PURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\n\nEDPS Opinion on the data protection reform\npackage
\nOn 25 January 2012, the Commission adopted a package\nfor reforming the EU rules on data protection, which\nincluded:
\n\n· \nthis proposal for a Regulation containing the\ngeneral rules on data protection and
\n\n· \na proposal for a Directive on\ndata protection in the law enforcement sector.
\nThe Regulation: the EDPS\nwelcomes the proposed Regulation, as it constitutes a huge step\nforward for data protection in Europe. The proposed rules will\nstrengthen the rights of individuals and make controllers more\naccountable for how they handle personal data. Furthermore, the\nrole and powers of national supervisory authorities (alone and\ntogether) are effectively reinforced.
\nThe EDPS is particularly pleased to see that the\ninstrument of a regulation is proposed for the general rules on\ndata protection. The proposed Regulation would be directly\napplicable in the Member States and would do away with many\ncomplexities and inconsistencies stemming from the different\nimplementing laws of the Member States currently in\nplace.
\nThe Directive: the EDPS\nis, however, seriously disappointed with the proposed Directive for\ndata protection in the law enforcement area. He regrets that the\nCommission has chosen to regulate this matter in a self-standing\nlegal instrument which provides for an inadequate level of\nprotection, and which is greatly inferior to the proposed\nRegulation.
\nA positive element of the proposed Directive is that\nit covers domestic processing, and thus has a wider scope than the\ncurrent Framework Decision. However, this improvement only has\nadded value if the Directive substantially increases the level of\ndata protection in this area, which is not the case.
\nThe main weakness of the package as a whole is\nthat it does not remedy the lack of comprehensiveness of the EU\ndata protection rules. It leaves many EU data protection\ninstruments unaffected such as the data protection rules for the EU\ninstitutions and bodies, but also all specific instruments adopted\nin the area of police and judicial cooperation in criminal matters\nsuch as the Prüm Decision and the rules on Europol and\nEurojust. Furthermore, the proposed instruments taken together do\nnot fully address factual situations that fall under both policy\nareas, such as the use of PNR or telecommunication data for law\nenforcement purposes.
\nGeneral comments on the proposed\nRegulation: the EDPS makes the\nfollowing observations:
\n(1) One horizontal issue is the relationship between\nEU and national law. The proposed Regulation goes a long way in\ncreating a single applicable law for data protection in the EU,\nhowever there is still more space for coexistence and interaction\nbetween EU law and national law than one might assume at first\nsight. The EDPS takes the view that the legislator should better\nacknowledge this.
\n(2) A second issue of general importance arises from\nthe numerous provisions which empower the Commission to adopt\ndelegated or implementing acts. The EDPS welcomes this approach in\nso far as it contributes to the consistent application of the\nRegulation, but has reservations about the extent to which\nessential legal provisions are left to delegated powers. Several of\nthese empowerments should be reconsidered.
\n(3) On a detailed level, the EDPS points to the main\npositive elements of the proposed Regulation, which are:
\n\n· \nthe clarification of the scope of application of\nthe proposed Regulation;
\n\n· \nthe enhanced transparency requirements towards\nthe data subject and the reinforcement of the right to\nobject;
\n\n· \nthe general obligation for controllers to ensure\nand be able to demonstrate compliance with the provisions of the\nRegulation;
\n\n· \nthe reinforcement of the position and role of\nnational supervisory authorities;
\n\n· \nthe main lines of the consistency\nmechanism.
\nThe main negative elements of the proposed Regulation\nare:
\n\n· \nthe new ground for exceptions to the purpose\nlimitation principle;
\n\n· \nthe possibilities for restricting basic\nprinciples and rights;
\n\n· \nthe obligation for controllers to maintain\ndocumentation of all processing operations;
\n\n· \nthe transfer of data to third countries by way\nof derogation;
\n\n· \nthe role of the Commission in the consistency\nmechanism;
\n\n· \nthe mandatory nature of imposing administrative\nsanctions.
\nGeneral comments on the proposed\nDirective: as regards the Directive,\nthe EDPS takes the view that the proposal, in many aspects, does\nnot meet the requirement of a consistent and high level of data\nprotection. It leaves all existing instruments in the area\nunaffected, and in many instances there is no justification\nwhatsoever for departing from the provisions of the rules in the\nproposed Regulation.
\nThe EDPS underlines that whilst the law enforcement\narea requires some specific rules, every departure from the general\ndata protection rules should be duly justified based on a proper\nbalance between the public interest in law enforcement and\ncitizens’ fundamental rights.
\nThe EDPS is particularly concerned\nregarding:
\n\n· \nthe lack of clarity in the drafting of the\nprinciple of purpose limitation;
\n\n· \nthe absence of any obligation on competent\nauthorities to be able to demonstrate compliance with the\nDirective;
\n\n· \nthe weak conditions for transfers to third\ncountries;
\n\n· \nthe unduly limited powers of supervisory\nauthorities.
\nThe following recommendations on the whole reform\nprocess are made:
\n\n· \nannounce publicly the time schedule on the\nsecond stage of the reform process as soon as possible;
\n\n· \nincorporate the rules for EU institutions and\nbodies in the proposed Regulation or at least have aligned rules in\nforce when the proposed Regulation applies;
\n\n· \npresent as soon as possible a proposal for\ncommon rules for the Common Foreign and Security Policy, based on\nArticle 39 TEU.
\nThe EDPS makes a series of detailed\nrecommendations regarding amendments to provisions in both the\ndraft regulation and the draft directive.
\nThe Council took note of the state-of-play on\nthe proposal for a Regulation on the protection of individuals with\nregard to the processing of personal data and on the free movement\nof such data (General Data Protection Regulation).
\nThe choice of legal instrument was raised\nduring the debate. Some delegations expressed their preference for\na directive instead of a regulation since it allowed for more\nflexibility where this was needed. However, some other delegations\npreferred the choice of a regulation, as proposed by the\nCommission.
\nMinisters have already discussed this proposal at the\ninformal ministerial meeting in July on the basis of three\nquestions: the administrative burden, the need for special\ntreatment for the public sector and the number of delegated\nacts.
\nThe proposal is the subject of in-depth discussions by\nexperts in the Working Party on Data Protection, which began under\nthe Danish Presidency and will continue under the Irish\nPresidency.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\n\nEDPS Opinion on the data protection reform\npackage
\nOn 25 January 2012, the Commission adopted a package\nfor reforming the EU rules on data protection, which\nincluded:
\n\n· \nthis proposal for a Regulation containing the\ngeneral rules on data protection and
\n\n· \na proposal for a Directive on\ndata protection in the law enforcement sector.
