Regulation (EU) 2023/2854 — Article 15a

Article total: 6 parts · 3 Council drafts · 36 Parliament amendments

Tracked part

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to Data Act

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 13 December 2023, with the Commission proposal change affecting this article applied.

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Commission source wording and instructions

Article 15a

Commission proposal

Article 15a Obligation for data holders to make data available on the basis of a public emergency 1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency. 2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection. 3. Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

Council document

View full Council comparison →

Article 15a

June Presidency compromise · 10 June

Council wording reconstructed for this provision from the official operation

Article 15a Obligation for data holders to make data available on the basis of a public emergency

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates the need to use certain data to carry out its statutory duties in the public interest when responding to, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to respond to the public emergency, personal data may also be requested and, , made available in pseudonymised form, subject to appropriate technical and organisational measures to ensure their protection. 3. Where the data requested are necessary to support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.

View full Council comparison →

Article 15a

June Presidency compromise · 18 June

Council wording reconstructed for this provision from the official operation

Article 15a Obligation for data holders to make data available on the basis of a public emergency

View full Council comparison →

Article in September Presidency compromise Council text

Comparison basis: Existing law (13 December 2023) compared with September Presidency compromise (3 September 2026)

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates thesn-exeeptionnt need to use certain data to carry out its statutory duties in the public interest when responding to, -mitigatingsor supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to respond toaddress the public emergency, personal data may also be requested and, where-possible, made available in pseudony misedpsendonynized form, subject to appropriate technical and organisational measures to ensure their protection. Where the data requested are necessary to mitigate ox support the recovery from a public emergency-# and the requesting body pursuant to paragraph 1 acting on the basis of Union or national law_is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, it may request specific non-personal data, the lack of which preventprevents it from—mitigating-or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises..""

Article 15a

September Presidency compromise

Council wording reconstructed for this provision from the official operation

Article 15a Obligation for data holders to make data available on the basis of a public emergency 1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates thesn-exeeptionnt need to use certain data to carry out its statutory duties in the public interest when responding to, -mitigatingsor supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to respond toaddress the public emergency, personal data may also be requested and, where-possible, made available in pseudony misedpsendonynized form, subject to appropriate technical and organisational measures to ensure their protection. Where the data requested are necessary to mitigate ox support the recovery from a public emergency-# and the requesting body pursuant to paragraph 1 acting on the basis of Union or national law_is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, it may request specific non-personal data, the lack of which preventprevents it from—mitigating-or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises..""

Article 15a 3 Council drafts

Article 15a

10 June 2026 · June Presidency compromise · 10 June

Council wording reconstructed for this provision from the official operation

Article 15a Obligation for data holders to make data available on the basis of a public emergency

Article 15a

18 June 2026 · June Presidency compromise · 18 June

Council wording reconstructed for this provision from the official operation

Article 15a Obligation for data holders to make data available on the basis of a public emergency

Article 15a

3 September 2026 · September Presidency compromise

Council wording reconstructed for this provision from the official operation

Article 15a Obligation for data holders to make data available on the basis of a public emergency 1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates thesn-exeeptionnt need to use certain data to carry out its statutory duties in the public interest when responding to, -mitigatingsor supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to respond toaddress the public emergency, personal data may also be requested and, where-possible, made available in pseudony misedpsendonynized form, subject to appropriate technical and organisational measures to ensure their protection. Where the data requested are necessary to mitigate ox support the recovery from a public emergency-# and the requesting body pursuant to paragraph 1 acting on the basis of Union or national law_is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, it may request specific non-personal data, the lack of which preventprevents it from—mitigating-or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises..""

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

Search amendments

Political group at the amendment date where available; otherwise the current Parliament affiliation.

Alternative wording Amendment 16 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to ~~address~~respond to the public emergency, personal data may also be requested and, where ~~possible~~strictly necessary, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

Preview
against:

Alternative wording Amendment 29 JURI draft opinion · Brando Benifei (rapporteur)

Justification

This amendment clarifies and narrows the scope of emergency-related data access by removing the broad and potentially ambiguous concept of “mitigation”. This helps improve legal certainty and ensures that access to data remains more closely linked to concrete emergency response and recovery activities.

Preview
against:

Incomplete comparison. Only the changes that can be reconstructed are shown.

