Digital Omnibus tracker

Data Act · Regulation (EU) 2023/2854

Article 32x

Compare the available Commission, Council and Parliament texts and amendments affecting this article.

Article total: 9 parts · 3 Council drafts · 15 Parliament amendments

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to Data Act

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 13 December 2023, with the Commission proposal change affecting this article applied.

Article 32x

Requirements for transfers of non-personal data to third countries by re-users

  1. 1.

    Where a re-user intends to transfer certain categories of protected data that are non- personal to a third country, it shall inform the public sector body of its intention to transfer such data and the purpose of such transfer at the time of requesting the re-use of the data. In the case of re-use based on the data holder’s permission the re-user shall, where appropriate with the assistance of the public sector body, inform the natural or legal person whose rights and interests may be affected of that intention, purpose and the appropriate safeguards. The public sector body shall not allow the re-use unless the natural or legal person gives permission for the transfer.

  2. 2.

    Public sector bodies shall transmit non-personal confidential data or data protected by intellectual property rights to a re-user which intends to transfer those data to a third country other than a country designated in accordance with paragraph 7 only if the re-user contractually commits to:

    1. (a)

      complying with the obligations imposed in accordance with intellectual property rights and Union or national law on commercial or statistical confidentiality even after the data is transferred to the third country;

    2. (b)

      accepting the jurisdiction of the courts or tribunals of the Member State of the transmitting public sector body with regard to any dispute related to compliance with intellectual property rights and Union or national law on commercial or statistical confidentiality.

  3. 3.

    The Commission may adopt implementing acts establishing model contractual clauses for complying with the obligations referred to in paragraph 2 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).

  4. 4.

    Public sector bodies shall, where relevant and to the extent of their capabilities, provide guidance and assistance to re-users in complying with the obligations referred to in paragraph 2.

  5. 5.

    Where justified because of the substantial number of requests across the Union concerning the re-use of non- personal data in specific third countries, the Commission may adopt implementing acts declaring that the legal, supervisory and enforcement arrangements of a third country:

    1. (a)

      ensure protection of intellectual property and trade secrets in a way that is essentially equivalent to the protection ensured under Union law;

    2. (b)

      are being effectively applied and enforced; and

    3. (c)

      provide effective judicial redress.

  6. 6.

    Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).

  7. 7.

    Specific Union legislative acts may deem certain non-personal data categories held by public sector bodies to be highly sensitive for the purposes of this Article where their transfer to third countries may put at risk Union public policy objectives, such as safety and public health or may lead to the risk of re-identification of non- personal, anonymised data. Where such an act is adopted, the Commission shall adopt delegated acts in accordance with Article 45 supplementing this Regulation by laying down special conditions applicable to the transfers of such data to third countries. If required by a specific Union legislative act referred to in the first subparagraph, such special conditions may include terms applicable for the transfer or technical arrangements in this regard, limitations with regard to the re-use of data in third countries or categories of persons entitled to transfer such data to third countries or, in exceptional cases, restrictions with regard to transfers to third countries. The re-user to whom the right to re-use non-personal data was granted may transfer the data only to those third countries for which the requirements set out in paragraphs 2, 4 and 5 are met.