\nThe Regulation: the EDPS\nwelcomes the proposed Regulation, as it constitutes a huge step\nforward for data protection in Europe. The proposed rules will\nstrengthen the rights of individuals and make controllers more\naccountable for how they handle personal data. Furthermore, the\nrole and powers of national supervisory authorities (alone and\ntogether) are effectively reinforced.
\nThe EDPS is particularly pleased to see that the\ninstrument of a regulation is proposed for the general rules on\ndata protection. The proposed Regulation would be directly\napplicable in the Member States and would do away with many\ncomplexities and inconsistencies stemming from the different\nimplementing laws of the Member States currently in\nplace.
\nThe Directive: the EDPS\nis, however, seriously disappointed with the proposed Directive for\ndata protection in the law enforcement area. He regrets that the\nCommission has chosen to regulate this matter in a self-standing\nlegal instrument which provides for an inadequate level of\nprotection, and which is greatly inferior to the proposed\nRegulation.
\nA positive element of the proposed Directive is that\nit covers domestic processing, and thus has a wider scope than the\ncurrent Framework Decision. However, this improvement only has\nadded value if the Directive substantially increases the level of\ndata protection in this area, which is not the case.
\nThe main weakness of the package as a whole is\nthat it does not remedy the lack of comprehensiveness of the EU\ndata protection rules. It leaves many EU data protection\ninstruments unaffected such as the data protection rules for the EU\ninstitutions and bodies, but also all specific instruments adopted\nin the area of police and judicial cooperation in criminal matters\nsuch as the Prüm Decision and the rules on Europol and\nEurojust. Furthermore, the proposed instruments taken together do\nnot fully address factual situations that fall under both policy\nareas, such as the use of PNR or telecommunication data for law\nenforcement purposes.
\nGeneral comments on the proposed\nRegulation: the EDPS makes the\nfollowing observations:
\n(1) One horizontal issue is the relationship between\nEU and national law. The proposed Regulation goes a long way in\ncreating a single applicable law for data protection in the EU,\nhowever there is still more space for coexistence and interaction\nbetween EU law and national law than one might assume at first\nsight. The EDPS takes the view that the legislator should better\nacknowledge this.
\n(2) A second issue of general importance arises from\nthe numerous provisions which empower the Commission to adopt\ndelegated or implementing acts. The EDPS welcomes this approach in\nso far as it contributes to the consistent application of the\nRegulation, but has reservations about the extent to which\nessential legal provisions are left to delegated powers. Several of\nthese empowerments should be reconsidered.
\n(3) On a detailed level, the EDPS points to the main\npositive elements of the proposed Regulation, which are:
\n\n· \nthe clarification of the scope of application of\nthe proposed Regulation;
\n\n· \nthe enhanced transparency requirements towards\nthe data subject and the reinforcement of the right to\nobject;
\n\n· \nthe general obligation for controllers to ensure\nand be able to demonstrate compliance with the provisions of the\nRegulation;
\n\n· \nthe reinforcement of the position and role of\nnational supervisory authorities;
\n\n· \nthe main lines of the consistency\nmechanism.
\nThe main negative elements of the proposed Regulation\nare:
\n\n· \nthe new ground for exceptions to the purpose\nlimitation principle;
\n\n· \nthe possibilities for restricting basic\nprinciples and rights;
\n\n· \nthe obligation for controllers to maintain\ndocumentation of all processing operations;
\n\n· \nthe transfer of data to third countries by way\nof derogation;
\n\n· \nthe role of the Commission in the consistency\nmechanism;
\n\n· \nthe mandatory nature of imposing administrative\nsanctions.
\nGeneral comments on the proposed\nDirective: as regards the Directive,\nthe EDPS takes the view that the proposal, in many aspects, does\nnot meet the requirement of a consistent and high level of data\nprotection. It leaves all existing instruments in the area\nunaffected, and in many instances there is no justification\nwhatsoever for departing from the provisions of the rules in the\nproposed Regulation.
\nThe EDPS underlines that whilst the law enforcement\narea requires some specific rules, every departure from the general\ndata protection rules should be duly justified based on a proper\nbalance between the public interest in law enforcement and\ncitizens’ fundamental rights.
\nThe EDPS is particularly concerned\nregarding:
\n\n· \nthe lack of clarity in the drafting of the\nprinciple of purpose limitation;
\n\n· \nthe absence of any obligation on competent\nauthorities to be able to demonstrate compliance with the\nDirective;
\n\n· \nthe weak conditions for transfers to third\ncountries;
\n\n· \nthe unduly limited powers of supervisory\nauthorities.
\nThe following recommendations on the whole reform\nprocess are made:
\n\n· \nannounce publicly the time schedule on the\nsecond stage of the reform process as soon as possible;
\n\n· \nncorporate the rules for EU institutions and\nbodies in the proposed Regulation or at least have aligned rules in\nforce when the proposed Regulation applies;
\n\n· \npresent as soon as possible a proposal for\ncommon rules for the Common Foreign and Security Policy, based on\nArticle 39 TEU.
\nThe EDPS makes a series of detailed\nrecommendations regarding amendments to provisions in both the\ndraft regulation and the draft directive.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\n\nEDPS Opinion on the data protection reform\npackage
\nOn 25 January 2012, the Commission adopted a package\nfor reforming the EU rules on data protection, which\nincluded:
\n\n· \nthis proposal for a Regulation containing the\ngeneral rules on data protection and
\n\n· \na proposal for a Directive on\ndata protection in the law enforcement sector.
\nThe Regulation: the EDPS\nwelcomes the proposed Regulation, as it constitutes a huge step\nforward for data protection in Europe. The proposed rules will\nstrengthen the rights of individuals and make controllers more\naccountable for how they handle personal data. Furthermore, the\nrole and powers of national supervisory authorities (alone and\ntogether) are effectively reinforced.
\nThe EDPS is particularly pleased to see that the\ninstrument of a regulation is proposed for the general rules on\ndata protection. The proposed Regulation would be directly\napplicable in the Member States and would do away with many\ncomplexities and inconsistencies stemming from the different\nimplementing laws of the Member States currently in\nplace.
\nThe Directive: the EDPS\nis, however, seriously disappointed with the proposed Directive for\ndata protection in the law enforcement area. He regrets that the\nCommission has chosen to regulate this matter in a self-standing\nlegal instrument which provides for an inadequate level of\nprotection, and which is greatly inferior to the proposed\nRegulation.
\nA positive element of the proposed Directive is that\nit covers domestic processing, and thus has a wider scope than the\ncurrent Framework Decision. However, this improvement only has\nadded value if the Directive substantially increases the level of\ndata protection in this area, which is not the case.