Unresolved changes and source qualifications

Unresolved change: The official source replaces Article 2 point (49) with the printed dynamic-data definition; it is not a pure addition. The accepted relationship does not establish the surrounding ordered replacement/removal chain for the following Commission points. Without verified removals and renumbering, applying point (49) alone leaves the dynamic-data, research-data and re-use definitions at points (50), (51) and (52) without a source-backed chain and risks duplicate definitions; preserve this amendment as incomplete. Unresolved change: The official header and unit label identify Regulation (EU) 2023/2854 Article 2 point 50, while the copied base text uniquely reproduces a different Commission definition within the same replace-proposed-text operation. Preserve the printed target and copied source columns; the full-article scenario remains incomplete and neither target is silently substituted. Unresolved change: The official amendment header and unit label identify the printed legal target, while its copied base text uniquely reproduces a different Commission definition in the same operation. The printed target is preserved and the full-article scenario remains incomplete; neither target is silently substituted. Unresolved change: The official header and unit label identify Regulation (EU) 2023/2854 Article 2 point 51, while the copied base text uniquely reproduces a different Commission definition within the same replace-proposed-text operation. Preserve the printed target and copied source columns; the full-article scenario remains incomplete and neither target is silently substituted. Unresolved change: The official source header identifies Article 32r paragraph 3, while both source columns reproduce paragraph (4). The header remains authoritative and no corrected legal target is substituted.

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to respond to the public emergency, personal data may also be requested and, where possible, made available in pseudonymised form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.

Alternative wording Amendment 30 JURI draft opinion · Brando Benifei (rapporteur)

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to ~~address~~respond to the public emergency, personal data may also be requested and, where possible, made available in ~~pseudonymized~~pseudonymised form, subject to appropriate technical and organisational measures to ensure their protection.

Justification

This amendment clarifies that the use of data under this provision should remain linked to concrete emergency response activities. The term “respond to” provides a narrower and more operationally precise standard than the broader concept of “addressing” a public emergency.

Preview
against:

Incomplete comparison. Only the changes that can be reconstructed are shown.

Unresolved changes and source qualifications

Unresolved change: The official source replaces Article 2 point (49) with the printed dynamic-data definition; it is not a pure addition. The accepted relationship does not establish the surrounding ordered replacement/removal chain for the following Commission points. Without verified removals and renumbering, applying point (49) alone leaves the dynamic-data, research-data and re-use definitions at points (50), (51) and (52) without a source-backed chain and risks duplicate definitions; preserve this amendment as incomplete. Unresolved change: The official header and unit label identify Regulation (EU) 2023/2854 Article 2 point 50, while the copied base text uniquely reproduces a different Commission definition within the same replace-proposed-text operation. Preserve the printed target and copied source columns; the full-article scenario remains incomplete and neither target is silently substituted. Unresolved change: The official amendment header and unit label identify the printed legal target, while its copied base text uniquely reproduces a different Commission definition in the same operation. The printed target is preserved and the full-article scenario remains incomplete; neither target is silently substituted. Unresolved change: The official header and unit label identify Regulation (EU) 2023/2854 Article 2 point 51, while the copied base text uniquely reproduces a different Commission definition within the same replace-proposed-text operation. Preserve the printed target and copied source columns; the full-article scenario remains incomplete and neither target is silently substituted. Unresolved change: The official source header identifies Article 32r paragraph 3, while both source columns reproduce paragraph (4). The header remains authoritative and no corrected legal target is substituted.

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to respond to the public emergency, personal data may also be requested and, where possible, made available in pseudonymised form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.

Alternative wording Amendment 45 IMCO draft opinion · Alex Agius Saliba (rapporteur)

Justification

In line with the EDPB - EDPS opinion paragraph 125.

Preview
against:

Alternative wording Amendment 46 IMCO draft opinion · Alex Agius Saliba (rapporteur)

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to ~~address~~respond to the public emergency, personal data may also be requested and~~, where possible~~, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

Justification

Following the EDPB-EDPS opinion para 122-124.