Commission source wording and instructions

Article 32x

Commission proposal

Article 32x Requirements for transfers of non-personal data to third countries by re-users (1) Where a re-user intends to transfer certain categories of protected data that are non-personal to a third country, it shall inform the public sector body of its intention to transfer such data and the purpose of such transfer at the time of requesting the re-use of the data. In the case of re-use based on the data holder’s permission the re-user shall, where appropriate with the assistance of the public sector body, inform the natural or legal person whose rights and interests may be affected of that intention, purpose and the appropriate safeguards. The public sector body shall not allow the re-use unless the natural or legal person gives permission for the transfer. (2) Public sector bodies shall transmit non-personal confidential data or data protected by intellectual property rights to a re-user which intends to transfer those data to a third country other than a country designated in accordance with paragraph 7 only if the re-user contractually commits to: (a) complying with the obligations imposed in accordance with intellectual property rights and Union or national law on commercial or statistical confidentiality even after the data is transferred to the third country; (b) accepting the jurisdiction of the courts or tribunals of the Member State of the transmitting public sector body with regard to any dispute related to compliance with intellectual property rights and Union or national law on commercial or statistical confidentiality. (3) The Commission may adopt implementing acts establishing model contractual clauses for complying with the obligations referred to in paragraph 2 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). (4) Public sector bodies shall, where relevant and to the extent of their capabilities, provide guidance and assistance to re-users in complying with the obligations referred to in paragraph 2. (5) Where justified because of the substantial number of requests across the Union concerning the re-use of non- personal data in specific third countries, the Commission may adopt implementing acts declaring that the legal, supervisory and enforcement arrangements of a third country: (a) ensure protection of intellectual property and trade secrets in a way that is essentially equivalent to the protection ensured under Union law; (b) are being effectively applied and enforced; and (c) provide effective judicial redress. (6) Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). (7) Specific Union legislative acts may deem certain non-personal data categories held by public sector bodies to be highly sensitive for the purposes of this Article where their transfer to third countries may put at risk Union public policy objectives, such as safety and public health or may lead to the risk of re-identification of non-personal, anonymised data. Where such an act is adopted, the Commission shall adopt delegated acts in accordance with Article 45 supplementing this Regulation by laying down special conditions applicable to the transfers of such data to third countries. If required by a specific Union legislative act referred to in the first subparagraph, such special conditions may include terms applicable for the transfer or technical arrangements in this regard, limitations with regard to the re-use of data in third countries or categories of persons entitled to transfer such data to third countries or, in exceptional cases, restrictions with regard to transfers to third countries. The re-user to whom the right to re-use non-personal data was granted may transfer the data only to those third countries for which the requirements set out in paragraphs 2, 4 and 5 are met.

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

Article 32x

June Presidency compromise · 10 June

Council wording reconstructed for this provision from the official operation

Article 32x Requirements for transfers of non-personal protected data to third countries by re-users

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

More filters

Alternative wording Amendment 318 · Virginie Joron IMCO
(1) Where a re-user intends to transfer certain categories of protected data that are non-personal to a third country, it shall inform the public sector body of its intention to transfer such data and the purpose of such transfer at the time of requesting the re-use of the data and, in any event, prior to the conclusion of any data sharing agreement. In the case of re-use based on the data holder’s permission the re-user shall, where appropriate with the assistance of the public sector body, and in any event prior to the conclusion of any contractual data transfer agreement, inform the natural or legal person whose rights and interests may be affected of that intention, purpose and the appropriate safeguards. The public sector body shall not allow the re-use unless the natural or legal person gives permission for the transfer.
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32 x

Alternative wording Amendment 319 · Virginie Joron IMCO
(3) The Commission may adopt implementing acts establishing model contractual clauses for complying with the obligations referred to in paragraph 2 of this Article. Those model contractual clauses shall ensure the protection of trade secrets, protection against the unauthorised transfer of knowledge, and the protection of the economic security of the Union and its Member States. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32 x

Alternative wording Amendment 320 · Virginie Joron IMCO
(4) Public sector bodies shall, where relevant and to the extent of their capabilities, provide guidance and assistance to re-users in complying with the obligations referred to in paragraph 2, including by raising awareness among the parties concerned of the risks arising from the extraterritorial application of third-country legislation, the unauthorised transfer of knowledge, and the misuse or re-identification of data.
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32 x

Alternative wording Amendment 321 · Virginie Joron IMCO
(5) Where justified because of the substantial number of requests across the Union concerning the re-use of non-personal data in specific third countries, the Commission, assisted by the European Data Innovation Board and the European Data Protection Board, may adopt implementingguidelines actsevaluating declaring thatwhether the legal, supervisory and enforcement arrangements of a third country:
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32 x

Additional proposed wording Amendment 322 · Virginie Joron IMCO
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32 x