\nThe main weakness of the package as a whole is\nthat it does not remedy the lack of comprehensiveness of the EU\ndata protection rules. It leaves many EU data protection\ninstruments unaffected such as the data protection rules for the EU\ninstitutions and bodies, but also all specific instruments adopted\nin the area of police and judicial cooperation in criminal matters\nsuch as the Prüm Decision and the rules on Europol and\nEurojust. Furthermore, the proposed instruments taken together do\nnot fully address factual situations that fall under both policy\nareas, such as the use of PNR or telecommunication data for law\nenforcement purposes.
\nGeneral comments on the proposed\nRegulation: the EDPS makes the\nfollowing observations:
\n(1) One horizontal issue is the relationship between\nEU and national law. The proposed Regulation goes a long way in\ncreating a single applicable law for data protection in the EU,\nhowever there is still more space for coexistence and interaction\nbetween EU law and national law than one might assume at first\nsight. The EDPS takes the view that the legislator should better\nacknowledge this.
\n(2) A second issue of general importance arises from\nthe numerous provisions which empower the Commission to adopt\ndelegated or implementing acts. The EDPS welcomes this approach in\nso far as it contributes to the consistent application of the\nRegulation, but has reservations about the extent to which\nessential legal provisions are left to delegated powers. Several of\nthese empowerments should be reconsidered.
\n(3) On a detailed level, the EDPS points to the main\npositive elements of the proposed Regulation, which are:
\n\n· \nthe clarification of the scope of application of\nthe proposed Regulation;
\n\n· \nthe enhanced transparency requirements towards\nthe data subject and the reinforcement of the right to\nobject;
\n\n· \nthe general obligation for controllers to ensure\nand be able to demonstrate compliance with the provisions of the\nRegulation;
\n\n· \nthe reinforcement of the position and role of\nnational supervisory authorities;
\n\n· \nthe main lines of the consistency\nmechanism.
\nThe main negative elements of the proposed Regulation\nare:
\n\n· \nthe new ground for exceptions to the purpose\nlimitation principle;
\n\n· \nthe possibilities for restricting basic\nprinciples and rights;
\n\n· \nthe obligation for controllers to maintain\ndocumentation of all processing operations;
\n\n· \nthe transfer of data to third countries by way\nof derogation;
\n\n· \nthe role of the Commission in the consistency\nmechanism;
\n\n· \nthe mandatory nature of imposing administrative\nsanctions.
\nGeneral comments on the proposed\nDirective: as regards the Directive,\nthe EDPS takes the view that the proposal, in many aspects, does\nnot meet the requirement of a consistent and high level of data\nprotection. It leaves all existing instruments in the area\nunaffected, and in many instances there is no justification\nwhatsoever for departing from the provisions of the rules in the\nproposed Regulation.
\nThe EDPS underlines that whilst the law enforcement\narea requires some specific rules, every departure from the general\ndata protection rules should be duly justified based on a proper\nbalance between the public interest in law enforcement and\ncitizens’ fundamental rights.
\nThe EDPS is particularly concerned\nregarding:
\n\n· \nthe lack of clarity in the drafting of the\nprinciple of purpose limitation;
\n\n· \nthe absence of any obligation on competent\nauthorities to be able to demonstrate compliance with the\nDirective;
\n\n· \nthe weak conditions for transfers to third\ncountries;
\n\n· \nthe unduly limited powers of supervisory\nauthorities.
\nThe following recommendations on the whole reform\nprocess are made:
\n\n· \nannounce publicly the time schedule on the\nsecond stage of the reform process as soon as possible;
\n\n· \nincorporate the rules for EU institutions and\nbodies in the proposed Regulation or at least have aligned rules in\nforce when the proposed Regulation applies;
\n\n· \npresent as soon as possible a proposal for\ncommon rules for the Common Foreign and Security Policy, based on\nArticle 39 TEU.
\nThe EDPS makes a series of detailed\nrecommendations regarding amendments to provisions in both the\ndraft regulation and the draft directive.
\n\nEDPS Opinion on the data protection reform\npackage
\nOn 25 January 2012, the Commission adopted a package\nfor reforming the EU rules on data protection, which\nincluded:
\n\n· \nthis proposal for a Regulation containing the\ngeneral rules on data protection and
\n\n· \na proposal for a Directive on\ndata protection in the law enforcement sector.
\nThe Regulation: the EDPS\nwelcomes the proposed Regulation, as it constitutes a huge step\nforward for data protection in Europe. The proposed rules will\nstrengthen the rights of individuals and make controllers more\naccountable for how they handle personal data. Furthermore, the\nrole and powers of national supervisory authorities (alone and\ntogether) are effectively reinforced.
\nThe EDPS is particularly pleased to see that the\ninstrument of a regulation is proposed for the general rules on\ndata protection. The proposed Regulation would be directly\napplicable in the Member States and would do away with many\ncomplexities and inconsistencies stemming from the different\nimplementing laws of the Member States currently in\nplace.
\nThe Directive: the EDPS\nis, however, seriously disappointed with the proposed Directive for\ndata protection in the law enforcement area. He regrets that the\nCommission has chosen to regulate this matter in a self-standing\nlegal instrument which provides for an inadequate level of\nprotection, and which is greatly inferior to the proposed\nRegulation.
\nA positive element of the proposed Directive is that\nit covers domestic processing, and thus has a wider scope than the\ncurrent Framework Decision. However, this improvement only has\nadded value if the Directive substantially increases the level of\ndata protection in this area, which is not the case.
\nThe main weakness of the package as a whole is\nthat it does not remedy the lack of comprehensiveness of the EU\ndata protection rules. It leaves many EU data protection\ninstruments unaffected such as the data protection rules for the EU\ninstitutions and bodies, but also all specific instruments adopted\nin the area of police and judicial cooperation in criminal matters\nsuch as the Prüm Decision and the rules on Europol and\nEurojust. Furthermore, the proposed instruments taken together do\nnot fully address factual situations that fall under both policy\nareas, such as the use of PNR or telecommunication data for law\nenforcement purposes.
\nGeneral comments on the proposed\nRegulation: the EDPS makes the\nfollowing observations:
\n(1) One horizontal issue is the relationship between\nEU and national law. The proposed Regulation goes a long way in\ncreating a single applicable law for data protection in the EU,\nhowever there is still more space for coexistence and interaction\nbetween EU law and national law than one might assume at first\nsight. The EDPS takes the view that the legislator should better\nacknowledge this.
\n(2) A second issue of general importance arises from\nthe numerous provisions which empower the Commission to adopt\ndelegated or implementing acts. The EDPS welcomes this approach in\nso far as it contributes to the consistent application of the\nRegulation, but has reservations about the extent to which\nessential legal provisions are left to delegated powers. Several of\nthese empowerments should be reconsidered.