Preview
against:

Remove proposed wording Amendment 47 IMCO draft opinion · Alex Agius Saliba (rapporteur)

Preview
against:

Remove proposed wording Amendment 183 JURI

7. the following Article 15a is inserted: ‘Article 15a Obligation for data holders to make data available on the basis of a public emergency 1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency. 2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection. 3. Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.;’

Preview
against:

Alternative wording Amendment 184 JURI

Preview
against:

Alternative wording Amendment 185 JURI

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to ~~address~~respond to the public emergency, personal data may also be requested and, ~~where~~unless ~~possible,~~strictly necessary made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

Preview
against:

Remove proposed wording Amendment 186 JURI

Preview
against:

Alternative wording Amendment 187 JURI

3. Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.; When addressing other SMEs, public sector bodies, the Commission, the European Central Bank and Union bodies shall take particular account of their limited administrative and technical capacity, and shall design requests and modalities of provision in a proportionate and SME-friendly manner.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’; When addressing other SMEs, public sector bodies, the Commission, the European Central Bank and Union bodies shall take particular account of their limited administrative and technical capacity, and shall design requests and modalities of provision in a proportionate and SME-friendly manner.

Alternative wording Amendment 241 IMCO

1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies and other than small and medium-sized enterprises and small mid-cap enterprises, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests shall not extend to data protected as trade secrets or to commercially sensitive information, shall be limited to non-personal data that is strictly necessary and proportionate to the public emergency, and shall be addressed to the person entitled to dispose of the data concerned. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

Justification

Cuts the business-to-government data-provision burden.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies and other than small and medium-sized enterprises and small mid-cap enterprises, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests shall not extend to data protected as trade secrets or to commercially sensitive information, shall be limited to non-personal data that is strictly necessary and proportionate to the public emergency, and shall be addressed to the person entitled to dispose of the data concerned. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Alternative wording Amendment 242 IMCO

1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Data requesters shall ensure that received data are adequately protected and shall take all measures necessary to prevent any undue harm to the data holder as a result of the data being made available. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Data requesters shall ensure that received data are adequately protected and shall take all measures necessary to prevent any undue harm to the data holder as a result of the data being made available. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Alternative wording Amendment 243 IMCO

1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may, as a last resort, request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. An exceptional need is present only when the data concerned are strictly necessary for the purpose pursued and cannot be obtained under equivalent conditions by another means. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may, as a last resort, request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. An exceptional need is present only when the data concerned are strictly necessary for the purpose pursued and cannot be obtained under equivalent conditions by another means. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Alternative wording Amendment 244 IMCO

1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates, anon ~~exceptional~~the ~~need~~basis of objective and verifiable evidence, that access to the requested data is strictly necessary and proportionate and that no less intrusive means are reasonably available, to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates, anon ~~exceptional~~the ~~need~~basis of objective and verifiable evidence, that access to the requested data is strictly necessary and proportionate and that no less intrusive means are reasonably available, to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Alternative wording Amendment 245 IMCO

Preview
against:

Alternative wording Amendment 246 IMCO

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Before requesting personal data, the requesting authority shall demonstrate that aggregated, anonymised or other non-personal data are insufficient to achieve the intended objective. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Before requesting personal data, the requesting authority shall demonstrate that aggregated, anonymised or other non-personal data are insufficient to achieve the intended objective. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Alternative wording Amendment 247 IMCO

2. Where the data requested are strictly necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. ~~Where~~Personal data may only be requested as a last resort where it is demonstrated that the provision of non-personal data is insufficient to address the public emergency, ~~personal~~and ~~data may also be requested and~~must, where possible, be made available in pseudonymised form, subject to appropriate technical and organisational measures to ensure their protection against any re-identification, any personal data breaches and any unlawful use.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are strictly necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. ~~Where~~Personal data may only be requested as a last resort where it is demonstrated that the provision of non-personal data is insufficient to address the public emergency, ~~personal~~and ~~data may also be requested and~~must, where possible, be made available in ~~pseudonymized~~pseudonymised form, subject to appropriate technical and organisational measures to ensure their protection against any re-identification, any personal data breaches and any unlawful use.3. Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Alternative wording Amendment 248 IMCO

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, ~~where~~wherever ~~possible~~technically feasible , made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

Preview
against:

Alternative wording Amendment 249 IMCO

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to ~~address~~respond to the public emergency, personal data may also be requested and, ~~where~~unless ~~possible~~strictly necessary , made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.

Preview
against:

Remove proposed wording Amendment 250 IMCO

Preview
against:

Additional proposed wording Amendment 251 IMCO

3a.

