Digital Omnibus proposal· Recital 39

14 propose alternative wording.

1. 7 ~Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as its updates”

   (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of theRegulation Regulation(EU) 2016/679, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the European Data Protection Board should prepareestablish and make public a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as its updates where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.

   Rapporteurs

   Aura Salla and Marina Kaljurand

   Group

   Rapporteurs

   Targets

   Digital Omnibus proposal Recital 39

   Document

   ITRE–LIBE draft report

   Source

   Official text, pages 12–13

   Printed header

   Recital 39

   Links

   Link to this amendment
   Cite this amendment

2. 130 ~Alternative Victor NegrescuS&D · JURI “This simplification of reporting obligations should not weaken cybersecurity standards or the overall level of protection of data subjects, and…”

   (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. This simplification of reporting obligations should not weaken cybersecurity standards or the overall level of protection of data subjects, and should be accompanied by clear guidance and, where appropriate, standard templates that facilitate timely, high-quality reporting by controllers of all sizes, including SMEs.

   Tabled by

   Victor Negrescu

   Group

   S&D

   Targets

   Digital Omnibus proposal Recital 39

   Document

   JURI amendments 69–296 to the draft opinion

   Source

   Official text, pages 60–61

   Printed header

   Recital 39

   Links

   Link to this amendment
   Cite this amendment

3. 131 ~Alternative Emil RadevEPP · JURI “where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board as well as its updates”

   (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepareestablish and make public a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board as well as its updates where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.

   Tabled by

   Emil Radev

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 39

   Document

   JURI amendments 69–296 to the draft opinion

   Source

   Official text, pages 61–63

   Printed header

   Recital 39

   Links

   Link to this amendment
   Cite this amendment

4. 174 ~Alternative David CormandGreens/EFA · IMCO “Adapting the threshold for notifications should not have an affect on the controller’s obligations under Regulation (EU) 2016/679 to carry out an…”

   (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. Adapting the threshold for notifications should not have an affect on the controller’s obligations under Regulation (EU) 2016/679 to carry out an individual risk assessment and to maintain complete documentation of personal data breaches in accordance with Article 33(5) and Article 30 of that Regulation. The common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedom of a natural person remains valid in order to determine when communicating the data breaches to the data subject, in accordance with Article 34.

   Tabled by

   David Cormand on behalf of the Verts/ALE Group

   Group

   Greens/EFA

   Targets

   Digital Omnibus proposal Recital 39

   Document

   IMCO amendments 125–328 to the draft opinion

   Source

   Official text, pages 49–50

   Printed header

   Recital 39

   Links

   Link to this amendment
   Cite this amendment

5. 175 ~Alternative Sophia KircherEPP · IMCO “where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board as well as its updates”

   (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board shouldestablish prepareand make public a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board as well as its updates, where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.

   Tabled by

   Sophia Kircher

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 39

   Document

   IMCO amendments 125–328 to the draft opinion

   Source

   Official text, pages 50–51

   Printed header

   Recital 39

   Links

   Link to this amendment
   Cite this amendment

6. 378 ~Alternative Diana Iovanovici ŞoşoacăNI · ITRE–LIBE “Controllers should continue to carry out, on a case-by-case basis, an assessment of the risks posed by each personal data breach, taking into account…”

   (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. Controllers should continue to carry out, on a case-by-case basis, an assessment of the risks posed by each personal data breach, taking into account the nature, scope, context and purposes of the processing, as well as the likelihood and severity of the impact on the data subjects’ rights and freedoms. If this assessment indicates a high risk to individuals’ rights and freedoms, controllers should inform data subjects and, where appropriate, the competent supervisory authority, as provided in Regulation (EU) 2016/679, without undue delay.

   Tabled by

   Diana Iovanovici Şoşoacă

   Group

   NI

   Targets

   Digital Omnibus proposal Recital 39

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 141–143

   Printed header

   Recital 39

   Links

   Link to this amendment
   Cite this amendment

7. 379 ~Alternative Alex Agius SalibaS&D · ITRE–LIBE “The alignment of notification thresholds should not affect the controller’s obligation to carry out an individual risk assessment and to maintain…”

   (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare and publish a common template for notifying data breaches to the competent supervisory authority and a common listlists of circumstances in which a personal data breach is likely and not likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take dueutmost account of the proposalproposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the listlists should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely or not to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. The alignment of notification thresholds should not affect the controller’s obligation to carry out an individual risk assessment and to maintain complete documentation of personal data breaches in accordance with Articles 30 and 33(5) of Regulation (EU) 2016/679. The common lists of circumstances in which a personal data breach is likely to result or not in a risk to the rights and freedom of a natural person should also apply in order to determine when communicating the data breaches to the data subject, in accordance with Article 34 of Regulation (EU) 2016/679.