\n(3) On a detailed level, the EDPS points to the main\npositive elements of the proposed Regulation, which are:
\n\n· \nthe clarification of the scope of application of\nthe proposed Regulation;
\n\n· \nthe enhanced transparency requirements towards\nthe data subject and the reinforcement of the right to\nobject;
\n\n· \nthe general obligation for controllers to ensure\nand be able to demonstrate compliance with the provisions of the\nRegulation;
\n\n· \nthe reinforcement of the position and role of\nnational supervisory authorities;
\n\n· \nthe main lines of the consistency\nmechanism.
\nThe main negative elements of the proposed Regulation\nare:
\n\n· \nthe new ground for exceptions to the purpose\nlimitation principle;
\n\n· \nthe possibilities for restricting basic\nprinciples and rights;
\n\n· \nthe obligation for controllers to maintain\ndocumentation of all processing operations;
\n\n· \nthe transfer of data to third countries by way\nof derogation;
\n\n· \nthe role of the Commission in the consistency\nmechanism;
\n\n· \nthe mandatory nature of imposing administrative\nsanctions.
\nGeneral comments on the proposed\nDirective: as regards the Directive,\nthe EDPS takes the view that the proposal, in many aspects, does\nnot meet the requirement of a consistent and high level of data\nprotection. It leaves all existing instruments in the area\nunaffected, and in many instances there is no justification\nwhatsoever for departing from the provisions of the rules in the\nproposed Regulation.
\nThe EDPS underlines that whilst the law enforcement\narea requires some specific rules, every departure from the general\ndata protection rules should be duly justified based on a proper\nbalance between the public interest in law enforcement and\ncitizens’ fundamental rights.
\nThe EDPS is particularly concerned\nregarding:
\n\n· \nthe lack of clarity in the drafting of the\nprinciple of purpose limitation;
\n\n· \nthe absence of any obligation on competent\nauthorities to be able to demonstrate compliance with the\nDirective;
\n\n· \nthe weak conditions for transfers to third\ncountries;
\n\n· \nthe unduly limited powers of supervisory\nauthorities.
\nThe following recommendations on the whole reform\nprocess are made:
\n\n· \nannounce publicly the time schedule on the\nsecond stage of the reform process as soon as possible;
\n\n· \nincorporate the rules for EU institutions and\nbodies in the proposed Regulation or at least have aligned rules in\nforce when the proposed Regulation applies;
\n\n· \npresent as soon as possible a proposal for\ncommon rules for the Common Foreign and Security Policy, based on\nArticle 39 TEU.
\nThe EDPS makes a series of detailed\nrecommendations regarding amendments to provisions in both the\ndraft regulation and the draft directive.
\n\nEDPS Opinion on the data protection reform\npackage
\nOn 25 January 2012, the Commission adopted a package\nfor reforming the EU rules on data protection, which\nincluded:
\n\n· \nthis proposal for a Regulation containing the\ngeneral rules on data protection and
\n\n· \na proposal for a Directive on\ndata protection in the law enforcement sector.
\nThe Regulation: the EDPS\nwelcomes the proposed Regulation, as it constitutes a huge step\nforward for data protection in Europe. The proposed rules will\nstrengthen the rights of individuals and make controllers more\naccountable for how they handle personal data. Furthermore, the\nrole and powers of national supervisory authorities (alone and\ntogether) are effectively reinforced.
\nThe EDPS is particularly pleased to see that the\ninstrument of a regulation is proposed for the general rules on\ndata protection. The proposed Regulation would be directly\napplicable in the Member States and would do away with many\ncomplexities and inconsistencies stemming from the different\nimplementing laws of the Member States currently in\nplace.
\nThe Directive: the EDPS\nis, however, seriously disappointed with the proposed Directive for\ndata protection in the law enforcement area. He regrets that the\nCommission has chosen to regulate this matter in a self-standing\nlegal instrument which provides for an inadequate level of\nprotection, and which is greatly inferior to the proposed\nRegulation.
\nA positive element of the proposed Directive is that\nit covers domestic processing, and thus has a wider scope than the\ncurrent Framework Decision. However, this improvement only has\nadded value if the Directive substantially increases the level of\ndata protection in this area, which is not the case.
\nThe main weakness of the package as a whole is\nthat it does not remedy the lack of comprehensiveness of the EU\ndata protection rules. It leaves many EU data protection\ninstruments unaffected such as the data protection rules for the EU\ninstitutions and bodies, but also all specific instruments adopted\nin the area of police and judicial cooperation in criminal matters\nsuch as the Prüm Decision and the rules on Europol and\nEurojust. Furthermore, the proposed instruments taken together do\nnot fully address factual situations that fall under both policy\nareas, such as the use of PNR or telecommunication data for law\nenforcement purposes.
\nGeneral comments on the proposed\nRegulation: the EDPS makes the\nfollowing observations:
\n(1) One horizontal issue is the relationship between\nEU and national law. The proposed Regulation goes a long way in\ncreating a single applicable law for data protection in the EU,\nhowever there is still more space for coexistence and interaction\nbetween EU law and national law than one might assume at first\nsight. The EDPS takes the view that the legislator should better\nacknowledge this.
\n(2) A second issue of general importance arises from\nthe numerous provisions which empower the Commission to adopt\ndelegated or implementing acts. The EDPS welcomes this approach in\nso far as it contributes to the consistent application of the\nRegulation, but has reservations about the extent to which\nessential legal provisions are left to delegated powers. Several of\nthese empowerments should be reconsidered.
\n(3) On a detailed level, the EDPS points to the main\npositive elements of the proposed Regulation, which are:
\n\n· \nthe clarification of the scope of application of\nthe proposed Regulation;
\n\n· \nthe enhanced transparency requirements towards\nthe data subject and the reinforcement of the right to\nobject;
\n\n· \nthe general obligation for controllers to ensure\nand be able to demonstrate compliance with the provisions of the\nRegulation;
\n\n· \nthe reinforcement of the position and role of\nnational supervisory authorities;
\n\n· \nthe main lines of the consistency\nmechanism.
\nThe main negative elements of the proposed Regulation\nare:
\n\n· \nthe new ground for exceptions to the purpose\nlimitation principle;
\n\n· \nthe possibilities for restricting basic\nprinciples and rights;
\n\n· \nthe obligation for controllers to maintain\ndocumentation of all processing operations;
\n\n· \nthe transfer of data to third countries by way\nof derogation;
\n\n· \nthe role of the Commission in the consistency\nmechanism;
\n\n· \nthe mandatory nature of imposing administrative\nsanctions.
\nGeneral comments on the proposed\nDirective: as regards the Directive,\nthe EDPS takes the view that the proposal, in many aspects, does\nnot meet the requirement of a consistent and high level of data\nprotection. It leaves all existing instruments in the area\nunaffected, and in many instances there is no justification\nwhatsoever for departing from the provisions of the rules in the\nproposed Regulation.
