Data Act· Article 32

Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.

[...]

Justification

This amendment preserves the original scope and structure of Article 32 in order to maintain legal coherence and effective supervision within the Data Act framework. Extending sensitive third-country access obligations to actors subject to a lighter and more voluntary regime could create legal uncertainty and weaken accountability safeguards.

1. Providers of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation, as well as any processor or secondary processor acting on their behalf, shall take all adequate technical, organisational and legal measures, including contracts, in order to prevent international and third-country governmentalany access and transfer ofto non-personal data held in the Union or any transfer of such data requested by a third-country authority or by an international body, where such transfer or access would create a conflict with Union law or with the national law of the relevant Member State, without prejudice to paragraph 2 or 3. That obligation shall apply irrespective of the place of establishment of the entity which holds or controls the data, where the data are held in the Union.

1. Providers of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation, and any processor or subcontractor acting on their behalf, shall take all adequate technical, organisational and legal measures, including contracts, in order to prevent international and third-country governmentalany access andto, or transfer of, non-personal data held in the Union that is requested or ordered by a third-country authority or by an international body, where such transfer or access would create a conflict with, or would undermine the objectives of Union law or with the national law of the relevant Member State, without prejudice to paragraph 2 or 3. This obligation shall apply irrespective of the place of establishment of the entity holding or controlling the data, where the data are held in the Union.

2. Any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union shall be recognised or enforceable in any manner only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, or any such agreement between the requesting third country and a Member State.’. Where the agreement is concluded between the requesting third country and the Union, it shall only give access to the data held by the institutions, agencies and bodies of the Union, and where it is concluded between the requesting third country and a Member State, it shall not give access to data held in any other Member State;

2. Any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union shall be recognised or enforceable in any manner only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, or any such agreement between the requesting third country and a Member State.; Where the agreement is concluded between the requesting third country and the Union, it shall only give access to the data held by Union institutions, agencies and bodies, and where it is concluded between the requesting third country and a Member State, it shall not give access to data held in any other Member State.

5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data before complying with that request, except where the request servesis lawmade enforcementby competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties and for as long as this is necessary to preserve the effectiveness of the law enforcement activity. Where informing the natural or legal person before compliance would seriously and demonstrably undermine a lawful investigation or enforcement activity, notification may be delayed only for as long as strictly necessary and proportionate. The reasons for delayed notification shall be documented and made available to the competent authority upon request. The affected person shall be informed as soon as the reason for delay no longer applies. Providers and other addressees shall publish annual transparency reports containing aggregate information on third-country access requests, legal bases invoked, categories of data concerned, the number of requests complied with, refused, or challenged, and the number of cases in which notification was delayed.’;

5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data, pursuant to an international agreement as referred to in paragraph 2, before complying withexamining that request, except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.’;

5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data before complying with that request, except where the request servesis lawmade enforcementby purposesa competent authority for the purpose of the prevention, investigation, detection or prosecution of criminal offences or for the execution of criminal penalties and for as long as this is necessary to preserve the effectiveness of the law enforcement activity. Where informing the natural or legal person before compliance would seriously and demonstrably undermine a lawful investigation or enforcement activity, notification may be delayed only for as long as strictly necessary and proportionate. The reasons for delayed notification shall be documented and made available to the competent authority upon request. The affected person shall be informed as soon as the reason for delay no longer applies. Providers and other addressees shall publish annual transparency reports containing aggregate information on third-country access requests, including third-countries making the requests, legal bases invoked, categories of data concerned, and the number of requests complied with, refused, or challenged.;

5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority pursuant to an international agreement referred to in paragraph 2 to access its data before complyingexamining with that request, except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.;