   Tabled by

   Alex Agius Saliba

   Group

   S&D

   Targets

   Digital Omnibus proposal Recital 39

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 143–144

   Printed header

   Recital 39

   Links

   Link to this amendment
   Cite this amendment

8. 380 ~Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “The raising of the notification threshold does not affect the obligation of the controller to document any personal data breach, including breaches…”

   (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. The raising of the notification threshold does not affect the obligation of the controller to document any personal data breach, including breaches which are not notified to the supervisory authority. That documentation shall comprise the facts relating to the breach, its effects and the remedial action taken, and shall enable the supervisory authority to verify compliance. The absence of a notification obligation is not an absence of an accountability obligation.

   Justification

   Aligning the notification threshold with that of communication to the data subject is acceptable only if the documentation obligation is expressly preserved. Otherwise, non-notified breaches would become invisible to the authority even in the course of an inspection.

   Tabled by

   Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay

   Group

   ECR, PfE

   Targets

   Digital Omnibus proposal Recital 39

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 145–146

   Printed header

   Recital 39

   Links

   Link to this amendment
   Cite this amendment

9. 381 ~Alternative Marina Kaljurand +8S&D · ITRE–LIBE “The common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person…”

   (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption.In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should establish and make public a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person, a common list of circumstances in which a personal data breach does not result in such a high risk, as well as a common list of circumstances in which a personal data breach does not result in a risk to the rights and freedoms of a natural person. In order to take account of new information security threats, the common template and the listlists should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as its updates where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. The common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should apply in order to determine when communicating the data breaches to the data subject, in accordance with Article 34.

   Tabled by

   Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec

   Group

   S&D

   Targets

   Digital Omnibus proposal Recital 39

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 146–147

   Printed header

   Recital 39

   Links

   Link to this amendment
   Cite this amendment

10. 382 ~Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “If processing operations do not appear in any of the lists, the controller is still required to assess whether the personal data breach is likely to…”

    (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption.The Commission is empowered to decide that the lists and the template as established by the Board have general validity within the Union by way of an implementing act. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. If processing operations do not appear in any of the lists, the controller is still required to assess whether the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

    Tabled by

    Markéta Gregorová on behalf of the Verts/ALE Group

    Group

    Greens/EFA

    Targets

    Digital Omnibus proposal Recital 39

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 147–149

    Printed header

    Recital 39

    Links

    Link to this amendment
    Cite this amendment

11. 383 ~Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “is likely to result in an increased risk to the rights and freedoms of natural persons. Since all processing of personal data is connected with some…”

    (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation.In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be increased to situations in which a personal data breach is likely to result in an increased risk to the rights and freedoms of natural persons. Since all processing of personal data is connected with some inherent risk, an increased threshold is necessary in order to avoid that every single personal data breach leads to a notification obligation. In order to assess the impact of the data breach to the rights and freedoms of data subjects, the controller shall compare the level of risk prior to the data breach with the respective risk after the data breach. The risk should be considered increased if an existing risk is more likely to materialise or if a new risk emerged by the personal data breach. In the case of a data breach that is not likely to result in aan highincreased risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.The threshold for a notification of the supervisory authority about a personal data breach should be lower than the threshold for the obligation to communicate the personal data breach to the affected data subject. Therefore, not all personal data breaches notified to the supervisory authority also result in an obligation to communicate the personal data breach to the affected data subject.

    Tabled by

    Pernando Barrena Arza

    Group

    The Left

    Targets

    Digital Omnibus proposal Recital 39

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 149–150

    Printed header

    Recital 39

    Links

    Link to this amendment
    Cite this amendment

12. 384 ~Alternative Francesco TorselliECR · ITRE–LIBE “Council Regulation (EEC, Euratom) No 1182/71 applies to the calculation of periods and time limits under Article 32 and 33 of Regulation (EU)…”

    (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. Council Regulation (EEC, Euratom) No 1182/71 applies to the calculation of periods and time limits under Article 32 and 33 of Regulation (EU) 2016/679.

    Tabled by

    Francesco Torselli

    Group

    ECR

    Targets

    Digital Omnibus proposal Recital 39

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 150–151

    Printed header

    Recital 39

    Links

    Link to this amendment
    Cite this amendment

13. 385 ~Alternative Irena Joveva +5Renew · ITRE–LIBE “establish and make public”

    (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepareestablish and make public a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.

    Tabled by

    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller

    Group

    Renew

    Targets

    Digital Omnibus proposal Recital 39

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 151–152

    Printed header

    Recital 39

    Links

    Link to this amendment
    Cite this amendment

14. 386 ~Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “after consulting the European Parliament and Member States”

    (39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communicationother ofUnion alegislation personalgoverning datacybersecurity breach to the data subject under Article 34 of that Regulationincidents. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying datacybersecurity breachesincidents to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption after consulting the European Parliament and Member States. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessarytechnological developments so require. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.

    Tabled by

    Sebastian Tynkkynen, Diego Solier

    Group

    ECR

    Targets

    Digital Omnibus proposal Recital 39

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 153–154

    Printed header

    Recital 39

    Links

    Link to this amendment
    Cite this amendment