as meeting the reasonable expectations of the data subject based on his or her relationship with the controller if highly visible information on the right to object and on the source of the personal data is given. The processing of business contact details should be generally regarded as carried out for the legitimate interest of the controller, or in case of disclosure, of the third party to whom the data are disclosed, and as meeting the reasonable expectations of the data subject based on his or her relationship with the controller. The same should apply to the processing of personal data made manifestly public by the data subject.

ANNEX DGD 2C LIMITE EN

Amendment 19 (40) The processing of personal deleted (40) The processing of personal data for other purposes should be data for other purposes than the only allowed where the processing purposes for which the data have is compatible with those purposes been initially collected should be for which the data have been only allowed where the processing initially collected, in particular is compatible with those purposes where the processing is necessary for which the data have been for historical, statistical or initially collected, . in In such case scientific research purposes. Where no separate legal basis is required the other purpose is not compatible other than the one which allowed with the initial one for which the the collection of the data. If data are collected, the controller particular where the processing is should obtain the consent of the necessary for the performance of a data subject for this other purpose task carried out in the public or should base the processing on interest or in the exercise of another legitimate ground for official authority vested in the lawful processing, in particular controller, Union law or Member where provided by Union law or State law may determine and the law of the Member State to specify the tasks and purposes for which the controller is subject. In which the further processing shall any case, the application of the be regarded as lawful. The further principles set out by this processing for archiving purposes Regulation and in particular the in the public interest, or historical, information of the data subject on statistical, or scientific research or those other purposes should be historical purposes or in view of ensured. future dispute resolution should

be considered as compatible lawful processing operations. The legal basis provided by Union or Member State law for the collection and processing of

ANNEX DGD 2C LIMITE EN

personal data may also provide a legal basis for further processing for other purposes if these purposes are in line with the assigned task and the controller is entitled legally to collect the data for these other purposes. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account inter alia any link between those purposes and the purposes of the intended further processing, the context in which the data have been collected, including the reasonable expectations of the data subject as to their further use, the nature of the personal data, the consequences of the intended further processing for data subjects, and the existence of appropriate safeguards in both the original and intended processing operations. Where the intended other purpose is not compatible with the initial one for which the

ANNEX DGD 2C LIMITE EN

data are collected, the controller should obtain the consent of the data subject for this other purpose or should base the processing on another legitimate ground for lawful processing, in particular where provided by Union law or the law of the Member State to which the controller is subject. In any case, the application of the principles set out by this Regulation and in particular the information of the data subject on those other purposes and on his or her rights including the right to object, should be ensured. Indicating possible criminal acts or threats to public security by the controller and transmitting these data to a competent authority should be regarded as being in the legitimate interest pursued by the controller. However such transmission in the legitimate interest of the controller or further processing of personal data should be prohibited if the processing is not compatible with a legal, professional or other binding obligation of secrecy.

ANNEX DGD 2C LIMITE EN

Amendment 20 (41) Personal data which are, by deleted (41) Personal data which are, by

their nature, particularly sensitive their nature, particularly sensitive and vulnerable in relation to and vulnerable in relation to fundamental rights or privacy, fundamental rights and freedomsor

deserve specific protection. Such privacy, deserve specific protection

data should not be processed, as the context of their processing unless the data subject gives his may create important risks for the

explicit consent. However, fundamental rights and freedoms. derogations from this prohibition These data should also include

should be explicitly provided for in personal data revealing racial or ethnic origin, whereby the use of

respect of specific needs, in the term ‘racial origin’ in this particular where the processing is Regulation does not imply an

carried out in the course of acceptance by the European legitimate activities by certain Union of theories which attempt to

associations or foundations the determine the existence of

purpose of which is to permit the separate human races. Such data

exercise of fundamental freedoms. should not be processed, unless processing is allowed in specific

cases set out in this Regulation, taking into account that Member States law may lay down specific provisions on data protection in order to adapt the application of the rules of this Regulation for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In addition to the specific requirements for such processing, the general principles and other rules of this Regulation should

ANNEX DGD 2C LIMITE EN

apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided inter alia where the data subject gives his or her explicit consent . However, derogations from this prohibition should be explicitly provided for or in respect of specific needs, in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms. Special categories of personal data may also be processed where the data have manifestly been made public or voluntarily and at the request of the data subject transferred to the controller for a specific purpose specified by the data subject, where the processing is done in the interest of the data subject. Member State and Union Law may provide that the general prohibition for processing such special categories of personal data in certain cases may not be lifted by the data subject’s explicit consent.

ANNEX DGD 2C LIMITE EN

Amendment 21 (42) Derogating from the (42) Derogating from the (42) Derogating from the prohibition on processing sensitive prohibition on processing sensitive prohibition on processing sensitive categories of data should also be categories of data should also be categories of data should also be allowed if done by a law, and allowed if done by a law, and allowed if done by a when subject to suitable safeguards, so as subject to suitable safeguards, so as provided for in Union or Member to protect personal data and other to protect personal data and other State law, and subject to suitable fundamental rights, where grounds fundamental rights, where grounds safeguards, so as to protect of public interest so justify and in of public interest so justify and in personal data and other particular for health purposes, particular for health purposes, fundamental rights, where grounds including public health and social including public health and social of public interest so justify, in protection and the management of protection and the management of particular processing data in the health-care services, especially in health-care services, especially in field of employment law, social order to ensure the quality and order to ensure the quality and costsecurity and social protection law, cost-effectiveness of the effectiveness of the procedures including pensions and for health procedures used for settling claims used for settling claims for benefits security, monitoring and alert for benefits and services in the and services in the health insurance purposes, the prevention or health insurance system, or for system, for historical, statistical and control of communicable diseases historical, statistical and scientific scientific research purposes, or for and other serious threats to research purposes. archive services. health or ensuring high

standards of quality and safety of health care and services and of medicinal products or medical devices or assessing public policies adopted in the field of health, also by producing quality and activity indicators. and in particular This may be done for health purposes, including public health and social protection and the management of health-care services, especially in order to

ANNEX DGD 2C LIMITE EN

ensure the quality and costeffectiveness of the procedures used for settling claims for benefits and services in the health insurance system, or for archiving in the public interest or historical, statistical and scientific research purposes. A derogation should also allow processing of such data where necessary for the establishment, exercise or defence of legal claims, regardless of whether in a judicial procedure or whether in an administrative or any out-ofcourt procedure. (42a) Special categories of personal data which deserve higher protection, may only be processed for health-related purposes where necessary to achieve those purposes for the benefit of individuals and society as a whole, in particular in the context of the management of health or social care services and systems including the processing by the management and central national health authorities of such data for the purpose of quality control, management information and the general national and local

ANNEX DGD 2C LIMITE EN

supervision of the health or social care system, and ensuring continuity of health or social care and cross-border healthcare or health security, monitoring and alert purposes or for archiving purposes in the public interest, for historical, statistical or scientific purposes as well as for studies conducted in the public interest in the area of public health. Therefore this Regulation should provide for harmonised conditions for the processing of special categories of personal data concerning health, in respect of specific needs, in particular where the processing of these data is carried out for certain health-related purposes by persons subject to a legal obligation of professional secrecy. Union or Member State law should provide for specific and suitable measures so as to protect the fundamental rights and the personal data of individuals.

ANNEX DGD 2C LIMITE EN

(42b) The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. This processing is subject to suitable and specific measures so as to protect the rights and freedoms of individuals. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 i of the European Parliament and of the Council of 16 December 2008 on Community statistics on public health and health and safety at work, meaning all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of personal data concerning health for reasons of public interest should not result in personal data being processed for other purposes by third parties

ANNEX DGD 2C LIMITE EN

such as employers, insurance and banking companies.

(43) Moreover, the processing of (43) Moreover, the processing of (43) Moreover, the processing of personal data by official authorities personal data by official authorities personal data by official authorities for achieving aims, laid down in for achieving aims, laid down in for achieving aims, laid down in constitutional law or international constitutional law or international constitutional law or international public law, of officially recognised public law, of officially recognised public law, of officially recognised religious associations is carried out religious associations is carried out religious associations is carried out on grounds of public interest. on grounds of public interest. on grounds of public interest. (44) Where in the course of (44) Where in the course of (44) Where in the course of electoral activities, the operation of electoral activities, the operation of electoral activities, the operation of the democratic system requires in a the democratic system requires in a the democratic system requires in a Member State that political parties Member State that political parties Member State that political parties compile data on people's political compile data on people's political compile data on people's political opinions, the processing of such opinions, the processing of such opinions, the processing of such data may be permitted for reasons data may be permitted for reasons data may be permitted for reasons of public interest, provided that of public interest, provided that of public interest, provided that appropriate safeguards are appropriate safeguards are appropriate safeguards are established. established. established.

ANNEX DGD 2C LIMITE EN

Amendment 22 (45) If the data processed by a (45) If the data processed by a (45) If the data

controller do not permit the controller do not permit the processed by a controller do not

controller to identify a natural controller to identify a natural permit the controller to identify a person, the data controller should person, the data controller should natural person, the data controller

not be obliged to acquire additional not be obliged to acquire additional should not be obliged to acquire

information in order to identify the information in order to identify the additional information in order to data subject for the sole purpose of data subject for the sole purpose of identify the data subject for the

complying with any provision of complying with any provision of sole purpose of complying with

this Regulation. In case of a request this Regulation. In case of a request any provision of this Regulation. In for access, the controller should be case of a request for access, the

for access, the controller should be entitled to ask the data subject for controller should be entitled to ask

entitled to ask the data subject for further information to enable the the data subject for further

further information to enable the data controller to locate the information to enable the data

data controller to locate the personal data which that person controller to locate the personal personal data which that person seeks. If it is possible for the data data which that person seeks

seeks. subject to provide such data, However, the controller should controllers should not be able to not refuse to take additional

invoke a lack of information to information provided by the data refuse an access request. subject in order to support the exercise of his or her rights.

ANNEX DGD 2C LIMITE EN

(46) The principle of transparency

requires that any information (46) The principle of transparency (46) The principle of transparency addressed to the public or to the requires that any information requires that any information data subject should be easily addressed to the public or to the addressed to the public or to the accessible and easy to understand, data subject should be easily data subject should be easily and that clear and plain language is accessible and easy to understand, accessible and easy to understand, used. This is in particular relevant and that clear and plain language is and that clear and plain language where in situations, such as online used. This is in particular relevant and, additionally, where advertising, the proliferation of where in situations, such as online appropriate, visualisation is used. actors and the technological advertising, the proliferation of This information could be complexity of practice makes it actors and the technological provided in electronic form, for difficult for the data subject to complexity of practice makes it example, when addressed to the know and understand if personal difficult for the data subject to public, through a website. This is data relating to them are being know and understand if personal in particular relevant where in collected, by whom and for what data relating to him or her are situations, such as online purpose. Given that children being collected, by whom and for advertising, the proliferation of deserve specific protection, any what purpose. Given that children actors and the technological information and communication, deserve specific protection, any complexity of practice makes it where processing is addressed information and communication, difficult for the data subject to specifically to a child, should be in where processing is addressed know and understand if personal such a clear and plain language that specifically to a child, should be in data relating to them are being

the child can easily understand. such a clear and plain language that collected, by whom and for what the child can easily understand. purpose. Given that children

deserve specific protection, any information and communication, where processing is addressed specifically to a child, should be in such a clear and plain language that the child can easily understand.

ANNEX DGD 2C LIMITE EN

Amendment 23

(47) Modalities should be provided (47) Modalities should be provided (47) Modalities should be provided for facilitating the data subject’s for facilitating the data subject’s for facilitating the data subject’s exercise of their rights provided by exercise of his or her rights exercise of their rights provided by this Regulation, including provided by this Regulation, this Regulation, including mechanisms to request, free of including mechanisms to request mechanisms to request, free of charge, in particular access to data, obtain, free of charge, in particular charge, in particular access to data, rectification, erasure and to access to data, rectification, erasure rectification, erasure and to exercise the right to object. The and to exercise the right to object. exercise the right to object. Thus controller should be obliged to The controller should be obliged to the controller should also provide respond to requests of the data respond to requests of the data means for requests to be made subject within a fixed deadline and subject within a fixed reasonable electronically, especially where give reasons, in case he does not deadline and give reasons, in case personal data are processed by comply with the data subject's he does not comply with the data electronic means. The controller request. subject’s request. should be obliged to respond to requests of the data subject without undue delay and at the latest within a fixed deadline of one month and give reasons where the controller , in case he does not intend to comply with the data subject's request.

ANNEX DGD 2C LIMITE EN

Amendment 24

(48) The principles of fair and (48) The principles of fair and (48) The principles of fair and transparent processing require that transparent processing require that transparent processing require that the data subject should be informed the data subject should be informed the data subject should be informed in particular of the existence of the in particular of the existence of the in particular of the existence of the processing operation and its processing operation and its processing operation and its

purposes, how long the data will be purposes, how long the data will be purposes, how long the data will be stored, on the existence of the right likely stored for each purpose, if the stored, on the existence of the right of access, rectification or erasure data are to be transferred to third of access, rectification or erasure and on the right to lodge a parties or third countries, on the and on the right to lodge a complaint. Where the data are existence of measures to object and complaint. The controller should collected from the data subject, the of the right of access, rectification or provide the data subject with any

data subject should also be erasure and on the right to lodge a further information necessary to informed whether they are obliged complaint. Where the data are guarantee fair and transparent to provide the data and of the collected from the data subject, the processing. Furthermore the data consequences, in cases they do not data subject should also be informed provide such data. whether they are obliged to provide

subject should be informed about

the data and of the consequences, in the existence of profiling, and the

cases they do not provide such data. consequences of such profiling.

This information should be Where the data are collected from provided, which can also mean the data subject, the data subject made readily available, to the data should also be informed whether subject after the provision of they are obliged to provide the data

simplified information in the form and of the consequences, in cases of standardised icons. This should they do not provide such data. also mean that personal data are processed in a way that effectively allows the data subject to exercise his or her rights.

ANNEX DGD 2C LIMITE EN

(49) The information in relation to (49) The information in relation to (49) The information in relation to the processing of personal data the processing of personal data the processing of personal data relating to the data subject should relating to the data subject should relating to the data subject should be given to them at the time of be given to them at the time of be given to them at the time of collection, or, where the data are collection, or, where the data are collection, or, where the data are not collected from the data subject, not collected from the data subject, not collected from the data subject, within a reasonable period, within a reasonable period, within a reasonable period, depending on the circumstances of depending on the circumstances of depending on the circumstances of the case. Where data can be the case. Where data can be the case. Where data can be legitimately disclosed to another legitimately disclosed to another legitimately disclosed to another recipient, the data subject should be recipient, the data subject should recipient, the data subject should be informed when the data are first be informed when the data are first informed when the data are first disclosed to the recipient. disclosed to the recipient. disclosed to the recipient. Where the controller intends to process the data for a purpose other than the one for which the data were collected the controller should provide the data subject prior to that further processing with information on that other purpose and other necessary information. Where the origin of the data could not be provided to the data subject because various sources have been used, the information should be provided in a general manner.

ANNEX DGD 2C LIMITE EN

Amendment 25

(50) However, it is not necessary to (50) However, it is not necessary to (50) However, it is not necessary to impose this obligation where the impose this obligation where the impose this obligation where the data subject already disposes of this data subject already disposes of data subject already disposes information, or where the recording knows this information, or where possesses of this information, or or disclosure of the data is the recording or disclosure of the where the recording or disclosure expressly laid down by law, or data is expressly laid down by law, of the data is expressly laid down where the provision of information or where the provision of by law, or where the provision of to the data subject proves information to the data subject information to the data subject impossible or would involve proves impossible or would involve proves impossible or would involve disproportionate efforts. The latter disproportionate efforts. The latter disproportionate efforts. The latter could be particularly the case could be particularly the case could be particularly the case where processing is for historical, where processing is for historical, where processing is for archiving statistical or scientific research statistical or scientific research purpose in the public interest, for purposes; in this regard, the number purposes; in this regard, the number historical, statistical or scientific of data subjects, the age of the data, of data subjects, the age of the data, researchpurposes; in this regard, and any compensatory measures and any compensatory measures the number of data subjects, the age adopted may be taken into adopted may be taken into of the data, and any compensatory consideration. consideration. measures appropriate safeguards adopted may be taken into consideration.

ANNEX DGD 2C LIMITE EN

Amendment 26

(51) Any person should have the (51) Any person should have the (51) Any A natural person should right of access to data which has right of access to data which have have the right of access to data been collected concerning them, been collected concerning them, which has been collected and to exercise this right easily, in and to exercise this right easily, in concerning themhim or her, and to order to be aware and verify the order to be aware and verify the exercise this right easily and at lawfulness of the processing. Every lawfulness of the processing. Every reasonable intervals, in order to be data subject should therefore have data subject should therefore have aware of and verify the lawfulness the right to know and obtain the right to know and obtain of the processing. This includes communication in particular for communication in particular for the right for individuals to have what purposes the data are what purposes the data are access to their personal data processed, for what period, which processed, for what estimated concerning their health, for recipients receive the data, what is period, which recipients receive the example the data in their medical the logic of the data that are data, what is the general logic of records containing such undergoing the processing and the data that are undergoing the information as diagnosis, what might be, at least when based processing and what might be, at examination results, assessments on profiling, the consequences of least when based on profiling, the by treating physicians and any such processing. This right should consequences of such processing. treatment or interventions not adversely affect the rights and This right should not adversely provided. Every data subject freedoms of others, including trade affect the rights and freedoms of should therefore have the right to secrets or intellectual property and others, including trade secrets or know and obtain communication in in particular the copyright intellectual property and in particular for what purposes the protecting the software. However, particular, such as in relation to data are processed, where possible the result of these considerations the copyright protecting the for what period, which recipients should not be that all information is software. However, the result of receive the data, what is the logic refused to the data subject. these considerations should not be involved in any automatic of the that all information is refused to the data that are undergoing the data subject. processing and what might be, at least when based on profiling, the consequences of such processing.

