Data Act· Article 19
Text
Article 19 Data Act as printed in the Council text of 22 October 2026
Obligations of public sector bodies, the Commission, the European Central Bank and Union bodies
Source Council, 22 October 2026. Article 19: ST 14756/26, page 76 · pp. 76–77 · exact text page
Scope This text prints Article 19(1), introductory wording, Article 19(1)(c), Article 19(3) only.
Article 19(1), introductory wording
A public sector body, the Commission, the European Central Bank or a Union body receiving data pursuant to a request made under Article 15a shall:
Article 19(1)(c)
erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and individuals or organisations that received the data pursuant to Article 21(1) without undue delay that the data have been erased, unless archiving of the data is required in accordance with Union or national law on public access to information in the context of transparency obligations.
Article 19(3)
Disclosure of trade secrets to a public sector body, the Commission, the European Central Bank or a Union body shall be required only to the extent that it is strictly necessary to achieve the purpose of a request under Article 15a. In such a case, the data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata. The public sector body, the Commission, the European Central Bank or the Union body shall, prior to the disclosure of trade secrets, take all necessary and appropriate technical and organisational measures to preserve the confidentiality of the trade secrets, including, as appropriate, the use of model contractual terms, technical standards and the application of codes of conduct.
How the provision changed
Each text against the law in forceEach text against the text before it
| What each text would do to the law in force | ||||||
|---|---|---|---|---|---|---|
| Element | Commission19 Nov 2025Art 19 | Council10 Jun 2026Art 19 | Council18 Jun 2026Art 19 | Council3 Sep 2026Art 19 | Council2 Oct 2026Art 19 | Council22 Oct 2026Art 19 |
| Compared with | law in force | the proposal | 10 Jun text | 18 Jun text | 3 Sep text | 2 Oct text |
| From the Commission’s Article 19 | ||||||
| Introductory wording for bodies receiving data | 19(1), introductory wording Adds Added | 19(1), introductory wording Adds Unchanged | 19(1), introductory wording Adds Unchanged | 19(1), introductory wording Adds Unchanged | 19(1), introductory wording Adds Unchanged | 19(1), introductory wording Adds Unchanged |
| Disclosure of trade secrets | 19(3) Adds Added | 19(3) Adds Unchanged | 19(3) Adds Unchanged | 19(3) Adds Unchanged | 19(3) Adds Unchanged | 19(3) Adds Unchanged |
| Added in the Council texts | ||||||
| Erasing data that are no longer needed | Not in the law in force or this text In neither text | 19(1)(c) Adds, added since the proposal Added | 19(1)(c) Adds Unchanged | 19(1)(c) Adds Unchanged | 19(1)(c) Adds Unchanged | 19(1)(c) Adds Unchanged |
Each text against the law in force: +Adds adds a provision the law in force lacks— neither the law in force nor the text has it changed from the text before
Each text against the text before it: +Added in this text, not in the text before=Unchanged same as the text before— in neither text
Parliament amendments
10 amendments to this article
1 would delete the wording, 5 propose alternative wording and 4 would add wording.
| Type | S&D | Renew | ECR | PfE | NI | Rapporteur |
|---|---|---|---|---|---|---|
| − Deletion | · | 1 | · | · | · | · |
| ~ Alternative | 1 | 2 | · | · | 1 | 1 |
| + Addition | 1 | · | 2 | 3 | · | · |
By political group
- − Deletion Renew 1
- ~ Alternative S&D 1 Renew 2 NI 1 Rapporteur 1
- + Addition S&D 1 ECR 2 PfE 3
Show
Paragraph (1)1 amendment
192 −Deletion Laurence FarrengRenew · JURI Deletes the introductory wording
Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.
11. Article 19 is amended as follows: (a) in paragraph 1, the introductory wording is replaced by the following: ‘A public sector body, the Commission, the European Central Bank or a Union body receiving data pursuant to a request made under Article 15a shall:;’ 3. Disclosure of trade secrets to a public sector body, the Commission, the European Central Bank or a Union body shall be required only to the extent that it is strictly necessary to achieve the purpose of a request under Article 15a. In such a case, the data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata. The public sector body, the Commission, the European Central Bank or the Union body shall, prior to the disclosure of trade secrets, take all necessary and appropriate technical and organisational measures to preserve the confidentiality of the trade secrets, including, as appropriate, the use of model contractual terms, technical standards and the application of codes of conduct.;’- Tabled by
- Laurence Farreng
- Group
- Renew
- Targets
- Data Act Article 19
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 1 – paragraph 1 – point 11 / Regulation (EU) 2023/2854 / Article 19
Paragraph (1)(c)3 amendments
33 ~Alternative Brando Benifei (rapporteur)Rapporteur · JURI “erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and individuals or organisations that…”
(aa) in paragraph 1, point (c) is replaced by the following:
(c) erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and individuals or organisations that received the data pursuant to Article 21(1) without undue delay that the data have been erased, unless archiving of the data is required in accordance with Union or national law on public access to
documentsinformation in the context of transparency obligations.’;Justification
This amendment clarifies the relationship between data deletion obligations and existing Union or national rules on transparency and public access to information. It helps ensure legal certainty for public authorities while preserving the principle that data should be erased once no longer necessary for the stated purpose.
