Digital Omnibus tracker

Data Act · Regulation (EU) 2023/2854

Article 32

Compare the available Commission, Council and Parliament texts and amendments affecting this article.

Article total: 7 parts · 3 Council drafts · 12 Parliament amendments

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to Data Act

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 13 December 2023, with all 5 Commission proposal changes affecting this article applied.

Article 32

International governmental access and transfer

  1. 1.

    Providers of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation shall take all adequate technical, organisational and legal measures, including contracts, in order to prevent international and third-country governmental access and transfer of non-personal data held in the Union where such transfer or access would create a conflict with Union law or with the national law of the relevant Member State, without prejudice to paragraph 2 or 3.

  2. 2.

    Any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union shall be recognised or enforceable in any manner only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, or any such agreement between the requesting third country and a Member State.

  3. 3.

    In the absence of an international agreement as referred to in paragraph 2, where a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation is the addressee of a decision or judgment of a third-country court or tribunal or a decision of a third-country administrative authority to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union and compliance with such a decision or judgement would risk putting the addressee in conflict with Union law or with the national law of the relevant Member State, transfer to or access to such data by that third-country authority shall take place only where:

    The addressee of the decision or judgment may ask the opinion of the relevant national body or authority competent for international cooperation in legal matters, in order to determine whether the conditions laid down in the first subparagraph are met, in particular when it considers that the decision may relate to trade secrets and other commercially sensitive data as well as to content protected by intellectual property rights or the transfer may lead to re-identification. The relevant national body or authority may consult the Commission. If the addressee considers that the decision or judgment may impinge on the national security or defence interests of the Union or its Member States, it shall ask the opinion of the relevant national body or authority in order to determine whether the data requested concerns national security or defence interests of the Union or its Member States. If the addressee has not received a reply within one month, or if the opinion of such body or authority concludes that the conditions laid down in the first subparagraph are not met, the addressee may reject the request for transfer or access, to non-personal data, on those grounds.

    The EDIB referred to in Article 42 shall advise and assist the Commission in developing guidelines on the assessment of whether the conditions laid down in the first subparagraph of this paragraph are met.

    1. (a)

      the third-country system requires the reasons and proportionality of such a decision or judgment to be set out and requires such a decision or judgment to be specific in character, for instance by establishing a sufficient link to certain suspected persons or infringements;

    2. (b)

      the reasoned objection of the addressee is subject to a review by a competent third-country court or tribunal; and

    3. (c)

      the competent third-country court or tribunal issuing the decision or judgment or reviewing the decision of an administrative authority is empowered under the law of that third country to take duly into account the relevant legal interests of the provider of the data protected by Union law or by the national law of the relevant Member State.

  4. 4.

    If the conditions laid down in paragraph 2 or 3 are met, the provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall provide the minimum amount of data permissible in response to a request, on the basis of the reasonable interpretation of that request by the provider or relevant national body or authority referred to in paragraph 3, second subparagraph.

  5. 5.

    The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the customernatural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data before complying with that request, except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.

Commission source wording and instructions

Article 32(1)

Commission proposal

1. Providers of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation shall take all adequate technical, organisational and legal measures, including contracts, in order to prevent international and third-country governmental access and transfer of non-personal data held in the Union where such transfer or access would create a conflict with Union law or with the national law of the relevant Member State, without prejudice to paragraph 2 or 3.

Article 32(2)

Commission proposal

2. Any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union shall be recognised or enforceable in any manner only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, or any such agreement between the requesting third country and a Member State.

Article 32(3), first subparagraph introductory wording

Commission proposal

3. In the absence of an international agreement as referred to in paragraph 2, where a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation is the addressee of a decision or judgment of a third-country court or tribunal or a decision of a third-country administrative authority to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union and compliance with such a decision or judgement would risk putting the addressee in conflict with Union law or with the national law of the relevant Member State, transfer to or access to such data by that third-country authority shall take place only where:

Article 32(4)

Commission proposal

4. If the conditions laid down in paragraph 2 or 3 are met, the provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall provide the minimum amount of data permissible in response to a request, on the basis of the reasonable interpretation of that request by the provider or relevant national body or authority referred to in paragraph 3, second subparagraph.

Article 32(5)

Commission proposal

5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data before complying with that request, except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

Article 32(1)

June Presidency compromise · 10 June

Council wording reconstructed for this provision from the official operation

Article 32(2)

June Presidency compromise · 10 June

2. Any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union shall be recognised or enforceable in any manner only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, or any such agreement between the requesting third country and a Member State.

Article 32(3), first subparagraph introductory wording

June Presidency compromise · 10 June

3. In the absence of an international agreement as referred to in paragraph 2, where a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation is the addressee of a decision or judgment of a third-country court or tribunal or a decision of a third-country administrative authority to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union and compliance with such a decision or judgement would risk putting the addressee in conflict with Union law or with the national law of the relevant Member State, transfer to or access to such data by that third-country authority shall take place only where:

Article 32(4)

June Presidency compromise · 10 June

4. If the conditions laid down in paragraph 2 or 3 are met, the provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall provide the minimum amount of data permissible in response to a request, on the basis of the reasonable interpretation of that request by the provider or relevant national body or authority referred to in paragraph 3, second subparagraph.

Article 32(5)

June Presidency compromise · 10 June

5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data before complying with that request, except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

More filters

Political group at the amendment date where available; otherwise the current Parliament affiliation.