ANNEX DGD 2C LIMITE EN

This right should not adversely affect the rights and freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of these considerations should not be that all information is refused to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller may request that before the information is delivered the data subject specify to which information or to which processing activities the request relates.

ANNEX DGD 2C LIMITE EN

(52) The controller should use all (52) The controller should use all (52) The controller should use all reasonable measures to verify the reasonable measures to verify the reasonable measures to verify the identity of a data subject that identity of a data subject that identity of a data subject thatwho requests access, in particular in the requests access, in particular in the requests access, in particular in the context of online services and context of online services and context of online services and online identifiers. A controller online identifiers. A controller online identifiers. Identification should not retain personal data for should not retain personal data for should include the digital the unique purpose of being able to the unique purpose of being able to identification of a data subject, for react to potential requests. react to potential requests. example through authentication mechanism such as the same credentials, used by the data subject to log-into the on-line service offered by the data controller. A controller should not retain personal data for the unique sole purpose of being able to react to potential requests.

ANNEX DGD 2C LIMITE EN

Amendment 27

(53) Any person should have the (53) Any person should have the (53) Any A natural person should right to have personal data right to have personal data have the right to have personal data concerning them rectified and a concerning them rectified and a concerning them rectified and a 'right to be forgotten' where the 'right to be forgotten erasure' 'right to be forgotten' where the retention of such data is not in where the retention of such data is retention of such data is not in compliance with this Regulation. In not in compliance with this compliance with this Regulation or particular, data subjects should Regulation. In particular, data with Union or Member State law have the right that their personal subjects should have the right that to which the controller is subject. data are erased and no longer their personal data are erased and In particular, data subjects should processed, where the data are no no longer processed, where the data have the right that their personal longer necessary in relation to the are no longer necessary in relation data are erased and no longer purposes for which the data are to the purposes for which the data processed, where the data are no collected or otherwise processed, are collected or otherwise longer necessary in relation to the where data subjects have processed, where data subjects purposes for which the data are withdrawn their consent for have withdrawn their consent for collected or otherwise processed, processing or where they object to processing or where they object to where data subjects have the processing of personal data the processing of personal data withdrawn their consent for concerning them or where the concerning them or where the processing or where they object to processing of their personal data processing of their personal data the processing of personal data otherwise does not comply with otherwise does not comply with concerning them or where the this Regulation. This right is this Regulation. This right is processing of their personal data particularly relevant, when the data particularly relevant, otherwise does not comply with subject has given their consent as a this Regulation. This right is child, when not being fully aware particularly in particular of the risks

ANNEX DGD 2C LIMITE EN

involved by the processing, and when the data subject has given relevant, when the data subject has later wants to remove such personal their consent as a child, when not given their consent as a child, when data especially on the Internet. being fully aware of the risks not being fully aware of the risks However, the further retention of involved by the processing, and involved by the processing, and the data should be allowed where it later wants to remove such personal later wants to remove such personal is necessary for historical, data especially on the Internet. data especially on the Internet. The statistical and scientific research However, the further retention of data subject should be able to

purposes, for reasons of public the data should be allowed where it exercise this right notwithstanding interest in the area of public health, is necessary for historical, the fact that he or she is no longer a

for exercising the right of freedom statistical and scientific research child. However, the further of expression, when required by purposes, for reasons of public retention of the data should be law or where there is a reason to interest in the area of public health, allowed lawful where it is restrict the processing of the data for exercising the right of freedom necessary for historical, statistical instead of erasing them. of expression, when required by and scientific research purposes, law or where there is a reason to for reasons of public interest in the restrict the processing of the data area of public health, for exercising instead of erasing them. Also, the the right of freedom of expression right to erasure should not apply and information, for compliance when the retention of personal with a legal obligation, for the data is necessary for the performance of a task carried out performance of a contract with the in the public interest or in the data subject, or when there is a exercise of official authority vested

legal obligation to retain this data. in the controller, for reasons of public interest in the area of

public health, for archiving purposes in the public interest, for historical, statistical and scientific purposes or for the establishment, exercise or defence of legal claims when required by law or where there is a reason to restrict the processing of the data

ANNEX DGD 2C LIMITE EN

instead of erasing them.

ANNEX DGD 2C LIMITE EN

Amendment 28

(54) To strengthen the 'right to be (54) To strengthen the 'right to be (54) To strengthen the 'right to be forgotten' in the online forgotten erasure' in the online forgotten' in the online environment, the right to erasure environment, the right to erasure environment, the right to erasure should also be extended in such a should also be extended in such a should also be extended in such a way that a controller who has made way that a controller who has made way that a controller who has made the personal data public should be the personal data public without the personal data public should be obliged to inform third parties legal justification should be obliged to inform third parties the which are processing such data that obliged to inform third parties controllers which are processing a data subject requests them to which are processing such data that such data that a data subject erase any links to, or copies or a data subject requests them to requests them to erase any links to, replications of that personal data. erase any links to, or copies or or copies or replications of that To ensure this information, the replications of that personal data. personal data. To ensure this the controller should take all To ensure this information, the above mentioned information, the reasonable steps, including controller should take all controller should take allreasonable technical measures, in relation to reasonable steps, including steps, taking into account data for the publication of which technical measures, in relation to available technology and the the controller is responsible. In data for the publication of which means available to the controller, relation to a third party publication the controller is responsible. In including technical measures, in of personal data, the controller relation to a third party publication relation to data for the publication should be considered responsible of personal data, the controller of which the controller is for the publication, where the should be considered responsible responsible. In relation to a third controller has authorised the for the publication, where the party publication of personal data, publication by the third party. controller has authorised the the controller should be considered publication by the third party take responsible for the publication, all necessary steps to have the data where the controller has authorised erased, including by third parties, the publication by the third party. without prejudice to the right of the data subject to claim compensation.

ANNEX DGD 2C LIMITE EN

Amendment 29

(54a) Data which are contested by the data subject and whose accuracy or inaccuracy cannot be determined should be blocked until the issue is cleared.

(54a) Methods to restrict processing of personal data could include, inter alia, temporarily moving the selected data to another processing system or making the selected data unavailable to users or temporarily removing published data from a website. In automated filing systems the restriction of processing of personal data should in principle be ensured by technical means; the fact that the processing of personal data is restricted should be indicated in the system in such a way that it is clear that the processing of the personal data is restricted.

ANNEX DGD 2C LIMITE EN

Amendment 30

(55) To further strengthen the (55) To further strengthen the (55) To further strengthen the control over their own data and control over their own data and control over their own data and their right of access, data subjects their right of access, data subjects their right of access, data subjects should have the right, where should have the right, where should have the right, where the personal data are processed by personal data are processed by processing of personal data are electronic means and in a electronic means and in a processed is carried out by structured and commonly used structured and commonly used electronic automated means and in format, to obtain a copy of the data format, to obtain a copy of the data a structured and commonly used concerning them also in commonly concerning them also in commonly format, to obtain a copy of the data used electronic format. The data used electronic format. The data concerning them also in commonly subject should also be allowed to subject should also be allowed to used electronic format. The the transmit those data, which they transmit those data, which they data subject should also be allowed have provided, from one automated have provided, from one automated to transmit receivethose the application, such as a social application, such as a social personal data concerning him or network, into another one. This network, into another one. Data her, which they have he or she has should apply where the data subject controllers should be encouraged provided , from one automated provided the data to the automated to develop interoperable formats application, such as a social processing system, based on their that enable data portability. This network, into to a controller, in a consent or in the performance of a should apply where the data subject structured and commonly used contract. provided the data to the automated and machine-readable format and processing system, based on transmit to another onecontroller. theirhis or her consent or in the

performance of a contract. This right should apply where the Providers of information society data subject provided the personal services should not make the data to the automated processing transfer of those data mandatory system, based on their his or her for the provision of their services. consent or in the performance of a

contract. It should not apply where processing is based on another legal ground other than consent or

ANNEX DGD 2C LIMITE EN

contract. By its very nature this right should not be exercised against controllers processing data in the exercise of their public duties. It should therefore in particular not apply where processing of the personal data is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller.

The data subject’s right to transmit personal data does not create an obligation for the controllers to adopt or maintain data processing systems which are technically compatible.

Where, in a certain set of personal data, more than one data subject is concerned, the right to transmit the data should be without prejudice to the requirements on the lawfulness of the processing of personal data related to another data subject in accordance with this Regulation. This right should also not prejudice the right of the data subject to obtain the erasure

ANNEX DGD 2C LIMITE EN

of personal data and the limitations of that right as set out in this Regulation and should in particular not imply the erasure of personal data concerning the data subject which have been provided by him or her for the performance of a contract, to the extent and as long as the data are necessary for the performance of that contract.

ANNEX DGD 2C LIMITE EN

Amendment 31

(56) In cases where personal data (56) In cases where personal data (56) In cases where personal data might lawfully be processed to might lawfully be processed to might lawfully be processed to protect the vital interests of the data protect the vital interests of the data protect the vital interests of the data subject, or on grounds of public subject, or on grounds of public subject, or because processing is interest, official authority or the interest, official authority or the necessary for the performance of a legitimate interests of a controller, legitimate interests of a controller, task carried out in the public any data subject should any data subject should interest or in the exercise of nevertheless be entitled to object to nevertheless be entitled to object to official authority vested in the the processing of any data relating the processing of any data relating controller or on grounds of public to them. The burden of proof to themhim or her, free of charge interest, official authority or the should be on the controller to and in a manner that can be easily legitimate interests of a controller demonstrate that their legitimate and effectively invoked. The or a third party, any data subject interests may override the interests burden of proof should be on the should nevertheless be entitled to or the fundamental rights and controller to demonstrate that their object to the processing of any data freedoms of the data subject. legitimate interests may override relating to themtheir particular the interests or the fundamental situation. The burden of proof It rights and freedoms of the data should be on for the controller to subject. demonstrate that their compelling legitimate interests may override the interests or the fundamental rights and freedoms of the data subject.

ANNEX DGD 2C LIMITE EN

Amendment 32

(57) Where personal data are (57) Where personal data are (57) Where personal data are processed for the purposes of direct processed for the purposes of direct processed for the purposes of direct marketing, the data subject should marketing, the data subject should marketing, the data subject should have the right to object to such have has the right to object to such have the right to object to such processing free of charge and in a the processing free of charge and in processing, whether the initial or manner that can be easily and a manner that can be easily and further processing, free of charge effectively invoked. effectively invoked, the controller and in a manner that can be easily should explicitly offer it to the data and effectively invoked. subject in an intelligible manner and form, using clear and plain language and should clearly distinguish it from other information.

ANNEX DGD 2C LIMITE EN

Amendment 33

(58) Every natural person should (58) Without prejudice to the (58) Every natural person The data have the right not to be subject to a lawfulness of the data processing, subject should have the right not to measure which is based on every natural person should have be subject to a measure a decision profiling by means of automated the right not to be subject to object evaluating personal aspects processing. However, such measure to a measure which is based on relating to him or her which is should be allowed when expressly profiling by means of automated based solely on profiling by means authorised by law, carried out in processing. However, such of automated processing, which the course of entering or measure. Profiling which leads to produces legal effects concerning performance of a contract, or when measures producing legal effects him or her or significantly affects the data subject has given his concerning the data subject or him or her, like automatic refusal consent. In any case, such does similarly significantly affect of an on-line credit application or processing should be subject to the interests, rights or freedoms of e-recruiting practices without any suitable safeguards, including the concerned data subject should human intervention. Such specific information of the data only be allowed when expressly processing includes also subject and the right to obtain authorised by law, carried out in 'profiling' consisting in any form human intervention and that such the course of entering or of automated processing of measure should not concern a child. performance of a contract, or when personal data evaluating personal the data subject has given his aspects relating to a natural consent. The In any case, such person, in particular to analyse or processing should be subject to predict aspects concerning suitable safeguards, including performance at work, economic specific information of the data situation, health, personal subject and the right to obtain preferences or interests, reliability human intervention assessment and or behaviour, location or that such measure should not movements as long as it produces concern a child. Such measures legal effects concerning him or should not lead to discrimination her or significantly affects him or against individuals on the basis of her. However, such measure race or ethnic origin, political decision making based on such opinions, religion or beliefs, trade processing, including profiling,

ANNEX DGD 2C LIMITE EN

union membership, sexual should be allowed when expressly

orientation or gender identity. authorised by Union or Member

State law, carried out in the course

of to which the controller is

subject, including for fraud and

tax evasion monitoring and

prevention purposes and to ensure

the security and reliability of a

service provided by the controller,

or necessary for the entering or

performance of a contract between

the data subject and a controller,

or when the data subject has given

his or her explicit consent. In any

case, such processing should be

subject to suitable safeguards,

including specific information of

the data subject and the right to

obtain human intervention and

that such measure should not

concern a child, to express his or

her point of view, to get an

explanation of the decision

reached after such assessment and

the right to contest the decision. In

order to ensure fair and

transparent processing in respect

of the data subject, having regard

to the specific circumstances and

context in which the personal data

are processed, the controller

should use adequate mathematical

ANNEX DGD 2C LIMITE EN

or statistical procedures for the profiling, implement technical and organisational measures appropriate to ensure in particular that factors which result in data inaccuracies are corrected and the risk of errors is minimized, secure personal data in a way which takes account of the potential risks involved for the interests and rights of the data subject and which prevents inter alia discriminatory effects against individuals on the basis of race or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic or health status, sexual orientation or that result in measures having such effect. Automated decision making and profiling based on special categories of personal data should only be allowed under specific conditions.

ANNEX DGD 2C LIMITE EN

Amendment 34

(58a) Profiling based solely on the processing of pseudonymous data should be presumed not to significantly affect the interests, rights or freedoms of the data subject. Where profiling, whether based on a single source of pseudonymous data or on the aggregation of pseudonymous data from different sources, permits the controller to attribute pseudonymous data to a specific data subject, the processed data should no longer be considered to be pseudonymous.

ANNEX DGD 2C LIMITE EN

(58a) Profiling as such is subject to the (general) rules of this Regulation governing processing of personal data (legal grounds of processing, data protection principles etc.) with specific safeguards (for instance the obligation to conduct an impact assessment in some cases or provisions concerning specific information to be provided to the concerned individual). The European Data Protection Board should have the possibility to issue guidance in this context.

ANNEX DGD 2C LIMITE EN

(60) Comprehensive responsibility (60) Comprehensive responsibility (60) Comprehensive The and liability of the controller for and liability of the controller for responsibility and liability of the any processing of personal data any processing of personal data controller for any processing of carried out by the controller or on carried out by the controller or on personal data carried out by the the controller's behalf should be the controller's behalf should be controller or on the controller's established. In particular, the established, in particular with behalf should be established. In controller should ensure and be regard to documentation, data particular, the controller should obliged to demonstrate the security, impact assessments, the ensure and be obliged to implement compliance of each processing data protection officer and appropriate measures and be able operation with this Regulation. oversight by data protection to demonstrate the compliance of authorities. In particular, the each processing operation activities controller should ensure and be with this Regulation. These obliged able to demonstrate the measures should take into account compliance of each processing the nature, scope, context and operation with this Regulation. purposes of the processing and the This should be verified by risk for the rights and freedoms of independent internal or external individuals. auditors.

ANNEX DGD 2C LIMITE EN

(60a) Such risks, of varying likelihood and severity, may result from data processing which could lead to physical, material or moral damage, in particular where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of data protected by professional secrecy, unauthorized reversal of pseudonymisation, or any other significant economic or social disadvantage; or where data subjects might be deprived of their rights and freedoms or from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade-union membership, and the processing of genetic data or data concerning health or sex life or criminal convictions and

ANNEX DGD 2C LIMITE EN

offences or related security measures; where personal aspects are evaluated, in particular analysing and prediction of aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable individuals, in particular of children, are processed; where processing involves a large amount of personal data and affects a large number of data subjects.

ANNEX DGD 2C LIMITE EN

(60b) The likelihood and severity of the risk should be determined in function of the nature, scope, context and purposes of the data processing. Risk should be evaluated on an objective assessment, by which it is established whether data processing operations involve a high risk. A high risk is a particular risk of prejudice to the rights and freedoms of individuals. (60c) Guidance for the implementation of appropriate measures, and for demonstrating the compliance by the controller or processor, especially as regards the identification of the risk related to the processing, their assessment in terms of their origin, nature, likelihood and severity, and the identification of best practices to mitigate the risk, could be provided in particular by approved codes of conduct, approved certifications,

ANNEX DGD 2C LIMITE EN

guidelines of the European Data Protection Board or through the indications provided by a data protection officer. The European Data Protection Board may also issue guidelines on processing operations that are considered to be unlikely to result in a high risk for the rights and freedoms of individuals and indicate what measures may be sufficient in such cases to address such risk.

