Digital Omnibus proposal· Recital 40

7 propose alternative wording.

1. 8 ~Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as updates to the common…”

   (40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, thethat Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act.The lists of processing operations should be established and made public by the European Data Protection Board. When establishing the lists, due account should be taken of the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons. In order to facilitate compliance by controllers, the Board should also prepareestablish and make public a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as updates to the common template, where necessary.

   Rapporteurs

   Aura Salla and Marina Kaljurand

   Group

   Rapporteurs

   Targets

   Digital Omnibus proposal Recital 40

   Document

   ITRE–LIBE draft report

   Source

   Official text, pages 13–14

   Printed header

   Recital 40

   Links

   Link to this amendment
   Cite this amendment

2. 132 ~Alternative Emil RadevEPP · JURI “Article 35 of Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is…”

   (40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.

   Tabled by

   Emil Radev

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 40

   Document

   JURI amendments 69–296 to the draft opinion

   Source

   Official text, pages 63–64

   Printed header

   Recital 40

   Links

   Link to this amendment
   Cite this amendment

3. 388 ~Alternative Diana Iovanovici ŞoşoacăNI · ITRE–LIBE “In addition, the Commission must regularly monitor the implementation of these provisions, draw up monitoring reports to be sent to Parliament and…”

   (40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act, as well as possible sanctions for data breaches. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary. In addition, the Commission must regularly monitor the implementation of these provisions, draw up monitoring reports to be sent to Parliament and the Council, and inform them of any necessary revisions.

   Tabled by

   Diana Iovanovici Şoşoacă

   Group

   NI

   Targets

   Digital Omnibus proposal Recital 40

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 155–156

   Printed header

   Recital 40

   Links

   Link to this amendment
   Cite this amendment

4. 389 ~Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “For processing operations that are on none of the lists, the controller is required to assess the need for a data protection impact assessment.”

   (40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act.For processing operations that are on none of the lists, the controller is required to assess the need for a data protection impact assessment. The lists of processing operations should be established by the Board, and the Commission is empowered to decide that the lists as established by the Board have general validity within the Union by way of an implementing act. In order to facilitate compliance by controllers, the Board should also establish prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted byand the Commission asis anempowered implementingto act.decide The Commission should take due account ofthat the proposalscommon preparedtemplate and the common methodology as established by the Board andhave reviewgeneral them,validity aswithin necessary,the priorUnion toby adoptionway of an implementing act. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.

   Tabled by

   Markéta Gregorová on behalf of the Verts/ALE Group

   Group

   Greens/EFA

   Targets

   Digital Omnibus proposal Recital 40

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 156–158

   Printed header

   Recital 40

   Links

   Link to this amendment
   Cite this amendment

5. 390 ~Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “This has resulted in significant fragmentation across Member States, making it increasingly difficult for European businesses, particularly SMEs and…”

   (40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. This has resulted in significant fragmentation across Member States, making it increasingly difficult for European businesses, particularly SMEs and micro-enterprises to expand and grow. In order to effectively contribute to the aim of convergence of the economies and to effectively encourage innovation, promote competitiveness, ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replaceserve theas existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatoryguidance. The lists of processing operations should be prepared by the Board and adopted by the Commission asafter anconsulting implementingthe actEuropean Parliament and Member States. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commissionserve as anguidance implementingfor act.national The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoptionauthorities. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.

   Tabled by

   Sebastian Tynkkynen, Diego Solier

   Group

   ECR

   Targets

   Digital Omnibus proposal Recital 40

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 158–159

   Printed header

   Recital 40

   Links

   Link to this amendment
   Cite this amendment

6. 391 ~Alternative Irena Joveva +5Renew · ITRE–LIBE “The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as its updates where necessary.”

   (40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be preparedestablished and made public by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as its updates where necessary.

   Tabled by

   Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller

   Group

   Renew

   Targets

   Digital Omnibus proposal Recital 40

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 159–160

   Printed header

   Recital 40

   Links

   Link to this amendment
   Cite this amendment

7. 392 ~Alternative Aura Salla +6EPP · ITRE–LIBE “Article 35 of Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is…”

   (40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.

   Tabled by

   Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Andrea Wechsler, Eva Maydell, Oliver Schenk, Christian Ehler

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 40

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 160–162

   Printed header

   Recital 40

   Links

   Link to this amendment
   Cite this amendment