EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

Data Act· Article 15a

Text

Article 15a Data Act as printed in the Council text of 22 October 2026

Obligation for data holders to make data available on the basis of a public emergency

Source Council, 22 October 2026. Article 15a: ST 14756/26, page 73 · exact text page

Article 15a

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates the need to use certain data to carry out its statutory duties in the public interest when responding to, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to respond to the public emergency, personal data may also be requested and,, made available in pseudonymised form, subject to appropriate technical and organisational measures to ensure their protection.

3.

Where the data requested are necessary to support the recovery from a public emergency and the requesting body pursuant to paragraph 1 acting on the basis of Union or national law is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, it may request specific non-personal data, the lack of which prevents it from supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.

Article 15a, heading

Obligation for data holders to make data available on the basis of a public emergency

Article 15a in the whole Data Act

How the article has changed

Show the statuses
What each text would do to the law in force
Article Commission19 Nov 2025Council10 Jun 2026Council18 Jun 2026Council3 Sep 2026Council2 Oct 2026Council22 Oct 2026 Parliamentamendments
Compared withlaw in forcethe proposal10 Jun text18 Jun text3 Sep text2 Oct text
15aText of the articleheading Adds Added Adds , changed since the proposal Changed Adds Unchanged Adds , changed since 18 Jun Changed Adds , changed since 3 Sep Changed Adds Unchanged 27
Provisions only Parliament would add or change4 units Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text 9

Each text against the law in force: +Adds adds a provision the law in force lacks— neither the law in force nor the text has it changed from the text before

Each text against the text before it: +Added in this text, not in the text before~Changed wording changed=Unchanged same as the text before— in neither text

What each text does

  1. 19 Nov 2025 Commission proposalCOM(2025) 837 Adds Adds the article. Article 15a in this text
  2. 5 Jun 2026 JURI draft opinion · Brando Benifei (rapporteur)JURI-PA-789142 2 amendments to this article. Amendments in this document
  3. 8 Jun 2026 IMCO draft opinion · Alex Agius Saliba (rapporteur)IMCO-PA-789877 3 amendments to this article. Amendments in this document
  4. 10 Jun 2026 Council textST 10426/26 Changed Changes the article. Article 15a in this text
  5. 18 Jun 2026 Council textST 10677/26 Unchanged Same as the text before. Article 15a in this text
  6. 22 Jun 2026 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)CJ72-PR-786818 1 amendment to this article. Amendments in this document
  7. 29 Jun 2026 JURI amendments 69–296 to the draft opinionJURI-AM-790236 5 amendments to this article. Amendments in this document
  8. 16 Jul 2026 IMCO amendments 125–328 to the draft opinionIMCO-AM-790905 11 amendments to this article. Amendments in this document
  9. 27 Jul 2026 ITRE–LIBE amendments 527–776 to the draft reportCJ72-AM-791071 14 amendments to this article. Amendments in this document
  10. 3 Sep 2026 Council textST 12535/26 Changed Changes the article. Article 15a in this text
  11. 2 Oct 2026 Council textST 13886/26 Changed Changes the article. Article 15a in this text
  12. 22 Oct 2026 Council textST 14756/26 Unchanged Same as the text before. Article 15a in this text

Article 15a: Text of the article

Added by the Commission · changed by the Council on 10 June · changed on 3 September · changed on 2 October

Parliament amendments 27

5 would delete the heading and 22 propose alternative wording. Deletion amendments come from Renew, EPP and ESN, and from the IMCO rapporteur’s draft opinion.

By political group; co-sponsored amendments count for each group
TypeS&DRenewEPPECRPfEESNRapporteur
− Deletion·12··11
~ Alternative2444515

By political group

  • − Deletion Renew 1 EPP 2 ESN 1 Rapporteur 1
  • ~ Alternative S&D 2 Renew 4 EPP 4 ECR 4 PfE 5 ESN 1 Rapporteur 5

Show

  1. 16 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such…”

    2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to addressrespond to the public emergency, personal data may also be requested and, where possiblestrictly necessary, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    Data Act Article 15a
    Document
    ITRE–LIBE draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2
  2. 29 Alternative Brando Benifei (rapporteur)Rapporteur · JURI “Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry…”

    1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

    Justification

    This amendment clarifies and narrows the scope of emergency-related data access by removing the broad and potentially ambiguous concept of ‘mitigation’. This helps improve legal certainty and ensures that access to data remains more closely linked to concrete emergency response and recovery activities.