ANNEX DGD 2C LIMITE EN

Amendment 37

(61) The protection of the rights (61) The protection of the rights (61) The protection of the rights and freedoms of data subjects with and freedoms of data subjects with and freedoms of data subjects regard to the processing of regard to the processing of personal individuals with regard to the personal data require that data require that appropriate processing of personal data require appropriate technical and technical and organisational that appropriate technical and organisational measures are taken, measures are taken, both at the time organisational measures are taken, both at the time of the design of the of the design of the processing and both at the time of the design of the processing and at the time of the at the time of the processing itself, processing and at the time of the processing itself, to ensure that the to ensure that the requirements of processing itself, to ensure that the requirements of this Regulation are this Regulation are met. In order to requirements of this Regulation are met. In order to ensure and ensure and demonstrate compliance met. In order to ensure andbe able demonstrate compliance with this with this Regulation, the controller to demonstrate compliance with Regulation, the controller should should adopt internal policies and this Regulation, the controller adopt internal policies and implement appropriate measures, should adopt internal policies and implement appropriate measures, which meet in particular the implement appropriate measures, which meet in particular the principles of data protection by which meet in particular the principles of data protection by design and data protection by principles of data protection by design and data protection by default. The principle of data design and data protection by default. protection by design requires data default. Such measures could protection to be embedded within consist inter alia of minimising the the entire life cycle of the processing of personal data, technology, from the very early pseudonymising personal data as design stage, right through to its soon as possible, transparency ultimate deployment, use and final

ANNEX DGD 2C LIMITE EN

disposal. This should also include with regard to the functions and the responsibility for the products processing of personal data, and services used by the controller enabling the data subject to or processor. The principle of data monitor the data processing, protection by default requires enabling the controller to create privacy settings on services and and improve security features. products which should by default When developing, designing, comply with the general principles selecting and using applications, of data protection, such as data services and products that are minimisation and purpose either based on the processing of limitation. personal data or process personal data to fulfil their task, producers of the products, services and applications should be encouraged to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations.

ANNEX DGD 2C LIMITE EN

Amendment 38

(62) The protection of the rights (62) The protection of the rights (62) The protection of the rights and freedoms of data subjects as and freedoms of data subjects as and freedoms of data subjects as well as the responsibility and well as the responsibility and well as the responsibility and liability of controllers and liability of controllers and liability of controllers and processor, also in relation to the processor, also in relation to the processors, also in relation to the monitoring by and measures of monitoring by and measures of monitoring by and measures of supervisory authorities, requires a supervisory authorities, requires a supervisory authorities, requires a clear attribution of the clear attribution of the clear attribution of the responsibilities under this responsibilities under this responsibilities under this Regulation, including where a Regulation, including where a Regulation, including where a controller determines the purposes, controller determines the purposes, controller determines the purposes, conditions and means of the conditions and means of the conditions and means of the processing jointly with other processing jointly with other processing jointly with other controllers or where a processing controllers or where a processing controllers or where a processing operation is carried out on behalf operation is carried out on behalf of operation is carried out on behalf of of a controller. a controller. The arrangement a controller. between the joint controllers should reflect the joint controllers' effective roles and relationships. The processing of personal data under this Regulation should include the permission for a controller to transmit the data to a joint controller or to a processor for the processing of the data on their his or her behalf.

ANNEX DGD 2C LIMITE EN

Amendment 39

(63) Where a controller not (63) Where a controller not (63) Where a controller not established in the Union is established in the Union is established in the Union is processing personal data of data processing personal data of data processing personal data of data subjects residing in the Union subjects residing in the Union subjects residing in the Union whose processing activities are whose processing activities are whose processing activities are related to the offering of goods or related to the offering of goods or related to the offering of goods or services to such data subjects, or to services to such data subjects, or to services to such data subjects, or to the monitoring their behaviour, the the monitoring their behaviour, the the monitoring of their behaviour controller should designate a controller should designate a in the Union, the controller should representative, unless the controller representative, unless the controller designate a representative, unless is established in a third country is established in a third country the processing it carries out is ensuring an adequate level of ensuring an adequate level of occasional and unlikely to result protection, or the controller is a protection, or the controller is a in a risk for the rights and small or medium sized enterprise small or medium sized enterprise or freedoms of data subjects, taking or a public authority or body or processing relates to fewer than into account the nature, scope, where the controller is only 5000 data subjects during any context and purposes of the occasionally offering goods or consecutive 12-month period and processing or the controller is services to such data subjects. The is not carried out on special established in a third country representative should act on behalf categories of personal data, or is a ensuring an adequate level of of the controller and may be public authority or body or where protection, or the controller is a addressed by any supervisory the controller is only occasionally small or medium sized enterprise or authority. offering goods or services to such a public authority or body or where data subjects. The representative the controller is only occasionally should act on behalf of the offering goods or services to such controller and may be addressed by data subjects. The any supervisory authority.

ANNEX DGD 2C LIMITE EN

representative should act on behalf of the controller and may be addressed by any supervisory authority. The representative should be explicitly designated by a written mandate of the controller to act on its behalf with regard to the latter's obligations under this Regulation. The designation of such representative does not affect the responsibility and liability of the controller under this Regulation. Such representative should perform its tasks according to the received mandate from the controller, including to cooperate with the competent supervisory authorities on any action taken in ensuring compliance with this Regulation. The designated representative should be subjected to enforcement actions in case of non-compliance by the controller.

ANNEX DGD 2C LIMITE EN

(63a) To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. Adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller. The carrying out of processing by a processor should be governed by a contract or other legal act under Union or

ANNEX DGD 2C LIMITE EN

Member State law, binding the processor to the controller, setting out the subject-matter and duration of the processing, the nature and purposes of the processing, the type of personal data and categories of data subjects, taking into account the specific tasks and responsibilities of the processor in the context of the processing to be carried out and the risk for the rights and freedoms of the data subject. The controller and processor may choose to use an individual contract or standard contractual clauses which are adopted either directly by the Commission or by a supervisory authority in accordance with the consistency mechanism and then adopted by the Commission, or which are part of a certification granted in the certification mechanism. After the completion of the processing on behalf of the controller, the processor should return or delete the personal

ANNEX DGD 2C LIMITE EN

data, unless there is a requirement to store the data under Union or Member State law to which the processor is subject.

Amendment 39

(64) In order to determine whether (64) In order to determine whether deleted a controller is only occasionally a controller is only occasionally offering goods and services to data offering goods and services to data subjects residing in the Union, it subjects residing in the Union, it should be ascertained whether it is should be ascertained whether it is apparent from the controller's apparent from the controller's overall activities that the offering overall activities that the offering of goods and services to such data of goods and services to such data subjects is ancillary to those main subjects is ancillary to those main activities. activities.

ANNEX DGD 2C LIMITE EN

Amendment 41

(65) In order to demonstrate (65) In order to be able to (65) In order to demonstrate compliance with this Regulation, demonstrate compliance with this compliance with this Regulation, the controller or processor should Regulation, the controller or the controller or processor should document each processing processor should document each document each maintain records operation. Each controller and processing operation maintain the regarding all categories of processor should be obliged to codocumentation necessary in order processing operationactivities operate with the supervisory to fulfill the requirements laid under its responsibility. Each authority and make this down in this Regulation. Each controller and processor should be documentation, on request, controller and processor should be obliged to co-operate with the available to it, so that it might obliged to co-operate with the supervisory authority and make this serve for monitoring those supervisory authority and make this documentationthese records, on processing operations. documentation, on request, request, available to it, so that it available to it, so that it might serve might serve for monitoring those for monitoring those processing processing operations. operations evaluating the compliance with this Regulation. However, equal emphasis and significance should be placed on good practice and compliance and not just the completion of documentation.

ANNEX DGD 2C LIMITE EN

Amendment 42

(66) In order to maintain security (66) In order to maintain security (66) In order to maintain security and to prevent processing in breach and to prevent processing in breach and to prevent processing in breach of this Regulation, the controller or of this Regulation, the controller or of this Regulation, the controller or processor should evaluate the risks processor should evaluate the risks processor should evaluate the risks inherent to the processing and inherent to the processing and inherent to the processing and implement measures to mitigate implement measures to mitigate implement measures to mitigate those risks. These measures should those risks. These measures should those risks. These measures should ensure an appropriate level of ensure an appropriate level of ensure an appropriate level of security, taking into account the security, taking into account the security including confidentiality, state of the art and the costs of state of the art and the costs of their taking into account available their implementation in relation to implementation in relation to the technology the state of the art and the risks and the nature of the risks and the nature of the personal the costs of their implementation in personal data to be protected. data to be protected. When relation to the risks and the nature When establishing technical establishing technical standards and of the personal data to be protected. standards and organisational organisational measures to ensure When establishing technical measures to ensure security of security of processing, the standards and organisational processing, the Commission should Commission should promote measures to ensure security of promote technological neutrality, technological neutrality, processing, the Commission should interoperability and innovation, interoperability and innovation promote technological neutrality, and, where appropriate, cooperate should be promoted and, where interoperability and innovation, with third countries. appropriate, cooperate cooperation and, where appropriate, cooperate with third countries should be with third countries In assessing encouraged. data security risk, consideration

ANNEX DGD 2C LIMITE EN

should be given to the risks that are presented by data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed, which may in particular lead to physical, material or moral damage. (66a) In order to enhance compliance with this Regulation in cases where the processing operations are likely to result in a high risk for the rights and freedoms of individuals, the controller should be responsible for the carrying out of a data protection impact assessment to evaluate, in particular, the origin, nature, particularity and severity of this risk. The outcome of the assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the processing of personal data is in compliance

ANNEX DGD 2C LIMITE EN

with this Regulation. Where a data protection impact assessment indicates that processing operations involve a high risk which the controller cannot mitigate by appropriate measures in terms of available technology and costs of implementation, a consultation of the supervisory authority should take place prior to the processing.

Amendment 43

(67) A personal data breach may, if (67) A personal data breach may, if (67) A personal data breach may, if not addressed in an adequate and not addressed in an adequate and not addressed in an adequate and timely manner, result in substantial timely manner, result in substantial timely manner, result in physical, economic loss and social harm, economic loss and social harm, material or moral damage to including identity fraud, to the including identity fraud, to the individuals such as substantial individual concerned. Therefore, as individual concerned. Therefore, as economic loss of control over their soon as the controller becomes soon as the controller becomes personal data or limitation of their aware that such a breach has aware that such a breach has rights, discrimination, identity occurred, the controller should occurred, the controller should theft or fraud, financial loss, notify the breach to the supervisory notify the breach to the supervisory unauthorized reversal of authority without undue delay and, authority without undue delay and, pseudonymisation, damage to the where feasible, within 24 hours. where feasible, within 24,which reputation, loss of confidentiality Where this cannot should be presumed to be not later

ANNEX DGD 2C LIMITE EN

achieved within 24 hours, an than 72 hours. Where this cannot of data protected by professional explanation of the reasons for the achieved within 24 hours If secrecy or any other economic or delay should accompany the applicable, an explanation of the and social harm, including identity notification. The individuals whose reasons for the delay should fraud, disadvantage to the personal data could be adversely accompany the notification. The individual concerned. Therefore, as affected by the breach should be individuals whose personal data soon as the controller becomes notified without undue delay in could be adversely affected by the aware that such a personal data order to allow them to take the breach should be notified without breach which may result in necessary precautions. A breach undue delay in order to allow them physical, material or moral should be considered as adversely to take the necessary precautions. A damage has occurred, the affecting the personal data or breach should be considered as controller should notify the breach privacy of a data subject where it adversely affecting the personal to the supervisory authority without could result in, for example, data or privacy of a data subject undue delay and, where feasible, identity theft or fraud, physical where it could result in, for within 24 72 hours. Where this harm, significant humiliation or example, identity theft or fraud, cannot be achieved within 24 72 damage to reputation. The physical harm, significant hours, an explanation of the reasons notification should describe the humiliation or damage to for the delay should accompany the nature of the personal data breach reputation. The notification should notification. The individuals whose as well as recommendations as describe the nature of the personal rights and freedoms personal data well as recommendations for the data breach and formulate as well could be adversely severely individual concerned to mitigate as recommendations as well as affected by the breach should be potential adverse effects. recommendations for the individual notified without undue delay in Notifications to data subjects concerned to mitigate potential order to allow them to take the should be made as soon as adverse effects. Notifications to necessary precautions. A breach reasonably feasible, and in close data subjects should be made as should be considered as adversely cooperation with the supervisory soon as reasonably feasible, and in affecting the personal data or authority and respecting guidance close cooperation with the privacy of a data subject where it provided by it or other relevant supervisory authority and could result in, for example, authorities (e.g. law enforcement respecting guidance provided by it identity theft or fraud, physical authorities). For example, the or other relevant authorities (e.g. harm, significant humiliation or chance for data subjects to mitigate law enforcement authorities). For damage to reputation. The an immediate risk of harm would example, the chance for data notification should describe the

ANNEX DGD 2C LIMITE EN

call for a prompt notification of subjects to mitigate an immediate nature of the personal data breach data subjects whereas the need to risk of harm would call for a as well as recommendations as well implement appropriate measures prompt notification of data subjects as recommendations for the against continuing or similar data whereas the need to implement individual concerned to mitigate breaches may justify a longer appropriate measures against potential adverse effects. delay. continuing or similar data breaches Notifications to data subjects may justify a longer delay. should be made as soon as reasonably feasible, and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities (e.g. law enforcement authorities). For example, the chance for data subjects need to mitigate an immediate risk of harmdamage would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay.

ANNEX DGD 2C LIMITE EN

(68) In order to determine whether (68) In order to determine whether (68) In order to determine It must a personal data breach is notified to a personal data breach is notified to whether a personal data breach is the supervisory authority and to the the supervisory authority and to the notified to the supervisory authority data subject without undue delay, it data subject without undue delay, it and to the data subject without should be ascertained whether the should be ascertained whether the undue delay, it should be controller has implemented and controller has implemented and ascertained whether the controller applied appropriate technological applied appropriate technological has implemented and applied all protection and organisational protection and organisational appropriate technological measures to establish immediately measures to establish immediately protection and organisational whether a personal data breach has whether a personal data breach has measures have been implemented taken place and to inform promptly taken place and to inform promptly to establish immediately whether a the supervisory authority and the the supervisory authority and the personal data breach has taken data subject, before a damage to data subject, before a damage to place and to inform promptly the personal and economic interests personal and economic interests supervisory authority and the data occurs, taking into account in occurs, taking into account in subject ., before a damage to particular the nature and gravity of particular the nature and gravity of personal and economic interests the personal data breach and its the personal data breach and its occurs, The fact that the consequences and adverse effects consequences and adverse effects notification was made without for the data subject. for the data subject. undue delay should be established taking into account in particular the nature and gravity of the personal data breach and its consequences and adverse effects for the data subject. Such notification may result in an intervention of the supervisory authority in accordance with its tasks and powers laid down in this Regulation.

ANNEX DGD 2C LIMITE EN

(68a) The communication of a personal data breach to the data subject should not be required if the controller has implemented appropriate technological protection measures, and that those measures were applied to the data affected by the personal data breach. Such technological protection measures should include those that render the data unintelligible to any person who is not authorised to access it, in particular by encrypting the personal data.

ANNEX DGD 2C LIMITE EN

(69) In setting detailed rules (69) In setting detailed rules (69) In setting detailed rules concerning the format and concerning the format and concerning the format and procedures applicable to the procedures applicable to the procedures applicable to the notification of personal data notification of personal data notification of personal data breaches, due consideration should breaches, due consideration should breaches, due consideration should be given to the circumstances of be given to the circumstances of the be given to the circumstances of the the breach, including whether or breach, including whether or not breach, including whether or not not personal data had been personal data had been protected by personal data had been protected by protected by appropriate technical appropriate technical protection appropriate technical protection protection measures, effectively measures, effectively limiting the measures, effectively limiting the limiting the likelihood of identity likelihood of identity fraud or other likelihood of identity fraud or other fraud or other forms of misuse. forms of misuse. Moreover, such forms of misuse. Moreover, such Moreover, such rules and rules and procedures should take rules and procedures should take procedures should take into into account the legitimate interests into account the legitimate interests account the legitimate interests of of law enforcement authorities in of law enforcement authorities in law enforcement authorities in cases where early disclosure could cases where early disclosure could cases where early disclosure could unnecessarily hamper the unnecessarily hamper the unnecessarily hamper the investigation of the circumstances investigation of the circumstances investigation of the circumstances of a breach. of a breach. of a breach.

ANNEX DGD 2C LIMITE EN

(70) Directive 95/46/EC i provided (70) Directive 95/46/EC i provided (70) Directive 95/46/EC i provided for a general obligation to notify for a general obligation to notify for a general obligation to notify processing of personal data to the processing of personal data to the processing of personal data to the supervisory authorities. While this supervisory authorities. While this supervisory authorities. While this obligation produces administrative obligation produces administrative obligation produces administrative and financial burdens, it did not in and financial burdens, it did not in and financial burdens, it did not in all cases contribute to improving all cases contribute to improving all cases contribute to improving the protection of personal data. the protection of personal data. the protection of personal data. Therefore such indiscriminate Therefore such indiscriminate Therefore such indiscriminate general notification obligation general notification obligation general notification obligations should be abolished, and replaced should be abolished, and replaced should be abolished, and replaced by effective procedures and by effective procedures and by effective procedures and mechanism which focus instead on mechanism which focus instead on mechanisms which focus instead on those processing operations which those processing operations which those types of processing are likely to present specific risks are likely to present specific risks operations which are likely to to the rights and freedoms of data to the rights and freedoms of data present specificresult in a high subjects by virtue of their nature, subjects by virtue of their nature, risks to the rights and freedoms of their scope or their purposes. In their scope or their purposes. In data subjectsindividuals by virtue such cases, a data protection such cases, a data protection impact of their nature, their scope, context impact assessment should be assessment should be carried out by and or their purposes. In such carried out by the controller or the controller or processor prior to cases, a data protection impact processor prior to the processing, the processing, which should assessment should be carried out by which should include in particular include in particular the envisaged the controller or processor prior to the envisaged measures, safeguards measures, safeguards and the types of processing, operations and mechanisms for ensuring the mechanisms for ensuring the may be those which should include protection of personal data and for protection of personal data and for in particular, involve using new demonstrating the compliance with demonstrating the compliance with technologies, or are of a new kind this Regulation. this Regulation. and where no data protection impact assessment has been carried out before by the controller, or where they become necessary in the light of the time

ANNEX DGD 2C LIMITE EN

that has elapsed since the initial processingthe envisaged measures, safeguards and mechanisms for ensuring the protection of personal data and for demonstrating the compliance with this Regulation. (70a) In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk, which should include in particular the envisaged measures, safeguards and mechanisms for mitigating that risk and for ensuring the protection of personal data and for demonstrating the compliance with this Regulation.

