Article 15a

1. Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding to, mitigating, or supporting the recovery from a public emergency, it may, as a measure of last resort, request from data holders that are legal persons, other than public sectors bodies, to make available those data, including the metadata necessary to interpret and use those data. An exceptional need exists only where the data concerned are strictly necessary for the purpose pursued and cannot be obtained under equivalent conditions by any other means. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.

Justification

The power to compel private data holders to make data available constitutes a significant interference with the freedom to conduct a business and, where personal data are concerned, with the right to the protection of personal data. Such a power must therefore be strictly circumscribed. This amendment clarifies that access may be requested only as a measure of last resort, where the data are strictly necessary and cannot be obtained under equivalent conditions by any other means. It further breaks the circularity between the notions of ‘exceptional need’ and ‘public emergency’ by anchoring the former in an objective test of strict necessity and subsidiarity, and the latter in autonomous criteria of gravity and effect. The subsidiary treatment of personal data ensures compliance with the principles of necessity and proportionality and with the data minimisation principle under Regulation (EU) 2016/679.

(1) Where a public sector body, that is competent under the Commission,law of the EuropeanMember Central Bank or a Union bodyState demonstrates an exceptional need to use certain data to carry out its statutory duties in the public interest when responding immediately to, mitigating, or supporting the recovery from a public emergency, it may request fromthat data holders that are legal persons, other than public sectorssector bodies, to make available thosesuch data, including the metadata strictly necessary to interpret and use those data. Upon such duly reasoned request, data holders shall make the data and metadata available to the requesting public sector body, the Commission, the European Central Bank or Union body. Such requests may also be made where the production of official statistics is required in relation to a public emergency.The Commission, the European Central Bank and Union bodies may address a request for data only to the public sector body that is competent under the national law of the Member State concerned. They may not directly request data from private data holders. The competent public sector body shall be responsible under national law for deciding whether and to what extent it complies with the request.

Justification

Access to data in emergencies must remain a national competence, in line with democratic principles and the rule of law. EU bodies may request information, but they may not directly impose obligations on private data holders.

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. Where the provision of non-personal data is insufficient to address the public emergency, personal data may also be requested and, where possible, made available in pseudonymized form, subject to appropriate technical and organisational measures to ensure their protection against further re-identification, personal data breaches and unlawful use.

2. Where the data requested are necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. WhereOnly where the provision of non-personal data is demonstrated to be insufficient to addressrespond to the public emergency, personal data may also be requested and, whereshall possible,only be made available in pseudonymized form and only when strictly necessary, subject to appropriate technical and organisational measures to ensure their protection.

2. Where the data requested are strictly necessary to respond to a public emergency, and the requesting body pursuant to paragraph 1 is unable to obtain such data by other means in a timely and effective manner under equivalent conditions, the request shall concern non-personal data. WherePersonal data may be requested only as a last resort, where the provision of non-personal data is demonstrably insufficient to address the public emergency, personaland data may also be requested andshall, where possible, be made available in pseudonymizedpseudonymised form, subject to appropriate technical and organisational measures to ensure their protection.

Justification

Access to data by public sector bodies in a public emergency must remain exceptional and bounded. The amendment ties the request to the strict impossibility of obtaining the data by other means and requires the requesting body to substantiate that impossibility, rather than merely assert it.

(3) Where the data requested are necessary to mitigate or support the recovery from a public emergency, a requesting body pursuant to paragraph 1 acting on the basis of Union or national law, may request specific non-personal data, the lack of which prevent it from mitigating or supporting the recovery from a public emergency. Such requests shall not be made to microenterprises and small enterprises.

Justification

Exceptional B2G powers must be limited to immediate action to address a clearly identified emergency. Standard legislative instruments should be used for reconstruction and general policy planning.

Justification

For reasons of legal clarity and accessibility, the safeguards attached to the use of data obtained in the context of a public emergency should be set out expressly in the operative provision rather than by cross-reference alone. Recalling in full the obligations to implement technical and organisational measures and to erase the data once they are no longer necessary ensures that these safeguards remain readable and enforceable, in line with the principles of purpose limitation and storage limitation under Regulation (EU) 2016/679. In addition, the exclusion of special categories of personal data and of data relating to criminal convictions from the scope of emergency data requests, save where their processing is strictly necessary and authorised by law, reinforces the protection of data subjects’ fundamental rights.