Article 32

1. Providers of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation, and any processor or subcontractor acting on their behalf, shall take all adequate technical, organisational and legal measures, including contracts, in order to prevent international and third-country governmentalany access andto, or transfer of, non-personal data held in the Union that is requested or ordered by a third-country authority or by an international body, where such transfer or access would create a conflict with, or would undermine the objectives of Union law or with the national law of the relevant Member State, without prejudice to paragraph 2 or 3. This obligation shall apply irrespective of the place of establishment of the entity holding or controlling the data, where the data are held in the Union.

2. Any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union shall be recognised or enforceable in any manner only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, or any such agreement between the requesting third country and a Member State.; Where the agreement is concluded between the requesting third country and the Union, it shall only give access to the data held by Union institutions, agencies and bodies, and where it is concluded between the requesting third country and a Member State, it shall not give access to data held in any other Member State.

Justification

Non-personal data may include operational, industrial or strategic data whose disclosure to a third-country authority could undermine public security, the continuity of essential services or strategic and economic autonomy. This amendment gives Member States a narrowly framed tool to protect such data, subject to necessity, proportionality, notification to the Commission and publication of the designated categories.

5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data before complying with that request, except where the request servesis lawmade enforcementby purposesa competent authority for the purpose of the prevention, investigation, detection or prosecution of criminal offences or for the execution of criminal penalties and for as long as this is necessary to preserve the effectiveness of the law enforcement activity. Where informing the natural or legal person before compliance would seriously and demonstrably undermine a lawful investigation or enforcement activity, notification may be delayed only for as long as strictly necessary and proportionate. The reasons for delayed notification shall be documented and made available to the competent authority upon request. The affected person shall be informed as soon as the reason for delay no longer applies. Providers and other addressees shall publish annual transparency reports containing aggregate information on third-country access requests, including third-countries making the requests, legal bases invoked, categories of data concerned, and the number of requests complied with, refused, or challenged.;

5. The provider of data processing services, the public sector body making available data or documents in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data or documents in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority pursuant to an international agreement referred to in paragraph 2 to access its data before complyingexamining with that request, except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.;

Justification

A private provider should not be able to make unilateral decisions concerning foreign access to strategic, public or sensitive data.