Research

Digital Omnibus tracker

Data Act · Regulation (EU) 2023/2854

Article 17

Compare the available Commission, Council and Parliament texts and amendments affecting this article.

Article total: 11 parts · 3 Council drafts · 15 Parliament amendments

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to Data Act

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 13 December 2023, with all 7 Commission proposal changes affecting this article applied.

Removed by the proposal: Article 17(2)(e), Article 17(5), Article 17(6).

Article 17

Requests for data to be made available

  1. 1.

    When requesting data pursuant to Article 1415a, a public sector body, the Commission, the European Central Bank or a Union body shall:

    1. (a)

      specify the data required, including the relevant metadata necessary to interpret and use those data;

    2. (b)

      demonstrate that the conditions necessary for the existence of an exceptional need as referred to inmake a request under Article 15 for the purpose of which the data are requested15a are met;

    3. (c)

      explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the exceptionalpublic needemergency;

    4. (d)

      specify, if possible, when the data are expected to be erased by all parties that have access to them;

    5. (e)

      justify the choice of data holder to which the request is addressed;

    6. (f)

      specify any other public sector bodies or the Commission, European Central Bank or Union bodies and the third parties with which the data requested is expected to be shared with;

    7. (g)

      where personal data are requested, specify any technical and organisational measures necessary and proportionate to implement data protection principles and necessary safeguards, such as pseudonymisation, and whether anonymisation can be applied by the data holder before making the data available;

    8. (h)

      state the legal provision allocating to the requesting public sector body, the Commission, the European Central Bank or the Union body the specific task carried out in the public interest relevant for requesting the data;

    9. (i)

      specify the deadline by which the data are to be made available and the deadline referred to in Article 18(2) by which the data holder may decline or seek modification of the request;

    10. (j)

      make its best efforts to avoid compliance with the data request resulting in the data holders’ liability for infringement of Union or national law.

  2. 2.

    A request for data made pursuant to paragraph 1 of this Article shall:

    The European Central Bank and Union bodies shall inform the Commission of their requests.

    1. (a)

      be made in writing and expressed in clear, concise and plain language understandable to the data holder;

    2. (b)

      be specific regarding the type of data requested and correspond to data which the data holder has control over at the time of the request;

    3. (c)

      be proportionate to the exceptionalpublic needemergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access ofto the data requested;

    4. (d)

      respect the legitimate aims of the data holder, committing to ensuring the protection of trade secrets in accordance with Article 19(3), and the cost and effort required to make the data available;

    5. (e)

      concern non-personal data, and only if this is demonstrated to be insufficient to respond to the exceptional need to use data, in accordance with Article 15(1), point (a), request personal data in pseudonymised form and establish the technical and organisational measures that are to be taken to protect the data;

    6. (f)

      inform the data holder of the penalties that are to be imposed pursuant to Article 40 by the competent authority designated pursuant to Article 37 in the event of non-compliance with the request;

    7. (g)

      where the request is made by a public sector body, be transmitted to the data coordinator referred to in Article 37 of the Member State where the requesting public sector body is established, who shall make the request publicly available online without undue delay unless the data coordinator considers that such publication would create a risk for public security;

    8. (h)

      where the request is made by the Commission, the European Central Bank or a Union body, be made available online without undue delay;

    9. (i)

      where personal data are requested, be notified without undue delay to the supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679 in the Member State where the public sector body is established.

  3. 3.

    A public sector body, the Commission, the European Central Bank or a Union body shall not make data obtained pursuant to this Chapter available for reuse as defined in Article 2, point (2), of Regulation (EU) 2022/868 or Article 2, point (11), of Directive (EU) 2019/1024. Regulation (EU) 2022/868 and Directive (EU) 2019/1024 shall not apply to the data held by public sector bodies obtained pursuant to this Chapter.

  4. 4.

