Regulation (EU) 2016/679 — Article 42

Article total: 1 part · 0 Council drafts · 1 Parliament amendment

Tracked part

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

The wording proposed by the Commission at the start of this legislative file.

No standalone Commission wording is mapped to these tracked parts. A newly proposed provision may have no earlier text of its own.

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

No Council wording is mapped to these tracked parts.

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

Search amendments

Alternative wording Amendment 1303 ITRE · LIBE

10a. In Article 42, paragraph 3 and 7 are amended as follows:

3. The certification shall be voluntary and available via a process that is transparent for small and medium controllers and large processors. Large controllers must be certified within one year after meeting the conditions in Article 4(28). 7. Certification shall be issued to a controller or processor for a maximum period of three years for small and medium controller and large processors. Certifications shall be issued for a maximum period of one year for large controllers. It may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met."

Justification

RISK-BASED APPROACH #11: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.

Preview
against:

Article 42

Certification

1.

The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. The specific needs of micro, small and medium-sized enterprises shall be taken into account.
2.

In addition to adherence by controllers or processors subject to this Regulation, data protection certification mechanisms, seals or marks approved pursuant to paragraph 5 of this Article may be established for the purpose of demonstrating the existence of appropriate safeguards provided by controllers or processors that are not subject to this Regulation pursuant to Article 3 within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (f) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards, including with regard to the rights of data subjects.
3.

The certification shall be voluntary and available via a process that is transparent for small and medium controllers and large processors. Large controllers must be certified within one year after meeting the conditions in Article 4(28).
4.

A certification pursuant to this Article does not reduce the responsibility of the controller or the processor for compliance with this Regulation and is without prejudice to the tasks and powers of the supervisory authorities which are competent pursuant to Article 55 or 56.
5.

A certification pursuant to this Article shall be issued by the certification bodies referred to in Article 43 or by the competent supervisory authority, on the basis of criteria approved by that competent supervisory authority pursuant to Article 58(3) or by the Board pursuant to Article 63. Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal.
6.

The controller or processor which submits its processing to the certification mechanism shall provide the certification body referred to in Article 43, or where applicable, the competent supervisory authority, with all information and access to its processing activities which are necessary to conduct the certification procedure.
7.

Certification shall be issued to a controller or processor for a maximum period of three years for small and medium controller and large processors. Certifications shall be issued for a maximum period of one year for large controllers. It may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met.
8.

The Board shall collate all certification mechanisms and data protection seals and marks in a register and shall make them publicly available by any appropriate means.

Selected texts

Compare wording

Choose a tracked part and a named pair of texts. Comparisons are offered only where both sides cover the same legal unit.

Select a specific tracked part above to compare wording.

Article 42 – paragraphs 3 and 7

Wording reproduced in the amendment → Amendment 1303 · ITRE–LIBE amendments 1261–1564 to the draft report

Changes in context

10a. In Article 42, paragraph 3 and 7 are amended as follows: 3. The certification shall be voluntary and available via a process that is transparent for small and medium controllers and large processors. Large controllers must be certified within one year after meeting the conditions in Article 4(28). 7. Certification shall be issued to a controller or processor for a maximum period of three years for small and medium controller and large processors. Certifications shall be issued for a maximum period of one year for large controllers. It may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met."

RemovedAdded

Both texts in full

Wording reproduced in the amendment

3. The certification shall be voluntary and available via a process that is transparent. 7. Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met.

Amendment 1303 · ITRE–LIBE amendments 1261–1564 to the draft report

Open official source ↗