\nThe EDPS underlines that whilst the law enforcement\narea requires some specific rules, every departure from the general\ndata protection rules should be duly justified based on a proper\nbalance between the public interest in law enforcement and\ncitizens’ fundamental rights.
\nThe EDPS is particularly concerned\nregarding:
\n\n· \nthe lack of clarity in the drafting of the\nprinciple of purpose limitation;
\n\n· \nthe absence of any obligation on competent\nauthorities to be able to demonstrate compliance with the\nDirective;
\n\n· \nthe weak conditions for transfers to third\ncountries;
\n\n· \nthe unduly limited powers of supervisory\nauthorities.
\nThe following recommendations on the whole reform\nprocess are made:
\n\n· \nannounce publicly the time schedule on the\nsecond stage of the reform process as soon as possible;
\n\n· \nincorporate the rules for EU institutions and\nbodies in the proposed Regulation or at least have aligned rules in\nforce when the proposed Regulation applies;
\n\n· \npresent as soon as possible a proposal for\ncommon rules for the Common Foreign and Security Policy, based on\nArticle 39 TEU.
\nThe EDPS makes a series of detailed\nrecommendations regarding amendments to provisions in both the\ndraft regulation and the draft directive.
\n\nEDPS Opinion on the data protection reform\npackage
\nOn 25 January 2012, the Commission adopted a package\nfor reforming the EU rules on data protection, which\nincluded:
\n\n· \nthis proposal for a Regulation containing the\ngeneral rules on data protection and
\n\n· \na proposal for a Directive on\ndata protection in the law enforcement sector.
\nThe Regulation: the EDPS\nwelcomes the proposed Regulation, as it constitutes a huge step\nforward for data protection in Europe. The proposed rules will\nstrengthen the rights of individuals and make controllers more\naccountable for how they handle personal data. Furthermore, the\nrole and powers of national supervisory authorities (alone and\ntogether) are effectively reinforced.
\nThe EDPS is particularly pleased to see that the\ninstrument of a regulation is proposed for the general rules on\ndata protection. The proposed Regulation would be directly\napplicable in the Member States and would do away with many\ncomplexities and inconsistencies stemming from the different\nimplementing laws of the Member States currently in\nplace.
\nThe Directive: the EDPS\nis, however, seriously disappointed with the proposed Directive for\ndata protection in the law enforcement area. He regrets that the\nCommission has chosen to regulate this matter in a self-standing\nlegal instrument which provides for an inadequate level of\nprotection, and which is greatly inferior to the proposed\nRegulation.
\nA positive element of the proposed Directive is that\nit covers domestic processing, and thus has a wider scope than the\ncurrent Framework Decision. However, this improvement only has\nadded value if the Directive substantially increases the level of\ndata protection in this area, which is not the case.
\nThe main weakness of the package as a whole is\nthat it does not remedy the lack of comprehensiveness of the EU\ndata protection rules. It leaves many EU data protection\ninstruments unaffected such as the data protection rules for the EU\ninstitutions and bodies, but also all specific instruments adopted\nin the area of police and judicial cooperation in criminal matters\nsuch as the Prüm Decision and the rules on Europol and\nEurojust. Furthermore, the proposed instruments taken together do\nnot fully address factual situations that fall under both policy\nareas, such as the use of PNR or telecommunication data for law\nenforcement purposes.
\nGeneral comments on the proposed\nRegulation: the EDPS makes the\nfollowing observations:
\n(1) One horizontal issue is the relationship between\nEU and national law. The proposed Regulation goes a long way in\ncreating a single applicable law for data protection in the EU,\nhowever there is still more space for coexistence and interaction\nbetween EU law and national law than one might assume at first\nsight. The EDPS takes the view that the legislator should better\nacknowledge this.
\n(2) A second issue of general importance arises from\nthe numerous provisions which empower the Commission to adopt\ndelegated or implementing acts. The EDPS welcomes this approach in\nso far as it contributes to the consistent application of the\nRegulation, but has reservations about the extent to which\nessential legal provisions are left to delegated powers. Several of\nthese empowerments should be reconsidered.
\n(3) On a detailed level, the EDPS points to the main\npositive elements of the proposed Regulation, which are:
\n\n· \nthe clarification of the scope of application of\nthe proposed Regulation;
\n\n· \nthe enhanced transparency requirements towards\nthe data subject and the reinforcement of the right to\nobject;
\n\n· \nthe general obligation for controllers to ensure\nand be able to demonstrate compliance with the provisions of the\nRegulation;
\n\n· \nthe reinforcement of the position and role of\nnational supervisory authorities;
\n\n· \nthe main lines of the consistency\nmechanism.
\nThe main negative elements of the proposed Regulation\nare:
\n\n· \nthe new ground for exceptions to the purpose\nlimitation principle;
\n\n· \nthe possibilities for restricting basic\nprinciples and rights;
\n\n· \nthe obligation for controllers to maintain\ndocumentation of all processing operations;
\n\n· \nthe transfer of data to third countries by way\nof derogation;
\n\n· \nthe role of the Commission in the consistency\nmechanism;
\n\n· \nthe mandatory nature of imposing administrative\nsanctions.
\nGeneral comments on the proposed\nDirective: as regards the Directive,\nthe EDPS takes the view that the proposal, in many aspects, does\nnot meet the requirement of a consistent and high level of data\nprotection. It leaves all existing instruments in the area\nunaffected, and in many instances there is no justification\nwhatsoever for departing from the provisions of the rules in the\nproposed Regulation.
\nThe EDPS underlines that whilst the law enforcement\narea requires some specific rules, every departure from the general\ndata protection rules should be duly justified based on a proper\nbalance between the public interest in law enforcement and\ncitizens’ fundamental rights.
\nThe EDPS is particularly concerned\nregarding:
\n\n· \nthe lack of clarity in the drafting of the\nprinciple of purpose limitation;
\n\n· \nthe absence of any obligation on competent\nauthorities to be able to demonstrate compliance with the\nDirective;
\n\n· \nthe weak conditions for transfers to third\ncountries;
\n\n· \nthe unduly limited powers of supervisory\nauthorities.
\nThe following recommendations on the whole reform\nprocess are made:
\n\n· \nannounce publicly the time schedule on the\nsecond stage of the reform process as soon as possible;
\n\n· \nincorporate the rules for EU institutions and\nbodies in the proposed Regulation or at least have aligned rules in\nforce when the proposed Regulation applies;
\n\n· \npresent as soon as possible a proposal for\ncommon rules for the Common Foreign and Security Policy, based on\nArticle 39 TEU.
\nThe EDPS makes a series of detailed\nrecommendations regarding amendments to provisions in both the\ndraft regulation and the draft directive.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\n\nEDPS Opinion on the data protection reform\npackage
\nOn 25 January 2012, the Commission adopted a package\nfor reforming the EU rules on data protection, which\nincluded:
\n\n· \nthis proposal for a Regulation containing the\ngeneral rules on data protection and
\n\n· \na proposal for a Directive on\ndata protection in the law enforcement sector.