    Paragraph 3 of this Article does not preclude a public sector body, the Commission, the European Central Bank or a Union body to exchange data obtained pursuant to this Chapter with another public sector body or the Commission, the European Central Bank or a Union body in view of completing the tasks referred to in Article 15, as specified in the request in accordance with paragraph 1, point (f), of this Article or to make the data available to a third party where it has delegated, by means of a publicly available agreement, technical inspections or other functions to that third party. The obligations on public sector bodies pursuant to Article 19, in particular safeguards to preserve the confidentiality of trade secrets, shall apply also to such third parties. Where a public sector body, the Commission, the European Central Bank or a Union body transmits or makes data available under this paragraph, it shall notify the data holder from whom the data was received without undue delay.

  5. 5.

    Where the data holder considers that its rights under this Chapter have been infringed by the transmission or making available of data, it may lodge a complaint with the competent authority designated pursuant to Article 37 of the Member State where the data holder is established.

  6. 6.

    The Commission shall develop a model template for requests pursuant to this Article.

Commission source wording and instructions

Article 17(1)(b)

Commission proposal

(b) demonstrate that the conditions to make a request under Article 15a are met;

Article 17(1)(c)

Commission proposal

(c) explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the public emergency;

Article 17(1), introductory wording

Commission proposal

When requesting data pursuant to Article 15a, a public sector body, the Commission, the European Central Bank or a Union body shall:

Article 17(2)(c)

Commission proposal

(c) be proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;

Article 17(2)(e)

Commission proposal

9. Article 17 is amended as follows: (a) paragraph 1 is amended as follows: (i) the introductory wording is replaced by the following: ‘When requesting data pursuant to Article 15a, a public sector body, the Commission, the European Central Bank or a Union body shall:’; (ii) points (b) and (c) are replaced by the following: ‘(b) demonstrate that the conditions to make a request under Article 15a are met; (c) explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the public emergency;’; (b) paragraph 2 is amended as follows: (i) point (c) is replaced by the following: ‘(c) be proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;’; (ii) point (e) is deleted.; (c) paragraphs 5 and 6 are deleted;

Article 17(5)

Commission proposal

9. Article 17 is amended as follows: (a) paragraph 1 is amended as follows: (i) the introductory wording is replaced by the following: ‘When requesting data pursuant to Article 15a, a public sector body, the Commission, the European Central Bank or a Union body shall:’; (ii) points (b) and (c) are replaced by the following: ‘(b) demonstrate that the conditions to make a request under Article 15a are met; (c) explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the public emergency;’; (b) paragraph 2 is amended as follows: (i) point (c) is replaced by the following: ‘(c) be proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;’; (ii) point (e) is deleted.; (c) paragraphs 5 and 6 are deleted;

Article 17(6)

Commission proposal

9. Article 17 is amended as follows: (a) paragraph 1 is amended as follows: (i) the introductory wording is replaced by the following: ‘When requesting data pursuant to Article 15a, a public sector body, the Commission, the European Central Bank or a Union body shall:’; (ii) points (b) and (c) are replaced by the following: ‘(b) demonstrate that the conditions to make a request under Article 15a are met; (c) explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the public emergency;’; (b) paragraph 2 is amended as follows: (i) point (c) is replaced by the following: ‘(c) be proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;’; (ii) point (e) is deleted.; (c) paragraphs 5 and 6 are deleted;

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

View full Council comparison →

Article 17(1)(b)

June Presidency compromise · 10 June

Council wording reconstructed for this provision from the official operation

(b) demonstrate that the conditions for the request under Article 15a are met

Article 17(1)(c)

June Presidency compromise · 10 June

(c) explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the public emergency;

Article 17(1), introductory wording

June Presidency compromise · 10 June

When requesting data pursuant to Article 15a, a public sector body, the Commission, the European Central Bank or a Union body shall:

Article 17(2)(c)

June Presidency compromise · 10 June

(c) be proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;

Article 17(2)(e)

June Presidency compromise · 10 June

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction
9.

