Article 18

(-a) paragraph 1 is replaced by the following:

1. A data holder receiving a request to make data available under this Chapter shall make the data available to the requesting public sector body, the Commission, the European Central Bank or a Union body without undue delay, takingand intoshall accountimplement the necessary technical, organisational and legal measures to implement data protection principles and to protect personal data and safeguard the rights and freedoms of data subjects.’

Justification

In line with the advice in the joint EDPB-EDPS Joint Opinion, paras. 126-127 to specify the data holders must implement the technical, organisational and legal measures requested, not just take them into account’. This would also be in line with Articles 17(1)(g) and 19(1)(b).

2. Without prejudice to specific needs regarding the availability of data defined in Union or national law, a data holder may decline or seek the modification of a request to make data available under this Chapter without undue delay and, in any event, no later than five working days after the receipt of a request pursuant to Article 15a(2) and without undue delay and, in any event, no later than 30 working days after the receipt of a request pursuant to Article 15a(3), on any of the following grounds:;