A public sector body, the Commission, the European Central Bank or a Union body that has received data as a result of a public emergency must:

(a)

implement technical and organisational measures designed to preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular personal data, and to safeguard the rights and freedoms of data subjects;

(b)

erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and any physical or legal person having received the data with a view to carrying out the task for which the request was made without undue delay that the data have been erased, unless archiving of the data is required in accordance with Union or national law on public access to information in the context of transparency obligations.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;
3a.
A public sector body, the Commission, the European Central Bank or a Union body that has received data as a result of a public emergency must:
1. (a)
  
  implement technical and organisational measures designed to preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular personal data, and to safeguard the rights and freedoms of data subjects;
2. (b)
  
  erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and any physical or legal person having received the data with a view to carrying out the task for which the request was made without undue delay that the data have been erased, unless archiving of the data is required in accordance with Union or national law on public access to information in the context of transparency obligations.

Alternative wording Amendment 642 ITRE · LIBE

1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may, as a measure of last resort, request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. An exceptional need exists only where the data concerned are strictly necessary for the purpose pursued and cannot be obtained under equivalent conditions by any other means. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

Justification

The power to compel private data holders to make data available constitutes a significant interference with the freedom to conduct a business and, where personal data are concerned, with the right to the protection of personal data. Such a power must therefore be strictly circumscribed. This amendment clarifies that access may be requested only as a measure of last resort, where the data are strictly necessary and cannot be obtained under equivalent conditions by any other means. It further breaks the circularity between the notions of ‘exceptional need’ and ‘public emergency’ by anchoring the former in an objective test of strict necessity and subsidiarity, and the latter in autonomous criteria of gravity and effect. The subsidiary treatment of personal data ensures compliance with the principles of necessity and proportionality and with the data minimisation principle under Regulation (EU) 2016/679.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may, as a measure of last resort, request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. An exceptional need exists only where the data concerned are strictly necessary for the purpose pursued and cannot be obtained under equivalent conditions by any other means. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Alternative wording Amendment 643 ITRE · LIBE

(1) Where a public sector body, that is competent under the ~~Commission,~~law of the ~~European~~Member ~~Central Bank or a Union body~~State demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding immediately to~~, mitigating, or supporting the recovery from~~ a public emergency, it may request ~~from~~that data holders that are legal persons, other than public ~~sectors~~sector bodies, to make available ~~those~~such data, including the metadata strictly necessary to interpret and use those data. ~~Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the~~ The Commission, the European Central Bank orand Union ~~body. Such requests~~bodies may ~~also~~address a request for data only to the public sector body that is competent under the national law of the Member State concerned. They may not directly request data from private data holders. The competent public sector body shall be ~~made~~responsible ~~where~~under national law for deciding whether and to what extent it complies with the ~~production of official statistics is required in relation to a public emergency~~request.

Justification

Access to data in emergencies must remain a national competence, in line with democratic principles and the rule of law. EU bodies may request information, but they may not directly impose obligations on private data holders.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, that is competent under the ~~Commission,~~law of the ~~European~~Member ~~Central Bank or a Union body~~State demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding immediately to~~, mitigating, or supporting the recovery from~~ a public emergency, it may request ~~from~~that data holders that are legal persons, other than public ~~sectors~~sector bodies, to make available ~~those~~such data, including the metadata strictly necessary to interpret and use those data. ~~Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the~~The Commission, the European Central Bank orand Union ~~body. Such requests~~bodies may ~~also~~address a request for data only to the public sector body that is competent under the national law of the Member State concerned. They may not directly request data from private data holders. The competent public sector body shall be ~~made~~responsible ~~where~~under national law for deciding whether and to what extent it complies with the ~~production~~request.2. ofWhere ~~official~~the ~~statistics~~data isrequested ~~required~~are innecessary ~~relation~~to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Alternative wording Amendment 644 ITRE · LIBE

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection against further re-identification, personal data breaches and unlawful use.

Preview
against:

Alternative wording Amendment 645 ITRE · LIBE

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. ~~Where~~Only where the provision of non-personal data is demonstrated to be insufficient to ~~address~~respond to the public emergency, personal data may also be requested and, ~~where~~shall ~~possible,~~only be made available in pseudonymized form and only when strictly necessary, subject to appropriate technical and organisational measures to ensure their protection.