Article 17 is amended as follows:

(a)

paragraph 1 is amended as follows:

(i)

the introductory wording is replaced by the following: ‘When requesting data pursuant to Article 15a, a public sector body, the Commission, the European Central Bank or a Union body shall:;’

(ii)

points (b) and (c) are replaced by the following: ‘(b) demonstrate that the conditions for the request under Article 15a are met;

(c)

explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the public emergency;;’

(b)

paragraph 2 is amended as follows:

(i)

point (c) is replaced by the following:

‘(c)

be proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;;’

(ii)

point (e) is deleted.;

(iii)

Point (i) is replaced by the following: ‘(i)where personal data are requested, be notified without undue delay to the supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679 in the Member State where the public sector body is established or to the EDPS where the request is made by the Commission, the European Central Bank or a Union body.’ (ba) paragraph 4 is replaced by the following: ‘Paragraph 3 of this Article does not preclude a public sector body, the Commission, the European Central Bank or a Union body to exchange data obtained pursuant to this Chapter with another public sector body or the Commission, the European Central Bank or a Union body in view of completing the tasks referred to in Article 15a, as specified in the request in accordance with paragraph 1, point (f), of this Article or to make the data available to a third party where it has delegated, by means of a publicly available agreement, technical inspections or other functions to that third party. The obligations on public sector bodies pursuant to Article 19, in particular safeguards to preserve the confidentiality of trade secrets, shall apply also to such third parties. Where a public sector body, the Commission, the European Central Bank or a Union body transmits or makes data available under this paragraph, it shall notify the data holder from whom the data was received without undue delay.’

(c)

paragraphs 5 and 6 are deleted;

Article 17(5)

June Presidency compromise · 10 June

Exact provision wording unavailable within a wider Council operation

This provision forms part of a wider Council operation. Its wording is not available separately here; open the official source for the full passage.

Official source passage and amending instruction
9.

Article 17 is amended as follows:

(a)

paragraph 1 is amended as follows:

(i)

the introductory wording is replaced by the following: ‘When requesting data pursuant to Article 15a, a public sector body, the Commission, the European Central Bank or a Union body shall:;’

(ii)

points (b) and (c) are replaced by the following: ‘(b) demonstrate that the conditions for the request under Article 15a are met;

(c)

explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the public emergency;;’

(b)

paragraph 2 is amended as follows:

(i)

point (c) is replaced by the following:

‘(c)

be proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;;’

(ii)

point (e) is deleted.;

(iii)

Point (i) is replaced by the following: ‘(i)where personal data are requested, be notified without undue delay to the supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679 in the Member State where the public sector body is established or to the EDPS where the request is made by the Commission, the European Central Bank or a Union body.’ (ba) paragraph 4 is replaced by the following: ‘Paragraph 3 of this Article does not preclude a public sector body, the Commission, the European Central Bank or a Union body to exchange data obtained pursuant to this Chapter with another public sector body or the Commission, the European Central Bank or a Union body in view of completing the tasks referred to in Article 15a, as specified in the request in accordance with paragraph 1, point (f), of this Article or to make the data available to a third party where it has delegated, by means of a publicly available agreement, technical inspections or other functions to that third party. The obligations on public sector bodies pursuant to Article 19, in particular safeguards to preserve the confidentiality of trade secrets, shall apply also to such third parties. Where a public sector body, the Commission, the European Central Bank or a Union body transmits or makes data available under this paragraph, it shall notify the data holder from whom the data was received without undue delay.’

(c)

paragraphs 5 and 6 are deleted;

Article 17(6)

June Presidency compromise · 10 June

Exact provision wording unavailable within a wider Council operation

This provision forms part of a wider Council operation. Its wording is not available separately here; open the official source for the full passage.

Official source passage and amending instruction
9.