- Rapporteur
- Brando Benifei
- Group
- Rapporteur
- Targets
- Data Act Article 19 – paragraph 1 – point c
- Document
- JURI draft opinion
- Printed header
- Article 1 – paragraph 1 – point 11 – point a a (new) / Regulation (EU) 2023/2854 / Article 19 – paragraph 1 – point c
667 +Addition Julie Rechagneux +8ECR, PfE · ITRE–LIBE “erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and individuals or organisations that…”
(aa) In Article 19, paragraph 1, point c is replaced by the following
(c)erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and individuals or organisations that received the data pursuant to Article 21(1) without undue delay that the data have been erased, unless archiving of the data is required in accordance with Union or national law on public access to information in the context of transparency obligations.'
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- Data Act Article 19 – paragraph 1 – point c
- Document
- ITRE–LIBE amendments 527–776 to the draft report
- Printed header
- Article 1 – paragraph 1 – point 11 – point a a (new) / Regulation (EU) 2023/2854 / Article 19 – paragraph 1 – point c
668 +Addition Elena Sancho Murillo +6S&D · ITRE–LIBE “erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and individuals or organisations that…”
(aa) In Article 19, paragraph 1, point c is replaced by the following
(c)erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and individuals or organisations that received the data pursuant to Article 21(1) without undue delay that the data have been erased, unless archiving of the data is required in accordance with Union or national law on public access to information in the context of transparency obligations.’
- Tabled by
- Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
- Group
- S&D
- Targets
- Data Act Article 19 – paragraph 1 – point c
- Document
- ITRE–LIBE amendments 527–776 to the draft report
- Source
- Official text, page 109
- Printed header
- Article 1 – paragraph 1 – point 11 – point a a (new) / Regulation (EU) 2023/2854 / Article 19 – paragraph 1– point c
Paragraph (3)Disclosure of trade secrets5 amendments
254 ~Alternative Morten Løkkegaard +2Renew · IMCO “and where the requesting authority has demonstrated that no alternative source of information capable of achieving the same objective is available”
3. Disclosure of trade secrets to a public sector body, the Commission, the European Central Bank or a Union body shall be required only to the extent that it is strictly necessary and where the requesting authority has demonstrated that no alternative source of information capable of achieving the same objective is available to achieve the purpose of a request under Article 15a. In such a case, the data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata. The public sector body, the Commission, the European Central Bank or the Union body shall, prior to the disclosure of trade secrets, take all necessary and appropriate technical and organisational measures to preserve the confidentiality of the trade secrets, including, as appropriate, the use of model contractual terms, technical standards and the application of codes of conduct.;
- Tabled by
- Morten Løkkegaard, Svenja Hahn, Sandro Gozi
- Group
- Renew
- Targets
- Data Act Article 19(3)
- Document
- IMCO amendments 125–328 to the draft opinion
- Printed header
- Article 1 – paragraph 1 – point 11 – point b / Regulation (EU) 2023/2854 / Article 19 – paragraph 3
255 +Addition Virginie JoronPfE · IMCO “The public sector body, the Commission, the European Central Bank or a Union body, as well as any joint venture shall ensure that trade secrets…”
(ba) the following paragraph 3a is inserted
The public sector body, the Commission, the European Central Bank or a Union body, as well as any joint venture shall ensure that trade secrets obtained in the context of a public emergency are erased as soon as they are no longer necessary for the purposes for which the request was made. Where those data are shared with a third party, the recipient must as far as possible be given access without data transmission or data downloading, and must erase the data as soon as they are no longer necessary and must not transmit them to third parties.
- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- Data Act Article 19(3)
- Document
- IMCO amendments 125–328 to the draft opinion
- Source
- Official text, page 111
- Printed header
- Article 1 – paragraph 1 – point 11 – point b a (new) / Regulation (EU) No 2023/2854 / Article 19 – paragraph 3 a
669 ~Alternative Diana Iovanovici ŞoşoacăNI · ITRE–LIBE “In case of disclosure, the public sector body, the Commission, the European Central Bank or the Union body shall notify the trade secret holder…”
(3) Disclosure of trade secrets to a public sector body, the Commission, the European Central Bank or a Union body shall be required only to the extent that it is strictly necessary to achieve the purpose of a request under Article 15a. In such a case, the data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata. The public sector body, the Commission, the European Central Bank or the Union body shall, prior to the disclosure of trade secrets, take all necessary and appropriate technical and organisational measures to preserve the confidentiality of the trade secrets, including, as appropriate, the use of model contractual terms, technical standards and the application of codes of conduct, as well as the implementation of data minimisation principles, needs-based access separation, encryption of data in transit and at rest, and regular monitoring and assessment of the risks of unauthorised disclosure. In case of disclosure, the public sector body, the Commission, the European Central Bank or the Union body shall notify the trade secret holder within a reasonable period of time, limit the disclosure to what is strictly necessary and take remedial measures, including data recovery or termination of disclosure, as requested or decided upon by the competent authority. Any authorised disclosure shall be conducted in accordance with the applicable legal framework, respecting the rights of the trade secret holder, the safeguards adopted and the principles of transparency, proportionality and information security. The trade secret holder may request that compliance with those measures be monitored and may challenge an unjustified or excessive disclosure before the competent authorities.