\nThe Regulation: the EDPS\nwelcomes the proposed Regulation, as it constitutes a huge step\nforward for data protection in Europe. The proposed rules will\nstrengthen the rights of individuals and make controllers more\naccountable for how they handle personal data. Furthermore, the\nrole and powers of national supervisory authorities (alone and\ntogether) are effectively reinforced.
\nThe EDPS is particularly pleased to see that the\ninstrument of a regulation is proposed for the general rules on\ndata protection. The proposed Regulation would be directly\napplicable in the Member States and would do away with many\ncomplexities and inconsistencies stemming from the different\nimplementing laws of the Member States currently in\nplace.
\nThe Directive: the EDPS\nis, however, seriously disappointed with the proposed Directive for\ndata protection in the law enforcement area. He regrets that the\nCommission has chosen to regulate this matter in a self-standing\nlegal instrument which provides for an inadequate level of\nprotection, and which is greatly inferior to the proposed\nRegulation.
\nA positive element of the proposed Directive is that\nit covers domestic processing, and thus has a wider scope than the\ncurrent Framework Decision. However, this improvement only has\nadded value if the Directive substantially increases the level of\ndata protection in this area, which is not the case.
\nThe main weakness of the package as a whole is\nthat it does not remedy the lack of comprehensiveness of the EU\ndata protection rules. It leaves many EU data protection\ninstruments unaffected such as the data protection rules for the EU\ninstitutions and bodies, but also all specific instruments adopted\nin the area of police and judicial cooperation in criminal matters\nsuch as the Prüm Decision and the rules on Europol and\nEurojust. Furthermore, the proposed instruments taken together do\nnot fully address factual situations that fall under both policy\nareas, such as the use of PNR or telecommunication data for law\nenforcement purposes.
\nGeneral comments on the proposed\nRegulation: the EDPS makes the\nfollowing observations:
\n(1) One horizontal issue is the relationship between\nEU and national law. The proposed Regulation goes a long way in\ncreating a single applicable law for data protection in the EU,\nhowever there is still more space for coexistence and interaction\nbetween EU law and national law than one might assume at first\nsight. The EDPS takes the view that the legislator should better\nacknowledge this.
\n(2) A second issue of general importance arises from\nthe numerous provisions which empower the Commission to adopt\ndelegated or implementing acts. The EDPS welcomes this approach in\nso far as it contributes to the consistent application of the\nRegulation, but has reservations about the extent to which\nessential legal provisions are left to delegated powers. Several of\nthese empowerments should be reconsidered.
\n(3) On a detailed level, the EDPS points to the main\npositive elements of the proposed Regulation, which are:
\n\n· \nthe clarification of the scope of application of\nthe proposed Regulation;
\n\n· \nthe enhanced transparency requirements towards\nthe data subject and the reinforcement of the right to\nobject;
\n\n· \nthe general obligation for controllers to ensure\nand be able to demonstrate compliance with the provisions of the\nRegulation;
\n\n· \nthe reinforcement of the position and role of\nnational supervisory authorities;
\n\n· \nthe main lines of the consistency\nmechanism.
\nThe main negative elements of the proposed Regulation\nare:
\n\n· \nthe new ground for exceptions to the purpose\nlimitation principle;
\n\n· \nthe possibilities for restricting basic\nprinciples and rights;
\n\n· \nthe obligation for controllers to maintain\ndocumentation of all processing operations;
\n\n· \nthe transfer of data to third countries by way\nof derogation;
\n\n· \nthe role of the Commission in the consistency\nmechanism;
\n\n· \nthe mandatory nature of imposing administrative\nsanctions.
\nGeneral comments on the proposed\nDirective: as regards the Directive,\nthe EDPS takes the view that the proposal, in many aspects, does\nnot meet the requirement of a consistent and high level of data\nprotection. It leaves all existing instruments in the area\nunaffected, and in many instances there is no justification\nwhatsoever for departing from the provisions of the rules in the\nproposed Regulation.
\nThe EDPS underlines that whilst the law enforcement\narea requires some specific rules, every departure from the general\ndata protection rules should be duly justified based on a proper\nbalance between the public interest in law enforcement and\ncitizens’ fundamental rights.
\nThe EDPS is particularly concerned\nregarding:
\n\n· \nthe lack of clarity in the drafting of the\nprinciple of purpose limitation;
\n\n· \nthe absence of any obligation on competent\nauthorities to be able to demonstrate compliance with the\nDirective;
\n\n· \nthe weak conditions for transfers to third\ncountries;
\n\n· \nthe unduly limited powers of supervisory\nauthorities.
\nThe following recommendations on the whole reform\nprocess are made:
\n\n· \nannounce publicly the time schedule on the\nsecond stage of the reform process as soon as possible;
\n\n· \nincorporate the rules for EU institutions and\nbodies in the proposed Regulation or at least have aligned rules in\nforce when the proposed Regulation applies;
\n\n· \npresent as soon as possible a proposal for\ncommon rules for the Common Foreign and Security Policy, based on\nArticle 39 TEU.
\nThe EDPS makes a series of detailed\nrecommendations regarding amendments to provisions in both the\ndraft regulation and the draft directive.
\n\nEDPS Opinion on the data protection reform\npackage
\nOn 25 January 2012, the Commission adopted a package\nfor reforming the EU rules on data protection, which\nincluded:
\n\n· \nthis proposal for a Regulation containing the\ngeneral rules on data protection and
\n\n· \na proposal for a Directive on\ndata protection in the law enforcement sector.
\nThe Regulation: the EDPS\nwelcomes the proposed Regulation, as it constitutes a huge step\nforward for data protection in Europe. The proposed rules will\nstrengthen the rights of individuals and make controllers more\naccountable for how they handle personal data. Furthermore, the\nrole and powers of national supervisory authorities (alone and\ntogether) are effectively reinforced.
\nThe EDPS is particularly pleased to see that the\ninstrument of a regulation is proposed for the general rules on\ndata protection. The proposed Regulation would be directly\napplicable in the Member States and would do away with many\ncomplexities and inconsistencies stemming from the different\nimplementing laws of the Member States currently in\nplace.
\nThe Directive: the EDPS\nis, however, seriously disappointed with the proposed Directive for\ndata protection in the law enforcement area. He regrets that the\nCommission has chosen to regulate this matter in a self-standing\nlegal instrument which provides for an inadequate level of\nprotection, and which is greatly inferior to the proposed\nRegulation.