    Rapporteur
    Brando Benifei
    Group
    Rapporteur
    Targets
    Data Act Article 15a
    Document
    JURI draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 1
  3. 30 Alternative Brando Benifei (rapporteur)Rapporteur · JURI “Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such…”

    2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to addressrespond to the public emergency, personal data may also be requested and, where possible, made available in pseudonymizedpseudonymised form, subject to appropriate technical and organisational measures to ensure their protection.

    Justification

    This amendment clarifies that the use of data under this provision should remain linked to concrete emergency response activities. The term ‘respond to’ provides a narrower and more operationally precise standard than the broader concept of ‘addressing’ a public emergency.

    Rapporteur
    Brando Benifei
    Group
    Rapporteur
    Targets
    Data Act Article 15a
    Document
    JURI draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2
  4. 45 Alternative Alex Agius Saliba (rapporteur)Rapporteur · IMCO “Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry…”

    1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

    Justification

    In line with the EDPB - EDPS opinion paragraph 125.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    Data Act Article 15a
    Document
    IMCO draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 1
  5. 46 Alternative Alex Agius Saliba (rapporteur)Rapporteur · IMCO “Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such…”

    2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to addressrespond to the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

    Justification

    Following the EDPB-EDPS opinion para 122-124.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    Data Act Article 15a
    Document
    IMCO draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2
  6. 47 Deletion Alex Agius Saliba (rapporteur)Rapporteur · IMCO Deletes the proposed article

    3. Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.;

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    Data Act Article 15a
    Document
    IMCO draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 3
  7. 183 Deletion Laurence FarrengRenew · JURI Deletes the proposed article

    7. the following Article 15a is inserted: ‘Article 15a Obligation for data holders to make data available on the basis of a public emergency 1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency. 2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection. 3. Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.;’

    Tabled by
    Laurence Farreng
    Group
    Renew
    Targets
    Data Act Article 15a
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15 a
  8. 184 Alternative Emil RadevEPP · JURI “Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry…”

    1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

    Tabled by
    Emil Radev
    Group
    EPP
    Targets
    Data Act Article 15a
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15 a – paragraph 1
  9. 185 Alternative Emil RadevEPP · JURI “Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such…”

    2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to addressrespond to the public emergency, personal data may also be requested and, whereunless possible,strictly necessary made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

    Tabled by
    Emil Radev
    Group
    EPP
    Targets
    Data Act Article 15a
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15 a – paragraph 2
  10. 186 Deletion Emil RadevEPP · JURI Deletes the proposed article

    3. Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.;

    Tabled by
    Emil Radev
    Group
    EPP
    Targets
    Data Act Article 15a
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15 a – paragraph 3
Show 17 more amendments
  1. 187 Alternative Victor NegrescuS&D · JURI “When addressing other SMEs, public sector bodies, the Commission, the European Central Bank and Union bodies shall take particular account of their…”

    3. Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.; When addressing other SMEs, public sector bodies, the Commission, the European Central Bank and Union bodies shall take particular account of their limited administrative and technical capacity, and shall design requests and modalities of provision in a proportionate and SME-friendly manner.

    Tabled by
    Victor Negrescu
    Group
    S&D
    Targets
    Data Act Article 15a
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15 a – paragraph 3
  2. 241 Alternative Piotr MüllerECR · IMCO “shall not extend to data protected as trade secrets or to commercially sensitive information, shall be limited to non-personal data that is strictly…”

    1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies and other than small and medium-sized enterprises and small mid-cap enterprises, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests shall not extend to data protected as trade secrets or to commercially sensitive information, shall be limited to non-personal data that is strictly necessary and proportionate to the public emergency, and shall be addressed to the person entitled to dispose of the data concerned. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

    Justification

    Cuts the business-to-government data-provision burden.