ANNEX DGD 2C LIMITE EN

(71) This should in particular apply (71) This should in particular apply (71) This should in particular apply to newly established large scale to newly established large scale to newly established large-scale filing systems, which aim at filing systems, which aim at filing systemsprocessing processing a considerable amount processing a considerable amount operations, which aim at of personal data at regional, of personal data at regional, processing a considerable amount national or supranational level and national or supranational level and of personal data at regional, which could affect a large number which could affect a large number national or supranational level and of data subjects. of data subjects. which could affect a large number of data subjects and which are likely to result in a high risk, for example, on account of their sensitivity, where in accordance with the achieved state of technological knowledge a new technology is used on a large scale as well as to other processing operations which result in a high risk for the rights and freedoms of data subjects, in particular where those operations render it more difficult for data subjects to exercise their rights. A data protection impact assessment should also be made in cases where data are processed for taking decisions regarding specific individuals following any systematic and extensive evaluation of personal aspects relating to natural persons based on profiling those data or following the processing of special

ANNEX DGD 2C LIMITE EN

categories of personal data, biometric data, or data on criminal convictions and offences or related security measures. A data protection impact assessment is equally required for monitoring publicly accessible areas on a large scale, especially when using optic-electronic devices or for any other operations where the competent supervisory authority considers that the processing is likely to result in a high risk for the rights and freedoms of data subjects, in particular because they prevent data subjects from exercising a right or using a service or a contract, or because they are carried out systematically on a large scale. The processing of personal data irrespective of the volume or the nature of the data, should not be considered as being on a large scale, if the processing of these data is protected by professional secrecy, such as the processing of personal data from patients or clients by an individual doctor, health care professional, hospital or attorney. In these cases a data protection impact assessment should not be mandatory.

ANNEX DGD 2C LIMITE EN

Amendment 44

(71a) Impact assessments are the essential core of any sustainable data protection framework, making sure that businesses are aware from the outset of all possible consequences of their data processing operations. If impact assessments are thorough, the likelihood of any data breach or privacy-intrusive operation can be fundamentally limited. Data protection impact assessments should consequently have regard to the entire lifecycle management of personal data from collection to processing to deletion, describing in detail the envisaged processing operations, the risks to the rights and freedoms of data subjects, the measures envisaged to address the risks, safeguards, security measures and mechanisms to ensure compliance with the this Rregulation.

ANNEX DGD 2C LIMITE EN

Amendment 45

(71b) Controllers should focus on the protection of personal data throughout the entire data lifecycle from collection to processing to deletion by investing from the outset in a sustainable data management framework and by following it up with a comprehensive compliance mechanism.

(72) There are circumstances under (72) There are circumstances under (72) There are circumstances under which it may be sensible and which it may be sensible and which it may be sensible and economic that the subject of a data economic that the subject of a data economic that the subject of a data protection impact assessment protection impact assessment protection impact assessment should be broader than a single should be broader than a single should be broader than a single project, for example where public project, for example where public project, for example where public authorities or bodies intend to authorities or bodies intend to authorities or bodies intend to establish a common application or establish a common application or establish a common application or processing platform or where processing platform or where processing platform or where several controllers plan to several controllers plan to introduce several controllers plan to introduce introduce a common application or a common application or a common application or processing environment across an processing environment across an processing environment across an industry sector or segment or for a industry sector or segment or for a industry sector or segment or for a widely used horizontal activity. widely used horizontal activity. widely used horizontal activity.

ANNEX DGD 2C LIMITE EN

Amendment 46

(73) Data protection impact deleted (73) Data protection impact assessments should be carried out assessments should may be carried by a public authority or public out by a public authority or public body if such an assessment has not body if such an assessment has not already been made in the context already been made in the context of of the adoption of the national law the adoption of the national law on on which the performance of the which the performance of the tasks tasks of the public authority or of the public authority or public public body is based and which body is based and which regulates regulates the specific processing the specific processing operation or operation or set of operations in set of operations in question. question.

Amendment 47

(74) Where a data protection (74) Where a data protection (74) Where a data protection impact assessment indicates that impact assessment indicates that impact assessment indicates that processing operations involve a processing operations involve a the processing would, despite the high degree of specific risks to the high degree of specific risks to the envisaged safeguards, security rights and freedoms of data rights and freedoms of data measures and mechanisms to subjects, such as excluding subjects, such as excluding mitigate the operations involve a individuals from their right, or by individuals from their right, or by high degree of specific risks to the the use of specific new the use of specific new result in a high risk to the rights technologies, the supervisory technologies, the data protection and freedoms of data authority should be consulted, prior officer or the supervisory authority subjectsindividuals and the to the start of operations, on a risky should be consulted, prior to the controller is of the opinion that the processing which might not be in start of operations, on a risky risk cannot be mitigated by compliance with this Regulation, processing which might not be in reasonable means in terms of and to make proposals to remedy compliance with this Regulation, available technologies and costs of such situation. Such consultation and to make proposals to remedy implementation, such as excluding should equally take place in the such situation. Such A consultation individuals from their right, or by course of the preparation either of of the supervisory authority should the use of specific new

ANNEX DGD 2C LIMITE EN

a measure by the national equally take place in the course of technologies, the supervisory parliament or of a measure based the preparation either of a measure authority should be consulted, prior on such legislative measure which by the national parliament or of a to the start of operationsprocessing defines the nature of the processing measure based on such legislative activities, on a risky processing and lays down appropriate measure which defines the nature which might not be in compliance safeguards. of the processing and lays down with this Regulation, and to make appropriate safeguards. proposals to remedy such situation. Such consultation should equally take place in the course of the preparation either of a measure by the national parliament or of a measure based on such legislative measure which defines the nature of the processing and lays down appropriate safeguards. Such high risk is likely to result from certain types of data processing and certain extent and frequency of processing, which may result also in a realisation of damage or interference with the rights and freedoms of the data subject. The supervisory authority should respond to the request for consultation in a defined period. However, the absence of a reaction of the supervisory authority within this period should be without prejudice to any intervention of the supervisory authority in accordance with its tasks and powers laid down in this

ANNEX DGD 2C LIMITE EN

Regulation, including the power to prohibit processing operations. As part of this consultation process, the outcome of a data protection impact assessment carried out with regard to the processing at issue pursuant to Article 33 may be submitted to the supervisory authority, in particular the measures envisaged to mitigate the risk for the rights and freedoms of individuals.

Amendment 48

(74a) Impact assessments can only be of help if controllers make sure that they comply with the promises originally laid down in them. Data controllers should therefore conduct periodic data protection compliance reviews demonstrating that the data processing mechanisms in place comply with assurances made in the data protection impact assessment. It should further demonstrate the ability of the data controller to comply with the autonomous choices of data subjects. In addition, in case the review finds compliance inconsistencies, it should highlight these and present recommendations on how to achieve

ANNEX DGD 2C LIMITE EN

full compliance.

ANNEX DGD 2C LIMITE EN

(74a) The processor should assist the controller, where necessary and upon request, in ensuring compliance with the obligations deriving from the carrying out of data protection impact assessments and from prior consultation of the supervisory authority. (74b) A consultation with the supervisory authority should also take place in the course of the preparation of a legislative or regulatory measure which provides for the processing of personal data, in order to ensure the compliance of the intended processing with this Regulation and in particular to mitigate the risk involved for the data subject.

ANNEX DGD 2C LIMITE EN

Amendment 49

(75) Where the processing is (75) Where the processing is (75) Where the processing is carried out in the public sector or carried out in the public sector or carried out in the public sector or where, in the private sector, where, in the private sector, where, in the private sector, processing is carried out by a large processing is carried out by a large processing is carried out by a large enterprise, or where its core enterprise relates to more than enterprise, or where its core activities, regardless of the size of 5000 data subjects within 12 activities, regardless of the size of the enterprise, involve processing months, or where its core activities, the enterprise, involve processing operations which require regular regardless of the size of the operations which require regular and systematic monitoring, a enterprise, involve processing and systematic monitoring, a person should assist the controller operations on sensitive data, or person should with expert or processor to monitor internal processing operations which knowledge of data protection law compliance with this Regulation. require regular and systematic and practices may assist the Such data protection officers, monitoring, a person should assist controller or processor to monitor whether or not an employee of the the controller or processor to internal compliance with this controller, should be in a position monitor internal compliance with Regulation. Such data protection to perform their duties and tasks this Regulation. When establishing officers, whether or not an independently. whether data about a large employee of the controller, should number of data subjects are be in a position to perform their processed, archived data that are duties and tasks in an restricted in such a way that they independently manner. are not subject to the normal data access and processing operations of the controller and can no longer be changed should not be taken into account. Such data protection

ANNEX DGD 2C LIMITE EN

officers, whether or not an employee of the controller and whether or not performing that task full time, should be in a position to perform their duties and tasks independently and enjoy special protection against dismissal. Final responsibility should stay with the management of an organisation. The data protection officer should in particular be consulted prior to the design, procurement, development and setting-up of systems for the automated processing of personal data, in order to ensure the principles of privacy by design and privacy by default.

ANNEX DGD 2C LIMITE EN

Amendment 50

( 75a) The data protection officer should have at least the following qualifications: extensive knowledge of the substance and application of data protection law, including technical and organisational measures and procedures; mastery of technical requirements for privacy by design, privacy by default and data security; industry-specific knowledge in accordance with the size of the controller or processor and the sensitivity of the data to be processed; the ability to carry out inspections, consultation, documentation, and log file analysis; and the ability to work with employee representation. The controller should enable the data protection officer to take part in advanced training measures to maintain the specialized knowledge required to perform his or her duties. The designation as a data protection officer does not necessarily require fulltime occupation of the respective employee.

ANNEX DGD 2C LIMITE EN

Amendment 51

(76) Associations or other bodies (76) Associations or other bodies (76) Associations or other bodies representing categories of representing categories of representing categories of controllers should be encouraged to controllers should be encouraged, controllers or processors should be draw up codes of conduct, within after consultation of the encouraged to draw up codes of the limits of this Regulation, so as representatives of the employees, conduct, within the limits of this to facilitate the effective to draw up codes of conduct, within Regulation, so as to facilitate the application of this Regulation, the limits of this Regulation, so as effective application of this taking account of the specific to facilitate the effective Regulation, taking account of the characteristics of the processing application of this Regulation, specific characteristics of the carried out in certain sectors. taking account of the specific processing carried out in certain characteristics of the processing sectors and the specific needs of carried out in certain sectors. Such micro, small and medium codes should make compliance enterprises. In particular such with this Regulation easier for codes of conduct could calibrate industry. the obligations of controllers and processors, taking into account the risk likely to result from the processing for the rights and freedoms of individuals.

ANNEX DGD 2C LIMITE EN

(76a) When drawing up a code of conduct, or when amending or extending such a code, associations and other bodies representing categories of controllers or processors should consult with relevant stakeholders, including data subjects where feasible, and have regard to submissions received and views expressed in response to such consultations.

Amendment 52

(77) In order to enhance (77) In order to enhance (77) In order to enhance transparency and compliance with transparency and compliance with transparency and compliance with this Regulation, the establishment this Regulation, the establishment this Regulation, the establishment of certification mechanisms, data of certification mechanisms, data of certification mechanisms, data protection seals and marks should protection seals and standardised protection seals and marks should be encouraged, allowing data marks should be encouraged, be encouraged, allowing data subjects to quickly assess the level allowing data subjects to quickly, subjects to quickly assess the level of data protection of relevant reliably and verifiably assess the of data protection of relevant products and services. level of data protection of relevant products and services. products and services. A "European Data Protection Seal" should be established on the European level to create trust among data subjects, legal certainty for controllers, and at the same time export European data protection standards by allowing non-European companies to more

ANNEX DGD 2C LIMITE EN

easily enter European markets by being certified.

(78) Cross-border flows of personal (78) Cross-border flows of personal (78) Cross-border flows of personal data are necessary for the expansion data are necessary for the expansion data to and from countries outside of international trade and of international trade and the Union and international international co-operation. The international co-operation. The organisations are necessary for the increase in these flows has raised increase in these flows has raised expansion of international trade and new challenges and concerns with new challenges and concerns with international co-operation. The respect to the protection of personal respect to the protection of personal increase in these flows has raised data. However, when personal data data. However, when personal data new challenges and concerns with are transferred from the Union to are transferred from the Union to respect to the protection of personal third countries or to international third countries or to international data. However, when personal data organisations, the level of protection organisations, the level of protection are transferred from the Union to of individuals guaranteed in the of individuals guaranteed in the controllers, processors or other Union by this Regulation should not Union by this Regulation should not recipients in third countries or to be undermined. In any event, be undermined. In any event, international organisations, the level transfers to third countries may only transfers to third countries may only of protection of individuals be carried out in full compliance be carried out in full compliance guaranteed in the Union by this with this Regulation. with this Regulation. Regulation should not be undermined, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. In any event, transfers to third countries and international organisations may only be carried out in full compliance with this Regulation. A transfer may only take place if, subject to the other provisions of this Regulation, the conditions laid down in Chapter V are complied

ANNEX DGD 2C LIMITE EN

with by the controller or processor.

Amendment 53

(79) This Regulation is without (79) This Regulation is without (79) This Regulation is without prejudice to international prejudice to international prejudice to international

agreements concluded between the agreements concluded between the agreements concluded between the Union and third countries Union and third countries Union and third countries regulating the transfer of personal regulating the transfer of personal regulating the transfer of personal data including appropriate data including appropriate data including appropriate safeguards for the data subjects. safeguards for the data subjects safeguards for the data subjects. ensuring an adequate level of Member States may conclude protection for the fundamental international agreements which rights of citizens involve the transfer of personal data to third countries or international organisations, as far as such agreements do not affect this Regulation or any other provisions of EU law and include safeguards to protect the rights of the data subjects.

ANNEX DGD 2C LIMITE EN

Amendment 54

(80) The Commission may decide (80) The Commission may decide (80) The Commission may decide with effect for the entire Union that with effect for the entire Union that with effect for the entire Union that certain third countries, or a certain third countries, or a territory certain third countries, or a territory territory or a processing sector or a processing sector within a third or a processing specified sector,

within a third country, or an country, or an international such as the private sector or one international organisation, offer an organisation, offer an adequate or more specific economic sectors adequate level of data protection, level of data protection, thus within a third country, or an thus providing legal certainty and providing legal certainty and international organisation, offer an uniformity throughout the Union as uniformity throughout the Union as adequate level of data protection, regards the third countries or regards the third countries or thus providing legal certainty and international organisations which international organisations which uniformity throughout the Union as are considered to provide such are considered to provide such regards the third countries or level of protection. In these cases, level of protection. In these cases, international organisations, which transfers of personal data to these transfers of personal data to these are considered to provide such countries may take place without countries may take place without level of protection. In these cases, needing to obtain any further needing to obtain any further transfers of personal data to these authorisation. authorisation. The Commission countries may take place without may also decide, having given needing to obtain any further notice and a complete justification authorisation. to the third country, to revoke such a decision.

ANNEX DGD 2C LIMITE EN

(81) In line with the fundamental (81) In line with the fundamental (81) In line with the fundamental values on which the Union is values on which the Union is values on which the Union is

founded, in particular the founded, in particular the founded, in particular the protection of human rights, the protection of human rights, the protection of human rights, the Commission should, in its Commission should, in its Commission should, in its assessment of the third country, assessment of the third country, assessment of the a third country or take into account how a given third take into account how a given third of a territory or of a specified country respects the rule of law, country respects the rule of law, sector within a third country, take access to justice as well as access to justice as well as into account how a given third international human rights norms international human rights norms country respects the rule of law, and standards. and standards. access to justice as well as international human rights norms and standards and its general and sectoral law, including legislation concerning public security, defence and national security as well as public order and criminal law. The adoption of an adequacy decision to a territory or a specified sector in a third country should take into account clear and objective criteria , such as specific processing activities and the scope of applicable legal standards and legislation in force in the third country. The third country should offer guarantees that ensure an adequate level of protection in particular when data are processed in one or several specific sectors. In particular, the third country should ensure

ANNEX DGD 2C LIMITE EN

effective data protection supervision and should provide for cooperation mechanisms with the European data protection authorities, and the data subjects should be provided with effective and enforceable rights and effective administrative and judicial redress.

