Recital 27c (new)

2 would add wording.

1. 230 +Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “The principles of data minimisation and data protection by design and by default are essential when processing involves significant risks to the…” numbered 27c

   (27c)The principles of data minimisation and data protection by design and by default are essential when processing involves significant risks to the fundamental rights of individuals. Taking into account the state of the art, all parties to data sharing falling within the scope of this Regulation should implement appropriate technical and organisational measures to protect those rights. Such measures include not only pseudonymisation and encryption, but also increasingly available technologies that permit algorithms to be brought to the data and valuable insights to be derived without the transmission between parties or the unnecessary copying of the raw or structured data themselves, while minimising the exposure of personal data and of strategically significant data to unnecessary transfer, copying or third-country access. Where personal data would otherwise be transmitted or re-used, preference should be given, where technically available and proportionate, to methods that bring computation to the data within a secure processing environment, including federated analysis or equivalent privacy-preserving methods, over the transmission or copying of the data themselves.

   Tabled by

   Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay

   Group

   ECR, PfE

   Targets

   Digital Omnibus proposal Recital 27c (new)

   Document

   ITRE–LIBE amendments 79–250 to the draft report

   Source

   Official text, pages 154–155

   Printed header

   Recital 27 c (new)

   Links

   Link to this amendment
   Cite this amendment

2. 231 +Addition Axel VossEPP · ITRE–LIBE “Given the limited resource of supervisory authorities, large controllers shall be certified for compliance with Regulation (EU) 2016/679 each year.…” numbered 27c

   (27c)Given the limited resource of supervisory authorities, large controllers shall be certified for compliance with Regulation (EU) 2016/679 each year. To ensure a high level of protection and to ensure that certification bodies that knowingly and repeatedly certified conduct that was clearly or foreseeably unlawful, new options for the revocation of accreditation are introduced.

   Justification

   RISK-BASED APPROACH #3: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.

   Tabled by

   Axel Voss

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 27c (new)

   Document

   ITRE–LIBE amendments 79–250 to the draft report

   Source

   Official text, pages 155–156

   Printed header

   Recital 27 c (new)

   Links

   Link to this amendment
   Cite this amendment