\nA positive element of the proposed Directive is that\nit covers domestic processing, and thus has a wider scope than the\ncurrent Framework Decision. However, this improvement only has\nadded value if the Directive substantially increases the level of\ndata protection in this area, which is not the case.
\nThe main weakness of the package as a whole is\nthat it does not remedy the lack of comprehensiveness of the EU\ndata protection rules. It leaves many EU data protection\ninstruments unaffected such as the data protection rules for the EU\ninstitutions and bodies, but also all specific instruments adopted\nin the area of police and judicial cooperation in criminal matters\nsuch as the Prüm Decision and the rules on Europol and\nEurojust. Furthermore, the proposed instruments taken together do\nnot fully address factual situations that fall under both policy\nareas, such as the use of PNR or telecommunication data for law\nenforcement purposes.
\nGeneral comments on the proposed\nRegulation: the EDPS makes the\nfollowing observations:
\n(1) One horizontal issue is the relationship between\nEU and national law. The proposed Regulation goes a long way in\ncreating a single applicable law for data protection in the EU,\nhowever there is still more space for coexistence and interaction\nbetween EU law and national law than one might assume at first\nsight. The EDPS takes the view that the legislator should better\nacknowledge this.
\n(2) A second issue of general importance arises from\nthe numerous provisions which empower the Commission to adopt\ndelegated or implementing acts. The EDPS welcomes this approach in\nso far as it contributes to the consistent application of the\nRegulation, but has reservations about the extent to which\nessential legal provisions are left to delegated powers. Several of\nthese empowerments should be reconsidered.
\n(3) On a detailed level, the EDPS points to the main\npositive elements of the proposed Regulation, which are:
\n\n· \nthe clarification of the scope of application of\nthe proposed Regulation;
\n\n· \nthe enhanced transparency requirements towards\nthe data subject and the reinforcement of the right to\nobject;
\n\n· \nthe general obligation for controllers to ensure\nand be able to demonstrate compliance with the provisions of the\nRegulation;
\n\n· \nthe reinforcement of the position and role of\nnational supervisory authorities;
\n\n· \nthe main lines of the consistency\nmechanism.
\nThe main negative elements of the proposed Regulation\nare:
\n\n· \nthe new ground for exceptions to the purpose\nlimitation principle;
\n\n· \nthe possibilities for restricting basic\nprinciples and rights;
\n\n· \nthe obligation for controllers to maintain\ndocumentation of all processing operations;
\n\n· \nthe transfer of data to third countries by way\nof derogation;
\n\n· \nthe role of the Commission in the consistency\nmechanism;
\n\n· \nthe mandatory nature of imposing administrative\nsanctions.
\nGeneral comments on the proposed\nDirective: as regards the Directive,\nthe EDPS takes the view that the proposal, in many aspects, does\nnot meet the requirement of a consistent and high level of data\nprotection. It leaves all existing instruments in the area\nunaffected, and in many instances there is no justification\nwhatsoever for departing from the provisions of the rules in the\nproposed Regulation.
\nThe EDPS underlines that whilst the law enforcement\narea requires some specific rules, every departure from the general\ndata protection rules should be duly justified based on a proper\nbalance between the public interest in law enforcement and\ncitizens’ fundamental rights.
\nThe EDPS is particularly concerned\nregarding:
\n\n· \nthe lack of clarity in the drafting of the\nprinciple of purpose limitation;
\n\n· \nthe absence of any obligation on competent\nauthorities to be able to demonstrate compliance with the\nDirective;
\n\n· \nthe weak conditions for transfers to third\ncountries;
\n\n· \nthe unduly limited powers of supervisory\nauthorities.
\nThe following recommendations on the whole reform\nprocess are made:
\n\n· \nannounce publicly the time schedule on the\nsecond stage of the reform process as soon as possible;
\n\n· \nincorporate the rules for EU institutions and\nbodies in the proposed Regulation or at least have aligned rules in\nforce when the proposed Regulation applies;
\n\n· \npresent as soon as possible a proposal for\ncommon rules for the Common Foreign and Security Policy, based on\nArticle 39 TEU.
\nThe EDPS makes a series of detailed\nrecommendations regarding amendments to provisions in both the\ndraft regulation and the draft directive.
\nThe Council took note of the state-of-play on\nthe proposal for a Regulation on the protection of individuals with\nregard to the processing of personal data and on the free movement\nof such data (General Data Protection Regulation).
\nThe choice of legal instrument was raised\nduring the debate. Some delegations expressed their preference for\na directive instead of a regulation since it allowed for more\nflexibility where this was needed. However, some other delegations\npreferred the choice of a regulation, as proposed by the\nCommission.
\nMinisters have already discussed this proposal at the\ninformal ministerial meeting in July on the basis of three\nquestions: the administrative burden, the need for special\ntreatment for the public sector and the number of delegated\nacts.
\nThe proposal is the subject of in-depth discussions by\nexperts in the Working Party on Data Protection, which began under\nthe Danish Presidency and will continue under the Irish\nPresidency.
\nThe Council took note of the state-of-play on\nthe proposal for a Regulation on the protection of individuals with\nregard to the processing of personal data and on the free movement\nof such data (General Data Protection Regulation).
\nThe choice of legal instrument was raised\nduring the debate. Some delegations expressed their preference for\na directive instead of a regulation since it allowed for more\nflexibility where this was needed. However, some other delegations\npreferred the choice of a regulation, as proposed by the\nCommission.
\nMinisters have already discussed this proposal at the\ninformal ministerial meeting in July on the basis of three\nquestions: the administrative burden, the need for special\ntreatment for the public sector and the number of delegated\nacts.
\nThe proposal is the subject of in-depth discussions by\nexperts in the Working Party on Data Protection, which began under\nthe Danish Presidency and will continue under the Irish\nPresidency.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\nGeneral\nobligations: the\nproposal takes account of the debate on a\n\"principle of accountability\" and describes in detail the\nobligation of responsibility of the controller to comply with this\nRegulation and to demonstrate this compliance, including by way of\nadoption of internal policies and mechanisms for ensuring such\ncompliance. It sets out the obligations of the controller arising\nfrom the principles of data protection by design and by default. It\nintroduces for controllers and processors: (i) the obligation for\ncontrollers and processors to maintain documentation of the\nprocessing operations under their responsibility, instead of a\ngeneral notification to the supervisory authority; (ii) the\nobligation to implement appropriate measures for the security of\nprocessing; (iii) an obligation to notify personal data breaches;\n(iv) the obligation of controllers and processors to carry out a\ndata protection impact assessment prior to risky processing\noperations.
\nData protection officer:\nthe proposal introduces a mandatory data protection officer\nfor the public sector, and, in the private sector, for large\nenterprises or where the core activities of the controller or\nprocessor consist of processing operations which require regular\nand systematic monitoring.