    Tabled by
    Piotr Müller
    Group
    ECR
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 1
  3. 242 Alternative Maria GrapiniS&D · IMCO “Data requesters shall ensure that received data are adequately protected and shall take all measures necessary to prevent any undue harm to the data…”

    1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Data requesters shall ensure that received data are adequately protected and shall take all measures necessary to prevent any undue harm to the data holder as a result of the data being made available. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

    Tabled by
    Maria Grapini
    Group
    S&D
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15 a – paragraph 1
  4. 243 Alternative Virginie JoronPfE · IMCO “An exceptional need is present only when the data concerned are strictly necessary for the purpose pursued and cannot be obtained under equivalent…”

    1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may, as a last resort, request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. An exceptional need is present only when the data concerned are strictly necessary for the purpose pursued and cannot be obtained under equivalent conditions by another means. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15 a – paragraph 1
  5. 244 Alternative Morten Løkkegaard +2Renew · IMCO “basis of objective and verifiable evidence, that access to the requested data is strictly necessary and proportionate and that no less intrusive…”

    1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates, anon exceptionalthe needbasis of objective and verifiable evidence, that access to the requested data is strictly necessary and proportionate and that no less intrusive means are reasonably available, to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

    Tabled by
    Morten Løkkegaard, Svenja Hahn, Sandro Gozi
    Group
    Renew
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 1
  6. 245 Alternative Sophia KircherEPP · IMCO “Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry…”

    1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

    Tabled by
    Sophia Kircher
    Group
    EPP
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 1
  7. 246 Alternative Morten Løkkegaard +2Renew · IMCO “Before requesting personal data, the requesting authority shall demonstrate that aggregated, anonymised or other non-personal data are insufficient…”

    2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Before requesting personal data, the requesting authority shall demonstrate that aggregated, anonymised or other non-personal data are insufficient to achieve the intended objective. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

    Tabled by
    Morten Løkkegaard, Svenja Hahn, Sandro Gozi
    Group
    Renew
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2
  8. 247 Alternative Virginie JoronPfE · IMCO “against any re-identification, any personal data breaches and any unlawful use”

    2. Where the data requested are strictly necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. WherePersonal data may only be requested as a last resort where it is demonstrated that the provision of non-personal data is insufficient to address the public emergency, personaland data may also be requested andmust, where possible, be made available in pseudonymised form, subject to appropriate technical and organisational measures to ensure their protection against any re-identification, any personal data breaches and any unlawful use.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15 a – paragraph 2
  9. 248 Alternative Morten Løkkegaard +2Renew · IMCO “Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such…”

    2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, wherewherever possibletechnically feasible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

    Tabled by
    Morten Løkkegaard, Jeannette Baljeu, Svenja Hahn
    Group
    Renew
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2
  10. 249 Alternative Sophia KircherEPP · IMCO “Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such…”

    2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to addressrespond to the public emergency, personal data may also be requested and, whereunless possiblestrictly necessary, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

    Tabled by
    Sophia Kircher
    Group
    EPP
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2
  11. 250 Deletion Sophia KircherEPP · IMCO Deletes the proposed article

    3. Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.;

    Tabled by
    Sophia Kircher
    Group
    EPP
    Targets
    Data Act Article 15a
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 3
  12. 642 Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “An exceptional need exists only where the data concerned are strictly necessary for the purpose pursued and cannot be obtained under equivalent…”

    1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may, as a measure of last resort, request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. An exceptional need exists only where the data concerned are strictly necessary for the purpose pursued and cannot be obtained under equivalent conditions by any other means. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

    Justification

    The power to compel private data holders to make data available constitutes a significant interference with the freedom to conduct a business and, where personal data are concerned, with the right to the protection of personal data. Such a power must therefore be strictly circumscribed. This amendment clarifies that access may be requested only as a measure of last resort, where the data are strictly necessary and cannot be obtained under equivalent conditions by any other means. It further breaks the circularity between the notions of ‘exceptional need’ and ‘public emergency’ by anchoring the former in an objective test of strict necessity and subsidiarity, and the latter in autonomous criteria of gravity and effect. The subsidiary treatment of personal data ensures compliance with the principles of necessity and proportionality and with the data minimisation principle under Regulation (EU) 2016/679.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    Data Act Article 15a
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 1
  13. 643 Alternative Mary KhanESN · ITRE–LIBE “address a request for data only to the public sector body that is competent under the national law of the Member State concerned. They may not…”

    (1) Where a public sector body, that is competent under the Commission,law of the EuropeanMember Central Bank or a Union bodyState demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding immediately to, mitigating, or supporting the recovery from a public emergency, it may request fromthat data holders that are legal persons, other than public sectorssector bodies, to make available thosesuch data, including the metadata strictly necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.The Commission, the European Central Bank and Union bodies may address a request for data only to the public sector body that is competent under the national law of the Member State concerned. They may not directly request data from private data holders. The competent public sector body shall be responsible under national law for deciding whether and to what extent it complies with the request.

