Article 70

12a. In Article 70, paragraph 1, point e is amendend as follows:

(e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation; in doing so, the Board shall ensure that such guidance: i. remains consistent with the wording, scope, objectives, and risk-based structure of this Regulation, ii. respects the principles of proportionality and legal certainty and does not introduce substantive obligations beyond those laid down in Union law, iii. is accompanied by a published legal assessment confirming its legal basis, feasibility, and conformity with the principles of this Regulation, iv. where applicable, informed by, and coordinated with relevant competent sectoral authorities."

Justification

INNOVATION PACKAGE #7: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.

12a. In Article 70 paragraph 1, point b is replaced by the following:

(b) advise the Commission on any issue related to the protection of personal data and the confidentiality of communications in the Union, including on any proposed amendment of this Regulation;"

Justification

This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.

13. In Article 70(1), point (h) is deleted.

13. In Article 70(1), point (h) is deleted.

13. In Article 70(1), point (h) is deleted.

14. In Article 70(1), the following points are inserted: (ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35. (hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33’

(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35.

(ha) prepare and transmit to the Commission a proposal forestablish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.

(ha) prepare and transmit to the Commission a proposal forestablish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and a list of processing operations for which no data protection impact assessment is required, pursuant to Article 35.

(hb) prepare and transmit to the Commission a proposal forestablish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

(hb) prepare and transmit to the Commission a proposal forestablish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

(hb) prepare and transmit to the Commission a proposal forestablish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

(hc) prepare and transmit to the Commission a proposal forestablish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33, a list of the circumstances in which it is not likely to result in a high risk, and a list of the circumstances in which it is not likely to result in any risk.

(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 and a list of the circumstances in which it is not likely to result in a high risk.

(hc) prepare and transmit to the Commission a proposal forestablish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely and not likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

(hc) prepare and transmit to the Commission a proposal forestablish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

(hc) prepare and transmit to the Commission a proposal forestablish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a listlists of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

Justification

To include both a white and a black list to help companies/contribute to legal certainty and more harmonisation across the EU

(hca) In Article 70, the following point is inserted:

Justification

This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.

(hca) In Article 70, the following point is inserted:

14a. In Article 77, paragraph 1 is replaced by the following:

14a. In Article 70, paragraph 3 is replaced by the following:

14f. In Article 70, paragraphs 4a and 4b are added:

Justification

INNOVATION PACKAGE #8: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.