Preview
against:

Alternative wording Amendment 646 ITRE · LIBE

2. Where the data requested are strictly necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. ~~Where~~Personal data may be requested only as a last resort, where the provision of non-personal data is demonstrably insufficient to address the public emergency, ~~personal~~and ~~data may also be requested and~~shall, where possible, be made available in ~~pseudonymized~~pseudonymised form, subject to appropriate technical and organisational measures to ensure their protection.

Justification

Access to data by public sector bodies in a public emergency must remain exceptional and bounded. The amendment ties the request to the strict impossibility of obtaining the data by other means and requires the requesting body to substantiate that impossibility, rather than merely assert it.

Preview
against:

Additional proposed wording Amendment 647 ITRE · LIBE

2a.

'The provisions of this Chapter shall clarify that a request for data by a public authority shall not be permissible insofar as the data requested contain personal data or permit conclusions to be drawn about identified or identifiable natural persons, unless an express and specific statutory basis of the Member State concerned provides for this in a narrowly delimited individual case. Such a request shall also be impermissible where the public authority can obtain the required information with reasonable effort from its own sources or from other public sources.'

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
2a.

'The provisions of this Chapter shall clarify that a request for data by a public authority shall not be permissible insofar as the data requested contain personal data or permit conclusions to be drawn about identified or identifiable natural persons, unless an express and specific statutory basis of the Member State concerned provides for this in a narrowly delimited individual case. Such a request shall also be impermissible where the public authority can obtain the required information with reasonable effort from its own sources or from other public sources.'
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;

Additional proposed wording Amendment 648 ITRE · LIBE

2a.

'The personal data referred to in paragraph 2 may only be requested following prior authorisation by a judicial authority.'

Preview
against:

Remove proposed wording Amendment 649 ITRE · LIBE

(3) Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.

Justification

Exceptional B2G powers must be limited to immediate action to address a clearly identified emergency. Standard legislative instruments should be used for reconstruction and general policy planning.

Preview
against:

Additional proposed wording Amendment 650 ITRE · LIBE

3a.

'A public sector body, the Commission, the European Central Bank or a Union body that has received data on the basis of a public emergency shall:

(a)

implement technical and organisational measures that preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular of personal data, and safeguard the rights and freedoms of data subjects;

(b)

erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder, as well as any natural or legal persons that received the data with a view to carrying out the task for which the request was made, without undue delay, that the data have been erased, unless archiving is required under Union or national law on public access to documents in the context of transparency obligations.'

Justification

For reasons of legal clarity and accessibility, the safeguards attached to the use of data obtained in the context of a public emergency should be set out expressly in the operative provision rather than by cross-reference alone. Recalling in full the obligations to implement technical and organisational measures and to erase the data once they are no longer necessary ensures that these safeguards remain readable and enforceable, in line with the principles of purpose limitation and storage limitation under Regulation (EU) 2016/679. In addition, the exclusion of special categories of personal data and of data relating to criminal convictions from the scope of emergency data requests, save where their processing is strictly necessary and authorised by law, reinforces the protection of data subjects’ fundamental rights.

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;
3a.
'A public sector body, the Commission, the European Central Bank or a Union body that has received data on the basis of a public emergency shall:
1. (a)
  
  implement technical and organisational measures that preserve the confidentiality and integrity of the requested data and the security of the data transfers, in particular of personal data, and safeguard the rights and freedoms of data subjects;
2. (b)
  
  erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder, as well as any natural or legal persons that received the data with a view to carrying out the task for which the request was made, without undue delay, that the data have been erased, unless archiving is required under Union or national law on public access to documents in the context of transparency obligations.'

Additional proposed wording Amendment 651 ITRE · LIBE

(3a)

‘Data provided under this Article may be processed only for the purpose specified in the data request. Their use for the training, testing or validation of AI systems or AI models, or for profiling, scoring, commercial purposes or administrative purposes other than those explicitly specified in the request shall be prohibited.’

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;
3a.

‘Data provided under this Article may be processed only for the purpose specified in the data request. Their use for the training, testing or validation of AI systems or AI models, or for profiling, scoring, commercial purposes or administrative purposes other than those explicitly specified in the request shall be prohibited.’

Additional proposed wording Amendment 652 ITRE · LIBE

3a.

'Requests shall be limited in time.'

Preview
against:

Additional proposed wording Amendment 653 ITRE · LIBE

3b.

