Article 32c

General requirements for registration of recognised data intermediation services providers

In order to qualify for registration in the public Union register referred to in Article 32a paragraph 1 point (a), aA data intermediation services provider shall meet all of the following requirements:

In order to qualify for registration in the public Union registerregisters referred to in Article 32a paragraph 1 point (a) and paragraph 1a point (a), a data intermediation services provider shall meet all of the following requirements:

(b) the data they collect with respect to any activity of a natural or legal person for the purpose of the provision of the data intermediation service, including the date, time and geolocation data, duration of activity and connections to other natural or legal persons established by the person who uses the data intermediation service, are used only for the development of that data intermediation service, which may entail the use of data for the detection of fraud or cybersecurity;

(ba) In Article 32c, paragraph 1, the following point is inserted

(c) where they offer additional tools and services to data holders or data subjects for the specific purpose of facilitating the exchange of data, such as temporary storage, curation, conversion, encryption, anonymisation and pseudonymisation, such tools and services are used only at the explicit request or approval of the data holder or data subject;the data intermediation services provider shall provide the tools and services necessary to facilitate the exchange of data, such as temporary storage, curation, conversion, encryption, anonymisation and pseudonymisation, and shall systematically implement appropriate technical and organisational measures to prevent the re-identification of pseudonymised data, personal data breaches, and any unlawful acquisition, use, disclosure or transfer of the data for which it provides data intermediation services; where the data are made available in pseudonymised or anonymised form, the provider shall apply state-of-the-art privacy-preserving and privacy-enhancing techniques to that effect.

(c) where they offer additional tools and services to data holders or data subjects for the specific purpose of facilitating the exchange of data, such as temporary storage, curation, conversion, encryption, anonymisation and pseudonymisation, such tools and services are used only at the explicit request or approval of the data holder or explicit consent of the data subject;

(ca) In Article 32c, paragraph 1, the follwoing point is inserted

(cb) In Article 32c, paragraph 1, the following point is inserted

(cc) In Article 32c, paragraph 1, the following point is inserted

(cd) In Article 32c, paragraph 1, the following point is inserted

(d) where data intermediation service providers which are not micro and small sized enterprises offer value-added services to their clients other than the services referred to in point (c), they fulfil the following conditions:

Justification

This amendment addresses concerns expressed in the EDPB-EDPS opinion. The Proposal does not specifically justify the reason for exempting small and micro enterprises entirely from the functional separation requirement. Ensuring neutrality by managing conflicting interests would appear relevant, regardless of enterprise size.

(ii) the data are not used for other purposes than performing the value-added service, such as advertising, profiling, ranking, price discrimination, training of AI systems or any purpose other than putting those data at the disposal of data users in accordance with the instructions of the data holder or data subject;

(ii) the data are not used for other purposes than performing the value-added service, including advertising, profiling, ranking, price discrimination and training of AI systems;

(iii) the value-added services are offered through a functionally separate entity, as demonstrated by criteria including technical and organisational segregation of data, absence of conflicts of interest, cross-use of data, and discriminatory treatment, and separate management, financing and staff;

(iii) the value-added services are offered through a functionallylegally separate entity;

(iv) the undertaking seeking to offer the value-added services is not designateda very large enterprise, including gatekeepers as a gatekeeperdesignated pursuant to Article 3 of Regulation (EU) 2022/1925;

(v) the commercial terms, including pricing, for the provision of data intermediation services to a data holder or data user are not dependent upon whether the data holder or data user uses value-added services provided by the data intermediation services provider or by a related entity;

Justification

Moved

(ea) In Article 32c, paragraph 1, the following point is added

in Article 32c(1), the following point (ea) is added

in Article 32c(1), the following point (eb) is added