    Justification

    Access to data in emergencies must remain a national competence, in line with democratic principles and the rule of law. EU bodies may request information, but they may not directly impose obligations on private data holders.

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    Data Act Article 15a
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 1
  14. 644 Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “against further re-identification, personal data breaches and unlawful use”

    2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection against further re-identification, personal data breaches and unlawful use.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    Data Act Article 15a
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2
  15. 645 Alternative Michael McNamara +4Renew · ITRE–LIBE “and only when strictly necessary”

    2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. WhereOnly where the provision of non-personal data is demonstrated to be insufficient to addressrespond to the public emergency, personal data may also be requested and, whereshall possible,only be made available in pseudonymized form and only when strictly necessary, subject to appropriate technical and organisational measures to ensure their protection.

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
    Group
    Renew
    Targets
    Data Act Article 15a
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2
  16. 646 Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “Personal data may be requested only as a last resort, where”

    2. Where the data requested are strictly necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. WherePersonal data may be requested only as a last resort, where the provision of non-personal data is demonstrably insufficient to address the public emergency, personaland data may also be requested andshall, where possible, be made available in pseudonymizedpseudonymised form, subject to appropriate technical and organisational measures to ensure their protection.

    Justification

    Access to data by public sector bodies in a public emergency must remain exceptional and bounded. The amendment ties the request to the strict impossibility of obtaining the data by other means and requires the requesting body to substantiate that impossibility, rather than merely assert it.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    Data Act Article 15a
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2
  17. 649 Deletion Mary KhanESN · ITRE–LIBE Deletes the proposed article

    (3) Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.

    Justification

    Exceptional B2G powers must be limited to immediate action to address a clearly identified emergency. Standard legislative instruments should be used for reconstruction and general policy planning.

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    Data Act Article 15a
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 3

Provisions only Parliament amendments would add or change

9 amendments on 4 units the Commission proposal leaves unchanged

Paragraph 2a (new)New2 proposals

  1. 647 Addition Markus BuchheitESN · ITRE–LIBE ‘The provisions of this Chapter shall clarify that a request for data by a public authority shall not be permissible insofar as the data requested… numbered 2a

    2a.‘The provisions of this Chapter shall clarify that a request for data by a public authority shall not be permissible insofar as the data requested contain personal data or permit conclusions to be drawn about identified or identifiable natural persons, unless an express and specific statutory basis of the Member State concerned provides for this in a narrowly delimited individual case. Such a request shall also be impermissible where the public authority can obtain the required information with reasonable effort from its own sources or from other public sources.’

    Tabled by
    Markus Buchheit
    Group
    ESN
    Targets
    Data Act Article 15a – paragraph 2a (new)
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2a (new)
  2. 648 Addition Michael McNamara +4Renew · ITRE–LIBE ‘The personal data referred to in paragraph 2 may only be requested following prior authorisation by a judicial authority.’ numbered 2a

    2a.‘The personal data referred to in paragraph 2 may only be requested following prior authorisation by a judicial authority.’

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
    Group
    Renew
    Targets
    Data Act Article 15a – paragraph 2a (new)
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 2a (new)

Paragraph 3a (new)New4 proposals

  1. 251 Addition Virginie JoronPfE · IMCO “A public sector body, the Commission, the European Central Bank or a Union body that has received data as a result of a public emergency must: (a)…” numbered 3a

    3a.A public sector body, the Commission, the European Central Bank or a Union body that has received data as a result of a public emergency must:

    (a)implement technical and organisational measures designed to preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular personal data, and to safeguard the rights and freedoms of data subjects;

    (b)erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and any physical or legal person having received the data with a view to carrying out the task for which the request was made without undue delay that the data have been erased, unless archiving of the data is required in accordance with Union or national law on public access to information in the context of transparency obligations.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    Data Act Article 15a – paragraph 3a (new)
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15 a – paragraph 3 a (new)
  2. 650 Addition Julie Rechagneux +8ECR, PfE · ITRE–LIBE ‘A public sector body, the Commission, the European Central Bank or a Union body that has received data on the basis of a public emergency shall: (a)… numbered 3a

    3a.'A public sector body, the Commission, the European Central Bank or a Union body that has received data on the basis of a public emergency shall:

    (a)implement technical and organisational measures that preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular of personal data, and safeguard the rights and freedoms of data subjects;

    (b)erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder, as well as any natural or legal persons that received the data with a view to carrying out the task for which the request was made, without undue delay, that the data have been erased, unless archiving is required under Union or national law on public access to documents in the context of transparency obligations.'