Alternative wording Amendment 20 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data before complying with that request, except where the request servesis lawmade enforcementby competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties and for as long as this is necessary to preserve the effectiveness of the law enforcement activity. Where informing the natural or legal person before compliance would seriously and demonstrably undermine a lawful investigation or enforcement activity, notification may be delayed only for as long as strictly necessary and proportionate. The reasons for delayed notification shall be documented and made available to the competent authority upon request. The affected person shall be informed as soon as the reason for delay no longer applies. Providers and other addressees shall publish annual transparency reports containing aggregate information on third-country access requests, legal bases invoked, categories of data concerned, the number of requests complied with, refused, or challenged, and the number of cases in which notification was delayed.’;
Preview
against:
Remove proposed wording Amendment 35 JURI draft opinion · Brando Benifei (rapporteur)

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 32

[...]
Justification

This amendment preserves the original scope and structure of Article 32 in order to maintain legal coherence and effective supervision within the Data Act framework. Extending sensitive third-country access obligations to actors subject to a lighter and more voluntary regime could create legal uncertainty and weaken accountability safeguards.

Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 / Regulation (EU) 2023/2854 / Article 32

Deletion marker printed in the source: deleted

Alternative wording Amendment 269 · Virginie Joron IMCO
1. Providers of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation, as well as any processor or secondary processor acting on their behalf, shall take all adequate technical, organisational and legal measures, including contracts, in order to prevent international and third-country governmentalany access and transfer ofto non-personal data held in the Union or any transfer of such data requested by a third-country authority or by an international body, where such transfer or access would create a conflict with Union law or with the national law of the relevant Member State, without prejudice to paragraph 2 or 3. That obligation shall apply irrespective of the place of establishment of the entity which holds or controls the data, where the data are held in the Union.
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point a / Regulation (EU) 2023/2854 / Article 32 – paragraph 1

Alternative wording Amendment 270 · Virginie Joron IMCO
2. Any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union shall be recognised or enforceable in any manner only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, or any such agreement between the requesting third country and a Member State.’. Where the agreement is concluded between the requesting third country and the Union, it shall only give access to the data held by the institutions, agencies and bodies of the Union, and where it is concluded between the requesting third country and a Member State, it shall not give access to data held in any other Member State;
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point a / Regulation 2023/2854 / Article 32 – paragraph 2

Additional proposed wording Amendment 271 · Virginie Joron IMCO
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point b / Regulation (EU) 2023/2854 / Article 32 – paragraph 3 a (new)

Alternative wording Amendment 272 · Virginie Joron IMCO
5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data, pursuant to an international agreement as referred to in paragraph 2, before complying withexamining that request, except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.’;
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point c / Regulation 2023/2854 / Article 32 – paragraph 5

Alternative wording Amendment 706 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
1. Providers of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation, and any processor or subcontractor acting on their behalf, shall take all adequate technical, organisational and legal measures, including contracts, in order to prevent international and third-country governmentalany access andto, or transfer of, non-personal data held in the Union that is requested or ordered by a third-country authority or by an international body, where such transfer or access would create a conflict with, or would undermine the objectives of Union law or with the national law of the relevant Member State, without prejudice to paragraph 2 or 3. This obligation shall apply irrespective of the place of establishment of the entity holding or controlling the data, where the data are held in the Union.
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point a / Regulation (EU) 2023/2854 / Article 32 – paragraph 1

Alternative wording Amendment 707 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
2. Any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union shall be recognised or enforceable in any manner only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, or any such agreement between the requesting third country and a Member State.; Where the agreement is concluded between the requesting third country and the Union, it shall only give access to the data held by Union institutions, agencies and bodies, and where it is concluded between the requesting third country and a Member State, it shall not give access to data held in any other Member State.
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point a / Regulation (EU) 2023/2854 / Article 32 – paragraph 2

Additional proposed wording Amendment 708 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
Justification

Non-personal data may include operational, industrial or strategic data whose disclosure to a third-country authority could undermine public security, the continuity of essential services or strategic and economic autonomy. This amendment gives Member States a narrowly framed tool to protect such data, subject to necessity, proportionality, notification to the Commission and publication of the designated categories.

Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point b / Regulation (EU) 2023/2854 / Article 32 – paragraph 3a (new)

Alternative wording Amendment 709 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data before complying with that request, except where the request servesis lawmade enforcementby purposesa competent authority for the purpose of the prevention, investigation, detection or prosecution of criminal offences or for the execution of criminal penalties and for as long as this is necessary to preserve the effectiveness of the law enforcement activity. Where informing the natural or legal person before compliance would seriously and demonstrably undermine a lawful investigation or enforcement activity, notification may be delayed only for as long as strictly necessary and proportionate. The reasons for delayed notification shall be documented and made available to the competent authority upon request. The affected person shall be informed as soon as the reason for delay no longer applies. Providers and other addressees shall publish annual transparency reports containing aggregate information on third-country access requests, including third-countries making the requests, legal bases invoked, categories of data concerned, and the number of requests complied with, refused, or challenged.;
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point c / Regulation (EU) 2023/2854 / Article 32 – paragraph 5

Alternative wording Amendment 710 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay ITRE · LIBE
5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority pursuant to an international agreement referred to in paragraph 2 to access its data before complyingexamining with that request, except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.;
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point c / Regulation (EU) 2023/2854 / Article 32 – Paragraph 5

Additional proposed wording Amendment 711 · Mary Khan ITRE · LIBE

Authorisation may only be granted if the request is based on an applicable international agreement, is limited to data that are strictly necessary, ensures an equivalent level of protection and excludes any onward transfer. The natural or legal persons concerned shall be informed prior to the transfer, unless a national court orders, for compelling reasons, that, for a limited period, they be informed at a later date.’

Justification

A private provider should not be able to make unilateral decisions concerning foreign access to strategic, public or sensitive data.

Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 16 – point c / Regulation (EU) 2023/2854 / Article 32 – paragraph 5 a (new)