Article 17 is amended as follows:

(a)

paragraph 1 is amended as follows:

(i)

the introductory wording is replaced by the following: ‘When requesting data pursuant to Article 15a, a public sector body, the Commission, the European Central Bank or a Union body shall:;’

(ii)

points (b) and (c) are replaced by the following: ‘(b) demonstrate that the conditions for the request under Article 15a are met;

(c)

explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the public emergency;;’

(b)

paragraph 2 is amended as follows:

(i)

point (c) is replaced by the following:

‘(c)

be proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;;’

(ii)

point (e) is deleted.;

(iii)

Point (i) is replaced by the following: ‘(i)where personal data are requested, be notified without undue delay to the supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679 in the Member State where the public sector body is established or to the EDPS where the request is made by the Commission, the European Central Bank or a Union body.’ (ba) paragraph 4 is replaced by the following: ‘Paragraph 3 of this Article does not preclude a public sector body, the Commission, the European Central Bank or a Union body to exchange data obtained pursuant to this Chapter with another public sector body or the Commission, the European Central Bank or a Union body in view of completing the tasks referred to in Article 15a, as specified in the request in accordance with paragraph 1, point (f), of this Article or to make the data available to a third party where it has delegated, by means of a publicly available agreement, technical inspections or other functions to that third party. The obligations on public sector bodies pursuant to Article 19, in particular safeguards to preserve the confidentiality of trade secrets, shall apply also to such third parties. Where a public sector body, the Commission, the European Central Bank or a Union body transmits or makes data available under this paragraph, it shall notify the data holder from whom the data was received without undue delay.’

(c)

paragraphs 5 and 6 are deleted;

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

More filters

Political group at the amendment date where available; otherwise the current Parliament affiliation.

Remove proposed wording Amendment 17 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
Preview
against:
Additional proposed wording Amendment 18 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
Preview
against:
Alternative wording Amendment 32 JURI draft opinion · Brando Benifei (rapporteur)
(ba) paragraph 4 is replaced by the following:
4. Paragraph 3 of this Article does not preclude a public sector body, the Commission, the European Central Bank or a Union body to exchange data obtained pursuant to this Chapter with another public sector body or the Commission, the European Central Bank or a Union body in view of completing the tasks referred to in Article 1515a, as specified in the request in accordance with paragraph 1, point (f), of this Article or to make the data available to a third party where it has delegated, by means of a publicly available agreement, technical inspections or other functions to that third party. The obligations on public sector bodies pursuant to Article 19, in particular safeguards to preserve the confidentiality of trade secrets, shall apply also to such third parties. Where a public sector body, the Commission, the European Central Bank or a Union body transmits or makes data available under this paragraph, it shall notify the data holder from whom the data was received without undue delay.’;
Justification

This amendment clarifies the conditions under which data obtained under Chapter V may be shared between public authorities or made available to delegated third parties. It strengthens operational cooperation in emergency situations while maintaining transparency obligations and safeguards for confidentiality and trade secret protection.

Preview
against:
Alternative wording Amendment 48 IMCO draft opinion · Alex Agius Saliba (rapporteur)
(c) be proportionate to the exceptional needs of the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;;
Preview
against:
Remove proposed wording Amendment 49 IMCO draft opinion · Alex Agius Saliba (rapporteur)
(ii) point (e) is deleted.;
Justification

Following the advice of the EDPB-EDPS joint opinion paragraphs 122-124.

Preview
against:
Remove proposed wording Amendment 189 · Laurence Farreng JURI

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 17

9. Article 17 is amended as follows: (a) paragraph 1 is amended as follows: (i) the introductory wording is replaced by the following: ‘When requesting data pursuant to Article 15a, a public sector body, the Commission, the European Central Bank or a Union body shall:;’ (b) demonstrate that the conditions to make a request under Article 15a are met; (c) explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is to address the public emergency;;’ (i) point (c) is replaced by the following: (c) be proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;;’ (c) paragraphs 5 and 6 are deleted;
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 / Regulation (EU) 2023/2854 / Article 17

Deletion marker printed in the source: deleted

Additional proposed wording Amendment 190 · David Cormand JURI

(ba) paragraph 4 is replaced by the following

4.