(81a) Apart from the international commitments the third country or international organisation has entered into, the Commission should also take account of obligations arising from the third country’s or international organisation’s participation in multilateral or regional systems in particular in relation to the protection of personal data, as well as the implementation of such obligations. In particular the third country’s accession to the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to the Automatic Processing of Personal Data and its Additional Protocol should be taken into account. The Commission should consult with the European Data Protection

ANNEX DGD 2C LIMITE EN

Board when assessing the level of protection in third countries or international organisations.

ANNEX DGD 2C LIMITE EN

(81b) The Commission should monitor the functioning of decisions on the level of protection in a third country or a territory or specified sector within a third country, or an international organisation, including decisions adopted on the basis of Article 25(6) or Article 26 (4) of Directive 95/46/EC. The Commission should evaluate, within a reasonable time, the functioning of the latter decisions and report any pertinent findings to the Committee within the meaning of Regulation (EU) No 182/2011 i as established under this Regulation.

ANNEX DGD 2C LIMITE EN

Amendment 55

(82) The Commission may equally (82) The Commission may equally (82) The Commission may equally recognise that a third country, or a recognise that a third country, or a recognise that a third country, or a territory or a processing sector territory or a processing sector territory or a processing specified within a third country, or an within a third country, or an sector within a third country, or an international organisation offers no international organisation offers no international organisation offers no adequate level of data protection. adequate level of data protection. longer ensures an adequate level

Consequently the transfer of Any legislation which provides for of data protection. Consequently personal data to that third country extra-territorial access to personal the transfer of personal data to that should be prohibited. In that case, data processed in the Union third country or international provision should be made for without authorisation under organisation should be prohibited, consultations between the Union or Member State law unless the requirements of Articles Commission and such third should be considered as an 42 to 44 are fulfilled. In that case, countries or international indication of a lack of adequacy. provision should be made for organisations. Consequently the transfer of consultations between the personal data to that third country Commission and such third should be prohibited. In that case, countries or international provision should be made for organisations. The Commission consultations between the should, in a timely manner, Commission and such third inform the third country or countries or international international organisation of the organisations. reasons and enter into consultations with it in order to remedy the situation.

ANNEX DGD 2C LIMITE EN

Amendment 56

(83) In the absence of an adequacy (83) In the absence of an adequacy (83) In the absence of an adequacy decision, the controller or decision, the controller or processor decision, the controller or processor processor should take measures to should take measures to should take measures to

compensate for the lack of data compensate for the lack of data compensate for the lack of data protection in a third country by protection in a third country by way protection in a third country by way way of appropriate safeguards for of appropriate safeguards for the of appropriate safeguards for the the data subject. Such appropriate data subject. Such appropriate data subject. Such appropriate safeguards may consist of making safeguards may consist of making safeguards may consist of making use of binding corporate rules, use of binding corporate rules, use of binding corporate rules, standard data protection clauses standard data protection clauses standard data protection clauses adopted by the Commission, adopted by the Commission, adopted by the Commission, standard data protection clauses standard data protection clauses standard data protection clauses adopted by a supervisory authority adopted by a supervisory authority adopted by a supervisory authority or contractual clauses authorised or contractual clauses authorised by or ad hoc contractual clauses by a supervisory authority, or other a supervisory authority, or other authorised by a supervisory suitable and proportionate suitable and proportionate authority, or other suitable and measures justified in the light of all measures justified in the light of all proportionate measures justified in the circumstances surrounding a the circumstances surrounding a the light of all the circumstances data transfer operation or set of data transfer operation or set of surrounding a data transfer data transfer operations and where data transfer operations and where operation or set of data transfer authorised by a supervisory authorised by a supervisory operations and where authorised by authority. authority. Those appropriate a supervisory authority. Those safeguards should uphold a safeguards should ensure respect of the data subject’s rights compliance with data protection adequate to intra-EU processing, requirements and the rights of the in particular relating to purpose data subjects, including the right limitation, right to access, to obtain effective administrative rectification, erasure and to claim or judicial redress. They should compensation. Those safeguards relate in particular to compliance should in particular guarantee the with the general principles

ANNEX DGD 2C LIMITE EN

observance of the principles of relating to personal data personal data processing, processing, the availability of safeguard the data subject’s rights enforceable data subject's rights and provide for effective redress and of effective legal remedies and mechanisms, ensure the the principles of data protection by observance of the principles of design and by default. Transfers data protection by design and by may be carried out also by public default, guarantee the existence of authorities or bodies with public a data protection officer. authorities or bodies in third countries or with international organisations with corresponding duties or functions, including on the basis of provisions to be inserted into administrative arrangements, such as a memorandum of understanding. The authorisation of the competent supervisory authority should be obtained when the safeguards are adduced in non legally binding administrative arrangements.

ANNEX DGD 2C LIMITE EN

Amendment 57

(84) The possibility for the (84) The possibility for the (84) The possibility for the controller or processor to use controller or processor to use controller or processor to use standard data protection clauses standard data protection clauses standard data protection clauses adopted by the Commission or by a adopted by the Commission or by a adopted by the Commission or by a supervisory authority should supervisory authority should supervisory authority should neither prevent the possibility for neither prevent the possibility for neither prevent the possibility for controllers or processors to include controllers or processors to include controllers or processors to include the standard data protection clauses the standard data protection clauses the standard data protection clauses in a wider contract nor to add other in a wider contract nor to add other in a wider contract, including in a clauses as long as they do not clauses or supplementary contract between the processor contradict, directly or indirectly, safeguards as long as they do not and another processor, nor to add the standard contractual clauses contradict, directly or indirectly, other clauses or additional adopted by the Commission or by a the standard contractual clauses safeguards as long as they do not supervisory authority or prejudice adopted by the Commission or by a contradict, directly or indirectly, the fundamental rights or freedoms supervisory authority or prejudice the standard contractual clauses of the data subjects. the fundamental rights or freedoms adopted by the Commission or by a of the data subjects. The standard supervisory authority or prejudice data protection clauses adopted by the fundamental rights or freedoms the Commission could cover of the data subjects.

different situations, namely transfers from controllers established in the Union to controllers established outside the Union and from controllers established in the Union to processors, including subprocessors, established outside the Union. Controllers and processors should be encouraged to provide even more robust safeguards via

ANNEX DGD 2C LIMITE EN

additional contractual commitments that supplement standard protection clauses.

Amendment 58

(85) A corporate group should be (85) A corporate group should be (85) A corporate group or a group able to make use of approved able to make use of approved of enterprises engaged in a joint binding corporate rules for its binding corporate rules for its economic activity should be able to international transfers from the international transfers from the make use of approved binding

Union to organisations within the Union to organisations within the corporate rules for its international same corporate group of same corporate group of transfers from the Union to undertakings, as long as such undertakings, as long as such organisations within the same corporate rules include essential corporate rules include all essential corporate group of undertakings or principles and enforceable rights to principles and enforceable rights to group of enterprises, as long as ensure appropriate safeguards for ensure appropriate safeguards for such corporate rules include transfers or categories of transfers transfers or categories of transfers essential principles and enforceable of personal data. of personal data rights to ensure appropriate safeguards for transfers or categories of transfers of personal data.

ANNEX DGD 2C LIMITE EN

Amendment 59

(86) Provisions should be made for (86) Provisions should be made for (86) Provisions should be made for the possibility for transfers in the possibility for transfers in the possibility for transfers in

certain circumstances where the certain circumstances where the certain circumstances where the data subject has given his consent, data subject has given his consent, data subject has given his explicit where the transfer is necessary in where the transfer is necessary in consent, where the transfer is relation to a contract or a legal relation to a contract or a legal necessary occasional in relation to claim, where important grounds of claim, where important grounds of a contract or a legal claim, public interest laid down by Union public interest laid down by Union regardless of whether in a judicial or Member State law so require or or Member State law so require or procedure or whether in an where the transfer is made from a where the transfer is made from a administrative or any out-of-court register established by law and register established by law and procedure, including procedures intended for consultation by the intended for consultation by the before regulatory bodies. public or persons having a public or persons having a Provision should also be made for legitimate interest. In this latter legitimate interest. In this latter the possibility for transfers where case such a transfer should not case such a transfer should not important grounds of public interest involve the entirety of the data or involve the entirety of the data or laid down by Union or Member entire categories of the data entire categories of the data State law so require or where the contained in the register and, when contained in the register and, when transfer is made from a register the register is intended for the register is intended for established by law and intended for consultation by persons having a consultation by persons having a consultation by the public or legitimate interest, the transfer legitimate interest, the transfer persons having a legitimate should be made only at the request should be made only at the request interest. In this latter case such a of those persons or if they are to be of those persons or if they are to be transfer should not involve the the recipients. the recipients, taking into full entirety of the data or entire account the interests and categories of the data contained in fundamental rights of the data the register and, when the register subject. is intended for consultation by persons having a legitimate interest, the transfer should be made only at the request of those

ANNEX DGD 2C LIMITE EN

persons or if they are to be the recipients.

ANNEX DGD 2C LIMITE EN

Amendment 60

(87) These derogations should in (87) These derogations should in (87) These derogations rules particular apply to data transfers particular apply to data transfers should in particular apply to data required and necessary for the required and necessary for the transfers required and necessary for protection of important grounds of protection of important grounds of the protection of important grounds public interest, for example in public interest, for example in cases reasons of public interest, for cases of international data transfers of international data transfers example in cases of international between competition authorities, between competition authorities, data transfers exchange between tax or customs administrations, tax or customs administrations, competition authorities, tax or financial supervisory authorities, financial supervisory authorities, customs administrations, between between services competent for between services competent for financial supervisory authorities, social security matters, or to social security matters or for public between services competent for competent authorities for the health, or to competent public social security matters, or to prevention, investigation, detection authorities for the prevention, competent authorities for the and prosecution of criminal investigation, detection and prevention, investigation, detection offences. prosecution of criminal offences , and prosecution of criminal including for the prevention of offencesfor public health, for money laundering and the fight example in case of contact tracing against terrorist financing. A for contagious diseases or in order transfer of personal data should to reduce and/or eliminate doping equally be regarded as lawful in sport. A transfer of personal where it is necessary to protect an data should equally be regarded as interest which is essential for the lawful where it is necessary to data subject’s or another person’s protect an interest which is life, if the data subject is incapable essential for the data subject’s or of giving consent. Transferring another person’s vital interests, personal data for such important including physical integrity or life, grounds of public interest should if the data subject is incapable of only be used for occasional giving consent. In the absence of transfers. In each and every case, an adequacy decision, Union law a careful assessment of all or Member State law may, for

ANNEX DGD 2C LIMITE EN

circumstances of the transfer important reasons of public should be carried out. interest, expressly set limits to the transfer of specific categories of data to a third country or an international organization. Member States should notify such provisions to the Commission. Any transfer to an international humanitarian organisation, such as a National Society of the Red Cross or to the ICRC of personal data of a data subject who is physically or legally incapable of giving consent, with the view to accomplishing a task incumbent upon the International Red Cross and Red Crescent Movement under the Geneva Conventions and/or to work for the faithful application of international humanitarian law applicable in armed conflicts could be considered as necessary for an important reason of public interest or being in the vital interest of the data subject.

ANNEX DGD 2C LIMITE EN

(88) Transfers which cannot be (88) Transfers which cannot be (88) Transfers which cannot be qualified as frequent or massive, qualified as frequent or massive, qualified as large scale or frequent could also be possible for the could also be possible for the or massive, could also be possible purposes of the legitimate interests purposes of the legitimate interests for the purposes of the legitimate pursued by the controller or the pursued by the controller or the interests pursued by the controller processor, when they have assessed processor, when they have assessed or the processor, when they have all the circumstances surrounding all the circumstances surrounding those interests are not overridden the data transfer. For the purposes the data transfer. For the purposes by the interests or rights and of processing for historical, of processing for historical, freedoms of the data subject and statistical and scientific research statistical and scientific research when the controller or the purposes, the legitimate purposes, the legitimate processor has assessed all the expectations of society for an expectations of society for an circumstances surrounding the data increase of knowledge should be increase of knowledge should be transfer. The controller or taken into consideration. taken into consideration. processor should give particular consideration to the nature of the data, the purpose and duration of the proposed processing operation or operations, as well as the situation in the country of origin, the third country and the country of final destination, and adduced suitable safeguards to protect fundamental rights and freedoms of natural persons with respect to processing of their personal data. For the purposes of processing for historical, statistical and scientific research purposes, the legitimate expectations of society for an increase of knowledge should be taken into consideration. To assess whether a transfer is large scale or

ANNEX DGD 2C LIMITE EN

frequent the amount of personal data and number of data subjects should be taken into account and whether the transfer takes place on an occasional or regular basis.

ANNEX DGD 2C LIMITE EN

Amendment 62

(89) In any case, where the (89) In any case, where the (89) In any case, where the Commission has taken no decision Commission has taken no decision Commission has taken no decision on the adequate level of data on the adequate level of data on the adequate level of data protection in a third country, the protection in a third country, the protection in a third country, the controller or processor should controller or processor should make controller or processor should make make use of solutions that provide use of solutions that provide data use of solutions that provide data data subjects with a guarantee that subjects with a legally binding subjects with a guarantee that they they will continue to benefit from guarantee that they will continue to will continue to benefit from the the fundamental rights and benefit from the fundamental rights fundamental rights and safeguards safeguards as regards processing of and safeguards as regards as regards processing of their data their data in the Union once this processing of their data in the in the Union once this data has data has been transferred. Union once those data have been been transferred.

transferred, to the extent that the processing is not massive, not repetitive and not structural. That guarantee should include financial indemnification in cases of loss or unauthorised access or processing of the data and an obligation, regardless of national legislation, to provide full details of all access to the data by public authorities in the third country.

ANNEX DGD 2C LIMITE EN

Amendment 63

(90) Some third countries enact (90) Some third countries enact (90) Some third countries enact laws, regulations and other laws, regulations and other laws, regulations and other legislative instruments which legislative instruments which legislative instruments which purport to directly regulate data purport to directly regulate data purport to directly regulate data processing activities of natural and processing activities of natural and processing activities of natural and legal persons under the jurisdiction legal persons under the jurisdiction legal persons under the jurisdiction of the Member States. The of the Member States. The of the Member States. The extraterritorial application of these extraterritorial application of these extraterritorial application of these laws, regulations and other laws, regulations and other laws, regulations and other legislative instruments may be in legislative instruments may be in legislative instruments may be in breach of international law and breach of international law and breach of international law and may impede the attainment of the may impede the attainment of the may impede the attainment of the protection of individuals protection of individuals protection of individuals guaranteed in the Union by this guaranteed in the Union by this guaranteed in the Union by this Regulation. . Transfers should only Regulation. Transfers should only Regulation. Transfers should only be allowed where the conditions of be allowed where the conditions of be allowed where the conditions of this Regulation for a transfer to this Regulation for a transfer to this Regulation for a transfer to third countries are met. This may third countries are met. This may third countries are met. This may inter alia be the case where the inter alia be the case where the inter alia be the case where the disclosure is necessary for an disclosure is necessary for an disclosure is necessary for an important ground of public interest important ground of public interest important ground of public interest recognised in Union law or in a recognised in Union law or in a recognised in Union law or in a Member State law to which the Member State law to which the Member State law to which the controller is subject. The controller is subject. The conditions controller is subject. The conditions conditions under which an under which an important ground under which an important ground important ground of public interest of public interest exists should be of public interest exists should be exists should be further specified further specified by the further specified by the by the Commission in a delegated Commission in a delegated act. In Commission in a delegated act. act. cases where controllers or processors are confronted with

ANNEX DGD 2C LIMITE EN

conflicting compliance requirements between the jurisdiction of the Union on the one hand, and that of a third country on the other, the Commission should ensure that Union law takes precedence at all times. The Commission should provide guidance and assistance to the controller and processor, and it should seek to resolve the jurisdictional conflict with the third country in question.

ANNEX DGD 2C LIMITE EN

(91) When personal data moves (91) When personal data moves (91) When personal data moves across borders it may put at across borders it may put at across borders outside the Union it increased risk the ability of increased risk the ability of may put at increased risk the ability individuals to exercise data individuals to exercise data of individuals to exercise data protection rights in particular to protection rights in particular to protection rights in particular to protect themselves from the protect themselves from the protect themselves from the unlawful use or disclosure of that unlawful use or disclosure of that unlawful use or disclosure of that information. At the same time, information. At the same time, information. At the same time, supervisory authorities may find supervisory authorities may find supervisory authorities may find that they are unable to pursue that they are unable to pursue that they are unable to pursue complaints or conduct complaints or conduct complaints or conduct investigations relating to the investigations relating to the investigations relating to the activities outside their borders. activities outside their borders. activities outside their borders. Their efforts to work together in Their efforts to work together in the Their efforts to work together in the the cross-border context may also cross-border context may also be cross-border context may also be be hampered by insufficient hampered by insufficient hampered by insufficient preventative or remedial powers, preventative or remedial powers, preventative or remedial powers, inconsistent legal regimes, and inconsistent legal regimes, and inconsistent legal regimes, and practical obstacles like resource practical obstacles like resource practical obstacles like resource constraints. Therefore, there is a constraints. Therefore, there is a constraints. Therefore, there is a need to promote closer coneed to promote closer coneed to promote closer cooperation among data protection operation among data protection operation among data protection supervisory authorities to help supervisory authorities to help them supervisory authorities to help them them exchange information and exchange information and carry out exchange information and carry out carry out investigations with their investigations with their investigations with their international counterparts. international counterparts. international counterparts. For the purposes of developing international co-operation mechanisms to facilitate and provide international mutual assistance for the enforcement of legislation for the protection of

ANNEX DGD 2C LIMITE EN

personal data, the Commission and the supervisory authorities should exchange information and cooperate in activities related to the exercise of their powers with competent authorities in third countries, based on reciprocity and in compliance with the provisions of this Regulation, including those laid down in Chapter V.