Alternative wording Amendment 323 · Virginie Joron IMCO
Specific Union legislative acts may deem certain non-personal data categories held by public sector bodies to be highly sensitive for the purposes of this Article where their transfer to third countries may put at risk Union public policy objectives, such as safety and public health or may lead to the risk of re-identification of non-personal,natural persons to whom pseudonymised or anonymised non-personal data relate. Where such an act is adopted, the Commission shall, adopt delegated acts in accordance with Article 45 supplementing this Regulationassisted by layingthe downEuropean Data Innovation Board and the European Data Protection Board, may publish guidelines on the special conditions applicable to the transfers of such data to third countries. Those conditions shall not have a detrimental effect on the national economic security frameworks of the Member States.
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32 x

Alternative wording Amendment 852 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(1) Where a re-user intends to transfer certain categories of protected data that are non-personal to a third country, it shall inform the public sector body of its intention to transfer such data and the purpose of such transfer at the time of requesting the re-use of the data and, in any event, prior to the conclusion of any sharing agreement. In the case of re-use based on the data holder’s permission the re-user shall, where appropriate with the assistance of the public sector body, and in any event prior to the conclusion of any contractual transfer agreement, inform the natural or legal person whose rights and interests may be affected of that intention, purpose and the appropriate safeguards. The public sector body shall not allow the re-use unless the natural or legal person gives permission for the transfer.
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32x – paragraph 1

Additional proposed wording Amendment 853 · Mary Khan ITRE · LIBE

(1a) In Article 32x, the following paragraph is inserted:

Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32x – paragraph 1 a (new)

Additional proposed wording Amendment 854 · Mary Khan ITRE · LIBE

(1b) In Article 32x, the following paragraph is inserted:

Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation 2023/2854 / Article 32x – paragraph 1 b (new)

Additional proposed wording Amendment 855 · Mary Khan ITRE · LIBE

(1c) In Article 32x, the following paragraph is added:

Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32x – paragraph 1 c (new)

Alternative wording Amendment 856 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(3) The Commission may adopt implementing acts establishing model contractual clauses for complying with the obligations referred to in paragraph 2 of this Article. Those model contractual clauses shall ensure the protection of trade secrets, the protection against the unauthorised transfer of knowledge, and the protection of the economic security of the Union and of its Member States. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32x – paragraph 3

Alternative wording Amendment 857 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(4) Public sector bodies shall, where relevant and to the extent of their capabilities, provide guidance and assistance to re-users in complying with the obligations referred to in paragraph 2, in particular by raising the awareness of the parties concerned of the risks arising from the extraterritorial reach of third-country laws, from the unauthorised transfer of knowledge, and from the misuse or re-identification of the data.
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32x – paragraph 4

Alternative wording Amendment 858 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(5) Where justified because of the substantial number of requests across the Union concerning the re-use of non-personal data in specific third countries, the Commission, assisted by the European Data Innovation Board and the European Data Protection Board, may adoptissue implementingguidelines actsassessing declaring thatwhether the legal, supervisory and enforcement arrangements of a third country:
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32x – paragraph 5

Additional proposed wording Amendment 859 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE

(5a) In Article 32x, the following subparagraph is inserted:

Such guidelines shall be without prejudice to the national economic-security frameworks of the Member States, which may restrict or prohibit the transfer of data to a third country irrespective of those guidelines.

Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32x – paragraph 5 – subparagraph (new)

Alternative wording Amendment 860 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
Specific Union legislative acts may deem certain non-personal data categories held by public sector bodies to be highly sensitive for the purposes of this Article where their transfer to third countries may put at risk Union public policy objectives, such as safety and public health or may lead to the risk of re-identification of non-personal,the natural persons from whom pseudonymised or anonymised data originate. Where such an act is adopted, the Commission shall adopt delegated acts in accordance with Article 45 supplementing this Regulationassisted by layingthe downEuropean specialData Innovation Board and the European Data Protection Board, may issue guidelines on the conditions applicable to the transfers of such data to third countries. Such conditions shall be without prejudice to the national economic-security frameworks of the Member States.
Preview
against:
Source identification

Header printed in the source: Article 1 – paragraph 1 – point 18 / Regulation (EU) 2023/2854 / Article 32x – paragraph 7 – subparagraph 1