Paragraph 3 of this Article does not preclude a public sector body, the Commission, the European Central Bank or a Union body to exchange data obtained pursuant to this Chapter with another public sector body or the Commission, the European Central Bank or a Union body in view of completing the tasks referred to in Article 15a, as specified in the request in accordance with paragraph 1, point (f), of this Article or to make the data available to a third party where it has delegated, by means of a publicly available agreement, technical inspections or other functions to that third party. The obligations on public sector bodies pursuant to Article 19, in particular safeguards to preserve the confidentiality of trade secrets, shall apply also to such third parties. Where a public sector body, the Commission, the European Central Bank or a Union body transmits or makes data available under this paragraph, it shall notify the data holder from whom the data was received without undue delay.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 – point b a (new) / Regulation (EU) 2023/2854 / Article 17 – paragraph 4

Alternative wording Amendment 657 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
(c) explain the purpose of the request, the intended use of the data requested, including, where applicable, by a third party in accordance with paragraph 4 of this Article, the duration of that use, and, where relevant, how the processing of personal data is necessary to address and how it will respond to the public emergency;;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 – point a – point ii / Regulation (EU) 2023/2854 / Article 17 – paragraph 1 – point c

Additional proposed wording Amendment 658 · Damian Boeselager on behalf of the Verts/ALE Group ITRE · LIBE

(iia) In Article 17, paragraph 2, the following subparagraph is added

The Commission, the European Central Bank (ECB) or any of the Union Bodies, shall notify the European Data Protection Supervisor of their requests for personal data.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 – point a – point ii a (new) / Regulation (EU) 2023/2854 / Article 17 – paragraph 2 – subparagraph (new)

Alternative wording Amendment 659 · Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba ITRE · LIBE
(c) be proportionate to the exceptional needs of the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;;
Justification

Brings back current wording of the Data Act

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 – point b – point i / Regulation (EU) 2023/2854 / Article 17 – paragraph 2 – point c

Alternative wording Amendment 660 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
(c) be strictly proportionate to the public emergency and duly justified, regarding the granularity and volume of the data requested and the frequency of access to the data requested;;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 – point b – point i / Regulation (EU) 2023/2854 / Article 17 – paragraph 2 – point c

Remove proposed wording Amendment 661 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 – point b – point ii / Regulation (EU) 2023/2854 / Article 17 – paragraph 2 – subparagraph 1 – point e

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 662 · Damian Boeselager on behalf of the Verts/ALE Group ITRE · LIBE
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 – point b – point ii / Regulation (EU) 2023/2854 / Article 17 paragraph 2 – subparagraph 1 – point e

Deletion marker printed in the source: deleted

Alternative wording Amendment 663 · Damian Boeselager on behalf of the Verts/ALE Group ITRE · LIBE
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 – point c / Regulation 2023/2854 / Article 17 paragraph 6

Additional proposed wording Amendment 664 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE

i) In Article 17, paragraph 2, the following subparagraph is added

Within six months of the request, the Commission, ECB and Union bodies shall notify the European Data Protection Superviser (EDPS) of their requests for personal data, including how the requested personal data was used to respond to the public emergency and why the requested personal data was necessary to respond to the public emergency.

Within six months of the request, public sector bodies shall notify their supervisory authority within the meaning of Regulation (EU) 2016/679 and the European Data Protection Board (EDPB) of their requests for personal data, including how the requested personal data was used to respond to the public emergency and why the requested personal data was necessary to respond to the public emergency.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 9 – point c – point i (new) / Regulation (EU) 2023/2854 / Article 17 – paragraph 2 – subparagraph 2 a (new)