ANNEX DGD 2C LIMITE EN

Article 3 Article 3 Article 3

Territorial scope Territorial scope Territorial scope

Amendment 97

1.This Regulation applies to the 1. This Regulation applies to the 1.This Regulation applies to the processing of personal data in the processing of personal data in the processing of personal data in the context of the activities of an context of the activities of an context of the activities of an establishment of a controller or a establishment of a controller or a establishment of a controller or a processor in the Union. processor in the Union, whether processor in the Union. the processing takes place in the Union or not.

ANNEX DGD 2C LIMITE EN

2.This Regulation applies to the 2. This Regulation applies to the 2.This Regulation applies to the processing of personal data of data processing of personal data of data processing of personal data of data subjects residing in the Union by a subjects residing in the Union by a subjects residing in the Union by a controller not established in the controller or processor not controller not established in the Union, where the processing established in the Union, where the Union, where the processing activities are related to: processing activities are related to: activities are related to:

(a) the offering of goods or services (a) the offering of goods or (a) the offering of goods or to such data subjects in the Union; services, irrespective of whether a services, irrespective of whether a or payment of the data subject is payment by the data subject is required, to such data subjects in required, to such data subjects in the Union; or the Union; or

(b) the monitoring of their (b) the monitoring of their (b) the monitoring of their behaviour. behaviour such data subjects. behaviour as far as their behaviour takes place within the European Union.

ANNEX DGD 2C LIMITE EN

• 3. 

  This Regulation applies to the 3. This Regulation applies to the 3. This Regulation applies to the processing of personal data by a processing of personal data by a processing of personal data by a controller not established in the controller not established in the controller not established in the Union, but in a place where the Union, but in a place where the Union, but in a place where the national law of a Member State national law of a Member State national law of a Member State applies by virtue of public applies by virtue of public applies by virtue of public international law. international law. international law.

ANNEX DGD 2C LIMITE EN

Article 4 Article 4 Article 4

Definitions Definitions Definitions

Amendment 98 For the purposes of this Regulation: For the purposes of this Regulation: For the purposes of this Regulation:

(2a) 'pseudonymous data' means personal data that cannot be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organisational measures to ensure non-attribution; (2b) ‘encrypted data’ means personal data, which through technological protection measures is rendered unintelligible to any person who is not authorised to access them;

ANNEX DGD 2C LIMITE EN

(3a) 'profiling' means any form of automated processing of personal data intended to evaluate certain personal aspects relating to a natural person or to analyse or predict in particular that natural person’s performance at work, economic situation, location, health, personal preferences, reliability or behaviour; (3a) 'restriction of processing' means the marking of stored personal data with the aim of limiting their processing in the future;

ANNEX DGD 2C LIMITE EN

(3b) pseudonymisation' means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organisational measures to ensure nonattribution to an identified or identifiable person.

(4) ' filing system' means any (4) 'filing system' means any (4) 'filing system' means any structured set of personal data structured set of personal data structured set of personal data which are accessible according to which are accessible according to which are accessible according to specific criteria, whether specific criteria, whether specific criteria, whether centralized, decentralized or centralized, decentralized or centralized, decentralized or dispersed on a functional or dispersed on a functional or dispersed on a functional or geographical basis; geographical basis; geographical basis;

ANNEX DGD 2C LIMITE EN

(5) 'controller' means the natural or (5) 'controller' means the natural or (5) 'controller' means the natural or legal person, public authority, legal person, public authority, legal person, public authority, agency or any other body which agency or any other body which agency or any other body which alone or jointly with others alone or jointly with others alone or jointly with others determines the purposes, determines the purposes, conditions determines the purposes, conditions conditions and means of the and means of the processing of and means of the processing of processing of personal data; where personal data; where the purposes, personal data; where the purposes, the purposes, conditions and means conditions and means of processing conditions and means of processing of processing are determined by are determined by Union law or are determined by Union law or Union law or Member State law, Member State law, the controller or Member State law, the controller or the controller or the specific the specific criteria for his the specific criteria for his criteria for his nomination may be nomination may be designated by nomination may be designated by designated by Union law or by Union law or by Member State law; Union law or by Member State law; Member State law;

ANNEX DGD 2C LIMITE EN

(6) 'processor' means a natural or (6) 'processor' means a natural or (6) 'processor' means a natural or legal person, public authority, legal person, public authority, legal person, public authority, agency or any other body which agency or any other body which agency or any other body which processes personal data on behalf processes personal data on behalf processes personal data on behalf of the controller; of the controller; of the controller;

(7a) ‘third party’ means any natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorized to process the data;

(8) 'the data subject's consent' (8) 'the data subject's consent' (8) 'the data subject's consent' means any freely given specific, means any freely given specific, means any freely given, specific, informed and explicit indication of informed and explicit indication of and informed and explicit his or her wishes by which the data his or her wishes by which the data indication of his or her wishes by subject, either by a statement or by subject, either by a statement or by which the data subject, either by a a clear affirmative action, signifies a clear affirmative action, signifies statement or by a clear affirmative agreement to personal data relating agreement to personal data relating action, signifies agreement to to them being processed; to them being processed; personal data relating to them being processed;

ANNEX DGD 2C LIMITE EN

(9) 'personal data breach' means a (9) 'personal data breach' means a (9) 'personal data breach' means a breach of security leading to the breach of security leading to the breach of security leading to the accidental or unlawful destruction, accidental or unlawful destruction, accidental or unlawful destruction, loss, alteration, unauthorised loss, alteration, unauthorised loss, alteration, unauthorised disclosure of, or access to, personal disclosure of, or access to, personal disclosure of, or access to, personal data transmitted, stored or data transmitted, stored or data transmitted, stored or otherwise processed; otherwise processed; otherwise processed; (10) 'genetic data' means all data, of (10) 'genetic data' means all (10) 'genetic data' means all whatever type, concerning the personal data, of whatever type, personal data, of whatever type, characteristics of an individual concerning relating to the genetic concerning relating to the genetic which are inherited or acquired characteristics of an individual characteristics of an individual during early prenatal development; which are have been inherited or which are inherited or acquired acquired during early prenatal during early prenatal development development as they result from that have been inherited or an analysis of a biological sample acquired, which give unique from the individual in question, in information about the physiology particular by chromosomal, or the health of that individual, desoxyribonucleic acid (DNA) or resulting in particular from an ribonucleic acid (RNA) analysis or analysis of a biological sample analysis of any other element from the individual in question; enabling equivalent information to be obtained;

ANNEX DGD 2C LIMITE EN

(11) 'biometric data' means any (11) 'biometric data' means any (11) 'biometric data' means any data relating to the physical, personal data relating to the personal data resulting from physiological or behavioural physical, physiological or specific technical processing characteristics of an individual behavioural characteristics of an relating to the physical, which allow their unique individual which allow his or her physiological or behavioural identification, such as facial unique identification, such as facial characteristics of an individual images, or dactyloscopic data; images, or dactyloscopic data; which allows or confirms the their unique identification of that individual, such as facial images, or dactyloscopic data; (12) ‘data concerning health’ (12) ‘data concerning health’ (12) ‘data concerning health’ means any information which means any information personal means data related any information relates to the physical or mental data which relate to the physical or which relates to the physical or health of an individual, or to the mental health of an individual, or to mental health of an individual, provision of health services to the the provision of health services to which reaveal information about individual; the individual; his or her health statusor to the provision of health services to the individual;

(12a) 'profiling' means any form of automated processing of personal data consisting of using those data to evaluate personal aspects relating to a natural person, in particular to analyse and predict aspects concerning performance at work, economic situation, health, personal preferences, or interests, reliability or behaviour, location or movements;

ANNEX DGD 2C LIMITE EN

(14) ‘representative’ means any (14) ‘representative’ means any (14) ‘representative’ means any natural or legal person established natural or legal person established natural or legal person established in the Union who, explicitly in the Union who, explicitly in the Union who, explicitly designated by the controller, acts designated by the controller, acts designated by the controller in and may be addressed by any and may be addressed by any writing pursuant to Article 25, supervisory authority and other supervisory authority and other represents acts and may be bodies in the Union instead of the bodies in the Union instead of addressed by any supervisory controller, with regard to the represents the controller, with authority and other bodies in the obligations of the controller under regard to the obligations of the Union instead of the controller, this Regulation; controller under this Regulation; with regard to the obligations of the controller under this Regulation;

(15) ‘enterprise’ means any entity (15) ‘enterprise’ means any entity (15) ‘enterprise’ means any natural engaged in an economic activity, engaged in an economic activity, or legal person entity engaged in irrespective of its legal form, thus irrespective of its legal form, thus an economic activity, irrespective including, in particular, natural and including, in particular, natural and of its legal form, thus including, in legal persons, partnerships or legal persons, partnerships or particular, natural and legal associations regularly engaged in associations regularly engaged in persons, partnerships or an economic activity; an economic activity; associations regularly engaged in an economic activity;

(16) 'group of undertakings' means (16) 'group of undertakings' means (16) 'group of undertakings' means a controlling undertaking and its a controlling undertaking and its a controlling undertaking and its controlled undertakings; controlled undertakings; controlled undertakings;

ANNEX DGD 2C LIMITE EN

(17) ‘binding corporate rules’ (17) ‘binding corporate rules’ (17) ‘binding corporate rules’ means personal data protection means personal data protection means personal data protection policies which are adhered to by a policies which are adhered to by a policies which are adhered to by a controller or processor established controller or processor established controller or processor established on the territory of a Member State on the territory of a Member State on the territory of a Member State of the Union for transfers or a set of of the Union for transfers or a set of of the Union for transfers or a set of transfers of personal data to a transfers of personal data to a transfers of personal data to a controller or processor in one or controller or processor in one or controller or processor in one or more third countries within a group more third countries within a group more third countries within a group of undertakings; of undertakings; of undertakings or group of enterprises engaged in a joint economic activity;

(18) 'child' means any person below (18) 'child' means any person below deleted the age of 18 years; the age of 18 years; (20) 'Information Society service' means any service as defined by Article 1 (2) of Directive 98/34/EC i of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on Information Society services.

ANNEX DGD 2C LIMITE EN

(21) 'international organisation' means an organisation and its subordinate bodies governed by public international law or any other body which is set up by, or on the basis of, an agreement between two or more countries;

ANNEX DGD 2C LIMITE EN

CHAPTER II CHAPTER II CHAPTER II PRINCIPLES PRINCIPLES PRINCIPLES

Article 5 Article 5 Article 5 Principles relating to personal data Principles relating to personal Principles relating to personal

processing data processing data processing Amendment 99

Personal data must be: 1. Personal data mustshall be: Personal data must be: (a) processed lawfully, fairly and in a (a) processed lawfully, fairly and (a) processed lawfully, fairly and transparent manner in relation to the in a transparent manner in relation in a transparent manner in relation data subject; to the data subject (lawfulness, to the data subject; fairness and transparency); (b) collected for specified, explicit (b) collected for specified, explicit (b) collected for specified, explicit and legitimate purposes and not and legitimate purposes and not and legitimate purposes and not further processed in a way further processed in a way further processed in a way incompatible with those purposes; incompatible with those purposes incompatible with those purposes; (purpose limitation); further processing of personal data for archiving purposes in the public interest or scientific, statistical or historical purposes shall in accordance with Article 83 not be considered incompatible with the initial purposes;

ANNEX DGD 2C LIMITE EN

(c) adequate, relevant, and limited to (c) adequate, relevant, and limited (c) adequate, relevant, and not the minimum necessary in relation to to the minimum necessary in excessive limited to the minimum the purposes for which they are relation to the purposes for which necessary in relation to the processed; they shall only be they are processed; they shall only purposes for which they are processed if, and as long as, the be processed if, and as long as, the processed; they shall only be purposes could not be fulfilled by purposes could not be fulfilled by processed if, and as long as, the processing information that does not processing information that does purposes could not be fulfilled by involve personal data; not involve personal data (data processing information that does minimisation); not involve personal data; (d) accurate and kept up to date; (d) accurate and, where necessary, (d) accurate and, where necessary, every reasonable step must be taken kept up to date; every reasonable kept up to date; every reasonable to ensure that personal data that are step must be taken to ensure that step must be taken to ensure that inaccurate, having regard to the personal data that are inaccurate, personal data that are inaccurate, purposes for which they are having regard to the purposes for having regard to the purposes for processed, are erased or rectified which they are processed, are which they are processed, are without delay; erased or rectified without delay erased or rectified without delay; (accuracy). (e) kept in a form which permits (e) kept in a form which permits (e) kept in a form which permits identification of data subjects for no direct or indirect identification of identification of data subjects for longer than is necessary for the data subjects for no longer than is no longer than is necessary for the purposes for which the personal data necessary for the purposes for purposes for which the personal are processed; personal data may be which the personal data are data are processed; personal data stored for longer periods insofar as processed; personal data may be may be stored for longer periods the data will be processed solely for stored for longer periods insofar as insofar as the data will be historical, statistical or scientific the data will be processed solely processed solely for archiving research purposes in accordance with for historical, statistical or purposes in the public interest, or the rules and conditions of Article 83 scientific research or for archive scientific, historical, statistical, or and if a periodic review is carried out purposes in accordance with the scientific research or historical to assess the necessity to continue the rules and conditions of Article purposes in accordance with the storage; Articles 83 and 83a and if a rules and conditions of Article 83 periodic review is carried out to and if a periodic review is carried assess the necessity to continue out to assess the necessity to the storage, and if appropriate continue the storagesubject to

ANNEX DGD 2C LIMITE EN

technical and organizational implementation of the measures are put in place to limit appropriate technical and access to the data only for these organisational measures required purposes (storage minimisation); by the Regulation in order to safeguard the rights and freedoms of data subject; (ea) processed in a way that effectively allows the data subject to exercise his or her rights (effectiveness); (eb) processed in a way that protects against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity); (ee) processed in a manner that ensures appropriate security of the personal data.

ANNEX DGD 2C LIMITE EN

(f) processed under the responsibility (f) processed under the deleted and liability of the controller, who responsibility and liability of the shall ensure and demonstrate for each controller, who shall ensure and processing operation the compliance be able to demonstrate for each with the provisions of this processing operation the Regulation. compliance with the provisions of this Regulation (accountability). 2. The controller shall be responsible for compliance with paragraph 1.

ANNEX DGD 2C LIMITE EN

Article 6 Article 6 Article 6

Lawfulness of processing Lawfulness of processing Lawfulness of processing

Amendment 100 1. Processing of personal data shall 1. Processing of personal data 1. Processing of personal data be lawful only if and to the extent that shall be lawful only if and to the shall be lawful only if and to the at least one of the following applies: extent that at least one of the extent that at least one of the

following applies: following applies: (a) the data subject has given consent (a) the data subject has given (a) the data subject has given to the processing of their personal consent to the processing of their unambiguous consent to the data for one or more specific personal data for one or more processing of their personal data purposes; specific purposes; for one or more specific purposes; (b) processing is necessary for the (b) processing is necessary for the (b) processing is necessary for the performance of a contract to which performance of a contract to performance of a contract to the data subject is party or in order to which the data subject is party or which the data subject is party or take steps at the request of the data in order to take steps at the request in order to take steps at the request subject prior to entering into a of the data subject prior to of the data subject prior to contract; entering into a contract; entering into a contract; (c) processing is necessary for (c) processing is necessary for (c) processing is necessary for compliance with a legal obligation to compliance with a legal obligation compliance with a legal obligation which the controller is subject; to which the controller is subject; to which the controller is subject;

ANNEX DGD 2C LIMITE EN

(d) processing is necessary in order to (d) processing is necessary in (d) processing is necessary in protect the vital interests of the data order to protect the vital interests order to protect the vital interests subject; of the data subject; of the data subject or of another person; (e) processing is necessary for the (e) processing is necessary for the (e) processing is necessary for the performance of a task carried out in performance of a task carried out performance of a task carried out the public interest or in the exercise in the public interest or in the in the public interest or in the of official authority vested in the exercise of official authority exercise of official authority controller; vested in the controller; vested in the controller; (f) processing is necessary for the (f) processing is necessary for the (f) processing is necessary for the purposes of the legitimate interests purposes of the legitimate interests purposes of the legitimate interests pursued by a controller, except where pursued by the controller or, in pursued by a the controller or by a such interests are overridden by the case of disclosure, by the third third party, except where such interests or fundamental rights and party to whom the data is are interests are overridden by the freedoms of the data subject which disclosed, and which meet the interests or fundamental rights and require protection of personal data, in reasonable expectations of the freedoms of the data subject which particular where the data subject is a data subject based on his or her require protection of personal child. This shall not apply to relationship with the controller, data, in particular where the data processing carried out by public except where such interests are subject is a child. This shall not authorities in the performance of their overridden by the interests or apply to processing carried out by tasks. fundamental rights and freedoms public authorities in the of the data subject which require performance exercise of their protection of personal data, in tasks. particular where the data subject is a child. This shall not apply to processing carried out by public authorities in the performance of their tasks.

ANNEX DGD 2C LIMITE EN

• 2. 

