Amendment 650· Data Act Article 15a(3a) (new)
+Addition
Text of the amendment
As tabled
Wording it would add
3a.'A public sector body, the Commission, the European Central Bank or a Union body that has received data on the basis of a public emergency shall:
(a)implement technical and organisational measures that preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular of personal data, and safeguard the rights and freedoms of data subjects;
(b)erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder, as well as any natural or legal persons that received the data with a view to carrying out the task for which the request was made, without undue delay, that the data have been erased, unless archiving is required under Union or national law on public access to documents in the context of transparency obligations.'
Data Act Article 15a with this amendment
Amendment 650 applied to the Commission proposal, no other amendment
Unchanged: (1), (2) and (3)
Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;
'A public sector body, the Commission, the European Central Bank or a Union body that has received data on the basis of a public emergency shall:
+Newimplement technical and organisational measures that preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular of personal data, and safeguard the rights and freedoms of data subjects;
+Newerase the data as soon as they are no longer necessary for the stated purpose and inform the data holder, as well as any natural or legal persons that received the data with a view to carrying out the task for which the request was made, without undue delay, that the data have been erased, unless archiving is required under Union or national law on public access to documents in the context of transparency obligations.'
+NewJustification
For reasons of legal clarity and accessibility, the safeguards attached to the use of data obtained in the context of a public emergency should be set out expressly in the operative provision rather than by cross-reference alone. Recalling in full the obligations to implement technical and organisational measures and to erase the data once they are no longer necessary ensures that these safeguards remain readable and enforceable, in line with the principles of purpose limitation and storage limitation under Regulation (EU) 2016/679. In addition, the exclusion of special categories of personal data and of data relating to criminal convictions from the scope of emergency data requests, save where their processing is strictly necessary and authorised by law, reinforces the protection of data subjects’ fundamental rights.
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
No Council text amends Article 15a(3a) (new).
Cite this amendment
Amendment 650 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 527–776 to the draft report on COM(2025) 837 (CJ72-AM-791071, PE791.071v01-00, 27 July 2026), pp. 99–100
Link, short form and official text
Amendment 650 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 527–776 to the draft report on COM(2025) 837 (CJ72-AM-791071, PE791.071v01-00, 27 July 2026), pp. 99–100
ITRE–LIBE Amendment 650 (CJ72-AM-791071), p. 99