Justification
Data privacy is essential, even in emergency situations, and requires clearly defined conditions for access and protection.
- Tabled by
- Diana Iovanovici Şoşoacă
- Group
- NI
- Targets
- Data Act Article 19(3)
- Document
- ITRE–LIBE amendments 527–776 to the draft report
- Printed header
- Article 1 – paragraph 1 – point 11 – point b / Regulation (EU) 2023/2854 / Article 19 – paragraph 3
670 ~Alternative Elena Sancho Murillo +6S&D · ITRE–LIBE “instead, it must trigger protective measures, limitations, and controls. Such measures must be proportionate and designed to safeguard the…”
3. Disclosure of trade secrets to a public sector body, the Commission, the European Central Bank or a Union body shall be required only to the extent that it is strictly necessary to achieve the purpose of a request under Article 15a. In such a case, the data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata. The public sector body, the Commission, the European Central Bank or the Union body shall, prior to the disclosure of trade secrets, take all necessary and appropriate technical and organisational measures to preserve the confidentiality of the trade secrets, including, as appropriate, the use of model contractual terms, technical standards and the application of codes of conduct. The disclosure of trade secrets shall not automatically prevent access; instead, it must trigger protective measures, limitations, and controls. Such measures must be proportionate and designed to safeguard the confidentiality of trade secrets while allowing necessary access in response to public sector requests.
- Tabled by
- Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
- Group
- S&D
- Targets
- Data Act Article 19(3)
- Document
- ITRE–LIBE amendments 527–776 to the draft report
- Printed header
- Article 1 – paragraph 1 – point 11 – point b / Regulation (EU) 2023/2854 / Article 19 – paragraph 1
671 ~Alternative Michael McNamara +4Renew · ITRE–LIBE “confidentiality agreements, strict access protocols”
3. Disclosure of trade secrets to a public sector body, the Commission, the European Central Bank or a Union body shall be required only to the extent that it is strictly necessary to achieve the purpose of a request under Article 15a. In such a case, the data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata. The public sector body, the Commission, the European Central Bank or the Union body shall, prior to the disclosure of trade secrets, take all necessary and appropriate technical and organisational measures pursuant to Article 4(6) of this Regulation to preserve the confidentiality of the trade secrets, including, as appropriate, the use of model contractual terms, confidentiality agreements, strict access protocols, technical standards and the application of codes of conduct.
;- Tabled by
- Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
- Group
- Renew
- Targets
- Data Act Article 19(3)
- Document
- ITRE–LIBE amendments 527–776 to the draft report
- Source
- Official text, page 112
- Printed header
- Article 1 – paragraph 1 – point 11 – point b / Regulation (EU) 2023/2854 / Article 19 – paragraph 3
New paragraphs1 amendment
672 +Addition Julie Rechagneux +8ECR, PfE · ITRE–LIBE “The public sector body, the Commission, the European Central Bank or the Union body, as well as any joint undertaking, shall ensure that trade…”
3a. In Article 19, the following paragraph 3a is added:
The public sector body, the Commission, the European Central Bank or the Union body, as well as any joint undertaking, shall ensure that trade secrets obtained in the context of a public emergency are erased as soon as they are no longer necessary for the purpose for which the request was made. Where such data are shared with a third party, the recipient shall, to the extent possible, be granted access without transmission or downloading of the data, and shall be bound to erase the data once they are no longer necessary and not to transmit them onward to any further party.
Justification
The disclosure of trade secrets to public bodies in the context of a public emergency, even where strictly necessary, exposes their holders to a heightened risk of unlawful use or onward dissemination. In order to preserve the confidentiality of trade secrets and the freedom to conduct a business, the safeguards should not be confined to the moment of disclosure but should extend to the subsequent handling of the data. This amendment provides that trade secrets obtained during a public emergency, including by any joint undertaking, are to be erased once they are no longer necessary, and that any sharing with a third party is, to the extent possible, to take place without transmission or downloading of the data, coupled with an obligation to erase and a prohibition on onward transmission. These measures ensure that the emergency-related use of trade secrets remains strictly proportionate to the purpose pursued.
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- Data Act Article 19 – paragraph 3a (new)
- Document
- ITRE–LIBE amendments 527–776 to the draft report
- Source
- Official text, page 113
- Printed header
- Article 1 – paragraph 1 – point 11 – point b / Regulation (EU) 2023/2854 / Article 19 – paragraph 3a (new)