  Processing of personal data which 2. Processing of personal data 2. Processing of personal data is necessary for the purposes of which is necessary for the which is necessary for archiving historical, statistical or scientific purposes of historical, statistical or thepurposes in the public interest, research shall be lawful subject to the scientific research shall be lawful or offor historical, statistical or conditions and safeguards referred to subject to the conditions and scientific research purposes shall in Article 83. safeguards referred to in Article be lawful subject also to the 83. conditions and safeguards referred to in Article 83. […] […] […]

ANNEX DGD 2C LIMITE EN

3a. In order to ascertain whether a purpose of further processing is compatible with the one for which the data are initially collected, the controller shall take into account, unless the data subject has given consent, inter alia: (a) any link between the purposes for which the data have been collected and the purposes of the intended further processing; (b) the context in which the data have been collected;

ANNEX DGD 2C LIMITE EN

(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9; (d) the possible consequences of the intended further processing for data subjects; (e) the existence of appropriate safeguards.

ANNEX DGD 2C LIMITE EN

• 4. 

  Where the purpose of further deleted 4. Where the purpose of further processing is not compatible with the processing is not incompatible one for which the personal data have with the one for which the been collected, the processing must personal data have been collected have a legal basis at least in one of by the same controller, the the grounds referred to in points (a) further processing must have a to (e) of paragraph 1. This shall in legal basis at least in one of the particular apply to any change of grounds referred to in points (a) to terms and general conditions of a (e) of paragraph 1. This shall in contract. particular apply to any change of

  terms and general conditions of a contract. Further processing by the same controller for incompatible purposes on grounds of legitimate interests of that controller or a third party shall be lawful if these interests override the interests of the data subject.

• 5. 

  The Commission shall be deleted deleted empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the conditions referred to in point (f) of paragraph 1 for various sectors and data processing situations, including as regards the processing of personal data related to a child.

ANNEX DGD 2C LIMITE EN

Article 7 Article 7 Article 7

Conditions for consent Conditions for consent Conditions for consent Amendment 101

• 1. 

  The controller shall bear the 1. Where processing is based on 1. Where Article 6(1)(a) applies burden of proof for the data subject's consent, Tthe controller shall bear the controller shall bear the burden consent to the processing of their the burden of proof for the data of proof for the data subject's be personal data for specified purposes. subject's consent to the processing able to demonstrate that of their his or her personal data unambiguous consent to the for specified purposes. processing of their personal data for specified purposes was given by the data subject. 1a. Where Article 9(2)(a) applies, the controller shall be able to demonstrate that explicit consent was given by the data subject. 2. If the data subject's consent is to be 2. If the data subject's consent is 2. If the data subject's consent is to given in the context of a written given in the context of a written be given in the context of a written declaration which also concerns declaration which also concerns declaration which also concerns another matter, the requirement to another matter, the requirement to another matters, the requirement give consent must be presented give consent must be presented to giverequest for consent must be distinguishable in its appearance from clearly distinguishable in its presented in a manner which is this other matter. appearance from this other matter. clearly distinguishable in its Provisions on the data subject’s appearance from thise other consent which are partly in matters, in an intelligible and violation of this Regulation are easily accessible form, using fully void. clear and plain language. 3. The data subject shall have the 3. Notwithstanding other legal 3. The data subject shall have the right to withdraw his or her consent at grounds for processing, Tthe data right to withdraw his or her any time. The withdrawal of consent subject shall have the right to consent at any time. The

ANNEX DGD 2C LIMITE EN

shall not affect the lawfulness of withdraw his or her consent at any withdrawal of consent shall not processing based on consent before time. The withdrawal of consent affect the lawfulness of processing its withdrawal. shall not affect the lawfulness of based on consent before its processing based on consent withdrawal. Prior to giving before its withdrawal. It shall be consent, the data subject shall be as easy to withdraw consent as to informed thereof. give it. The data subject shall be informed by the controller if withdrawal of consent may result in the termination of the services provided or of the relationship with the controller.

ANNEX DGD 2C LIMITE EN

• 4. 

  Consent shall not provide a legal 4. Consent shall not provide a deleted basis for the processing, where there legal basis for the processing, is a significant imbalance between the where there is a significant position of the data subject and the imbalance between the position of controller. the data subject and the controller be purpose-limited and shall lose its validity when the purpose ceases to exist or as soon as the processing of personal data is no longer necessary for carrying out the purpose for which they were originally collected. The execution of a contract or the provision of a service shall not be made conditional on the consent to the processing of data that is not necessary for the execution of the contract or the provision of the service pursuant to Article 6(1), point (b).

ANNEX DGD 2C LIMITE EN

Article 8 Article 8 Article 8 Processing of personal data of a Processing of personal data of a Conditions applicable to child's

child child consent in relation to information society services

Amendment 102 1. For the purposes of this 1. For the purposes of this 1. For the purposes of this Regulation, in relation to the offering Regulation, in relation to the RegulationWhere Article 6 (1)(a) of information society services offering of information society applies, in relation to the offering directly to a child, the processing of goods or services directly to a of information society services personal data of a child below the age child, the processing of personal directly to a child, the processing of 13 years shall only be lawful if and data of a child below the age of 13 of personal data of a child below to the extent that consent is given or years shall only be lawful if and to the age of 13 years shall only be authorised by the child's parent or the extent that consent is given or lawful if and to the extent that custodian. The controller shall make authorised by the child's parent or such consent is given or reasonable efforts to obtain verifiable custodianlegal guardian. The authorised by the holder of consent, taking into consideration controller shall make reasonable parental responsibility over the available technology. efforts to obtain verifiable verify child's parent or custodianis given

such consent, taking into by the child in circumstances consideration available technology where it is treated as valid by without causing otherwise Union or Member State law. unnecessary processing of personal data. 1a. Information provided to children, parents and legal guardians in order to express consent, including about the controller’s collection and use of personal data, should be given in a clear language appropriate to the intended audience.

ANNEX DGD 2C LIMITE EN

1a. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

• 2. 

  Paragraph 1 shall not affect the 2. Paragraph 1 shall not affect the 2. Paragraph 1 shall not affect the general contract law of Member general contract law of Member general contract law of Member States such as the rules on the States such as the rules on the States such as the rules on the validity, formation or effect of a validity, formation or effect of a validity, formation or effect of a contract in relation to a child. contract in relation to a child. contract in relation to a child. 3. The Commission shall be 3. The Commission European deleted empowered to adopt delegated acts in Data Protection Board shall be accordance with Article 86 for the empowered to adopt delegated purpose of further specifying the acts in accordance with Article 86 criteria and requirements for the for the purpose entrusted with the methods to obtain verifiable consent task of further specifying the referred to in paragraph 1. In doing criteria and requirements issuing so, the Commission shall consider guidelines, recommendations and specific measures for micro, small best practices for the methods to and medium-sized enterprises. obtain verifiable of verifying consent referred to in paragraph 1, in accordance with Article 66. In doing so, the Commission shall consider specific measures for micro, small and medium-sized enterprises.

ANNEX DGD 2C LIMITE EN

• 4. 

  The Commission may lay down deleted deleted standard forms for specific methods to obtain verifiable consent referred to in paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).

  Article 9 Article 9 Article 9 Amendment 103

Processing of special categories of Processing of special Special Processing of special categories personal data categories of personal data of personal data

• 1. 

  The processing of personal data, 1. The processing of personal data, 1. The processing of personal data, revealing race or ethnic origin, revealing race or ethnic origin, revealing race racial or ethnic political opinions, religion or beliefs, political opinions, religion or origin, political opinions, trade-union membership, and the philosophical beliefs, sexual religionus or philosophical processing of genetic data or data orientation or gender identity, beliefs, trade-union membership, concerning health or sex life or trade-union membership and and the processing of genetic data criminal convictions or related activities, and the processing of or data concerning health or sex security measures shall be prohibited. genetic or biometric data or data life or criminal convictions or concerning health or sex lifeor, related security measures shall be administrative sanctions, prohibited. judgments, criminal or suspected offences, convictions or related security measures shall be prohibited. 2. Paragraph 1 shall not apply where: 2. Paragraph 1 shall not 2. Paragraph 1 shall not apply if applywhere if one of the one of the following applies: following applies:

ANNEX DGD 2C LIMITE EN

(a) the data subject has given consent (a) the data subject has given (a) the data subject has given to the processing of those personal consent to the processing of those explicit consent to the processing data, subject to the conditions laid personal data for one or more of those personal data, subject to down in Articles 7 and 8, except specified purposes, subject to the the conditions laid down in where Union law or Member State conditions laid down in Articles 7 Articles 7 and 8, except where law provide that the prohibition and 8, except where Union law or Union law or Member State law referred to in paragraph 1 may not be Member State law provide that the provide that the prohibition lifted by the data subject; or prohibition referred to in referred to in paragraph 1 may not paragraph 1 may not be lifted by be lifted by the data subject; or the data subject; or (aa) processing is necessary for the performance or execution of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (b) processing is necessary for the (b) processing is necessary for the (b) processing is necessary for the purposes of carrying out the purposes of carrying out the purposes of carrying out the obligations and exercising specific obligations and exercising specific obligations and exercising specific rights of the controller in the field of rights of the controller in the field rights of the controller or of the employment law in so far as it is of employment law in so far as it data subject in the field of authorised by Union law or Member is authorised by Union law or employment and social security State law providing for adequate Member State law or collective and social protection law in so far safeguards; or agreements providing for as it is authorised by Union law or adequate safeguards for the Member State law or a collective fundamental rights and the agreement pursuant to Member interests of the data subject such State law providing for adequate as right to non-discrimination, safeguards; or subject to the conditions and safeguards referred to in Article 82; or

ANNEX DGD 2C LIMITE EN

(c) processing is necessary to protect (c) processing is necessary to (c) processing is necessary to the vital interests of the data subject protect the vital interests of the protect the vital interests of the or of another person where the data data subject or of another person data subject or of another person subject is physically or legally where the data subject is where the data subject is incapable of giving consent; or physically or legally incapable of physically or legally incapable of giving consent; or giving consent; or (d) processing is carried out in the (d) processing is carried out in the (d) processing is carried out in the course of its legitimate activities with course of its legitimate activities course of its legitimate activities appropriate safeguards by a with appropriate safeguards by a with appropriate safeguards by a foundation, association or any other foundation, association or any foundation, association or any non-profit-seeking body with a other non-profit-seeking body other non-profit-seeking body political, philosophical, religious or with a political, philosophical, with a political, philosophical, trade-union aim and on condition that religious or trade-union aim and religious or trade-union aim and the processing relates solely to the on condition that the processing on condition that the processing members or to former members of the relates solely to the members or to relates solely to the members or to body or to persons who have regular former members of the body or to former members of the body or to contact with it in connection with its persons who have regular contact persons who have regular contact purposes and that the data are not with it in connection with its with it in connection with its disclosed outside that body without purposes and that the data are not purposes and that the data are not the consent of the data subjects; or disclosed outside that body disclosed outside that body without the consent of the data without the consent of the data subjects; or subjects; or (e) the processing relates to personal (e) the processing relates to (e) the processing relates to data which are manifestly made personal data which are manifestly personal data which are manifestly public by the data subject; or made public by the data subject; made public by the data subject; or or

ANNEX DGD 2C LIMITE EN

(f) processing is necessary for the (f) processing is necessary for the (f) processing is necessary for the establishment, exercise or defence of establishment, exercise or defence establishment, exercise or defence legal claims; or of legal claims; or of legal claims or whenever courts are acting in their judicial capacity; or (g) processing is necessary for the (g) processing is necessary for the (g) processing is necessary for the performance of a task carried out in performance of a task carried out performance of a task carried out the public interest, on the basis of in the for reasons of high public in the reasons of public interest, Union law, or Member State law interest, on the basis of Union law, on the basis of Union law, or which shall provide for suitable or Member State law which shall Member State law which shall measures to safeguard the data be proportionate to the aim provide for suitable and specific subject's legitimate interests; or pursued, respect the essence of measures to safeguard the data the right to data protection and subject's legitimate interests; or provide for suitable measures to safeguard the fundamental rights and the data subject's legitimate interests of the data subject; or (h) processing of data concerning (h) processing of data concerning (h) processing of data concerning health is necessary for health health is necessary for health health is necessary for health purposes and subject to the conditions purposes and subject to the purposes the purposes of and safeguards referred to in Article conditions and safeguards referred preventive or occupational 81; or to in Article 81; or medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union law or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards

ANNEX DGD 2C LIMITE EN

referred to in Article 81paragraph 4; or (hb) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious crossborder threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union law or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject; or

(i) processing is necessary for (i) processing is necessary for (i) processing is necessary for historical, statistical or scientific historical, statistical or scientific archiving purposes in the public research purposes subject to the research purposes subject to the interest or historical, statistical or conditions and safeguards referred to conditions and safeguards referred scientific research purposes and in Article 83; or to in Article 83; or subject to the conditions and safeguards laid down in Union or Member State law, including those referred to in Article 83.

ANNEX DGD 2C LIMITE EN

(ia) processing is necessary for archive services subject to the conditions and safeguards referred to in Article 83a; or

(j) processing of data relating to (j) processing of data relating to deleted criminal convictions or related administrative sanctions, security measures is carried out either judgments, criminal offences, under the control of official authority convictions or related security or when the processing is necessary measures is carried out either for compliance with a legal or under the control of official regulatory obligation to which a authority or when the processing controller is subject, or for the is necessary for compliance with a performance of a task carried out for legal or regulatory obligation to important public interest reasons, and which a controller is subject, or in so far as authorised by Union law for the performance of a task or Member State law providing for carried out for important public adequate safeguards. A complete interest reasons, and in so far as register of criminal convictions shall authorised by Union law or be kept only under the control of Member State law providing for official authority. adequate safeguards. A complete for the fundamental rights and the interests of the data subject. Any register of criminal convictions shall be kept only under the control of official authority.

ANNEX DGD 2C LIMITE EN

• 3. 

  The Commission shall be 3. The Commission European deleted empowered to adopt delegated acts in Data Protection Board shall be accordance with Article 86 for the empowered to adopt delegated purpose of further specifying the acts in accordance with Article 86

criteria, conditions and appropriate for the purposeentrusted with the safeguards for the processing of the task of further specifying the special categories of personal data criteria, conditions and referred to in paragraph 1 and the appropriate safeguards issuing

exemptions laid down in paragraph 2. guidelines, recommendations and best practices for the processing

of the special categories of personal data referred to in paragraph 1 and the exemptions laid down in paragraph 2, in accordance with Article 66. 4. Personal data referred to in paragraph 1 may on the basis of Union or Member State law be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

ANNEX DGD 2C LIMITE EN

5. Member States may maintain or introduce more specific provisions with regard to genetic data or health data. This includes the possibility for Member States to introduce further conditions for the processing of these data.

Article 9a Processing of data relating to criminal convitions and offences Processing of data relating to criminal convictions and offences or related security measures based on Article 6(1) may only be carried out either under the control of official authority or when the processing is authorised by Union law or Member State law providing for adequate safeguards for the rights and freedoms of data subjects. A complete register of criminal convictions may be kept only under the control of official authority.

ANNEX DGD 2C LIMITE EN

Article 10 Article 10 Article 10 Processing not allowing Processing not allowing Processing not allowing

identification identification requiring identification Amendment 104

If the data processed by a controller 1. If the data processed by a If the data processed by purposes do not permit the controller to controller do not permit the for which a controller processes identify a natural person, the controller or processor to directly personal data do not permitor do controller shall not be obliged to or indirectly identify a natural no longer require the acquire additional information in person, or consist only of identification of a data subject by order to identify the data subject for pseudonymous data, the the controller to identify a natural the sole purpose of complying with controller shall not be obliged to person, the controller shall not be any provision of this Regulation. process or acquire additional obliged to maintain or acquire information in order to identify the additional information nor to data subject for the sole purpose engage in additional processing of complying with any provision in order to identify the data of this Regulation. subject for the sole purpose of complying with any provision of this Regulation. 2. Where the data controller is 2. Where, in such cases the unable to comply with a provision controller is not in a position to of this Regulation because of identify the data subject, articles paragraph 1, the controller shall 15, 16, 17, 17a, 17b and 18 do not not be obliged to comply with that apply except where the data particular provision of this subject, for the purpose of Regulation. Where as a exercising his or her rights under consequence the data controller these articles, provides additional is unable to comply with a information enabling his or her request of the data subject, it identification. shall inform the data subject accordingly.

ANNEX DGD 2C LIMITE EN

CHAPTER III CHAPTER III CHAPTER III

RIGHTS OF THE DATA RIGHTS OF THE RIGHTS OF THE

SUBJECT DATA SUBJECT DATA SUBJECT

SECTION 1 SECTION 1 SECTION 1 TRANSPARENCY AND TRANSPARENCY AND TRANSPARENCY AND

MODALITIES MODALITIES MODALITIES

Article 10 a (new)

Amendment 105

General principles for the rights of the data subject rights

1. The basis of data protection is clear and unambiguous rights for the data subject which shall be respected by the data controller. The provisions of this Regulation aim to strengthen, clarify, guarantee and where appropriate, codify these rights.

ANNEX DGD 2C LIMITE EN

2. Such rights include, inter alia, the provision of clear and easily understandable information regarding the processing of the data subject’s his or her personal data, the right of access, rectification and erasure of their his or her data, the right to obtain data, the right to object to profiling, the right to lodge a complaint with the competent data protection authority and to bring legal proceedings as well as the right to compensation and damages resulting from an unlawful processing operation. Such rights shall in general be exercised free of charge. The data controller shall respond to requests from the data subject within a reasonable period of time.

ANNEX DGD 2C LIMITE EN

Article 11 Article 11 Article 11

Transparent information and Transparent information and Transparent information and communication communication communication

Amendment 106

• 1. 