'Requests shall be notified latest 6 months after the request was made to the European Data Protection Board, including:

- an assessment of whether the criteria laid out in Article 17 were fulfilled a description of the technical and organisational measures taken for the data to be collected, used, stored and deleted;

- an assessment of how the request contributed to the achievement of the public interest objective pursued;

- an assessment of the costs incurred by data providers comparatively to the compensation provided;

- and an assessment of compliance with the applicable rules on the protection of personal data.

- an assessment of the potential need to compensate requested entities for potential misuse or non-fulfilment of the criteria laid out in this Article and Article 17.'

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;
3b.

'Requests shall be notified latest 6 months after the request was made to the European Data Protection Board, including:
- an assessment of whether the criteria laid out in Article 17 were fulfilled a description of the technical and organisational measures taken for the data to be collected, used, stored and deleted;
- an assessment of how the request contributed to the achievement of the public interest objective pursued;
- an assessment of the costs incurred by data providers comparatively to the compensation provided;
- and an assessment of compliance with the applicable rules on the protection of personal data.
- an assessment of the potential need to compensate requested entities for potential misuse or non-fulfilment of the criteria laid out in this Article and Article 17.'

Additional proposed wording Amendment 654 ITRE · LIBE

(3b)

‘The requesting body shall delete the data received and any copies thereof as soon as the purpose is fulfilled and no later than 30 days after the end of the public emergency. Retention for a longer period is permitted only on the basis of a specific national legal provision and a verifiable decision taken on a case-by-case basis. All access, transmission and deletion operations shall be logged in an audit-compliant manner.’

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;
3b.

‘The requesting body shall delete the data received and any copies thereof as soon as the purpose is fulfilled and no later than 30 days after the end of the public emergency. Retention for a longer period is permitted only on the basis of a specific national legal provision and a verifiable decision taken on a case-by-case basis. All access, transmission and deletion operations shall be logged in an audit-compliant manner.’

Additional proposed wording Amendment 655 ITRE · LIBE

(3c)

‘Member States shall publish, at least once per year, a register of the data requests made pursuant to this Article, indicating the legal basis, purpose and categories of data concerned, the recipients, the duration of the processing and the date of deletion. Where publication during an ongoing emergency would be damaging for compelling reasons of public security, publication shall take place without delay after those reasons cease to exist.’

Preview
against:

Article 15a

Obligation for data holders to make data available on the basis of a public emergency

1.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.
2.

Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection.
3.

Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.’;
3c.

‘Member States shall publish, at least once per year, a register of the data requests made pursuant to this Article, indicating the legal basis, purpose and categories of data concerned, the recipients, the duration of the processing and the date of deletion. Where publication during an ongoing emergency would be damaging for compelling reasons of public security, publication shall take place without delay after those reasons cease to exist.’

Article in June Presidency compromise · 10 June Council text

Article in June Presidency compromise · 18 June Council text

Article in September Presidency compromise Council text

Changes in context

European Commission proposal

Council Presidency text · ST 10426/26

Changes in context

Council Presidency text · ST 10426/26

Council Presidency text · ST 10677/26

Changes in context

Council Presidency text · ST 10677/26

Council Presidency text · ST 12535/26

Changes in context

Wording reproduced in the amendment

Amendment 642 · ITRE–LIBE amendments 527–776 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 643 · ITRE–LIBE amendments 527–776 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 644 · ITRE–LIBE amendments 527–776 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 645 · ITRE–LIBE amendments 527–776 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 646 · ITRE–LIBE amendments 527–776 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 649 · ITRE–LIBE amendments 527–776 to the draft report: removal

Changes in context

Wording reproduced in the amendment

Amendment 16 · ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)

Changes in context

Wording reproduced in the amendment

Amendment 241 · IMCO amendments 125–328 to the draft opinion

Changes in context

Wording reproduced in the amendment

Amendment 242 · IMCO amendments 125–328 to the draft opinion

Changes in context

Wording reproduced in the amendment

Amendment 243 · IMCO amendments 125–328 to the draft opinion

Changes in context

Wording reproduced in the amendment

Amendment 244 · IMCO amendments 125–328 to the draft opinion

Changes in context

Wording reproduced in the amendment

Amendment 245 · IMCO amendments 125–328 to the draft opinion

Changes in context