Article 14
Amendments as tabled
Three amendments, each tabled separately · ITRE–LIBE amendments 1053–1260 to the draft report
1127 +Addition Aura Salla +6EPP · ITRE–LIBE “The obligation to make information available pursuant to Article 14 shall be deemed fulfilled where such information is published and maintained in…”
5a. In Article 14, paragraph 5a is added:
The obligation to make information available pursuant to Article 14 shall be deemed fulfilled where such information is published and maintained in an easily accessible manner on the entity’s website.'
- Tabled by
- Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Andrea Wechsler, Oliver Schenk, Pekka Toveri, Christian Ehler
- Group
- EPP
- Document
- ITRE–LIBE amendments 1053–1260 to the draft report
- Source
- Official text, page 62
- Printed header
- Article 3 – paragraph 1 – point 6 / Regulation (EU) 2016/679 / Article 14 – paragraph 5a (new)
1130 +Addition Axel VossEPP · ITRE–LIBE “if the controller is a small, medium or large controller under Article 4(27) to (29), and; (fb) if the controller is a large controller, the number…”
6a. In Article 14(1), the following points are added:
(fa)if the controller is a small, medium or large controller under Article 4(27) to (29), and;
(fb)if the controller is a large controller, the number of data subjects they processed personal data about, the number of times data subjects have exercised their rights against them under Articles 13 to 22 and the number of each type of outcome, the number of data breaches under Article 32 and the number of likely affected data subjects, the number of procedure filed against them under Article 78 and 79, the certifications received or revoked under Article 42 and the name and contact details of the certification body that has certified them for the past three financial years.
Justification
RISK-BASED APPROACH #9: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
- Tabled by
- Axel Voss
- Group
- EPP
- Document
- ITRE–LIBE amendments 1053–1260 to the draft report
- Source
- Official text, page 66
- Printed header
- Article 3 – paragraph 1 – point 6 a (new) / Regulation (EU) 2016/679 / Article 14 – paragraph 1 – points fa and fb (new)
1136 +Addition Kristian VigeninS&D · ITRE–LIBE “The controller shall provide the information referred to in paragraphs 1 and 2 within a reasonable period after obtaining the personal data, having…”
In Article 14, paragraph 3 is amended as follows
The controller shall provide the information referred to in paragraphs 1 and 2 within a reasonable period after obtaining the personal data, having regard to the specific circumstances in which the personal data are processed.
If the personal data are to be used for communication with the data subject, the information referred to in paragraphs 1 and 2 has to be provided to the data subject at the latest at the time of the first communication to that data subject.
If a disclosure to another recipient is envisaged, the information referred to in paragraphs 1 and 2 has to be provided to the data subject at the latest when the personal data are first disclosed.
In any case, the information referred to in paragraphs 1 and 2 has to be provided to the data subject at the latest within one month.
- Tabled by
- Kristian Vigenin
- Group
- S&D
- Document
- ITRE–LIBE amendments 1053–1260 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 6 b (new) / Regulation (EU) 2016/679 / Article 14 – paragraph 3