  The controller shall have 1. The controller shall have deleted transparent and easily accessible concise, transparent, clear and policies with regard to the processing easily accessible policies with of personal data and for the exercise regard to the processing of of data subjects' rights. personal data and for the exercise of data subjects' rights

• 2. 

  The controller shall provide any 2. The controller shall provide any deleted information and any communication information and any relating to the processing of personal communication relating to the data to the data subject in an processing of personal data to the intelligible form, using clear and data subject in an intelligible plain language, adapted to the data form, using clear and plain subject, in particular for any language, adapted to the data information addressed specifically to subject, in particular for any a child. information addressed specifically to a child.

ANNEX DGD 2C LIMITE EN

Article 12 Article 12 Article 12

Procedures and mechanisms for Procedures and mechanisms for Procedures and mechanisms exercising the rights of the data exercising the rights of the data Transparent information, subject subject communication and modalities for exercising the rights of the data subject

Amendment 107

• 1. 

  The controller shall establish 1. The controller shall establish 1. The controller shall establish procedures for providing the procedures for providing the procedures for providing the take information referred to in Article 14 information referred to in Article appropriate measured to provide and for the exercise of the rights of 14 and for the exercise of the any information referred to in data subjects referred to in Article 13 rights of data subjects referred to Article 14 and 14a for the exercise and Articles 15 to 19. The controller in Article 13 and Articles 15 to 19. of the rights of data subjects shall provide in particular The controller shall provide in referred to in Article 13 and any mechanisms for facilitating the particular mechanisms for communication under Articles 15 request for the actions referred to in facilitating the request for the to 19 and 32 relating to the Article 13 and Articles 15 to 19. actions referred to in Article 13 processing of personal data to the Where personal data are processed by and Articles 15 to 19. Where data subject in an intelligible and automated means, the controller shall personal data are processed by easily accessible form, using also provide means for requests to be automated means, the controller clear and plain language. The made electronically. shall also provide means for information shall be provided in requests to be made electronically writing, or by other means, where where possible. appropriately in electronic form. Where the data subject makes the request in electronic form, the information may as a rule be provided in electronic form, unless otherwise requested by the data subject. When requested by

ANNEX DGD 2C LIMITE EN

the data subject, the information may be given orally provided that the identity of the data subject is proven other means. The controller shall provide in particular mechanisms for facilitating the request for the actions referred to in Article 13 and Articles 15 to 19. Where personal data are processed by automated means, the controller shall also provide means for requests to be made electronically.

1a. The controller shall facilitate the exercise of data subject rights under Articles 15 to 19. In cases referred to in Article 10 (2) the controller shall not refuse to act on the request of the data subject for exercising his/her rights under Articles 15 to 19, unless the controller demonstrates that he/she is not in a position to identify the data subject.

ANNEX DGD 2C LIMITE EN

• 2. 

  The controller shall inform the data 2. The controller shall inform the 2. The controller shall provide subject without delay and, at the data subject without undue delay information on action taken on a latest within one month of receipt of and, at the latest within one month request under Articles 15 and 16 the request, whether or not any action 40 calendar days of receipt of the to 19 to the data subject without has been taken pursuant to Article 13 request, whether or not any action undue delay and, at the latest and Articles 15 to 19 and shall has been taken pursuant to Article within one month of receipt of the provide the requested information. 13 and Articles 15 to 19 and shall request, whether or not any action This period may be prolonged for a provide the requested information. has been taken pursuant to Article further month, if several data subjects This period may be prolonged for 13 and Articles 15 to 19 and shall exercise their rights and their a further month, if several data provide the requested information. cooperation is necessary to a subjects exercise their rights and This period may be prolonged reasonable extent to prevent an their cooperation is necessary to a extended for a further two months unnecessary and disproportionate reasonable extent to prevent an when necessary, taking into effort on the part of the controller. unnecessary and disproportionate account the complexity of the The information shall be given in effort on the part of the controller. request and the number of the writing. Where the data subject The information shall be given in requests., if several data subjects makes the request in electronic form, writing and, where possible, the exercise their rights and their the information shall be provided in controller may provide remote cooperation is necessary to a electronic form, unless otherwise access to a secure system which reasonable extent to prevent an requested by the data subject. would provide the data subject unnecessary and disproportionate with direct access to their his or effort on the part of the controller. her personal data. Where the data The information shall be given in subject makes the request in writing. Where the extended electronic form, the information period applies, the data subject shall be provided in electronic makes the request in electronic form where possible, unless form, the information shall be otherwise requested by the data provided in electronic form, unless subject. otherwise requested by the data subjectinformed within one month of receipt of the request of the reasons for the delay.

ANNEX DGD 2C LIMITE EN

• 3. 

  If the controller refuses to take 3. If the controller refuses to does 3. If the controller refuses todoes action on the request of the data not take action at the request of not take action on the request of subject, the controller shall inform the the data subject, the controller the data subject, the controller data subject of the reasons for the shall inform the data subject of the shall inform the data subject refusal and on the possibilities of reasons for the refusalinaction and without delay and at the latest lodging a complaint to the on the possibilities of lodging a within one month of receipt of supervisory authority and seeking a complaint to the supervisory the request of the reasons for the judicial remedy. authority and seeking a judicial refusalnot taking action and on remedy. the possibilities possibility of lodging a complaint to the a supervisory authority and seeking a judicial remedy.

• 4. 

  The information and the actions 4. The information and the actions 4. The iInformation and the taken on requests referred to in taken on requests referred to in actions taken on requests referred paragraph 1 shall be free of charge. paragraph 1 shall be free of to in paragraph 1provided under Where requests are manifestly charge. Where requests are Articles 14 and 14a and any excessive, in particular because of manifestly excessive, in particular communication under Articles 16 their repetitive character, the because of their repetitive to 19 and 32 shall be provided controller may charge a fee for character, the controller may free of charge. Where requests providing the information or taking charge a reasonable fee taking from a data subject are manifestly the action requested, or the controller into account the administrative unfounded or excessive, in may not take the action requested. In costs for providing the particular because of their that case, the controller shall bear the information or taking the action repetitive character, the controller burden of proving the manifestly requested, or the controller may may charge a fee for providing the excessive character of the request. not take the action requested. In information or taking the action that case, the controller shall bear requested, or the controller may the burden of proving the not take the action requested manifestly excessive character of refuse to act on the request.

ANNEX DGD 2C LIMITE EN

the request. In that case, the controller shall bear the burden of proving demonstrating the manifestly unfounded or excessive character of the request.

4a. Without prejudice to Article 10, where the controller has reasonable doubts concerning the identity of the individual making the request referred to in Articles 15 to 19, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

• 5. 

  The Commission shall be deleted deleted empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and conditions for the manifestly excessive requests and the fees referred to in paragraph 4.

ANNEX DGD 2C LIMITE EN ANNEX DGD 2C LIMITE EN

Article 13 Article 13 Article 13

Amendment 108

Rights in relation to recipients Rights in relation to recipients Rights in relation to recipients Notification requirement in the

event of rectification and erasure

The controller shall communicate The controller shall communicate deleted any rectification or erasure carried any rectification or erasure carried out in accordance with Articles 16 out in accordance with Articles 16 and 17 to each recipient to whom the and 17 to each recipient to whom data have been disclosed, unless this the data have been disclosed proves impossible or involves a transferred, unless this proves disproportionate effort. impossible or involves a disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests this.

ANNEX DGD 2C LIMITE EN

SECTION 2 SECTION 2 SECTION 2

INFORMATION AND INFORMATION AND INFORMATION AND ACCESS TO DATA ACCESS TO DATA ACCESS TO DATA

Article 13 a (new)

Amendment 109

Standardised information policies

1. Where personal data relating to a data subject are collected, the controller shall provide the data subject with the following particulars before providing information pursuant to Article 14: (a) whether personal data are collected beyond the minimum necessary for each specific purpose of the processing; (b) whether personal data are retained beyond the minimum necessary for each specific purpose of the processing; (c) whether personal data are processed for purposes other than the purposes for which they were collected; (d) whether personal data are disseminated to commercial third parties;

ANNEX DGD 2C LIMITE EN

(e) whether personal data are sold or rented out; (f) whether personal data are retained in encrypted form. 2. The particulars referred to in paragraph 1 shall be presented pursuant to Annex to this Regulation in an aligned tabular format, using text and symbols, in the following three columns: (a) the first column depicts graphical forms symbolising those particulars; (b) the second column contains essential information describing those particulars; (c) the third column depicts graphical forms indicating whether a specific particular is met. 3. The information referred to in paragraphs 1 and 2 shall be presented in an easily visible and clearly legible way and shall appear in a language easily understood by the consumers of the Member States to whom the information is provided. Where the particulars are presented electronically, they shall be machine readable.

ANNEX DGD 2C LIMITE EN

4. Additional particulars shall not be provided. Detailed explanations or further remarks regarding the particulars referred to in paragraph 1 may be provided together with the other information requirements pursuant to Article 14. 5. The Commission shall be empowered to adopt, after requesting an opinion of the European Data Protection Board, delegated acts in accordance with Article 86 for the purpose of further specifying the particulars referred to in paragraph 1 and their presentation as referred to in paragraph 2 and in the Annex to this Regulation.

ANNEX DGD 2C LIMITE EN

Article 14 Article 14 Article 14

Information to the data subject Information to the data subject Information to be provided where the data are collected from the data subject

Amendment 110

• 1. 

  Where personal data relating to a 1. Where personal data relating to 1. Where personal data relating to data subject are collected, the a data subject are collected, the a data subject are collected from controller shall provide the data controller shall provide the data the data subject, the controller subject with at least the following subject with at least the following shall, at the time when personal information: information, after the particulars data are obtained, provide the pursuant to Article 13a have been data subject with at least the provided: following information:

(a) the identity and the contact details (a) the identity and the contact (a) the identity and the contact of the controller and, if any, of the details of the controller and, if details of the controller and, if controller's representative and of the any, of the controller's any, of the controller's data protection officer; representative and of the data representative; the controller protection officer; shall also include the contact details and of the data protection officer, if any;

ANNEX DGD 2C LIMITE EN

(b) the purposes of the processing for (b) the purposes of the processing (b) the purposes of the processing which the personal data are intended, for which the personal data are for which the personal data are including the contract terms and intended, as well as information intended, including the contract general conditions where the regarding the security of the terms and general conditions processing is based on point (b) of processing of personal data, where the processing is based on Article 6(1) and the legitimate including the contract terms and point (b) of Article 6(1) and the interests pursued by the controller general conditions where the legitimate interests pursued by the where the processing is based on processing is based on point (b) of controller where the processing is point (f) of Article 6(1); Article 6(1) and the legitimate based on point (f) of Article 6(1); interests pursued by the controller as well as the legal basis of the where the processing is based on , processing. where applicable, information on how they implement and meet the requirements of point (f) of Article 6(1);

1a. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with such further information that is necessary to ensure fair and transparent processing, having regard to the specific circumstances and context in which the personal data are processed:

ANNEX DGD 2C LIMITE EN

(c) the period for which the personal (c) the period for which the deleted data will be stored; personal data will be stored, or if this is not possible, the criteria used to determine this period;

(b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(fc) the recipients or categories of recipients of the personal data;

ANNEX DGD 2C LIMITE EN

(gd) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and on the level of protection afforded by that third country or international organisation by reference to an adequacy decision by the Commission;

(d) the existence of the right to (d) the existence of the right to (de) the existence of the right to request from the controller access to request from the controller access request from the controller access and rectification or erasure of the to and rectification or erasure of to and rectification or erasure of personal data concerning the data the personal data concerning the the personal data or restriction of subject or to object to the processing data subject, or to object to the processing of personal data of such personal data; processing of such personal data, concerning the data subject or and or to obtain data; to object to the processing of such personal data as well as the right to data portability;

ANNEX DGD 2C LIMITE EN

(ea) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(e) the right to lodge a complaint to (e) the right to lodge a complaint (ef) the right to lodge a complaint the supervisory authority and the towith the supervisory authority to the a supervisory authority and contact details of the supervisory and the contact details of the the contact details of the authority; supervisory authority; supervisory authority;

(f) the recipients or categories of (f) the recipients or categories of moved under (c) recipients of the personal data; recipients of the personal data;

ANNEX DGD 2C LIMITE EN

(g) where applicable, that the (g) where applicable, that the moved under (d) modified controller intends to transfer to a third controller’s intends to transfer the country or international organisation data to a third country or and on the level of protection international organisation and on afforded by that third country or the level of protection afforded by international organisation by that third country or international reference to an adequacy decision by organisation by reference to the the Commission; existence or absence of an adequacy decision by the Commission, or in case of transfers referred to in Article 42, Articleor 43, or point (h) of Article 44(1), reference to the appropriate safeguards and the means to obtain a copy of them;

(g) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the data and of the possible consequences of failure to provide such data;

ANNEX DGD 2C LIMITE EN

(ga) where applicable, information about the existence of profiling, of measures based on profiling, and the envisaged effects of profiling on the data subject;

(gb) meaningful information about the logic involved in any automated processing;

(h) the existence of automated decision making including profiling referred to in Article 20(1) and (3) and information concerning the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

ANNEX DGD 2C LIMITE EN

(h) any further information necessary (h) any further information which deleted to guarantee fair processing in respect is necessary to guarantee fair of the data subject, having regard to processing in respect of the data the specific circumstances in which subject, having regard to the the personal data are collected. specific circumstances in which the personal data are collected or processed, in particular the existence of certain processing activities and operations for which a personal data impact assessment has indicated that there may be a high risk;

(ha) where applicable, information whether personal data was were provided to public authorities during the last consecutive 12-month period.

ANNEX DGD 2C LIMITE EN

1b. Where the controller intends to further process the data for a purpose other than the one for which the data were collected the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 1a.

• 2. 

  Where the personal data are 2. Where the personal data are deleted collected from the data subject, the collected from the data subject, controller shall inform the data the controller shall inform the data subject, in addition to the information subject, in addition to the referred to in paragraph 1, whether information referred to in the provision of personal data is paragraph 1, whether the provision obligatory or voluntary, as well as the of personal data is obligatory possible consequences of failure to mandatory or voluntaryoptional, provide such data. as well as the possible consequences of failure to provide such data.

ANNEX DGD 2C LIMITE EN

2a. In deciding on further information which is necessary to make the processing fair under point (h) of paragraph 1, controllers shall have regard to any relevant guidance under Article 3834.

• 3. 

  Where the personal data are not 3. Where the personal data are not deleted collected from the data subject, the collected from the data subject, controller shall inform the data the controller shall inform the data subject, in addition to the information subject, in addition to the referred to in paragraph 1, from information referred to in which source the personal data paragraph 1, from which source originate. the specific personal data originate. If personal data originate from publicly available sources, a general indication may be given.

• 4. 

  The controller shall provide the 4. The controller shall provide the deleted information referred to in paragraphs information referred to in 1, 2 and 3: paragraphs 1, 2 and 3:

(a) at the time when the personal data (a) at the time when the personal deleted are obtained from the data subject; or data are obtained from the data subject or without undue delay where the above is not feasible; or

ANNEX DGD 2C LIMITE EN

(aa) on at the request by of a body, organization or association referred to in Article 73;

(b) where the personal data are not (b) where the personal data are not deleted collected from the data subject, at the collected from the data subject, at time of the recording or within a the time of the recording or within reasonable period after the collection, a reasonable period after the having regard to the specific collection, having regard to the circumstances in which the data are specific circumstances in which collected or otherwise processed, or, the data are collected or otherwise if a disclosure to another recipient is processed, or, if a disclosure envisaged, and at the latest when the transfer to another recipient is data are first disclosed. envisaged, and at the latest when the data are first disclosed.at the time of the first transfer, or, if the data are to be used for communication with the data subject concerned, at the latest at the time of the first communication to that data subject; or

(ba) only on request where the data are processed by a small or micro enterprise which processes personal data only as an ancillary activity.

ANNEX DGD 2C LIMITE EN

• 5. 

  Paragraphs 1 to 4 shall not apply, 5. Paragraphs 1 to 4 shall not 5. Paragraphs 1, to 41a and 1b where: apply, where: shall not apply, where and insofar as the data subject already has the information.

(a) the data subject has already the (a) the data subject has already the merged with above 5. information referred to in paragraphs information referred to in 1, 2 and 3; or paragraphs 1, 2 and 3; or

(b) the data are not collected from the (b) the data are processed for deleted data subject and the provision of such historical, statistical or scientific information proves impossible or research purposes subject to the would involve a disproportionate conditions and safeguards effort; or referred to in Articles 81 and 83, are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort and the controller has published the information for anyone to retrieve; or

ANNEX DGD 2C LIMITE EN

(c) the data are not collected from the (c) the data are not collected from deleted data subject and recording or the data subject and recording or disclosure is expressly laid down by disclosure is expressly laid down law; or by law to which the controller is subject, which provides appropriate measures to protect the data subject's legitimate interests, considering the risks represented by the processing and the nature of the personal data; or

(d) the data are not collected from the (d) the data are not collected from deleted data subject and the provision of such the data subject and the provision information will impair the rights and of such information will impair freedoms of others, as defined in the rights and freedoms of others Union law or Member State law in other natural persons, as defined accordance with Article 21. in Union law or Member State law in accordance with Article 21;

(da) the data are processed in the exercise of his profession by, or are entrusted or become known to, a person who is subject to an obligation of professional secrecy regulated by Union or Member State law or to a statutory obligation of secrecy, unless the data is collected directly from the data subject.