EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

Article 37

Source
CJ72-AM-791073, page 154 pp. 154–156

Amendments as tabled

Three amendments, each tabled separately · ITRE–LIBE amendments 1053–1260 to the draft report

  1. 1237 Addition Angelika Niebler +1EPP · ITRE–LIBE “The controller or the processor shall publish the contact details of the data protection officer.”

    9a. Article 37, paragraph 7, is amended as follows

    The controller or the processor shall publish the contact details of the data protection officer.

    Tabled by
    Angelika Niebler, Monika Hohlmeier
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 a (new) / Regulation (EU) 2016/679 / Article 37 – paragraph 7
  2. 1238 Alternative Axel VossEPP · ITRE–LIBE “In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of…”

    9a. In Article 37, paragraph 4 is replaced by the following:

    4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors."

    Justification

    DPO Package #2: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.

    Tabled by
    Axel Voss
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 a (new) / Regulation (EU) 2016/679 / Article 37 – paragraph 4
  3. 1239 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Microenterprises, small and medium-sized enterprises within the meaning of Recommendation 2003/361/EC, and small mid-cap enterprises may jointly…” numbered 2a

    9b. In Article 37, paragraphs 2a and 4a are inserted:

    2a.Microenterprises, small and medium-sized enterprises within the meaning of Recommendation 2003/361/EC, and small mid-cap enterprises may jointly designate a single data protection officer, whether or not they are partner or linked enterprises, provided that the data protection officer is easily accessible from each of them and is able to perform his or her tasks effectively in respect of each participating enterprise, taking into account the nature, scope, context and purposes of their respective processing operations. The participating enterprises shall specify, in a written arrangement, the allocation of responsibilities and the resources made available to the shared data protection officer.';

    4a.Member States may provide that a public body designated for that purpose makes available data protection officers acting for a pool of microenterprises, small and medium-sized enterprises or small mid-cap enterprises. A data protection officer made available under this paragraph shall perform the tasks referred to in Article 39 independently, in accordance with Article 38, and shall not receive instructions regarding the exercise of those tasks. This paragraph shall not apply to the supervisory authorities referred to in Article 51, so as to avoid any conflict of interest.';

    Justification

    The cost of a dedicated data protection officer is prohibitive for small structures. The amendment allows micro, small and medium-sized enterprises and small mid-caps which are not related undertakings to designate a single data protection officer jointly, provided that the officer is easily accessible from each establishment and that the conditions of independence and absence of conflict of interest are met in respect of each controller concerned. Pooling reduces compliance costs without lowering the level of protection.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 b (new) / Regulation (EU) 2016/679 / Article 37 – paragraphs 2a and 4a (new)