\nTransfer of personal\ndata to third countries or\ninternational organisations: the\nproposal spells out, as a general principle, that the compliance\nwith the obligations in that chapter are mandatory for any\ntransfers of personal data to third countries or international\norganisations, including onward transfers. It sets out the\ncriteria, conditions and procedures for the adoption of an adequacy\ndecision by the Commission. The criteria which shall be taken into\naccount for the Commission’s assessment of an adequate or\nnot adequate level of protection include expressly the rule of\nlaw, judicial redress and independent supervision. The proposal\nrequires for transfers to third countries, where no adequacy\ndecision has been adopted by the Commission, to adduce appropriate\nsafeguards, in particular standard data protection clauses, binding\ncorporate rules and contractual clauses.
\nIndependent supervisory authorities: the proposal obliges Member States to establish\nsupervisory authorities and to enlarge the mission of the\nsupervisory authorities to co-operation with each other and with\nthe Commission. It clarifies the conditions for the independence of\nsupervisory authorities, implementing case law by the Court of\nJustice of the European Union.
\nCo-operation and consistency: the proposal introduces explicit rules on mandatory\nmutual assistance, including consequences for non-compliance with\nthe request of another supervisory authority. It introduces a\nconsistency mechanism for ensuring unity of application in relation\nto processing operations which may concern data subjects in several\nMember States.
\nThe proposal also establishes the European Data\nProtection Board, consisting of the heads of the supervisory\nauthority of each Member State and of the European Data Protection\nSupervisor.
\nThe European Data Protection Board replaces the\nWorking Party on the Protection of Individuals with regard to the\nProcessing of Personal Data set up under Article 29 of Directive\n95/46/EC.
\nRemedies, liability and sanctions: the proposal provides: (i) for the right of any data\nsubject to lodge a complaint with a supervisory authority,\n(ii) that the bodies, organisations or associations which may lodge\na complaint on behalf of the data subject and also in case of a\npersonal data breach independently of a data subject's\ncomplaint; (iii) for the right to a judicial remedy against a\nsupervisory authority; (iv) the data subject may launch a court\naction for obliging the supervisory authority to act on a\ncomplaint; (v) the right to a judicial remedy against a controller\nor processor; (vi) for the introduction of common rules for court\nproceedings, including the rights of bodies, organisations or\nassociations to represent data subjects before the courts, and the\nright of supervisory authorities to engage in legal proceedings;\n(vii) for the Member States to provide for the right to\ncompensation and lay down rules on penalties, to\nsanction infringements of the Directive, and to ensure their\nimplementation.
\nBUDGETARY IMPLICATIONS: the specific budgetary\nimplications of the proposal relate to the tasks allocated to the\nEuropean Data Protection Supervisor as specified in the legislative\nfinancial statements accompanying this proposal. These implications\nrequire reprogramming of Heading 5 of the Financial Perspective.\nThe total appropriations are estimated at EUR 24.339 million for\n2014-2020. The proposal has no implications on operational\nexpenditure.
\nDELEGATED ACTS: this proposal contains provisions\nempowering the Commission to adopt delegated acts in accordance\nwith Article 290 of the Treaty on the Functioning of the European\nUnion.
\nPURPOSE: to protect individuals with regard to\nthe processing of personal data and on the free movement of such\ndata.
\nPROPOSED ACT: Regulation of the European\nParliament and of the Council.
\nBACKGROUND: the\ncentrepiece of existing EU legislation on personal data protection,\nDirective 95/46/EC, was adopted in 1995 with two objectives in\nmind: to protect the fundamental right to data protection and to\nguarantee the free flow of personal data between Member States. It\nwas complemented by Framework Decision 2008/977/JHA as a general\ninstrument at Union level for the protection of personal data in\nthe areas of police co-operation and judicial co-operation in\ncriminal matters.
\nThe current legal framework remains sound as far as\nits objectives and principles are concerned, but it has not\nprevented fragmentation in the way personal data protection is\nimplemented across the Union, legal uncertainty and a widespread\npublic perception that there are significant risks associated\nnotably with online activity.
\nThis is why it is time to build a stronger and more\ncoherent data protection framework in the EU, backed by strong\nenforcement that will allow the digital economy to develop across\nthe internal market.
\nPersonal data protection therefore plays a central\nrole in the Digital Agenda for Europe,\nand more generally in the Europe 2020 Strategy.
\nThis proposal further details the approach for\nthe new legal framework for the protection of personal data\nin the EU as presented in its Communication on this issue.
\nThe legal framework consists of two legislative\nproposals:
\nIMPACT ASSESSMENT: the impact assessment was based on the three policy\nobjectives of improving the internal market dimension of data\nprotection, making the exercise of data protection rights by\nindividuals more effective and creating a comprehensive and\ncoherent framework covering all areas of Union competence,\nincluding police co-operation and judicial co-operation in criminal\nmatters.
\nThree policy options of different degrees of\nintervention were assessed:
\nThe analysis of the overall impact led to the\ndevelopment of the preferred policy option which is based on the second option with some elements\nfrom the other two options and incorporated in the present\nproposal. According to the impact assessment, its implementation\nwill lead inter alia to considerable improvements regarding\nlegal certainty for data controllers and citizens, reduction of\nadministrative burden, consistency of data protection enforcement\nin the Union, the effective possibility of individuals to exercise\ntheir data protection rights to the protection of personal data\nwithin the EU and the efficiency of data protection supervision and\nenforcement.
\nLEGAL BASIS: Article 16(2) and Article 114(1)\nof the Treaty on the Functioning of the European Union\n(TFEU).
\nCONTENT: the proposed Regulation lays down rules\nrelating to the protection of individuals with regard to the\nprocessing of personal data and rules relating to the free movement\nof personal data. It protects the fundamental rights and freedoms\nof natural persons, and in particular their right to the protection\nof personal data. It main provisions are as follows:
\nPrinciples: the proposal\nsets out the principles relating to personal data processing.\nAdditional new elements are in particular the transparency\nprinciple, the clarification of the data minimisation\nprinciple and the establishment of a comprehensive responsibility\nand liability of the controller. It also sets out the criteria for\nlawful processing, which are further specified as regards the\nbalance of interest criterion, and the compliance with legal\nobligations and public interest. It clarifies the conditions for\nconsent to be valid as a legal ground for lawful processing and\nsets out further conditions for the lawfulness of the processing of\npersonal data of children in relation to information society\nservices offered directly to them.
\nRights of the data\nsubject: the\nproposal introduces the obligation on controllers to provide\ntransparent and easily accessible and understandable information.\nIt obliges the controller to provide procedures and mechanism for\nexercising the data subject's rights, including means for\nelectronic requests, requiring response to the data subject's\nrequest within a defined deadline, and the motivation of\nrefusals.
\nIn addition, the proposal:
\n