Digital Omnibus proposal· Recital 36

6 amendments would delete the whole recital: members of The Left, S&D, Renew and non-attached members.

1. 125 −Deletion Arash SaeidiThe Left · JURI Deletes the recital

   [...]

   Tabled by

   Arash Saeidi

   Group

   The Left

   Targets

   Digital Omnibus proposal Recital 36

   Document

   JURI amendments 69–296 to the draft opinion

   Source

   Official text, page 56

   Printed header

   Recital 36

   Links

   Link to this amendment
   Cite this amendment

2. 335 −Deletion Irena Joveva +5Renew · ITRE–LIBE Deletes the recital

   [...]

   Tabled by

   Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller

   Group

   Renew

   Targets

   Digital Omnibus proposal Recital 36

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, page 95

   Printed header

   Recital 36

   Links

   Link to this amendment
   Cite this amendment

3. 336 −Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the recital

   [...]

   Tabled by

   Pernando Barrena Arza

   Group

   The Left

   Targets

   Digital Omnibus proposal Recital 36

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, page 95

   Printed header

   Recital 36

   Links

   Link to this amendment
   Cite this amendment

4. 337 −Deletion Birgit SippelS&D · ITRE–LIBE Deletes the recital

   [...]

   Tabled by

   Birgit Sippel

   Group

   S&D

   Targets

   Digital Omnibus proposal Recital 36

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, page 95

   Printed header

   Recital 36

   Links

   Link to this amendment
   Cite this amendment

5. 338 −Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the recital

   [...]

   Tabled by

   Sibylle Berg, Martin Sonneborn

   Group

   NI

   Targets

   Digital Omnibus proposal Recital 36

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, page 96

   Printed header

   Recital 36

   Links

   Link to this amendment
   Cite this amendment

6. 339 −Deletion João OliveiraThe Left · ITRE–LIBE Deletes the recital

   [...]

   Tabled by

   João Oliveira

   Group

   The Left

   Targets

   Digital Omnibus proposal Recital 36

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, page 96

   Printed header

   Recital 36

   Links

   Link to this amendment
   Cite this amendment

7. 340 ~Alternative Marina Kaljurand +8S&D · ITRE–LIBE “Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of their…”

   (36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or hertheir personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

   Tabled by

   Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec

   Group

   S&D

   Targets

   Digital Omnibus proposal Recital 36

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 96–98

   Printed header

   Recital 36

   Links

   Link to this amendment
   Cite this amendment

8. 341 ~Alternative Alex Agius SalibaS&D · ITRE–LIBE “Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or…”

   (36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

   Tabled by

   Alex Agius Saliba

   Group

   S&D

   Targets

   Digital Omnibus proposal Recital 36

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 98–100

   Printed header

   Recital 36

   Links

   Link to this amendment
   Cite this amendment

9. 342 ~Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “and the average data subject comprehends the processing, the data needs to be collected directly from the data subject, the processing needs to be…”

   (36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller.To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the personal data have been collected by a micro, small, and medium-sized enterprise or an organisation employing fewer than 250 employees, the personal data are necessary based on point (b) of paragraph 1 of Article 6 in the context of a clear and circumscribed relationship between the data subject and a controller which the data subject fully comprehends and which is not data-intensive, the controller is not required to appoint a data protection officer pursuant to Article 37(1), the personal data are not special categories of data pursuant to Article 9 or personal data related to criminal convictions and offences pursuant to Article 10, there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 and the information remains available to the data subject, the controller does not transmit the data to other controllers or to a third country, the controller does not carry out automated decision-making, including profiling, referred to in Article 22(1) and the processing is not likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35. These should be the situations where theThe context of the relationship between the controller and the data subject is very clear and circumscribed andin the controller’s activity is not data-intensive,situations such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The processing could for instance be limited to activities related to bookings, orders or appointments as long as the controller fulfills all the requirements. The personal data needs, however, to be collected by the controller directly from the data subject. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment or profiling. Complex processing operations are outside the scope of this exemption notably as the average data subject would not be in the capacity to comprehend them. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679.In order to assume that the data subject has the information referred to in points (a) and (c) of paragraph 1 of Article 13 Regulation (EU) 2016/679 and the average data subject comprehends the processing, the data needs to be collected directly from the data subject, the processing needs to be non data-intensive, non-complex and the controller needs to collect a low amount of personal data. The information needs, however, to remain available to the data subject through other means, in order to enable the data subject to exercise its rights or check the lawfulness of the processing. That information can either be made available to the public, such as on the website of the controller or it could, for instance in the case of controllers not having a website, be available upon request. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. If the controller aims for more transparency, the controller may alternatively provide the information solely through the icons referred to in Article 12(7) of Regulation (EU) 2016/679, as long as the complete information remains easily and readily available to the data subject through other means. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

   Tabled by

   Markéta Gregorová on behalf of the Verts/ALE Group

   Group

   Greens/EFA

   Targets

   Digital Omnibus proposal Recital 36

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 100–102

   Printed header

   Recital 36

   Links

   Link to this amendment
   Cite this amendment

10. 343 ~Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “The same applies to associations, sport clubs, and micro, small and medium-sized enterprises where the processing of personal data is confined to the…”

    (36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. The same applies to associations, sport clubs, and micro, small and medium-sized enterprises where the processing of personal data is confined to the management of membership, communication with members, the organisation of activities, or the performance of a contract with the data subject. The derogation does not apply where the controller engages in the collection of personal data from third parties, in their purchase, aggregation, enrichment, sale or making available to third parties for commercial purposes, such activities being by nature data-intensive. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

    Tabled by

    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay

    Group

    ECR, PfE

    Targets

    Digital Omnibus proposal Recital 36

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 102–105

    Printed header

    Recital 36

    Links

    Link to this amendment
    Cite this amendment

11. 344 ~Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “as well as other entities with similarly limited and transparent processing activities, such as small cultural or educational associations and…”

    (36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, in particular SMEs and micro-enterprises without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information or the data controller has taken reasonable steps available to it, taking into account relevant technical and organisational means to provide the data subject with the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between aSMEs, craftsmanmicro-enterprises and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for legitimate interests, the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to freelancers or sole traders providing services to their customers, local craftsmen, retailers or hospitality businesses, and associations and sport clubs, as well as other entities with similarly limited and transparent processing activities, such as small cultural or educational associations and non-profit organisations serving a clearly defined group of members or beneficiaries where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

    Tabled by

    Sebastian Tynkkynen, Diego Solier

    Group

    ECR

    Targets

    Digital Omnibus proposal Recital 36

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 105–107

    Printed header

    Recital 36

    Links

    Link to this amendment
    Cite this amendment

12. 345 ~Alternative Diana Iovanovici ŞoşoacăNI · ITRE–LIBE “At the end of the contract, personal data should be deleted securely from the controller’s system in order to prevent use that is improper and not…”

    (36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should not be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679.At the end of the contract, personal data should be deleted securely from the controller’s system in order to prevent use that is improper and not consented to by the data subject. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

    Tabled by

    Diana Iovanovici Şoşoacă

    Group

    NI

    Targets

    Digital Omnibus proposal Recital 36

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 107–109

    Printed header

    Recital 36

    Links

    Link to this amendment
    Cite this amendment

13. 346 ~Alternative Elena Sancho Murillo +6S&D · ITRE–LIBE “Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or…”

    (36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofaras far as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

    Tabled by

    Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba

    Group

    S&D

    Targets

    Digital Omnibus proposal Recital 36

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 109–110

    Printed header

    Recital 36

    Links

    Link to this amendment
    Cite this amendment