Recital 39a (new)

1 would add wording.

1. 387 +Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “The collection of personal data from third parties, and their purchase, aggregation, enrichment, sale or making available to third parties for…” numbered 39a

   (39a)The collection of personal data from third parties, and their purchase, aggregation, enrichment, sale or making available to third parties for commercial purposes, have given rise to opaque chains in which the origin of the data, the legal basis for their initial collection and the validity of any consent obtained can no longer be established. Successive transfers dilute accountability to the point where no operator in the chain is in a position to demonstrate the lawfulness of the processing. The principle of accountability laid down in Article 5(2) of Regulation (EU) 2016/679 requires that a controller engaging in such activities verify and document the lawful origin of the data, and refrain from processing them where that lawfulness cannot be demonstrated. A general declaration of compliance or a standard contractual term supplied by the data provider cannot suffice. That verification, which forms part of the measures referred to in Article 24 of that Regulation, should be strengthened where the data originate from an undisclosed or indeterminate source, where they concern a large number of data subjects, or where they have been obtained through successive transfers. This is without prejudice to the processing of personal data which is strictly necessary for the prevention and detection of fraud, where the data are processed exclusively for that purpose.

   Justification

   Data brokerage is the blind spot of the Regulation: personal data circulate through chains in which no operator can any longer demonstrate lawful origin. This recital does not create a new obligation — it specifies what the existing accountability principle requires of those who trade in data, and underpins the record-keeping and penalty provisions introduced in the operative part.

   Tabled by

   Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay

   Group

   ECR, PfE

   Targets

   Digital Omnibus proposal Recital 39a (new)

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 154–155

   Printed header

   Recital 39 a (new)

   Links

   Link to this amendment
   Cite this amendment