    Justification

    For reasons of legal clarity and accessibility, the safeguards attached to the use of data obtained in the context of a public emergency should be set out expressly in the operative provision rather than by cross-reference alone. Recalling in full the obligations to implement technical and organisational measures and to erase the data once they are no longer necessary ensures that these safeguards remain readable and enforceable, in line with the principles of purpose limitation and storage limitation under Regulation (EU) 2016/679. In addition, the exclusion of special categories of personal data and of data relating to criminal convictions from the scope of emergency data requests, save where their processing is strictly necessary and authorised by law, reinforces the protection of data subjects’ fundamental rights.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    Data Act Article 15a – paragraph 3a (new)
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 3a (new)
  3. 651 Addition Mary KhanESN · ITRE–LIBE ‘Data provided under this Article may be processed only for the purpose specified in the data request. Their use for the training, testing or… numbered 3a

    (3a)‘Data provided under this Article may be processed only for the purpose specified in the data request. Their use for the training, testing or validation of AI systems or AI models, or for profiling, scoring, commercial purposes or administrative purposes other than those explicitly specified in the request shall be prohibited.’

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    Data Act Article 15a – paragraph 3a (new)
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 3 a (new)
  4. 652 Addition Damian BoeselagerGreens/EFA · ITRE–LIBE ‘Requests shall be limited in time.’ numbered 3a

    3a.‘Requests shall be limited in time.’

    Tabled by
    Damian Boeselager on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    Data Act Article 15a – paragraph 3a (new)
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 3a (new)

Paragraph 3b (new)New2 proposals

  1. 653 Addition Damian BoeselagerGreens/EFA · ITRE–LIBE ‘Requests shall be notified latest 6 months after the request was made to the European Data Protection Board, including: - an assessment of whether… numbered 3b

    3b.'Requests shall be notified latest 6 months after the request was made to the European Data Protection Board, including:

    - an assessment of whether the criteria laid out in Article 17 were fulfilled a description of the technical and organisational measures taken for the data to be collected, used, stored and deleted;

    - an assessment of how the request contributed to the achievement of the public interest objective pursued;

    - an assessment of the costs incurred by data providers comparatively to the compensation provided;

    - and an assessment of compliance with the applicable rules on the protection of personal data.

    - an assessment of the potential need to compensate requested entities for potential misuse or non-fulfilment of the criteria laid out in this Article and Article 17.'

    Tabled by
    Damian Boeselager on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    Data Act Article 15a – paragraph 3b (new)
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 3b (new)
  2. 654 Addition Mary KhanESN · ITRE–LIBE ‘The requesting body shall delete the data received and any copies thereof as soon as the purpose is fulfilled and no later than 30 days after the… numbered 3b

    (3b)‘The requesting body shall delete the data received and any copies thereof as soon as the purpose is fulfilled and no later than 30 days after the end of the public emergency. Retention for a longer period is permitted only on the basis of a specific national legal provision and a verifiable decision taken on a case-by-case basis. All access, transmission and deletion operations shall be logged in an audit-compliant manner.’

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    Data Act Article 15a – paragraph 3b (new)
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 3 b (new)

Paragraph 3c (new)New

  1. 655 Addition Mary KhanESN · ITRE–LIBE ‘Member States shall publish, at least once per year, a register of the data requests made pursuant to this Article, indicating the legal basis… numbered 3c

    (3c)‘Member States shall publish, at least once per year, a register of the data requests made pursuant to this Article, indicating the legal basis, purpose and categories of data concerned, the recipients, the duration of the processing and the date of deletion. Where publication during an ongoing emergency would be damaging for compelling reasons of public security, publication shall take place without delay after those reasons cease to exist.’

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    Data Act Article 15a – paragraph 3 c (new)
    Document
    ITRE–LIBE amendments 527–776 to the draft report
    Printed header
    Article 1 – paragraph 1 – point 7 / Regulation (EU) 2023/2854 / Article 15a – paragraph 3 c (new)